Merge branch 'core-updates'

173 files changed, 4258 insertions, 2812 deletions

diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index aeea93f378..01a58763d8 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -126,7 +126,9 @@
      `(("libgcrypt" ,libgcrypt)
        ("libgpg-error" ,libgpg-error)
        ("libmhash" ,libmhash)
+       ("pcre:static" ,pcre "static")
        ("pcre" ,pcre)
+       ("zlib:static" ,zlib "static")
        ("zlib" ,zlib)))
     (synopsis "File and directory integrity checker")
     (description
@@ -226,13 +228,15 @@ interface and is based on GNU Guile.")
        (modify-phases %standard-phases
          (add-after 'unpack 'chdir
            (lambda _
-             (chdir ,(string-append  name "-" version))))
+             (chdir ,(string-append name "-" version))
+             #t))
          (delete 'configure)
          (add-before 'build 'patch
            (lambda _
              (substitute* "src/error.h"
                (("extern int errno;")
-                "#include <errno.h>"))))
+                "#include <errno.h>"))
+             #t))
          (replace 'build
            (lambda _
              (invoke "package/compile")))
@@ -242,7 +246,8 @@ interface and is based on GNU Guile.")
                     (bin (string-append out "/bin")))
                (for-each (lambda (file)
                            (install-file file bin))
-                         (find-files "command"))))))))
+                         (find-files "command")))
+             #t)))))
     (synopsis "Tools for managing UNIX style services")
     (description
      "@code{daemontools} is a collection of tools for managing UNIX
@@ -964,7 +969,7 @@ at once based on a Perl regular expression.")
                       #t))
                   (add-after 'install 'install-info
                     (lambda _
-                      (zero? (system* "make" "install-info")))))))
+                      (invoke "make" "install-info"))))))
     (native-inputs `(("texinfo" ,texinfo)
                      ("util-linux" ,util-linux))) ; for 'cal'
     (home-page "https://www.gnu.org/software/rottlog/")
@@ -1095,7 +1100,8 @@ commands and their arguments.")
       CFLAGS += $(shell pkg-config libnl-3.0 --cflags)
       CONFIG_LIBNL32=y
       CONFIG_READLINE=y\n" port)
-               (close-port port))))
+               (close-port port))
+             #t))
          (add-after 'install 'install-man-pages
            (lambda* (#:key outputs #:allow-other-keys)
              (let* ((out  (assoc-ref outputs "out"))
@@ -1234,11 +1240,10 @@ This package provides the 'wpa_supplicant' daemon and the 'wpa_cli' command.")
                ;; It's an old configure script that doesn't understand
                ;; the extra options we pass.
                (setenv "CONFIG_SHELL" (which "bash"))
-               (zero?
-                (system* "./configure"
-                         (string-append "--prefix=" out)
-                         (string-append "--mandir=" out
-                                        "/share/man")))))))
+               (invoke "./configure"
+                       (string-append "--prefix=" out)
+                       (string-append "--mandir=" out
+                                      "/share/man"))))))
        #:tests? #f))
     (home-page "https://www.kernel.org") ; really, no home page
     (synopsis "Send a wake-on-LAN packet")
@@ -1673,20 +1678,18 @@ lookup to YAML Mode.  You could enable the mode with @code{(add-hook
     (arguments
      `(#:phases (modify-phases %standard-phases
                   (delete 'configure)
-                  (replace
-                   'build
-                   (lambda _
-                     (zero? (system* "make" "CC=gcc" "-Csrc"))))
-                  (replace
-                   'check
-                   (lambda _
-                     (zero? (system* "make" "CC=gcc" "-Ctests"))))
-                  (replace
-                   'install
-                   (lambda* (#:key outputs #:allow-other-keys)
-                     (let* ((out (assoc-ref outputs "out"))
-                            (bin (string-append out "/bin")))
-                       (install-file "src/cpulimit" bin)))))))
+                  (replace 'build
+                    (lambda _
+                      (invoke "make" "CC=gcc" "-Csrc")))
+                  (replace 'check
+                    (lambda _
+                      (invoke "make" "CC=gcc" "-Ctests")))
+                  (replace 'install
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (let* ((out (assoc-ref outputs "out"))
+                             (bin (string-append out "/bin")))
+                        (install-file "src/cpulimit" bin))
+                      #t)))))
     (home-page "https://github.com/opsengine/cpulimit")
     (synopsis "Limit CPU usage")
     (description
@@ -1895,10 +1898,9 @@ done with the @code{auditctl} utility.")
          (replace 'install
            (lambda* (#:key outputs #:allow-other-keys)
              (define (make out . args)
-               (unless (zero? (apply system* "make"
-                                     (string-append "prefix=" out)
-                                     args))
-                 (error "make failed")))
+               (apply invoke "make"
+                      (string-append "prefix=" out)
+                      args))
              (define (python-path dir)
                (string-append dir "/lib/python2.7/site-packages"))
              (let ((out (assoc-ref outputs "out"))
@@ -1912,13 +1914,14 @@ done with the @code{auditctl} utility.")
                (make ndiff "install-ndiff")
                (wrap-program (string-append ndiff "/bin/ndiff")
                  `("PYTHONPATH" prefix
-                   (,(python-path ndiff)))))))
+                   (,(python-path ndiff)))))
+             #t))
          ;; These are the tests that do not require network access.
          (replace 'check
-           (lambda _ (zero? (system* "make"
-                                     "check-nse"
-                                     "check-ndiff"
-                                     "check-dns")))))
+           (lambda _ (invoke "make"
+                             "check-nse"
+                             "check-ndiff"
+                             "check-dns"))))
        ;; Nmap can't cope with out-of-source building.
        #:out-of-source? #f))
     (home-page "https://nmap.org/")
@@ -2224,15 +2227,15 @@ Kerberos and Heimdal and FAST is supported with recent MIT Kerberos.")
              #t))
          (replace 'build
            (lambda* (#:key make-flags #:allow-other-keys)
-             (zero? (apply system* "make" "tools" "misc" make-flags))))
+             (apply invoke "make" "tools" "misc" make-flags)))
          (add-after 'build 'build-armhf
            (lambda* (#:key make-flags #:allow-other-keys)
              (setenv "LIBRARY_PATH" #f)
-             (zero? (apply system* "make" "target-tools" make-flags))))
+             (apply invoke "make" "target-tools" make-flags)))
          (replace 'install
            (lambda* (#:key make-flags #:allow-other-keys)
-             (zero? (apply system* "make" "install-all" "install-misc"
-                           make-flags)))))))
+             (apply invoke "make" "install-all" "install-misc"
+                    make-flags))))))
     (home-page "https://github.com/linux-sunxi/sunxi-tools")
     (synopsis "Hardware management tools for Allwinner computers")
     (description "This package contains tools for Allwinner devices:
diff --git a/gnu/packages/agda.scm b/gnu/packages/agda.scm
index 6bb38aac4d..d2113555eb 100644
--- a/gnu/packages/agda.scm
+++ b/gnu/packages/agda.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Alex ter Weele <alex.ter.weele@gmail.com>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2018 Alex Vong <alexvong1995@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -85,6 +86,7 @@
            (lambda* (#:key outputs inputs tests? (configure-flags '())
                      #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))
+                    (name-version (strip-store-file-name out))
                     (input-dirs (match inputs
                                   (((_ . dir) ...)
                                    dir)
@@ -95,8 +97,7 @@
                                     `(,(string-append "--bindir=" out "/bin"))
                                     `(,(string-append
                                         "--docdir=" out
-                                        "/share/doc/" ((@@ (guix build haskell-build-system)
-                                                           package-name-version) out)))
+                                        "/share/doc/" name-version))
                                     '("--libsubdir=$compiler/$pkg-$version")
                                     '("--package-db=../package.conf.d")
                                     '("--global")
diff --git a/gnu/packages/algebra.scm b/gnu/packages/algebra.scm
index 60d99423b2..7b0e24049f 100644
--- a/gnu/packages/algebra.scm
+++ b/gnu/packages/algebra.scm
@@ -591,14 +591,14 @@ a C program.")
 (define-public fftw
   (package
     (name "fftw")
-    (version "3.3.7")
+    (version "3.3.8")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp.fftw.org/pub/fftw/fftw-"
                                  version".tar.gz"))
              (sha256
               (base32
-               "0wsms8narnbhfsa8chdflv2j9hzspvflblnqdn7hw8x5xdzrnq1v"))))
+               "00z3k8fq561wq2khssqg0kallk0504dzlx989x3vvicjdqpjc4v1"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/android.scm b/gnu/packages/android.scm
index 9f8d850ff5..48380740a3 100644
--- a/gnu/packages/android.scm
+++ b/gnu/packages/android.scm
@@ -108,7 +108,7 @@ use their packages mostly unmodified in our Android NDK build system.")
 ;; Big thanks to them for laying the groundwork.
 
 ;; The version tag is consistent between all repositories.
-(define (android-platform-version) "7.1.2_r6")
+(define (android-platform-version) "7.1.2_r36")
 
 (define (android-platform-system-core version)
   (origin
@@ -120,7 +120,7 @@ use their packages mostly unmodified in our Android NDK build system.")
                               version "-checkout"))
     (sha256
      (base32
-      "0xc2n7jxrf1iw9cc278pijdfjix2fkiig5ws27f6rwp40zg5mrgg"))
+      "1krnc2b9zfkzpdgs1dcbji59nszlx2qr723pg89m52622czc06hg"))
     (patches
      (search-patches "libbase-use-own-logging.patch"
                      "libbase-fix-includes.patch"
@@ -151,7 +151,7 @@ use their packages mostly unmodified in our Android NDK build system.")
                               version "-checkout"))
     (sha256
      (base32
-      "0n9wkz3ynqw39if1ss9n32m66iga14nndf29hpm7g1aqn4wvvgzk"))))
+      "15r4s20d7vw022f8vrc3jbghmqwdcqzprl7i2bfvdkz8z76wc1ps"))))
 
 (define (android-platform-external version subdirectory checksum)
   (origin
@@ -339,6 +339,13 @@ various Android core host applications.")
        (modify-phases %standard-phases
          (add-after 'unpack 'enter-source
            (lambda _ (chdir "adb") #t))
+         (add-after 'enter-source 'glibc-compat
+           (lambda _
+             ;; Include sysmacros.h for "major" and "minor" in Glibc 2.28.
+             (substitute* "usb_linux.cpp"
+               (("#include <sys/types.h>" all)
+                (string-append all "\n#include <sys/sysmacros.h>\n")))
+             #t))
          (add-after 'enter-source 'make-libs-available
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (substitute* "Android.mk"
diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index b58d574fcc..a65cfa238e 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -798,7 +798,8 @@ language and software synthesizer.")
            (lambda _
              (symlink "libclalsadrv.so"
                       (string-append (assoc-ref %outputs "out")
-                                     "/lib/libclalsadrv.so.2"))))
+                                     "/lib/libclalsadrv.so.2"))
+             #t))
          ;; no configure script
          (delete 'configure))))
     (inputs
@@ -1567,7 +1568,8 @@ synchronous execution of all clients, and low latency operation.")
               ((".*CFLAGS.*-Wall.*" m)
                (string-append m
                               "    conf.env.append_unique('LINKFLAGS',"
-                              "'-Wl,-rpath=" %output "/lib')\n")))))
+                              "'-Wl,-rpath=" %output "/lib')\n")))
+            #t))
          (add-after 'install 'wrap-python-scripts
           (lambda* (#:key inputs outputs #:allow-other-keys)
             ;; Make sure 'jack_control' runs with the correct PYTHONPATH.
@@ -1603,6 +1605,7 @@ synchronous execution of all clients, and low latency operation.")
     (build-system waf-build-system)
     (arguments
      `(#:tests? #f ; no check target
+       #:python ,python-2
        #:phases
        (modify-phases %standard-phases
          (add-before
@@ -1650,19 +1653,20 @@ plugin function as a JACK application.")
     (arguments
      `(#:tests? #f  ; the "test" target is a listening test only
        #:phases
-       (alist-replace
-        'configure
-        (lambda* (#:key inputs outputs #:allow-other-keys #:rest args)
-          (chdir "src")
-          (let ((out (assoc-ref outputs "out")))
-            (substitute* "makefile"
-              (("/usr/lib/ladspa/") (string-append out "/lib/ladspa/"))
-              (("/usr/include/")    (string-append out "/include/"))
-              (("/usr/bin/")        (string-append out "/bin/"))
-              (("-mkdirhier")       "mkdir -p")
-              (("^CC.*")            "CC = gcc\n")
-              (("^CPP.*")           "CPP = g++\n"))))
-        (alist-delete 'build %standard-phases))))
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys #:rest args)
+             (chdir "src")
+             (let ((out (assoc-ref outputs "out")))
+               (substitute* "makefile"
+                 (("/usr/lib/ladspa/") (string-append out "/lib/ladspa/"))
+                 (("/usr/include/")    (string-append out "/include/"))
+                 (("/usr/bin/")        (string-append out "/bin/"))
+                 (("-mkdirhier")       "mkdir -p")
+                 (("^CC.*")            "CC = gcc\n")
+                 (("^CPP.*")           "CPP = g++\n")))
+             #t))
+         (delete 'build))))
     ;; Since the home page is gone, we provide a link to the archived version.
     (home-page
      "https://web.archive.org/web/20140729190945/http://www.ladspa.org/")
@@ -1877,6 +1881,8 @@ significantly faster and have minimal dependencies.")
     (build-system waf-build-system)
     (arguments
      `(#:tests? #f  ; no check target
+       ;; XXX: The bundled waf does not work with Python 3.7.
+       #:python ,python-2
        #:configure-flags '("--no-plugins")))
     (inputs
      ;; Leaving off cairo and gtk+-2.0 which are needed for example plugins
@@ -2435,6 +2441,7 @@ the Turtle syntax.")
     (build-system waf-build-system)
     (arguments
      `(#:tests? #f ; no check target
+       #:python ,python-2 ;XXX: The bundled waf does not work with Python 3.7.0.
        #:configure-flags
        '("CXXFLAGS=-std=gnu++11")))
     (inputs
@@ -2583,7 +2590,8 @@ analysis plugins or audio feature extraction plugins.")
             (symlink
              (string-append (assoc-ref inputs "automake") "/share/automake-"
                             ,(package-version automake) "/ar-lib")
-             "ar-lib"))))))
+             "ar-lib")
+            #t)))))
     (home-page "http://sbsms.sourceforge.net/")
     (synopsis "Library for time stretching and pitch scaling of audio")
     (description
@@ -2979,12 +2987,14 @@ result.")
              (substitute* "libs/Makefile"
                (("ldconfig") "true")
                (("^LIBDIR =.*") "LIBDIR = lib\n"))
-             (chdir "libs") #t))
+             (chdir "libs")
+             #t))
          (add-after 'install 'install-symlink
            (lambda _
              (symlink "libzita-convolver.so"
                       (string-append (assoc-ref %outputs "out")
-                                     "/lib/libzita-convolver.so.3"))))
+                                     "/lib/libzita-convolver.so.3"))
+             #t))
          ;; no configure script
          (delete 'configure))))
     (inputs `(("fftwf" ,fftwf)))
@@ -3034,7 +3044,8 @@ engine.")
           (lambda _
             (symlink "libzita-resampler.so"
                      (string-append (assoc-ref %outputs "out")
-                                    "/lib/libzita-resampler.so.1"))))
+                                    "/lib/libzita-resampler.so.1"))
+            #t))
          ;; no configure script
          (delete 'configure))))
     (home-page "https://kokkinizita.linuxaudio.org/linuxaudio/zita-resampler/resampler.html")
@@ -3075,7 +3086,8 @@ provide high-quality sample rate conversion.")
            (lambda _
              (symlink "libzita-alsa-pcmi.so"
                       (string-append (assoc-ref %outputs "out")
-                                     "/lib/libzita-alsa-pcmi.so.0"))))
+                                     "/lib/libzita-alsa-pcmi.so.0"))
+             #t))
           ;; no configure script
           (delete 'configure))))
     (inputs
@@ -3260,7 +3272,8 @@ code, used in @code{libtoxcore}.")
                (mkdir-p (string-append out "/man/man1"))
                (mkdir-p (string-append out "/man/man3"))
                (mkdir-p (string-append out "/bin"))
-               (mkdir-p (string-append out "/lib")))))
+               (mkdir-p (string-append out "/lib")))
+             #t))
          (add-after 'install 'post-install
            (lambda _
              (let ((out (assoc-ref %outputs "out")))
@@ -3268,7 +3281,8 @@ code, used in @code{libtoxcore}.")
                             (string-append out "/include"))
                (mkdir-p (string-append out "/include/gsm"))
                (copy-recursively "inc"
-                                 (string-append out "/include/gsm")))))
+                                 (string-append out "/include/gsm")))
+             #t))
          (delete 'configure))))         ; no configure script
     (synopsis "GSM 06.10 lossy speech compression library")
     (description "This C library provides an encoder and a decoder for the GSM
@@ -3544,14 +3558,16 @@ representations.")
              (invoke "sh" "autogen.sh")))
          (add-before 'build 'make-cava-ldflags
            (lambda* (#:key outputs #:allow-other-keys)
-             (mkdir-p (string-append (assoc-ref outputs "out") "/lib"))))
+             (mkdir-p (string-append (assoc-ref outputs "out") "/lib"))
+             #t))
          (add-after 'install 'data
            (lambda* (#:key outputs #:allow-other-keys)
              (for-each (lambda (file)
                          (install-file file
                                        (string-append (assoc-ref outputs "out")
                                                       "/share/doc/examples")))
-                       (find-files "example_files")))))))
+                       (find-files "example_files"))
+             #t)))))
     (home-page "https://karlstav.github.io/cava/")
     (synopsis "Console audio visualizer for ALSA, MPD, and PulseAudio")
     (description "C.A.V.A. is a bar audio spectrum visualizer for the terminal
diff --git a/gnu/packages/authentication.scm b/gnu/packages/authentication.scm
index a58eac9890..68a6459828 100644
--- a/gnu/packages/authentication.scm
+++ b/gnu/packages/authentication.scm
@@ -17,6 +17,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu packages authentication)
+  #:use-module (gnu packages)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages pkg-config)
   #:use-module (guix build-system gnu)
@@ -35,6 +36,7 @@
        (method url-fetch)
        (uri (string-append "https://download.savannah.nongnu.org/releases/"
                            name "/" name "-" version ".tar.gz"))
+       (patches (search-patches "oath-toolkit-glibc-compat.patch"))
        (sha256
         (base32 "182ah8vfbg0yhv6mh1b6ap944d0na6x7lpfkwkmzb6jl9gx4cd5h"))))
     (build-system gnu-build-system)
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index 4065af0abc..60f8051dc6 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -102,6 +102,15 @@ command-line arguments, multiple languages, and so on.")
    (arguments
     `(#:phases
       (modify-phases %standard-phases
+        (add-before 'check 'disable-failing-tests
+          (lambda _
+            ;; These tests are expected to fail due to a glibc bug which has
+            ;; been fixed in 2.28, so they are unexpectedly passing.  They
+            ;; should be fixed for grep versions > 3.1.
+            (substitute* "tests/Makefile.in"
+              (("^[[:blank:]]+backref-alt[[:blank:]]+\\\\") "\\")
+              (("^[[:blank:]]+triple-backref[[:blank:]]+\\\\") "\\"))
+            #t))
         (add-after 'install 'fix-egrep-and-fgrep
           ;; Patch 'egrep' and 'fgrep' to execute 'grep' via its
           ;; absolute file name instead of searching for it in $PATH.
@@ -289,7 +298,9 @@ interactive means to merge two files.")
              (base32
               "178nn4dl7wbcw499czikirnkniwnx36argdnqgz4ik9i6zvwkm6y"))
             (patches (search-patches
+                      "findutils-gnulib-libio.patch"
                       "findutils-localstatedir.patch"
+                      "findutils-makedev.patch"
                       "findutils-test-xargs.patch"))
             (modules '((guix build utils)))
             (snippet
@@ -326,14 +337,14 @@ used to apply commands with arbitrarily long arguments.")
 (define-public coreutils
   (package
    (name "coreutils")
-   (version "8.29")
+   (version "8.30")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/coreutils/coreutils-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "0plm1zs9il6bb5mk881qvbghq4glc8ybbgakk2lfzb0w64fgml4j"))))
+              "0mxhw43d4wpqmvg0l4znk1vm10fy92biyh90lzdnqjcic2lb6cg8"))))
    (build-system gnu-build-system)
    (inputs `(("acl"  ,acl)                        ; TODO: add SELinux
              ("gmp"  ,gmp)                        ;bignums in 'expr', yay!
@@ -364,7 +375,17 @@ used to apply commands with arbitrarily long arguments.")
                      (substitute* (find-files "gnulib-tests" "\\.c$")
                        (("/bin/sh") (which "sh")))
                      (substitute* (find-files "tests" "\\.sh$")
-                       (("#!/bin/sh") (which "sh")))
+                       (("#!/bin/sh") (string-append "#!" (which "sh"))))
+                     #t))
+                 (add-before 'check 'disable-broken-test
+                   (lambda _
+                     ;; This test hits the 127 character shebang limit in the build
+                     ;; environment due to the way "env -S" splits arguments into
+                     ;; shebangs.  Note that "env-S-script.sh" works around this
+                     ;; specific issue, but "env-S.pl" is not adjusted for build
+                     ;; environments with long prefixes (/tmp/guix-build-...).
+                     (substitute* "Makefile"
+                       (("^.*tests/misc/env-S.pl.*$") ""))
                      #t)))
 
       ;; Work around a cross-compilation bug whereby libcoreutils.a would
@@ -435,14 +456,14 @@ change.  GNU make offers many powerful extensions over the standard utility.")
 (define-public binutils
   (package
    (name "binutils")
-   (version "2.30")
+   (version "2.31.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/binutils/binutils-"
                                 version ".tar.bz2"))
             (sha256
              (base32
-              "028cklfqaab24glva1ks2aqa1zxa6w6xmc8q34zs1sb7h22dxspg"))
+              "1l34hn1zkmhr1wcrgf0d4z7r3najxnw3cx2y2fk7v55zjlk3ik7z"))
             (patches (search-patches "binutils-loongson-workaround.patch"))))
    (build-system gnu-build-system)
 
@@ -480,17 +501,6 @@ included.")
    (license gpl3+)
    (home-page "https://www.gnu.org/software/binutils/")))
 
-(define-public binutils/fixed
-  ;; TODO: Incorporate this in binutils during the next rebuild cycle.
-  (hidden-package
-   (package
-     (inherit binutils)
-     (source (origin
-               (inherit (package-source binutils))
-               (patches (append (origin-patches (package-source binutils))
-                                (search-patches
-                                 "binutils-aarch64-symbol-relocation.patch"))))))))
-
 (define* (make-ld-wrapper name #:key
                           (target (const #f))
                           binutils
@@ -567,18 +577,20 @@ store.")
 
 (export make-ld-wrapper)
 
-(define-public glibc/linux
+(define-public glibc
+  ;; This is the GNU C Library, used on GNU/Linux and GNU/Hurd.  Prior to
+  ;; version 2.28, GNU/Hurd used a different glibc branch.
   (package
    (name "glibc")
    ;; Note: Always use a dot after the minor version since various places rely
    ;; on "version-major+minor" to determine where locales are found.
-   (version "2.27")
+   (version "2.28")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/glibc/glibc-" version ".tar.xz"))
             (sha256
              (base32
-              "0wpwq7gsm7sd6ysidv0z575ckqdg13cr2njyfgrbgh4f65adwwji"))
+              "10iha5ynvdj5m62vgpgqbq4cwvc2yhyl2w9yyyjgfxmdmx8h145i"))
             (snippet
              ;; Disable 'ldconfig' and /etc/ld.so.cache.  The latter is
              ;; required on LFS distros to avoid loading the distro's libc.so
@@ -590,7 +602,7 @@ store.")
                 #t))
             (modules '((guix build utils)))
             (patches (search-patches "glibc-ldd-x86_64.patch"
-                                     "glibc-2.27-git-fixes.patch"
+                                     "glibc-2.28-git-fixes.patch"
                                      "glibc-hidden-visibility-ldconfig.patch"
                                      "glibc-versioned-locpath.patch"
                                      "glibc-allow-kernel-2.6.32.patch"
@@ -598,8 +610,13 @@ store.")
    (build-system gnu-build-system)
 
    ;; Glibc's <limits.h> refers to <linux/limit.h>, for instance, so glibc
-   ;; users should automatically pull Linux headers as well.
-   (propagated-inputs `(("kernel-headers" ,linux-libre-headers)))
+   ;; users should automatically pull Linux headers as well.  On GNU/Hurd,
+   ;; libc provides <hurd.h>, which includes a bunch of Hurd and Mach headers,
+   ;; so both should be propagated.
+   (propagated-inputs
+    (if (hurd-target?)
+        `(("hurd-core-headers" ,hurd-core-headers))
+        `(("kernel-headers" ,linux-libre-headers))))
 
    (outputs '("out" "debug"
               "static"))                          ;9 MiB of .a files
@@ -654,7 +671,13 @@ store.")
             ;; Use our Bash instead of /bin/sh.
             (string-append "BASH_SHELL="
                            (assoc-ref %build-inputs "bash")
-                           "/bin/bash"))
+                           "/bin/bash")
+
+            ;; On GNU/Hurd we get discarded-qualifiers warnings for
+            ;; 'device_write_inband' among other things.  Ignore them.
+            ,@(if (hurd-target?)
+                  '("--disable-werror")
+                  '()))
 
       #:tests? #f                                 ; XXX
       #:phases (modify-phases %standard-phases
@@ -759,7 +782,18 @@ store.")
                                  (filter linker-script?
                                          (map (cut string-append slib "/" <>)
                                               files)))
-                       #t))))))
+                       #t)))
+
+                 ,@(if (hurd-target?)
+                       '((add-after 'install 'augment-libc.so
+                           (lambda* (#:key outputs #:allow-other-keys)
+                             (let* ((out (assoc-ref outputs "out")))
+                               (substitute* (string-append out "/lib/libc.so")
+                                 (("/[^ ]+/lib/libc.so.0.3")
+                                  (string-append out "/lib/libc.so.0.3"
+                                                 " libmachuser.so libhurduser.so"))))
+                             #t)))
+                       '()))))
 
    (inputs `(("static-bash" ,static-bash)))
 
@@ -768,7 +802,12 @@ store.")
    (native-inputs `(("texinfo" ,texinfo)
                     ("perl" ,perl)
                     ("bison" ,bison)
-                    ("gettext" ,gettext-minimal)))
+                    ("gettext" ,gettext-minimal)
+
+                    ,@(if (hurd-target?)
+                          `(("mig" ,mig)
+                            ("perl" ,perl))
+                          '())))
 
    (native-search-paths
     ;; Search path for packages that provide locale data.  This is useful
@@ -790,108 +829,25 @@ with the Linux kernel.")
    (license lgpl2.0+)
    (home-page "https://www.gnu.org/software/libc/")))
 
-(define-public glibc/hurd
-  ;; The Hurd's libc variant.
-  (package (inherit glibc/linux)
-    (name "glibc-hurd")
-    (version "2.23")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "http://alpha.gnu.org/gnu/hurd/glibc-"
-                                  version "-hurd+libpthread-20161218" ".tar.gz"))
-              (sha256
-               (base32
-                "0vpdv05j6j3ria5bw8gp468i64gij94cslxkxj9xkfgi6p615b8p"))))
-
-    ;; Libc provides <hurd.h>, which includes a bunch of Hurd and Mach headers,
-    ;; so both should be propagated.
-    (propagated-inputs `(("hurd-core-headers" ,hurd-core-headers)))
-    (native-inputs
-     `(,@(package-native-inputs glibc/linux)
-       ("mig" ,mig)
-       ("perl" ,perl)))
+;; Below are old libc versions, which we use mostly to build locale data in
+;; the old format (which the new libc cannot cope with.)
 
-    (arguments
-     (substitute-keyword-arguments (package-arguments glibc/linux)
-       ((#:phases original-phases)
-        ;; Add libmachuser.so and libhurduser.so to libc.so's search path.
-        ;; See <http://lists.gnu.org/archive/html/bug-hurd/2015-07/msg00051.html>.
-        `(modify-phases ,original-phases
-           (add-after 'install 'augment-libc.so
-             (lambda* (#:key outputs #:allow-other-keys)
-               (let* ((out (assoc-ref outputs "out")))
-                 (substitute* (string-append out "/lib/libc.so")
-                   (("/[^ ]+/lib/libc.so.0.3")
-                    (string-append out "/lib/libc.so.0.3" " libmachuser.so" " libhurduser.so"))))
-               #t))
-           (add-after 'pre-configure 'pre-configure-set-pwd
-             (lambda _
-               ;; Use the right 'pwd'.
-               (substitute* "configure"
-                 (("/bin/pwd") "pwd"))
-               #t))
-           (replace 'build
-             (lambda _
-               ;; Force mach/hurd/libpthread subdirs to build first in order to avoid
-               ;; linking errors.
-               ;; See <https://lists.gnu.org/archive/html/bug-hurd/2016-11/msg00045.html>
-               (let ((flags (list "-j" (number->string (parallel-job-count)))))
-                 (define (make target)
-                   (apply invoke "make" target flags))
-                 (make "mach/subdir_lib")
-                 (make "hurd/subdir_lib")
-                 (make "libpthread/subdir_lib")
-                 (apply invoke "make" flags))))))
-        ((#:configure-flags original-configure-flags)
-        `(append (list "--host=i586-pc-gnu"
-
-                       ;; We need this to get a working openpty() function.
-                       "--enable-pt_chown"
-
-                       ;; <https://lists.gnu.org/archive/html/bug-hurd/2016-10/msg00033.html>
-                       "--disable-werror"
-
-                       ;; nscd fails to build for GNU/Hurd:
-                       ;; <https://lists.gnu.org/archive/html/bug-hurd/2014-07/msg00006.html>.
-                       ;; Disable it.
-                       "--disable-nscd")
-                 (filter (lambda (flag)
-                           (not (string-prefix? "--enable-kernel=" flag)))
-                         ,original-configure-flags)))))
-    (synopsis "The GNU C Library (GNU Hurd variant)")
-    (supported-systems %hurd-systems)))
-
-(define* (glibc-for-target #:optional
-                           (target (or (%current-target-system)
-                                       (%current-system))))
-  "Return the glibc for TARGET, GLIBC/LINUX for a Linux host or
-GLIBC/HURD for a Hurd host"
-  (match target
-    ((or "i586-pc-gnu" "i586-gnu") glibc/hurd)
-    (_ glibc/linux)))
-
-(define-syntax glibc
-  (identifier-syntax (glibc-for-target)))
-
-;; The "next" libc.  Useful for populating locale data before reconfiguring the
-;; entire system on it.  Will be the default in the next rebuild cycle.
-(define-public glibc-2.28
+(define-public glibc-2.27
   (package
     (inherit glibc)
-    (version "2.28")
+    (version "2.27")
     (source (origin
               (inherit (package-source glibc))
               (uri (string-append "mirror://gnu/glibc/glibc-" version ".tar.xz"))
               (sha256
                (base32
-                "10iha5ynvdj5m62vgpgqbq4cwvc2yhyl2w9yyyjgfxmdmx8h145i"))
-              (patches (search-patches "glibc-allow-kernel-2.6.32.patch"
-                                       "glibc-ldd-x86_64.patch"
+                "0wpwq7gsm7sd6ysidv0z575ckqdg13cr2njyfgrbgh4f65adwwji"))
+              (patches (search-patches "glibc-ldd-x86_64.patch"
+                                       "glibc-2.27-git-fixes.patch"
                                        "glibc-hidden-visibility-ldconfig.patch"
-                                       "glibc-versioned-locpath.patch"))))))
-
-;; Below are old libc versions, which we use mostly to build locale data in
-;; the old format (which the new libc cannot cope with.)
+                                       "glibc-versioned-locpath.patch"
+                                       "glibc-allow-kernel-2.6.32.patch"
+                                       "glibc-reinstate-prlimit64-fallback.patch"))))))
 
 (define-public glibc-2.26
   (package
@@ -1111,18 +1067,17 @@ command.")
     (license gpl3+))) ; some files are under GPLv2+
 
 (define-public glibc/hurd-headers
-  (package (inherit glibc/hurd)
+  (package (inherit glibc)
     (name "glibc-hurd-headers")
     (outputs '("out"))
     (propagated-inputs `(("gnumach-headers" ,gnumach-headers)
                          ("hurd-headers" ,hurd-headers)))
     (arguments
-     (substitute-keyword-arguments (package-arguments glibc/hurd)
+     (substitute-keyword-arguments (package-arguments glibc)
        ;; We just pass the flags really needed to build the headers.
        ((#:configure-flags _)
         `(list "--enable-add-ons"
-               "--host=i586-pc-gnu"
-               "--enable-obsolete-rpc"))
+               "--host=i586-pc-gnu"))
        ((#:phases _)
         '(modify-phases %standard-phases
            (replace 'install
@@ -1137,13 +1092,7 @@ command.")
                   (open-output-file
                    (string-append out "/include/gnu/stubs.h"))))
                #t))
-           (delete 'build)              ; nothing to build
-           (add-before 'configure 'patch-configure-script
-             (lambda _
-               ;; Use the right 'pwd'.
-               (substitute* "configure"
-                 (("/bin/pwd") "pwd"))
-               #t))))))))
+           (delete 'build)))))))                  ; nothing to build
 
 (define-public tzdata
   (package
diff --git a/gnu/packages/bash.scm b/gnu/packages/bash.scm
index 121a459fa6..fb4e3f4be3 100644
--- a/gnu/packages/bash.scm
+++ b/gnu/packages/bash.scm
@@ -2,7 +2,7 @@
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2018 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015, 2017 Leo Famulari <leo@famulari.name>
-;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -79,7 +79,11 @@
    (16 "1cgi1y6mifm8hsgv4avj5ih76535js3qba1sqwbfvp7si76927sh")
    (17 "0w6jpj2giakji1ir83rpkx1y7n7xqppah3j748m6dm38hywr0gvp")
    (18 "1k58h4wxbsg7r4rwhrvzx5hfbapba2nxjysbhh6qp6ki5ys99i2v")
-   (19 "07n1i5610lbs672x1s8g82qn3qfj06s0ip3z80sri0g8vxp0s5r7")))
+   (19 "07n1i5610lbs672x1s8g82qn3qfj06s0ip3z80sri0g8vxp0s5r7")
+   (20 "0b2jk5n1af1vh590qfc52hv65mafb4vl1xv26s8j5a3byb5y4h0q")
+   (21 "1hblcd2xmqqlp0idnavw66570n7m0yv5rbbr873c2gkn982mk3xx")
+   (22 "0yfbjzr79vzjs2hyi5m8iy2b38fq7vikdfa4zqdvjsp36q4iycs5")
+   (23 "1dlism6qdx60nvzj0v7ndr7lfahl4a8zmzckp13hqgdx7xpj7v2g")))
 
 (define (download-patches store count)
   "Download COUNT Bash patches into store.  Return a list of
diff --git a/gnu/packages/bdw-gc.scm b/gnu/packages/bdw-gc.scm
index eba30217da..c7491f845f 100644
--- a/gnu/packages/bdw-gc.scm
+++ b/gnu/packages/bdw-gc.scm
@@ -30,14 +30,14 @@
 (define-public libgc
   (package
    (name "libgc")
-   (version "7.6.4")
+   (version "7.6.6")
    (source (origin
             (method url-fetch)
-            (uri (string-append "http://www.hboehm.info/gc/gc_source/gc-"
-                                version ".tar.gz"))
+            (uri (string-append "https://github.com/ivmai/bdwgc/releases"
+                                "/download/v" version "/gc-" version ".tar.gz"))
             (sha256
              (base32
-              "076dzsqqyxd3nlzs0z277vvhqjp8nv5dqi763s0m90zr6ljiyk5r"))))
+              "1p1r015a7jbpvkkbgzv1y8nxrbbp6dg0mq3ksi6ji0qdz3wfss79"))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags
@@ -91,7 +91,7 @@ C or C++ programs, though that is not its primary goal.")
 (define-public libatomic-ops
   (package
     (name "libatomic-ops")
-    (version "7.6.4")
+    (version "7.6.6")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -99,7 +99,7 @@ C or C++ programs, though that is not its primary goal.")
                     version "/libatomic_ops-" version ".tar.gz"))
               (sha256
                (base32
-                "0knxncsjhbknlyy6lx7ycxhpzfk3sykhvicgxyp0rmsxd1d3v0jv"))))
+                "0x7071z707msvyrv9dmgahd1sghbkw8fpbagvcag6xs8yp2spzlr"))))
     (build-system gnu-build-system)
     (outputs '("out" "debug"))
     (synopsis "Accessing hardware atomic memory update operations")
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 782af294e0..026527cd36 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -281,7 +281,8 @@ instance, it implements several methods to assess contig-wise read coverage.")
             (setenv "LDFLAGS"
                     (string-append
                      "-Wl,-rpath="
-                     (assoc-ref outputs "out") "/lib/bamtools")))))))
+                     (assoc-ref outputs "out") "/lib/bamtools"))
+            #t)))))
     (inputs `(("zlib" ,zlib)))
     (home-page "https://github.com/pezmaster31/bamtools")
     (synopsis "C++ API and command-line toolkit for working with BAM data")
@@ -496,7 +497,8 @@ BED, GFF/GTF, VCF.")
                 '("create_annotations_files.bash"
                   "create_metaplots.bash"
                   "Ribotaper_ORF_find.sh"
-                  "Ribotaper.sh"))))))))
+                  "Ribotaper.sh")))
+             #t)))))
     (inputs
      `(("bedtools" ,bedtools-2.18)
        ("samtools" ,samtools-0.1)
@@ -591,7 +593,8 @@ independently with transcriptional regulation.")
                     (man (string-append out "/share/man/man1")))
                (mkdir-p man)
                (copy-file "awk.1" (string-append man "/bioawk.1"))
-               (install-file "bioawk" bin)))))))
+               (install-file "bioawk" bin))
+             #t)))))
     (home-page "https://github.com/lh3/bioawk")
     (synopsis "AWK with bioinformatics extensions")
     (description "Bioawk is an extension to Brian Kernighan's awk, adding the
@@ -1240,7 +1243,7 @@ confidence to have in an alignment.")
      '(#:tests? #f ;no "check" target
        #:make-flags
        (list (string-append "ZLIB="
-                            (assoc-ref %build-inputs "zlib")
+                            (assoc-ref %build-inputs "zlib:static")
                             "/lib/libz.a")
              (string-append "LDFLAGS="
                             (string-join '("-lboost_filesystem"
@@ -1283,6 +1286,7 @@ confidence to have in an alignment.")
        ("boost" ,boost)
        ("sparsehash" ,sparsehash)
        ("pigz" ,pigz)
+       ("zlib:static" ,zlib "static")
        ("zlib" ,zlib)))
     (supported-systems '("x86_64-linux"))
     (home-page "https://sourceforge.net/p/bless-ec/wiki/Home/")
@@ -1811,7 +1815,8 @@ databases.")
                (copy-recursively "QuarryFiles"
                                  (string-append out "/QuarryFiles"))
                (install-file "CodingQuarry" bin)
-               (install-file "CufflinksGTF_to_CodingQuarryGFF3.py" bin)))))))
+               (install-file "CufflinksGTF_to_CodingQuarryGFF3.py" bin))
+             #t)))))
     (inputs `(("openmpi" ,openmpi)))
     (native-search-paths
      (list (search-path-specification
@@ -2727,7 +2732,8 @@ Illumina, Roche 454, and the SOLiD platform.")
                     (share (string-append out "/share/fraggenescan/train")))
                (install-file "run_FragGeneScan.pl" bin)
                (install-file "FragGeneScan" bin)
-               (copy-recursively "train" share))))
+               (copy-recursively "train" share))
+             #t))
          (delete 'check)
          (add-after 'install 'post-install-check
            ;; In lieu of 'make check', run one of the examples and check the
@@ -4153,7 +4159,8 @@ probabilistic distances of genome abundance and tetranucleotide frequency.")
                      "#!" (assoc-ref inputs "bash") "/bin/sh\n\n"
                      (assoc-ref inputs "jre") "/bin/java -jar "
                      bin "/minced.jar \"$@\"\n"))))
-               (chmod wrapper #o555)))))))
+               (chmod wrapper #o555))
+             #t)))))
     (native-inputs
      `(("jdk" ,icedtea "jdk")))
     (inputs
@@ -4408,7 +4415,7 @@ downstream analysis.")
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'enter-scripts-dir
-           (lambda _ (chdir "scripts")))
+           (lambda _ (chdir "scripts") #t))
          (replace 'check
            (lambda _ (invoke "python" "-m" "unittest" "discover" "-v") #t))
          (add-after 'install 'wrap-executables
@@ -5222,6 +5229,7 @@ viewer.")
                         #t))))))
       (inputs
        `(("perl" ,perl)
+         ("zlib:static" ,zlib "static")
          ("zlib" ,zlib)))
       (supported-systems '("x86_64-linux"))
       (home-page "https://github.com/wanpinglee/MOSAIK")
@@ -6019,7 +6027,8 @@ application of SortMeRNA is filtering rRNA from metatranscriptomic data.")
            (lambda _
              (substitute* "Makefile"
                (("(COMPILATION_TIME_PLACE=\")(.*)(\")" _ pre mid post)
-                (string-append pre "Built with Guix" post)))))
+                (string-append pre "Built with Guix" post)))
+             #t))
          (add-after 'enter-source-dir 'do-not-use-bundled-htslib
            (lambda _
              (substitute* "Makefile"
@@ -6103,7 +6112,8 @@ sequences.")
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((bin (string-append (assoc-ref outputs "out") "/bin/")))
                (mkdir-p bin)
-               (copy-recursively "../bin" bin))))
+               (copy-recursively "../bin" bin))
+             #t))
          ;; no "configure" script
          (delete 'configure))))
     (inputs `(("zlib" ,zlib)))
@@ -12007,11 +12017,13 @@ bytes of memory space, where n is the length of the string.")
          (add-after 'unpack 'do-not-look-for-boost
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* "CMakeLists.txt"
-               (("find_package\\(Boost 1\\.53\\.0") "#"))))
+               (("find_package\\(Boost 1\\.53\\.0") "#"))
+             #t))
          (add-after 'unpack 'do-not-assign-to-macro
            (lambda _
              (substitute* "include/spdlog/details/format.cc"
-               (("const unsigned CHAR_WIDTH = 1;") ""))))
+               (("const unsigned CHAR_WIDTH = 1;") ""))
+             #t))
          (add-after 'unpack 'prepare-rapmap
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((src "external/install/src/rapmap/")
@@ -12027,7 +12039,8 @@ bytes of memory space, where n is the length of the string.")
                (for-each (lambda (file)
                            (install-file file src))
                          (find-files "/tmp/rapmap/src" "\\.(c|cpp)"))
-               (copy-recursively "/tmp/rapmap/include" include))))
+               (copy-recursively "/tmp/rapmap/include" include))
+             #t))
          (add-after 'unpack 'use-system-libraries
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* '("src/SailfishIndexer.cpp"
@@ -12067,7 +12080,8 @@ bytes of memory space, where n is the length of the string.")
                      (string-append (getenv "CPLUS_INCLUDE_PATH")
                                     ":"
                                     (assoc-ref inputs "eigen")
-                                    "/include/eigen3")))))))
+                                    "/include/eigen3"))
+             #t)))))
     (inputs
      `(("boost" ,boost)
        ("eigen" ,eigen)
@@ -12253,11 +12267,13 @@ performance as its primary goal.")
          (add-after 'unpack 'do-not-look-for-boost
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* "CMakeLists.txt"
-               (("find_package\\(Boost 1\\.53\\.0") "#"))))
+               (("find_package\\(Boost 1\\.53\\.0") "#"))
+             #t))
          (add-after 'unpack 'do-not-phone-home
            (lambda _
              (substitute* "src/Salmon.cpp"
-               (("getVersionMessage\\(\\)") "\"\""))))
+               (("getVersionMessage\\(\\)") "\"\""))
+             #t))
          (add-after 'unpack 'prepare-rapmap
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((src "external/install/src/rapmap/")
@@ -12274,7 +12290,8 @@ performance as its primary goal.")
                                        "external/install/include/rapmap/concurrentqueue.h"
                                        "external/install/include/rapmap/FastxParserThreadUtils.hpp"
                                        "external/install/src/rapmap/FastxParser.cpp"
-                                       "external/install/src/rapmap/xxhash.c")))))
+                                       "external/install/src/rapmap/xxhash.c")))
+             #t))
          (add-after 'unpack 'use-system-libraries
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* "src/CMakeLists.txt"
@@ -12385,8 +12402,7 @@ variational inference.")
     (propagated-inputs
      `(("python-h5py" ,python-h5py)
        ("python-numpy" ,python-numpy)
-       ("python-scipy" ,python-scipy)
-       ("python-typing" ,python-typing)))
+       ("python-scipy" ,python-scipy)))
     (home-page "https://github.com/linnarsson-lab/loompy")
     (synopsis "Work with .loom files for single-cell RNA-seq data")
     (description "The loom file format is an efficient format for very large
@@ -13059,7 +13075,7 @@ expression report comparing samples in an easily configurable manner.")
        ("fastqc" ,fastqc)
        ("bowtie" ,bowtie)
        ("idr" ,idr)
-       ("snakemake" ,snakemake-4)
+       ("snakemake" ,snakemake)
        ("samtools" ,samtools)
        ("bedtools" ,bedtools)
        ("kentutils" ,kentutils)))
@@ -13120,7 +13136,7 @@ in an easily configurable manner.")
        ("ghc-pandoc-citeproc" ,ghc-pandoc-citeproc)
        ("python-wrapper" ,python-wrapper)
        ("python-pyyaml" ,python-pyyaml)
-       ("snakemake" ,snakemake-4)
+       ("snakemake" ,snakemake)
        ("bismark" ,bismark)
        ("fastqc" ,fastqc)
        ("bowtie" ,bowtie)
@@ -13170,7 +13186,7 @@ methylation and segmentation.")
        ("ghc-pandoc" ,ghc-pandoc)
        ("ghc-pandoc-citeproc" ,ghc-pandoc-citeproc)
        ("samtools" ,samtools)
-       ("snakemake" ,snakemake-4)
+       ("snakemake" ,snakemake)
        ("star" ,star)
        ("r-minimal" ,r-minimal)
        ("r-argparser" ,r-argparser)
diff --git a/gnu/packages/bison.scm b/gnu/packages/bison.scm
index 09c6481a16..71de47762d 100644
--- a/gnu/packages/bison.scm
+++ b/gnu/packages/bison.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -29,7 +30,7 @@
 (define-public bison
   (package
     (name "bison")
-    (version "3.0.4")
+    (version "3.0.5")
     (source
      (origin
       (method url-fetch)
@@ -37,10 +38,10 @@
                           version ".tar.xz"))
       (sha256
        (base32
-        "1qbgf6q1n2z17k8g33444m0q68kf3fbiq65q7jlrzpvvj73jh957"))))
+        "0f7kjygrckkx8vas2nm673592jif0a9mw5g8207f6hj6h4pfyp07"))))
     (build-system gnu-build-system)
     (native-inputs `(("perl" ,perl)
-                     ;; m4 is not present in PATH when cross-building
+                     ;; m4 is not present in PATH when cross-building.
                      ("m4" ,m4)))
     (inputs `(("flex" ,flex)))
     (propagated-inputs `(("m4" ,m4)))
@@ -52,15 +53,3 @@ deterministic or generalized LR parser from an annotated, context-free
 grammar.  It is versatile enough to have many applications, from parsers for
 simple tools through complex programming languages.")
     (license gpl3+)))
-
-(define-public bison-2.7
-  (package (inherit bison)
-    (version "2.7")
-    (source
-     (origin
-      (method url-fetch)
-      (uri (string-append "mirror://gnu/bison/bison-"
-                          version ".tar.xz"))
-      (sha256
-       (base32
-        "1zd77ilmpv5mi3kr55jrj6ncqlcnyhpianhrwzak2q28cv2cbn23"))))))
diff --git a/gnu/packages/boost.scm b/gnu/packages/boost.scm
index cf70a29775..b772781f56 100644
--- a/gnu/packages/boost.scm
+++ b/gnu/packages/boost.scm
@@ -9,6 +9,7 @@
 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2018 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -27,6 +28,7 @@
 
 (define-module (gnu packages boost)
   #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix utils)
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix git-download)
@@ -43,7 +45,7 @@
 (define-public boost
   (package
     (name "boost")
-    (version "1.66.0")
+    (version "1.68.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -52,7 +54,7 @@
                     ".tar.bz2"))
               (sha256
                (base32
-                "1aaw48cmimsskzgiclwn0iifp62a5iw9cbqrhfari876af1828ap"))
+                "1dyqsr9yb01y0nnjdq9b8q5s2kvhxbayk34832k5cpzn7jy30qbz"))
               (patches (search-patches "boost-fix-icu-build.patch"))))
     (build-system gnu-build-system)
     (inputs `(("icu4c" ,icu4c)
@@ -78,7 +80,6 @@
                    (out (assoc-ref outputs "out")))
                (substitute* '("libs/config/configure"
                               "libs/spirit/classic/phoenix/test/runtest.sh"
-                              "tools/build/doc/bjam.qbk"
                               "tools/build/src/engine/execunix.c"
                               "tools/build/src/engine/Jambase"
                               "tools/build/src/engine/jambase.c")
@@ -100,7 +101,18 @@
                     make-flags)))
          (replace 'install
            (lambda* (#:key make-flags #:allow-other-keys)
-             (apply invoke "./b2" "install" make-flags))))))
+             (apply invoke "./b2" "install" make-flags)))
+         (add-after 'install 'provide-libboost_python
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               ;; Boost can build support for both Python 2 and Python 3 since
+               ;; version 1.67.0, and suffixes each library with the Python
+               ;; version.  Many consumers only check for libboost_python
+               ;; however, so we provide it here as suggested in
+               ;; <https://github.com/boostorg/python/issues/203>.
+               (with-directory-excursion (string-append out "/lib")
+                 (symlink "libboost_python27.so" "libboost_python.so"))
+               #t))))))
 
     (home-page "https://www.boost.org")
     (synopsis "Peer-reviewed portable C++ source libraries")
@@ -124,6 +136,15 @@ across a broad spectrum of applications.")
               (sha256
                (base32
                 "1jj1aai5rdmd72g90a3pd8sw9vi32zad46xv5av8fhnr48ir6ykj"))))
+    (arguments (substitute-keyword-arguments (package-arguments boost)
+      ((#:phases phases)
+       `(modify-phases ,phases
+          ;; This was removed after boost-1.67.
+          (add-before 'configure 'more-bin-sh-patching
+            (lambda _
+              (substitute* "tools/build/doc/bjam.qbk"
+                (("/bin/sh") (which "sh")))))
+          (delete 'provide-libboost_python)))))
     (properties '((hidden? . #t)))))
 
 (define-public boost-sync
@@ -161,14 +182,14 @@ Boost.Thread.")
 (define-public mdds
   (package
     (name "mdds")
-    (version "1.3.1")
+    (version "1.4.3")
     (source (origin
              (method url-fetch)
              (uri (string-append
                    "http://kohei.us/files/mdds/src/mdds-" version ".tar.bz2"))
              (sha256
               (base32
-               "18g511z1lgfxrga2ld9yr95phmyfbd3ymbv4q5g5lyjn4ljcvf6w"))))
+               "10cw6irdm6d15nxnys2v5akp8yz52qijpcjvw0frwq7nz5d3vki5"))))
     (build-system gnu-build-system)
     (propagated-inputs
       `(("boost" ,boost))) ; inclusion of header files
diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index 0c11639150..c155228b4d 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -87,7 +87,8 @@
              (sha256
               (base32
                "03vvdfhdmf16121v7xs8is2krwnv15wpkhkf16a4yf8nsfc3f2w1"))
-             (patches (search-patches "grub-check-error-efibootmgr.patch"))))
+             (patches (search-patches "grub-check-error-efibootmgr.patch"
+                                      "grub-binutils-compat.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
diff --git a/gnu/packages/build-tools.scm b/gnu/packages/build-tools.scm
index a52ee480ac..a34e7ebff4 100644
--- a/gnu/packages/build-tools.scm
+++ b/gnu/packages/build-tools.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2017 Corentin Bocquillon <corentin@nybble.fr>
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Fis Trivial <ybbs.daans@hotmail.com>
@@ -158,7 +158,7 @@ files and generates build instructions for the Ninja build system.")
 (define-public meson
   (package
     (name "meson")
-    (version "0.47.1")
+    (version "0.47.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/mesonbuild/meson/"
@@ -166,7 +166,7 @@ files and generates build instructions for the Ninja build system.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "19mdap2ncvczajx220bd73xmwhd8x906382y18cn9c5syxwxwwyn"))))
+                "1swmycf6p9p0ag6yiywyyri42ffkxxj38r2ic7in24km47cszn4j"))))
     (build-system python-build-system)
     (arguments
      `(;; FIXME: Tests require many additional inputs, a fix for the RUNPATH
diff --git a/gnu/packages/c.scm b/gnu/packages/c.scm
index d89b6ea00d..c5141451f0 100644
--- a/gnu/packages/c.scm
+++ b/gnu/packages/c.scm
@@ -185,8 +185,45 @@ compiler while still keeping it small, simple, fast and understandable.")
                     "download/" version "/libbytesize-" version ".tar.gz"))
               (sha256
                (base32
-                "0bbqzln1nhjxl71aydq9k4jg3hvki9lqsb4w10s1i27jgibxqkdv"))))
+                "0bbqzln1nhjxl71aydq9k4jg3hvki9lqsb4w10s1i27jgibxqkdv"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  ;; This Makefile hard-codes MSGMERGE et al. instead of
+                  ;; honoring what 'configure' detected.  Fix that.
+                  (substitute* "po/Makefile.in"
+                    (("^MSGMERGE = msgmerge")
+                     "MSGMERGE = @MSGMERGE@\n"))
+                  #t))))
     (build-system gnu-build-system)
+    (arguments
+     ;; When running "make", the POT files are built with the build time as
+     ;; their "POT-Creation-Date".  Later on, "make" notices that .pot
+     ;; files were updated and goes on to run "msgmerge"; as a result, the
+     ;; non-deterministic POT-Creation-Date finds its way into .po files,
+     ;; and then in .gmo files.  To avoid that, simply make sure 'msgmerge'
+     ;; never runs.  See <https://bugs.debian.org/792687>.
+     '(#:configure-flags '("ac_cv_path_MSGMERGE=true")
+
+       #:phases (modify-phases %standard-phases
+                  (add-after 'configure 'create-merged-po-files
+                    (lambda _
+                      ;; Create "merged PO" (.mpo) files so that 'msgmerge'
+                      ;; doesn't need to run.
+                      (for-each (lambda (po-file)
+                                  (let ((merged-po
+                                         (string-append (dirname po-file) "/"
+                                                        (basename po-file
+                                                                  ".po")
+                                                        ".mpo")))
+                                    (copy-file po-file merged-po)))
+                                (find-files "po" "\\.po$"))
+                      #t)))
+
+       ;; One test fails because busctl (systemd only?) and python2-pocketlint
+       ;; are missing.  Should we fix it, we would need the "python-2" ,
+       ;; "python2-polib" and "python2-six" native-inputs.
+       #:tests? #f))
     (native-inputs
      `(("gettext" ,gettext-minimal)
        ("pkg-config" ,pkg-config)
@@ -194,10 +231,6 @@ compiler while still keeping it small, simple, fast and understandable.")
     (inputs
      `(("mpfr" ,mpfr)
        ("pcre" ,pcre)))
-    ;; One test fails because busctl (systemd only?) and python2-pocketlint
-    ;; are missing.  Should we fix it, we would need the "python-2" ,
-    ;; "python2-polib" and "python2-six" native-inputs.
-    (arguments `(#:tests? #f))
     (home-page "https://github.com/storaged-project/libbytesize")
     (synopsis "Tiny C library for working with arbitrary big sizes in bytes")
     (description
diff --git a/gnu/packages/calendar.scm b/gnu/packages/calendar.scm
index c2bbf139c1..24e19b472c 100644
--- a/gnu/packages/calendar.scm
+++ b/gnu/packages/calendar.scm
@@ -48,7 +48,7 @@
 (define-public libical
   (package
     (name "libical")
-    (version "3.0.3")
+    (version "3.0.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -56,7 +56,7 @@
                     version "/libical-" version ".tar.gz"))
               (sha256
                (base32
-                "0hcjyf35b8rrvy8xziqxc4imi28mmkixb09gknisvp6jsa5fp4av"))))
+                "0ifisnh42cw5z53hp9p52l3ggc7k877zlqk0n06gdhrk0bhidckj"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f ; test suite appears broken
diff --git a/gnu/packages/cdrom.scm b/gnu/packages/cdrom.scm
index a222652295..d94636ba4c 100644
--- a/gnu/packages/cdrom.scm
+++ b/gnu/packages/cdrom.scm
@@ -293,17 +293,26 @@ images.")
      `(#:tests? #f ; No tests.
        #:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'fix-glibc-compatability
+           (lambda* (#:key inputs #:allow-other-keys)
+             ;; We use sed --in-place because substitute* cannot handle the
+             ;; character encoding used by growisofs.c.
+             (invoke "sed" "-i" "-e"
+                     (string-append
+                       "s,<sys/stat.h>,"
+                       "<sys/stat.h>\\\n#include <sys/sysmacros.h>,")
+                     "growisofs.c")))
          (replace 'configure
            (lambda _ (setenv "prefix" (assoc-ref %outputs "out")) #t))
          (add-before 'build 'embed-mkisofs
-           (lambda*  (#:key inputs #:allow-other-keys)
+           (lambda* (#:key inputs #:allow-other-keys)
              ;; We use sed --in-place because substitute* cannot handle the
              ;; character encoding used by growisofs.c.
-             (zero? (system* "sed" "-i" "-e"
-                             (string-append
-                              "s,\"mkisofs\","
-                              "\"" (which "mkisofs") "\",")
-                             "growisofs.c")))))))
+             (invoke "sed" "-i" "-e"
+                     (string-append
+                       "s,\"mkisofs\","
+                       "\"" (which "mkisofs") "\",")
+                     "growisofs.c"))))))
     (home-page "http://fy.chalmers.se/~appro/linux/DVD+RW/")
     (synopsis "DVD and Blu-ray Disc burning tools")
     (description "dvd+rw-tools, mostly known for its command
diff --git a/gnu/packages/check.scm b/gnu/packages/check.scm
index 40f341fb64..937e4e094c 100644
--- a/gnu/packages/check.scm
+++ b/gnu/packages/check.scm
@@ -26,7 +26,7 @@
 ;;; Copyright © 2017 Nils Gillmann <ng0@n0.is>
 ;;; Copyright © 2015, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016, 2017, 2018 Marius Bakke <mbakke@fastmail.com>
-;;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2018 Fis Trivial <ybbs.daans@hotmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -51,6 +51,7 @@
   #:use-module (gnu packages compression)
   #:use-module (gnu packages llvm)
   #:use-module (gnu packages golang)
+  #:use-module (gnu packages perl)
   #:use-module (gnu packages python)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages time)
@@ -250,7 +251,7 @@ a multi-paradigm automated test framework for C++ and Objective-C.")
              ;; the build environment. Hence assuming-failure test fails.
              (delete-file "yarn.tests/assuming-failure.script")
              (delete-file "yarn.tests/assuming-failure.stdout")
-             (zero? (system* "python" "setup.py" "check")))))))
+             (invoke "python" "setup.py" "check"))))))
     (native-inputs
      `(("python2-coverage-test-runner" ,python2-coverage-test-runner)))
     (propagated-inputs
@@ -619,14 +620,14 @@ standard library.")
 (define-public python-pytest
   (package
     (name "python-pytest")
-    (version "3.5.0")
+    (version "3.8.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pytest" version))
        (sha256
         (base32
-         "1q832zd07zak2lyxbycxjydh0jp7y3hvawjqzlvra6aghz8r3r7s"))))
+         "17grcfvd6ggvvqmprwv5y8g319nayam70hr43ssjwj40ws27z858"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -642,9 +643,11 @@ standard library.")
                 (string-append "@pytest.mark.skip"
                                "(reason=\"Assumes that /usr exists.\")\n    "
                                line)))
-             #t)))))
+             #t))
+         (replace 'check (lambda _ (invoke "pytest" "-vv"))))))
     (propagated-inputs
-     `(("python-attrs" ,python-attrs-bootstrap)
+     `(("python-atomicwrites" ,python-atomicwrites)
+       ("python-attrs" ,python-attrs-bootstrap)
        ("python-more-itertools" ,python-more-itertools)
        ("python-pluggy" ,python-pluggy)
        ("python-py" ,python-py)
@@ -655,6 +658,7 @@ standard library.")
        ("python-hypothesis" ,python-hypothesis)
        ("python-nose" ,python-nose)
        ("python-mock" ,python-mock)
+       ("python-pytest" ,python-pytest-bootstrap)
        ("python-setuptools-scm" ,python-setuptools-scm)))
     (home-page "http://pytest.org")
     (synopsis "Python testing library")
@@ -672,6 +676,7 @@ and many external plugins.")
       (inherit pytest)
       (propagated-inputs
        `(("python2-funcsigs" ,python2-funcsigs)
+         ("python2-pathlib2" ,python2-pathlib2)
          ,@(package-propagated-inputs pytest))))))
 
 (define-public python-pytest-bootstrap
@@ -688,19 +693,20 @@ and many external plugins.")
     (package (inherit pytest)
              (propagated-inputs
               `(("python2-funcsigs" ,python2-funcsigs-bootstrap)
+                ("python2-pathlib2" ,python2-pathlib2-bootstrap)
                 ,@(package-propagated-inputs pytest))))))
 
 (define-public python-pytest-cov
   (package
     (name "python-pytest-cov")
-    (version "2.4.0")
+    (version "2.5.1")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "pytest-cov" version))
         (sha256
          (base32
-          "03c2qc42r4bczyw93gd7n0qi1h1jfhw7fnbhi33c3vp1hs81gm2k"))))
+          "0bbfpwdh9k3636bxc88vz9fa7vf4akchgn513ql1vd0xy4n7bah3"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -710,8 +716,8 @@ and many external plugins.")
             ;; options taken from tox.ini
             ;; TODO: make "--restructuredtext" tests pass. They currently fail
             ;; with "Duplicate implicit target name"
-            (zero? (system* "python" "./setup.py" "check"
-                            "--strict" "--metadata")))))))
+            (invoke "python" "./setup.py" "check"
+                    "--strict" "--metadata"))))))
     (propagated-inputs
      `(("python-coverage" ,python-coverage)
        ("python-pytest" ,python-pytest)))
@@ -729,26 +735,15 @@ supports coverage of subprocesses.")
 (define-public python-pytest-runner
   (package
     (name "python-pytest-runner")
-    (version "2.11.1")
+    (version "4.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pytest-runner" version))
        (sha256
         (base32
-         "1cw978kqqcq916b9gfns1qjqvg33c5ail5jhw9054dsynkm32flq"))))
+         "1gkpyphawxz38ni1gdq1fmwyqcg02m7ypzqvv46z06crwdxi2gyj"))))
     (build-system python-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         ;; The fancy way of setting the version with setuptools_scm does not
-         ;; seem to work here.
-         (add-after 'unpack 'set-version
-          (lambda _
-            (substitute* "docs/conf.py"
-              (("version = setuptools_scm\\.get_version\\(root='\\.\\.')")
-               (string-append "version = \"" ,version "\"")))
-            #t)))))
     (native-inputs
      `(("python-pytest" ,python-pytest-bootstrap)
        ("python-setuptools-scm" ,python-setuptools-scm)))
@@ -765,14 +760,14 @@ supports coverage of subprocesses.")
 (define-public python-pytest-mock
   (package
     (name "python-pytest-mock")
-    (version "1.6.3")
+    (version "1.10.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "pytest-mock" version))
         (sha256
          (base32
-          "075v7b2wm5f839r1a30n21wfk5rfqp3d05q7zb9jlb2wmxki23cj"))))
+          "1h6lgpmsvs9s8j2s80v06f9f3iaw1n1rc51mbrxk1f12sw4q56nq"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-setuptools-scm" ,python-setuptools-scm)))
@@ -885,7 +880,8 @@ subprocess and see the output as well as any file modifications.")
        (uri (pypi-uri "testtools" version))
        (sha256
         (base32
-         "0n8519lk8aaa91vymz842831181wf7fss98hyllhygi3z1nfq9sq"))))
+         "0n8519lk8aaa91vymz842831181wf7fss98hyllhygi3z1nfq9sq"))
+       (patches (search-patches "python-testtools.patch"))))
     (build-system python-build-system)
     (arguments '(#:tests? #f))
     (propagated-inputs
@@ -1105,8 +1101,8 @@ python-fixtures package instead.")
        (modify-phases %standard-phases
          (replace 'check
            (lambda _
-             (zero? (system* "python" "-m" "testtools.run"
-                             "fixtures.test_suite")))))))
+             (invoke "python" "-m" "testtools.run"
+                     "fixtures.test_suite"))))))
     (propagated-inputs
      ;; Fixtures uses pbr at runtime to check versions, etc.
      `(("python-pbr" ,python-pbr)
@@ -1346,20 +1342,20 @@ the last py.test invocation.")
 (define-public python-pytest-localserver
   (package
     (name "python-pytest-localserver")
-    (version "0.4.1")
+    (version "0.5.0")
     (source (origin
-             (method url-fetch)
-             (uri (pypi-uri "pytest-localserver" version))
-             (sha256
-              (base32
-               "08f06rvj31wqf0vgmd1waya87r7vy6x8ck48lxl3dxy83q5gcam7"))))
+              (method url-fetch)
+              (uri (pypi-uri "pytest-localserver" version))
+              (sha256
+               (base32
+                "1hpgpxrpfq5c731ndnsay2lc0y9nh2wy9fn1f83s3z8xkn82fm1s"))))
     (build-system python-build-system)
     (arguments
-      `(#:phases (modify-phases %standard-phases
+     '(#:phases
+       (modify-phases %standard-phases
          (replace 'check
            (lambda _
-             (zero? (system* "py.test" "--genscript=runtests.py"))
-             (zero? (system* "py.test")))))))
+             (invoke "py.test" "-v"))))))
     (native-inputs
      `(("python-pytest" ,python-pytest)
        ("python-requests" ,python-requests)
@@ -1421,16 +1417,17 @@ normally the case.")
 (define-public python-hypothesis
   (package
     (name "python-hypothesis")
-    (version "3.52.0")
+    (version "3.70.3")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "hypothesis" version))
               (sha256
                (base32
-                "0g54cypfi5qj6cgxfr7l1nb41r1cqhhngx4qxn4ga9h720rcsbr8"))))
+                "1rshs1japfmwgar98yrkq4hg4z2q76hlnq7w2n3lfbjnscn1jd9b"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-flake8" ,python-flake8)
+     `(;; FIXME: Change to python-flake8 in the next rebuild cycle.
+       ("python-flake8" ,python-flake8-3.5)
        ("python-pytest" ,python-pytest-bootstrap)))
     (propagated-inputs
      `(("python-attrs" ,python-attrs-bootstrap)
@@ -1527,7 +1524,7 @@ failures.")
              ;; It's easier to run tests after install.
              ;; Make installed package available for running the tests
              (add-installed-pythonpath inputs outputs)
-             (zero? (system* "py.test" "-vv")))))))
+             (invoke "py.test" "-vv"))))))
     (native-inputs
      `(("python-coverage" ,python-coverage)
        ("python-pytest" ,python-pytest)
@@ -1564,7 +1561,7 @@ failures.")
        (modify-phases %standard-phases
          (replace 'check
            (lambda _
-             (zero? (system* "./testrun")))))))
+             (invoke "./testrun"))))))
     (propagated-inputs
      `(("python2-coverage" ,python2-coverage)))
     (home-page "https://liw.fi/coverage-test-runner/")
@@ -1610,9 +1607,9 @@ statements in the module it tests.")
                               (string-append (getenv "PYTHONPATH") ":" work))
                       (copy-recursively "." work)
                       (with-directory-excursion "/tmp"
-                        (zero? (system* "python" "-m" "unittest" "discover"
-                                        "-s" (string-append work "/pylint/test")
-                                        "-p" "*test_*.py")))))))))
+                        (invoke "python" "-m" "unittest" "discover"
+                                "-s" (string-append work "/pylint/test")
+                                "-p" "*test_*.py"))))))))
     (home-page "https://github.com/PyCQA/pylint")
     (synopsis "Python source code analyzer which looks for coding standard
 errors")
@@ -1845,7 +1842,8 @@ tests written in a natural language style, backed up by Python code.")
            (lambda _
              (substitute* "setup.py"
                (("'wheel'") "")                ; We don't use it.
-               (("'ordereddict==1.1'") ""))))))) ; Python >= 2.7 has it built-in.
+               (("'ordereddict==1.1'") ""))    ; Python >= 2.7 has it built-in.
+             #t)))))
     (propagated-inputs
      `(("behave" ,behave)
        ("python-requests" ,python-requests)))
@@ -2091,3 +2089,42 @@ aspects of UnitTest++.  UnitTest++ is mostly standard C++ and makes minimal use
 of advanced library and language features, which means it should be easily
 portable to just about any platform.")
     (license license:expat)))
+
+(define-public libfaketime
+  (package
+    (name "libfaketime")
+    (version "0.9.7")
+    (home-page "https://github.com/wolfcw/libfaketime")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url home-page)
+                    (commit (string-append "v" version))))
+              (sha256
+               (base32
+                "1cin1pqwpsswcv7amiwijirvcg3x1zf2l00s1x84nxc5602fzr5c"))
+              (file-name (git-file-name name version))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:phases (modify-phases %standard-phases
+                  (replace 'configure
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (let ((out (assoc-ref outputs "out")))
+                        (setenv "CC" "gcc")
+                        (setenv "PREFIX" out)
+                        #t)))
+                  (add-before 'check 'pre-check
+                    (lambda _
+                      (substitute* "test/functests/test_exclude_mono.sh"
+                        (("/bin/bash") (which "bash")))
+                      #t)))
+       #:test-target "test"))
+    (native-inputs
+     `(("perl" ,perl)))                           ;for tests
+    (synopsis "Fake the system time for single applications")
+    (description
+     "The libfaketime library allows users to modify the system time that an
+application \"sees\".  It is meant to be loaded using the dynamic linker's
+@code{LD_PRELOAD} environment variable.  The @command{faketime} command
+provides a simple way to achieve this.")
+    (license license:gpl2)))
diff --git a/gnu/packages/chez.scm b/gnu/packages/chez.scm
index c8e76b8ab4..929e50ee9b 100644
--- a/gnu/packages/chez.scm
+++ b/gnu/packages/chez.scm
@@ -85,6 +85,7 @@
        ("xorg-rgb" ,xorg-rgb)
        ("nanopass" ,nanopass)
        ("zlib" ,zlib)
+       ("zlib:static" ,zlib "static")
        ("stex" ,stex)))
     (native-inputs
      `(("texlive" ,texlive)
@@ -128,6 +129,7 @@
                    (nanopass (assoc-ref inputs "nanopass"))
                    (stex (assoc-ref inputs "stex"))
                    (zlib (assoc-ref inputs "zlib"))
+                   (zlib-static (assoc-ref inputs "zlib:static"))
                    (unpack (assoc-ref %standard-phases 'unpack))
                    (patch-source-shebangs
                     (assoc-ref %standard-phases 'patch-source-shebangs)))
@@ -148,7 +150,7 @@
                  (("\\$\\{Kernel\\}: \\$\\{kernelobj\\} \\.\\./zlib/libz\\.a")
                   "${Kernel}: ${kernelobj}")
                  (("ld ([-a-zA-Z0-9_${} ]+) \\.\\./zlib/libz\\.a" all args)
-                  (string-append "ld " args " " zlib "/lib/libz.a"))
+                  (string-append "ld " args " " zlib-static "/lib/libz.a"))
                  (("\\(cd \\.\\./zlib; ([-a-zA-Z0-9=./ ]+))")
                   (which "true")))
                (substitute* (find-files "mats" "Mf-.*")
diff --git a/gnu/packages/cmake.scm b/gnu/packages/cmake.scm
index 06b1cab82c..5abf087557 100644
--- a/gnu/packages/cmake.scm
+++ b/gnu/packages/cmake.scm
@@ -7,6 +7,7 @@
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017, 2018 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -43,7 +44,7 @@
 (define-public cmake
   (package
     (name "cmake")
-    (version "3.11.0")
+    (version "3.12.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.cmake.org/files/v"
@@ -51,7 +52,7 @@
                                   "/cmake-" version ".tar.gz"))
               (sha256
                (base32
-                "0sv5k9q6braa8hhw0y3w19avqn0xn5czv5jf5fz5blnlf7ivw4y3"))
+                "19410mxgcyvk5q42phaclb1hz6rl08z4yj8iriq706p5k5bli5qg"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -86,6 +87,13 @@
            " --exclude-regex ^\\(" (string-join skipped-tests "\\|") "\\)$")))
        #:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'split-package
+           ;; Remove files that have been packaged in other package recipes.
+           (lambda _
+             (delete-file "Auxiliary/cmake-mode.el")
+             (substitute* "Auxiliary/CMakeLists.txt"
+               ((".*cmake-mode.el.*") ""))
+             #t))
          (add-before 'configure 'patch-bin-sh
            (lambda _
              ;; Replace "/bin/sh" by the right path in... a lot of
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 30a0ffcec9..0aa65fe638 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -186,12 +186,25 @@
                     ,cf)))))
      (inputs %boot0-inputs))))
 
+;; Use a "fixed" package source for this early libstdc++ variant so we can
+;; update GCC 4.9 without triggering a full rebuild.
+(define gcc-for-libstdc++
+  (package
+    (inherit gcc-4.9)
+    (source (origin
+              (inherit (package-source gcc-4.9))
+              (patches (search-patches "gcc-4.9-libsanitizer-fix.patch"
+                                       "gcc-arm-bug-71399.patch"
+                                       "gcc-asan-missing-include.patch"
+                                       "gcc-libvtv-runpath.patch"
+                                       "gcc-fix-texi2pod.patch"))))))
+
 (define libstdc++-boot0
   ;; GCC's libcc1 is always built as a shared library (the top-level
   ;; 'Makefile.def' forcefully adds --enable-shared) and thus needs to refer
   ;; to libstdc++.so.  We cannot build libstdc++-5.3 because it relies on
   ;; C++14 features missing in some of our bootstrap compilers.
-  (let ((lib (package-with-bootstrap-guile (make-libstdc++ gcc-4.9))))
+  (let ((lib (package-with-bootstrap-guile (make-libstdc++ gcc-for-libstdc++))))
     (package
       (inherit lib)
       (name "libstdc++-boot0")
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index e775052b7a..32b92a976c 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -7,7 +7,7 @@
 ;;; Copyright © 2015, 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015, 2017, 2018 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2015 Jeff Mickey <j@codemac.net>
-;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Ben Woodcroft <donttrustben@gmail.com>
 ;;; Copyright © 2016 Danny Milosavljevic <dannym@scratchpost.org>
 ;;; Copyright © 2016, 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
@@ -85,6 +85,7 @@
        (base32
         "18dighcs333gsvajvvgqp8l4cx7h1x7yx9gd5xacnk80spyykrf3"))))
     (build-system gnu-build-system)
+    (outputs '("out" "static"))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
@@ -99,7 +100,15 @@
                      `((setenv "CHOST" ,(%current-target-system)))
                      '())
                (invoke "./configure"
-                       (string-append "--prefix=" out))))))))
+                       (string-append "--prefix=" out)))))
+         (add-after 'install 'move-static-library
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out"))
+                   (static (assoc-ref outputs "static")))
+               (with-directory-excursion (string-append out "/lib")
+                 (install-file "libz.a" (string-append static "/lib"))
+                 (delete-file "libz.a")
+                 #t)))))))
     (home-page "https://zlib.net/")
     (synopsis "Compression library")
     (description
@@ -208,6 +217,21 @@ adding and extracting files to/from a tar archive.")
     '(#:tests? #f
       #:phases
       (modify-phases %standard-phases
+        (add-after 'unpack 'patch-for-glibc-2.28
+          (lambda _
+            ;; Adjust the bundled gnulib to work with glibc 2.28.  See e.g.
+            ;; "m4-gnulib-libio.patch".  This is a phase rather than patch
+            ;; or snippet to work around <https://bugs.gnu.org/32347>.
+            (substitute* (find-files "lib" "\\.c$")
+              (("#if defined _IO_ftrylockfile")
+               "#if defined _IO_EOF_SEEN"))
+            (substitute* "lib/stdio-impl.h"
+              (("^/\\* BSD stdio derived implementations")
+               (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                              "# define _IO_IN_BACKUP 0x100\n"
+                              "#endif\n\n"
+                              "/* BSD stdio derived implementations")))
+            #t))
         (add-after 'unpack 'use-absolute-name-of-gzip
           (lambda* (#:key outputs #:allow-other-keys)
             (substitute* "gunzip.in"
@@ -240,6 +264,7 @@ file; as a result, it is often used in conjunction with \"tar\", resulting in
     (arguments
      `(#:modules ((guix build gnu-build-system)
                   (guix build utils)
+                  (ice-9 ftw)
                   (srfi srfi-1))
        #:phases
        (modify-phases %standard-phases
@@ -268,25 +293,32 @@ file; as a result, it is often used in conjunction with \"tar\", resulting in
              ;; it create all the (un)versioned symlinks, so we handle it here.
              (let* ((out    (assoc-ref outputs "out"))
                     (libdir (string-append out "/lib"))
-                    ;; Find the actual library (e.g. "libbz2.so.1.0.6").
-                    (lib (string-drop
-                          (car (find-files
-                                "."
-                                (lambda (file stat)
-                                  (and (string-prefix? "./libbz2.so" file)
-                                       (eq? 'regular (stat:type stat))))))
-                          2))
-                    (soversion (string-drop lib (string-length "libbz2.so."))))
+                    (soname "libbz2.so")
+                    ;; Locate the built library (e.g. "libbz2.so.1.0.6").
+                    (lib (car (scandir "."
+                                       (lambda (file)
+                                         (and (string-prefix? soname file)
+                                              (eq? 'regular
+                                                   (stat:type (lstat file))))))))
+                    (soversion (string-drop lib (+ 1 (string-length soname)))))
                (install-file lib libdir)
                (with-directory-excursion libdir
                  ;; Create symlinks libbz2.so.1 -> libbz2.so.1.0, etc.
-                 (let loop ((base "libbz2.so")
+                 (let loop ((base soname)
                             (numbers (string-split soversion #\.)))
                    (unless (null? numbers)
                      (let ((so-file (string-append base "." (car numbers))))
                        (symlink so-file base)
                        (loop so-file (cdr numbers))))))
                #t)))
+         (add-after 'install-shared-lib 'move-static-lib
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out"))
+                   (static (assoc-ref outputs "static")))
+               (with-directory-excursion (string-append out "/lib")
+                 (install-file "libbz2.a" (string-append static "/lib"))
+                 (delete-file "libbz2.a")
+                 #t))))
          (add-after 'install-shared-lib 'patch-scripts
            (lambda* (#:key outputs inputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out")))
@@ -301,6 +333,7 @@ file; as a result, it is often used in conjunction with \"tar\", resulting in
        ,@(if (%current-target-system)
              '(#:tests? #f)
              '())))
+    (outputs '("out" "static"))
     (synopsis "High-quality data compression program")
     (description
      "bzip2 is a freely available, patent free (see below), high-quality data
@@ -322,7 +355,20 @@ decompression.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1sahaqc5bw4i0iyri05syfza4ncf5cml89an033fspn97klmxis6"))))
+                "1sahaqc5bw4i0iyri05syfza4ncf5cml89an033fspn97klmxis6"))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                 (substitute* (find-files "lib" "\\.c$")
+                   (("#if defined _IO_ftrylockfile")
+                    "#if defined _IO_EOF_SEEN"))
+                 (substitute* "lib/stdio-impl.h"
+                   (("^/\\* BSD stdio derived implementations")
+                    (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                                   "# define _IO_IN_BACKUP 0x100\n"
+                                   "#endif\n\n"
+                                   "/* BSD stdio derived implementations")))
+                 #t))))
     (build-system gnu-build-system)
     (synopsis "Parallel bzip2 compression utility")
     (description
@@ -368,7 +414,7 @@ compressed with pbzip2 can be decompressed with bzip2).")
 (define-public xz
   (package
    (name "xz")
-   (version "5.2.3")
+   (version "5.2.4")
    (source (origin
             (method url-fetch)
             (uri (list (string-append "http://tukaani.org/xz/xz-" version
@@ -377,7 +423,7 @@ compressed with pbzip2 can be decompressed with bzip2).")
                                       version ".tar.gz")))
             (sha256
              (base32
-              "1jr8pxnz55ifc8cvp3ivgl79ph9iik5aypsc9cma228aglsqp4ki"))))
+              "0ibi2zsfaz6l756spjwc5rayf4ckgc9hwmy8qinppcyk4svz64mm"))))
    (build-system gnu-build-system)
    (synopsis "General-purpose data compression")
    (description
@@ -543,7 +589,20 @@ decompressors when faced with corrupted input.")
       (patches (search-patches "sharutils-CVE-2018-1000097.patch"))
       (sha256
        (base32
-        "16isapn8f39lnffc3dp4dan05b7x6mnc76v6q5nn8ysxvvvwy19b"))))
+        "16isapn8f39lnffc3dp4dan05b7x6mnc76v6q5nn8ysxvvvwy19b"))
+      (modules '((guix build utils)))
+      (snippet
+       '(begin
+          (substitute* (find-files "lib" "\\.c$")
+            (("#if defined _IO_ftrylockfile")
+             "#if defined _IO_EOF_SEEN"))
+          (substitute* "lib/stdio-impl.h"
+            (("^/\\* BSD stdio derived implementations")
+             (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                            "# define _IO_IN_BACKUP 0x100\n"
+                            "#endif\n\n"
+                            "/* BSD stdio derived implementations")))
+          #t))))
     (build-system gnu-build-system)
     (inputs
      `(("which" ,which)))
@@ -701,7 +760,8 @@ INCLUDE = ~a/include
 LIB = ~:*~a/lib
 OLD_ZLIB = False
 GZIP_OS_CODE = AUTO_DETECT"
-                                 (assoc-ref inputs "zlib")))))))))
+                                 (assoc-ref inputs "zlib"))))
+                     #t)))))
     (home-page "https://metacpan.org/release/Compress-Raw-Zlib")
     (synopsis "Low-level interface to zlib compression library")
     (description "This module provides a Perl interface to the zlib
@@ -834,8 +894,16 @@ the LZ4 frame format.")
        #:phases
        (modify-phases %standard-phases
          (replace 'configure
-                  (lambda _
-                    (chdir "squashfs-tools"))))))
+           (lambda _
+             (chdir "squashfs-tools")
+             #t))
+         (add-after 'unpack 'fix-glibc-compatability
+           (lambda _
+             (substitute* '("squashfs-tools/mksquashfs.c"
+                            "squashfs-tools/unsquashfs.c")
+               (("<sys/sysinfo.h>")
+                "<sys/sysinfo.h>\n#include <sys/sysmacros.h>"))
+             #t)))))
     (inputs
      `(("lz4" ,lz4)
        ("lzo" ,lzo)
@@ -1134,16 +1202,30 @@ well as bzip2.")
 (define-public bitshuffle
   (package
     (name "bitshuffle")
-    (version "0.3.4")
+    (version "0.3.5")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "bitshuffle" version))
               (sha256
                (base32
-                "0ydawb01ghsvmw0lraczhrgvkjj97bpg98f1qqs1cnfp953mdd5v"))))
+                "1823x61kyax4dc2hjmc1xraskxi1193y8lvxd03vqv029jrj8cjy"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  ;; Remove generated Cython files.
+                  (delete-file "bitshuffle/h5.c")
+                  (delete-file "bitshuffle/ext.c")
+                  #t))))
     (build-system python-build-system)
     (arguments
-     `(#:tests? #f))           ; fail: https://github.com/h5py/h5py/issues/769
+     `(#:tests? #f             ; fail: https://github.com/h5py/h5py/issues/769
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'dont-build-native
+           (lambda _
+             (substitute* "setup.py"
+               (("'-march=native', ") ""))
+             #t)))))
     (inputs
      `(("numpy" ,python-numpy)
        ("h5py" ,python-h5py)
@@ -1161,14 +1243,15 @@ algorithm within the Numpy framework.")
   (package
     (name "snappy")
     (version "1.1.7")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/google/snappy/archive/"
-                                  version ".tar.gz"))
-              (file-name (string-append "snappy-" version ".tar.gz"))
-              (sha256
-               (base32
-                "1m7rcdqzkys5lspj8jcsaah8w33zh28s771bw0ga2lgzfgl05yix"))))
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/google/snappy/archive/"
+                           version ".tar.gz"))
+       (file-name (string-append "snappy-" version ".tar.gz"))
+       (sha256
+        (base32 "1m7rcdqzkys5lspj8jcsaah8w33zh28s771bw0ga2lgzfgl05yix"))
+       (patches (search-patches "snappy-add-O2-flag-in-CmakeLists.txt.patch"))))
     (build-system cmake-build-system)
     (arguments
      `(#:configure-flags '("-DBUILD_SHARED_LIBS=ON")))
@@ -1278,7 +1361,8 @@ install: libbitshuffle.so
          (add-after 'build-jni 'copy-jni
            (lambda _
              (copy-recursively "src/main/resources/org/xerial/snappy/native"
-                               "build/classes/org/xerial/snappy/native")))
+                               "build/classes/org/xerial/snappy/native")
+             #t))
          (add-before 'check 'fix-failing
            (lambda _
              (with-directory-excursion "src/test/java/org/xerial/snappy"
@@ -1396,7 +1480,8 @@ compressor/decompressor.")
                        class))
              (invoke "ant" "compile-tests")
              (test "org.iq80.snappy.SnappyFramedStreamTest")
-             (test "org.iq80.snappy.SnappyStreamTest")))
+             (test "org.iq80.snappy.SnappyStreamTest")
+             #t))
          (add-before 'build 'remove-hadoop-dependency
            (lambda _
              ;; We don't have hadoop
@@ -1751,7 +1836,7 @@ speed.")
      `(#:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'enter-subdirectory
-           (lambda _ (chdir "contrib/pzstd")))
+           (lambda _ (chdir "contrib/pzstd") #t))
          (delete 'configure)            ; no configure script
          (add-before 'check 'compile-tests
            (lambda* (#:key make-flags #:allow-other-keys)
@@ -2033,14 +2118,16 @@ type by using either Perl modules, or command-line tools on your system.")
            (lambda _
              ;; Our build system enters the first directory in the archive, but
              ;; the package is not contained in a subdirectory
-             (chdir "..")))
+             (chdir "..")
+             #t))
          (replace 'install
            (lambda* (#:key outputs #:allow-other-keys)
              ;; Do we want to install *Demo.jar?
              (install-file "build/jar/xz.jar"
                            (string-append
                              (assoc-ref outputs "out")
-                             "/share/java/xz.jar")))))))
+                             "/share/java/xz.jar"))
+             #t)))))
     (native-inputs
      `(("unzip" ,unzip)))
     (home-page "https://tukaani.org")
diff --git a/gnu/packages/cross-base.scm b/gnu/packages/cross-base.scm
index bbd779ae4e..2fcb7fb36b 100644
--- a/gnu/packages/cross-base.scm
+++ b/gnu/packages/cross-base.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2018 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2016 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
@@ -356,7 +356,7 @@ target that libc."
              ,@(package-arguments glibc/hurd-headers))
          ((#:phases phases)
           `(modify-phases ,phases
-             (add-before 'pre-configure 'set-cross-headers-path
+             (add-after 'unpack 'set-cross-headers-path
                (lambda* (#:key inputs #:allow-other-keys)
                  (let* ((mach (assoc-ref inputs "gnumach-headers"))
                         (hurd (assoc-ref inputs "hurd-headers"))
@@ -426,17 +426,9 @@ target that libc."
                      (xheaders (cross-kernel-headers target)))
   "Return a libc cross-built for TARGET, a GNU triplet.  Use XGCC and
 XBINUTILS and the cross tool chain."
-  (define (cross-libc-for-target target)
-    "Return libc depending on TARGET."
-    (match target
-      ((or "i586-pc-gnu" "i586-gnu") glibc/hurd)
-      (_ glibc/linux)))
-
-  ;; Use (cross-libc-for-target ...) to determine the correct libc to use.
-
   (if (cross-newlib? target)
       (native-libc target)
-      (let ((libc (cross-libc-for-target target)))
+      (let ((libc glibc))
         (package (inherit libc)
           (name (string-append "glibc-cross-" target))
           (arguments
@@ -457,7 +449,9 @@ XBINUTILS and the cross tool chain."
                  ,@(package-arguments libc))
              ((#:configure-flags flags)
               `(cons ,(string-append "--host=" target)
-                   ,flags))
+                     ,(if (hurd-triplet? target)
+                          `(cons "--disable-werror" ,flags)
+                          flags)))
              ((#:phases phases)
               `(modify-phases ,phases
                  (add-before 'configure 'set-cross-kernel-headers-path
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index 04a533de02..4343910d59 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -53,7 +53,7 @@
 (define-public cups-filters
   (package
     (name "cups-filters")
-    (version "1.20.1")
+    (version "1.21.0")
     (source(origin
               (method url-fetch)
               (uri
@@ -61,7 +61,7 @@
                               "cups-filters-" version ".tar.xz"))
               (sha256
                (base32
-                "0qix1whz5n4ijnl6d44f1v8nzkpv99wqjyrby8vx6xnpskw5hsxk"))
+                "0fs90xx9i4h8gbpligf5kkh21llv4kf5g3bgfbx4z272xkm7bsfi"))
               (modules '((guix build utils)))
               (snippet
                ;; install backends, banners and filters to cups-filters output
@@ -176,8 +176,7 @@ filters for the PDF-centric printing workflow introduced by OpenPrinting.")
 (define-public cups-minimal
   (package
     (name "cups-minimal")
-    (replacement cups-minimal-2.2.8)
-    (version "2.2.6")
+    (version "2.2.8")
     (source
      (origin
        (method url-fetch)
@@ -185,7 +184,7 @@ filters for the PDF-centric printing workflow introduced by OpenPrinting.")
                            version "/cups-" version "-source.tar.gz"))
        (sha256
         (base32
-         "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"))))
+         "1r7r7b3nqpzc1a9dczqpj2mr8rkcwf01676v11sp4j7w4qfzqs1r"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -237,21 +236,8 @@ describe printer capabilities and features, and a wide variety of generic and
 device-specific programs to convert and print many types of files.")
     (license license:gpl2)))
 
-(define-public cups-minimal-2.2.8
-  (package
-    (inherit cups-minimal)
-    (version "2.2.8")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "https://github.com/apple/cups/releases/download/v"
-                           version "/cups-" version "-source.tar.gz"))
-       (sha256
-        (base32
-         "1r7r7b3nqpzc1a9dczqpj2mr8rkcwf01676v11sp4j7w4qfzqs1r"))))))
-
 (define-public cups
-  (package/inherit cups-minimal
+  (package (inherit cups-minimal)
     (name "cups")
     (arguments
      `(;; Three tests fail:
diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 2fb87251f4..61313af7d2 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -50,7 +50,7 @@
 (define-public curl
   (package
    (name "curl")
-   (version "7.59.0")
+   (version "7.61.1")
    (replacement curl-7.62.0)
    (source (origin
             (method url-fetch)
@@ -58,7 +58,7 @@
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1z310hrjm2vmbcpkyp81dcmj9rk127zkjyawpy2pah0nz6yslkp4"))))
+              "148qv1f32290r9pwg07mccawihz4srznkzsdwdl2xllvlgb16n9x"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "doc"))                             ;1.2 MiB of man3 pages
@@ -85,7 +85,8 @@
            (separator #f)                         ;single entry
            (files '("etc/ssl/certs/ca-certificates.crt")))))
    (arguments
-    `(#:configure-flags '("--with-gnutls" "--with-gssapi")
+    `(#:configure-flags '("--with-gnutls" "--with-gssapi"
+                          "--disable-static")
       ;; Add a phase to patch '/bin/sh' occurances in tests/runtests.pl
       #:phases
       (modify-phases %standard-phases
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index ac1b23a327..d7b35834fe 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -153,7 +153,7 @@
        (modify-phases %standard-phases
          (add-after 'unpack 'generate-configure
            (lambda _
-             (zero? (system* "sh" "autogen.sh")))))))
+             (invoke "sh" "autogen.sh"))))))
     ;; http://www.4store.org has been down for a while now.
     (home-page "https://github.com/4store/4store")
     (synopsis "Clustered RDF storage and query engine")
@@ -164,14 +164,14 @@ either single machines or networked clusters.")
 (define-public gdbm
   (package
     (name "gdbm")
-    (version "1.14.1")
+    (version "1.18")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/gdbm/gdbm-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0pxwz3jlwvglq2mrbxvrjgr8pa0aj73p3v9sxmdlj570zw0gzknd"))))
+                "1kimnv12bzjjhaqk4c8w2j6chdj9c6bg21lchaf7abcyfss2r0mq"))))
     (arguments `(#:configure-flags '("--enable-libgdbm-compat")))
     (build-system gnu-build-system)
     (home-page "http://www.gnu.org.ua/software/gdbm")
@@ -207,14 +207,16 @@ and provides interfaces to the traditional file format.")
          (delete 'reset-gzip-timestamps)
          (add-before 'check 'start-mongodb
            (lambda* (#:key tests? #:allow-other-keys)
-             (or (not tests?)
-                 (with-directory-excursion "src/gopkg.in/mgo.v2"
-                   (invoke "make" "startdb")))))
+             (when tests?
+               (with-directory-excursion "src/gopkg.in/mgo.v2"
+                 (invoke "make" "startdb")))
+             #t))
          (add-after 'check 'stop'mongodb
            (lambda* (#:key tests? #:allow-other-keys)
-             (or (not tests?)
-                 (with-directory-excursion "src/gopkg.in/mgo.v2"
-                   (invoke "make" "stopdb"))))))))
+             (when tests?
+               (with-directory-excursion "src/gopkg.in/mgo.v2"
+                 (invoke "make" "stopdb")))
+             #t)))))
     (native-inputs
      `(("go-gopkg.in-check.v1" ,go-gopkg.in-check.v1)
        ("mongodb" ,mongodb)
@@ -511,28 +513,27 @@ applications.")
                (setenv "TZDIR"
                        (string-append (assoc-ref inputs "tzdata")
                                       "/share/zoneinfo"))
-               (or (not tests?)
-                   ;; Note that with the tests, especially the unittests, the
-                   ;; build can take up to ~45GB of space, as many tests are
-                   ;; individual executable files, with some being hundreds of
-                   ;; megabytes in size.
-                   (begin
-                     (apply
-                       invoke `("scons" ,@common-options "dbtest" "unittests"))
-                     (substitute* "build/unittests.txt"
-                       ;; TODO: Don't run the async_stream_test, as it hangs
-                       (("^build\\/opt\\/mongo\\/executor\\/async\\_stream\\_test\n$")
-                        "")
-                       ;; TODO: This test fails
-                       ;; Expected 0UL != disks.size() (0 != 0) @src/mongo/util/procparser_test.cpp:476
-                       (("^build\\/opt\\/mongo\\/util\\/procparser\\_test\n$")
-                        ""))
-                     (invoke "python" "buildscripts/resmoke.py"
-                             "--suites=dbtest,unittests"
-                             (format #f  "--jobs=~a" (parallel-job-count)))))))
+               (when tests?
+                 ;; Note that with the tests, especially the unittests, the
+                 ;; build can take up to ~45GB of space, as many tests are
+                 ;; individual executable files, with some being hundreds of
+                 ;; megabytes in size.
+                 (apply invoke `("scons" ,@common-options "dbtest" "unittests"))
+                 (substitute* "build/unittests.txt"
+                   ;; TODO: Don't run the async_stream_test, as it hangs
+                   (("^build\\/opt\\/mongo\\/executor\\/async\\_stream\\_test\n$")
+                    "")
+                   ;; TODO: This test fails
+                   ;; Expected 0UL != disks.size() (0 != 0) @src/mongo/util/procparser_test.cpp:476
+                   (("^build\\/opt\\/mongo\\/util\\/procparser\\_test\n$")
+                    ""))
+                 (invoke "python" "buildscripts/resmoke.py"
+                         "--suites=dbtest,unittests"
+                         (format #f  "--jobs=~a" (parallel-job-count))))
+               #t))
            (replace 'install
-             (lambda _
-               (let ((bin  (string-append (assoc-ref %outputs "out") "/bin")))
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
                  (install-file "mongod" bin)
                  (install-file "mongos" bin)
                  (install-file "mongo" bin))
@@ -620,7 +621,7 @@ Language.")
 (define-public mariadb
   (package
     (name "mariadb")
-    (version "10.1.35")
+    (version "10.1.37")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://downloads.mariadb.org/f/"
@@ -628,14 +629,20 @@ Language.")
                                   name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0k9walaglwmwdwmkq48ir17g98n83vliyyg5wck22rjgxn2xk4cy"))
-              (patches (search-patches "mariadb-gcc-ice.patch"
-                                       "mariadb-client-test-32bit.patch"))
+                "0ijdmdn9mcciwv361zfmja6b1h6qpbdqgrnnq6kkdapplyq1dmcc"))
+              (patches (search-patches "mariadb-client-test-32bit.patch"))
               (modules '((guix build utils)))
               (snippet
                '(begin
                   ;; Delete bundled snappy and xz.
                   (delete-file-recursively "storage/tokudb/PerconaFT/third_party")
+                  (substitute* "storage/tokudb/PerconaFT/CMakeLists.txt"
+                    ;; This file checks that the bundled sources are present and
+                    ;; declares build procedures for them.
+                    (("^include\\(TokuThirdParty\\)") ""))
+                  (substitute* "storage/tokudb/PerconaFT/ft/CMakeLists.txt"
+                    ;; Don't attempt to use the procedures we just removed.
+                    ((" build_lzma build_snappy") ""))
 
                   ;; Preserve CMakeLists.txt for these.
                   (for-each (lambda (file)
@@ -679,7 +686,7 @@ Language.")
          "-DINSTALL_SHAREDIR=share")
        #:phases
        (modify-phases %standard-phases
-         (add-after 'unpack 'unbundle
+         (add-after 'unpack 'fix-pcre-detection
            (lambda _
              ;; The bundled PCRE in MariaDB has a patch that was upstreamed
              ;; in version 8.34.  Unfortunately the upstream patch behaves
@@ -688,16 +695,6 @@ Language.")
              ;; XXX: Consider patching PCRE instead.
              (substitute* "cmake/pcre.cmake"
                ((" OR NOT PCRE_STACK_SIZE_OK") ""))
-
-             (substitute* "storage/tokudb/PerconaFT/ft/CMakeLists.txt"
-               ;; Remove dependency on these CMake targets.
-               ((" build_lzma build_snappy") ""))
-
-             (substitute* "storage/tokudb/PerconaFT/CMakeLists.txt"
-               ;; This file checks that the bundled sources are present and
-               ;; declares build procedures for them.  We don't need that.
-               (("^include\\(TokuThirdParty\\)") ""))
-
              #t))
          (add-after 'unpack 'adjust-tests
            (lambda _
@@ -707,6 +704,7 @@ Language.")
                       ;; See <https://jira.mariadb.org/browse/MDEV-7761>.
                       "main.join_cache"
                       "main.explain_non_select"
+                      "main.stat_tables_innodb"
                       "roles.acl_statistics"
 
                       ;; FIXME: This test fails on i686:
@@ -772,8 +770,8 @@ Language.")
                 (for-each delete-file-recursively
                           '("data" "mysql-test" "sql-bench"
                             "share/man/man1/mysql-test-run.pl.1"))
-                ;; Delete huge mysqltest executables.
-                (for-each delete-file (find-files "bin" "test"))
+                ;; Delete huge and unnecessary executables.
+                (for-each delete-file (find-files "bin" "(test|embedded)"))
                 ;; And static libraries.
                 (for-each delete-file (find-files "lib" "\\.a$")))
               #t))))))
@@ -785,11 +783,13 @@ Language.")
        ("libaio" ,libaio)
        ("libxml2" ,libxml2)
        ("ncurses" ,ncurses)
-       ("openssl" ,openssl)
        ("pcre" ,pcre)
        ("snappy" ,snappy)
        ("xz" ,xz)
        ("zlib" ,zlib)))
+    (propagated-inputs
+     ;; mariadb.pc says -lssl -lcrypto, so propagate it.
+     `(("openssl" ,openssl)))
     ;; The test suite is very resource intensive and can take more than three
     ;; hours on a x86_64 system.  Give slow and busy machines some leeway.
     (properties '((timeout . 64800)))        ;18 hours
@@ -923,7 +923,23 @@ organized in a hash table or B+ tree.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0cdwa4094x3yx7vn98xykvnlp9rngvd58d19vs3vh5hrvggccg93"))))
+                "0cdwa4094x3yx7vn98xykvnlp9rngvd58d19vs3vh5hrvggccg93"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  ;; Adjust the bundled gnulib to work with glibc 2.28.  See e.g.
+                  ;; "m4-gnulib-libio.patch".  This is a phase rather than patch
+                  ;; or snippet to work around <https://bugs.gnu.org/32347>.
+                  (substitute* (find-files "lib" "\\.c$")
+                    (("#if defined _IO_ftrylockfile")
+                     "#if defined _IO_EOF_SEEN"))
+                  (substitute* "lib/stdio-impl.h"
+                    (("^/\\* BSD stdio derived implementations")
+                     (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                                    "# define _IO_IN_BACKUP 0x100\n"
+                                    "#endif\n\n"
+                                    "/* BSD stdio derived implementations")))
+                  #t))))
     (build-system gnu-build-system)
 
     ;; Running tests in parallel leads to test failures and crashes in
@@ -973,15 +989,16 @@ types are supported, as is encryption.")
 (define-public rocksdb
   (package
     (name "rocksdb")
-    (version "5.12.4")
+    (version "5.15.10")
     (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/facebook/rocksdb"
-                                  "/archive/v" version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/facebook/rocksdb")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "1jcwgsjhk4hdfr2wf549blkgb89vwcdb5i2ahhqs6zf3mm20i3bf"))
+                "0q26frbj9pykarcfa0yxgwncxlvsqhjkby0jrbfs1a8srja688r4"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -1102,7 +1119,8 @@ data in a single database.  RocksDB is partially based on @code{LevelDB}.")
            (lambda _
              (substitute* "Makefile"
                (("^gitrev :=.*$")
-                (string-append "gitrev = \"v" ,version "\"")))))
+                (string-append "gitrev = \"v" ,version "\"")))
+             #t))
          ;; The install phase of the Makefile assumes $PREFIX/usr/local/bin.
          ;; This replacement does the same thing, except for using $PREFIX/bin
          ;; instead.
@@ -1111,14 +1129,13 @@ data in a single database.  RocksDB is partially based on @code{LevelDB}.")
              (let* ((out (assoc-ref outputs "out"))
                     (bin (string-append out "/bin")))
                (install-file "sparql-query" bin)
-               (system* "ln" "--symbolic"
-                        (string-append bin "/sparql-query")
-                        (string-append bin "/sparql-update")))))
+               (symlink (string-append bin "/sparql-query")
+                        (string-append bin "/sparql-update")))
+             #t))
          (replace 'check
            (lambda* (#:key make-flags #:allow-other-keys)
-             (and
-              (zero? (apply system* "make" `(,@make-flags "scan-test")))
-              (zero? (system "./scan-test"))))))))
+             (apply invoke "make" `(,@make-flags "scan-test"))
+             (invoke "./scan-test"))))))
     (home-page "https://github.com/tialaramex/sparql-query/")
     (synopsis "Command-line tool for accessing SPARQL endpoints over HTTP")
     (description "Sparql-query is a command-line tool for accessing SPARQL
@@ -1166,7 +1183,7 @@ changes.")
 (define-public sqlite
   (package
    (name "sqlite")
-   (version "3.23.0")
+   (version "3.24.0")
    (source (origin
             (method url-fetch)
             (uri (let ((numeric-version
@@ -1182,7 +1199,7 @@ changes.")
                                   numeric-version ".tar.gz")))
             (sha256
              (base32
-              "0jbf78g3cm5wq77k7sfg8fb6rz44hnp9hs7p5d66fwd000c1lwdp"))))
+              "0jmprv2vpggzhy7ma4ynmv1jzn3pfiwzkld0kkg6hvgvqs44xlfr"))))
    (build-system gnu-build-system)
    (inputs `(("readline" ,readline)))
    (arguments
@@ -1243,8 +1260,8 @@ is in the public domain.")
              (let ((out (assoc-ref outputs "out")))
                ;; The 'configure' script is a wrapper for Waf and
                ;; doesn't recognize things like '--enable-fast-install'.
-               (zero? (system* "./configure"
-                               (string-append "--prefix=" out)))))))))
+               (invoke "./configure"
+                       (string-append "--prefix=" out))))))))
     (native-inputs
      `(;; TODO: Build the documentation.
        ;; ("docbook-xsl" ,docbook-xsl)
@@ -1609,7 +1626,7 @@ valid SQL query.")
 (define-public unixodbc
   (package
    (name "unixodbc")
-   (version "2.3.6")
+   (version "2.3.7")
    (source (origin
             (method url-fetch)
             (uri
@@ -1617,7 +1634,7 @@ valid SQL query.")
               "ftp://ftp.unixodbc.org/pub/unixODBC/unixODBC-"
               version ".tar.gz"))
             (sha256
-             (base32 "0sads5b8cmmj526gyjba7ccknl1vbhkslfqshv1yqln08zv3gdl8"))))
+             (base32 "0xry3sg497wly8f7715a7gwkn2k36bcap0mvzjw74jj53yx6kwa5"))))
    (build-system gnu-build-system)
    (synopsis "Data source abstraction library")
    (description "Unixodbc is a library providing an API with which to access
@@ -1993,8 +2010,7 @@ can autogenerate peewee models using @code{pwiz}, a model generator.")
            (assoc-ref %standard-phases 'check))
          (replace 'check
            (lambda _
-             (zero?
-              (system* "./testfixture" "test/crypto.test")))))))
+             (invoke "./testfixture" "test/crypto.test"))))))
     (home-page "https://www.zetetic.net/sqlcipher/")
     (synopsis
      "Library providing transparent encryption of SQLite database files")
@@ -2250,9 +2266,6 @@ and web services platform functionality.")
      `(("pkg-config" ,pkg-config)))
     (inputs
      `(("mariadb" ,mariadb)
-       ;; FIXME: This should be propagated from MariaDB, but add it here
-       ;; for now to prevent a large rebuild.
-       ("openssl" ,openssl)
        ("zlib" ,zlib)))
     (propagated-inputs
      `(("r-dbi" ,r-dbi)))
@@ -2321,7 +2334,7 @@ Database API 2.0T.")
 (define-public python-sqlalchemy
   (package
     (name "python-sqlalchemy")
-    (version "1.0.12")
+    (version "1.2.11")
     (source
      (origin
       (method url-fetch)
@@ -2329,7 +2342,7 @@ Database API 2.0T.")
                           "SQLAlchemy/SQLAlchemy-" version ".tar.gz"))
       (sha256
        (base32
-        "1l8qclhd0s90w3pvwhi5mjxdwr5j7gw7cjka2fx6f2vqmq7f4yb6"))))
+        "094mmbs4igrxplfyqd59j90jb83ixpbbzqc0w49yw81m82nnjrgg"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-cython" ,python-cython) ;for c extensions
@@ -2339,7 +2352,7 @@ Database API 2.0T.")
      `(#:phases
        (modify-phases %standard-phases
          (replace 'check
-           (lambda _ (zero? (system* "py.test")))))))
+           (lambda _ (invoke "py.test"))))))
     (home-page "http://www.sqlalchemy.org")
     (synopsis "Database abstraction library")
     (description
@@ -2406,14 +2419,14 @@ You might also want to install the following optional dependencies:
 (define-public python-alembic
   (package
     (name "python-alembic")
-    (version "0.9.6")
+    (version "1.0.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "alembic" version))
        (sha256
         (base32
-         "0cm73vabrqj92v7a0wwvldj8j7bc7dwv358kvkk7p87gx7mm2a04"))))
+         "0asqz9mwc4w8bsar1icv3ik9jslxrj3gv3yxgmhc6nc6r9qbkg04"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-mock" ,python-mock)
@@ -2731,13 +2744,13 @@ reasonable substitute.")
 (define-public python-rq
   (package
     (name "python-rq")
-    (version "0.7.1")
+    (version "0.12.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "rq" version))
        (sha256
-        (base32 "0gaq5pnh0zy46r8jvygi0ifbvz3pq6i7xla78ijcgjw0x77qzsdh"))))
+        (base32 "16d8kni57xlnah2hawy4xgw21xrv3f64j5q5shyp3zxx4yd9iibs"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-click" ,python-click)
@@ -2792,7 +2805,7 @@ is designed to have a low barrier to entry.")
      `(#:phases
        (modify-phases %standard-phases
          (replace 'check
-           (lambda _ (zero? (system* "py.test")))))))
+           (lambda _ (invoke "py.test"))))))
     (native-inputs
      `(("python-pytest" ,python-pytest)))
     (home-page "https://github.com/andialbrecht/sqlparse")
@@ -2859,41 +2872,46 @@ transforms idiomatic python function calls to well-formed SQL queries.")
            (delete 'install-source)
            (replace 'build
              (lambda _
-               (every (lambda (tool)
-                        (let ((command
-                               `("go" "build"
-                                 ;; This is where the tests expect to find the
-                                 ;; executables
-                                 "-o" ,(string-append
-                                        "src/github.com/mongodb/mongo-tools/bin/"
-                                        tool)
-                                 "-v"
-                                 "-tags=\"ssl sasl\""
-                                 "-ldflags"
-                                 "-extldflags=-Wl,-z,now,-z,relro"
-                                 ,(string-append
-                                   "src/github.com/mongodb/mongo-tools/"
-                                   tool "/main/" tool ".go"))))
-                          (simple-format #t "build: running ~A\n"
-                                         (string-join command))
-                          (apply invoke command)))
-                      all-tools)))
+               (for-each (lambda (tool)
+                           (let ((command
+                                  `("go" "build"
+                                    ;; This is where the tests expect to find the
+                                    ;; executables
+                                    "-o" ,(string-append
+                                           "src/github.com/mongodb/mongo-tools/bin/"
+                                           tool)
+                                    "-v"
+                                    "-tags=\"ssl sasl\""
+                                    "-ldflags"
+                                    "-extldflags=-Wl,-z,now,-z,relro"
+                                    ,(string-append
+                                      "src/github.com/mongodb/mongo-tools/"
+                                      tool "/main/" tool ".go"))))
+                             (simple-format #t "build: running ~A\n"
+                                            (string-join command))
+                             (apply invoke command)))
+                         all-tools)
+               #t))
            (replace 'check
              (lambda _
                (with-directory-excursion "src"
-                 (every (lambda (tool)
-                          (invoke
-                           "go" "test" "-v"
-                           (string-append "github.com/mongodb/mongo-tools/" tool)))
-                        all-tools))))
+                 (for-each (lambda (tool)
+                             (invoke
+                              "go" "test" "-v"
+                              (string-append "github.com/mongodb/mongo-tools/"
+                                             tool)))
+                           all-tools))
+               #t))
            (replace 'install
              (lambda* (#:key outputs #:allow-other-keys)
                (for-each (lambda (tool)
                            (install-file
-                            (string-append "src/github.com/mongodb/mongo-tools/bin/" tool)
+                            (string-append "src/github.com/mongodb/mongo-tools/bin/"
+                                           tool)
                             (string-append (assoc-ref outputs "out")
                                            "/bin")))
-                         all-tools)))))))
+                         all-tools)
+               #t))))))
     (native-inputs
      `(("go-github.com-howeyc-gopass" ,go-github.com-howeyc-gopass)
        ("go-github.com-jessevdk-go-flags" ,go-github.com-jessevdk-go-flags)
diff --git a/gnu/packages/disk.scm b/gnu/packages/disk.scm
index 2158da6a81..4c4a3b849f 100644
--- a/gnu/packages/disk.scm
+++ b/gnu/packages/disk.scm
@@ -76,6 +76,7 @@
               (method url-fetch)
               (uri (string-append "mirror://gnu/parted/parted-"
                                   version ".tar.xz"))
+              (patches (search-patches "parted-glibc-compat.patch"))
               (sha256
                (base32
                 "1r3qpg3bhz37mgvp9chsaa3k0csby3vayfvz8ggsqz194af5i2w5"))))
diff --git a/gnu/packages/docbook.scm b/gnu/packages/docbook.scm
index 1c00e56d6d..1e5379b020 100644
--- a/gnu/packages/docbook.scm
+++ b/gnu/packages/docbook.scm
@@ -138,11 +138,15 @@ by no means limited to these applications.)  This package provides XML DTDs.")
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/docbook/docbook-xsl/"
                                   version "/docbook-xsl-" version ".tar.bz2"))
-              ;; Note: If removing all patches, the XZ dependency is no longer needed.
               (patches (search-patches "docbook-xsl-nonrecursive-string-subst.patch"))
               (sha256
                (base32
-                "0s59lihif2fr7rznckxr2kfyrvkirv76r1zvidp9b5mj28p4apvj"))))
+                "0s59lihif2fr7rznckxr2kfyrvkirv76r1zvidp9b5mj28p4apvj"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  (for-each delete-file (find-files "." "\\.jar$"))
+                  #t))))
     (build-system trivial-build-system)
     (arguments
      `(#:builder (let ((name-version (string-append ,name "-" ,version)))
@@ -168,7 +172,7 @@ by no means limited to these applications.)  This package provides XML DTDs.")
                      #t))
        #:modules ((guix build utils))))
     (native-inputs `(("bzip2" ,bzip2)
-                     ("xz" ,xz)
+                     ("xz" ,xz)         ;needed for repacked tarballs
                      ("tar" ,tar)))
     (home-page "http://docbook.org")
     (synopsis "DocBook XSL style sheets for document authoring")
diff --git a/gnu/packages/documentation.scm b/gnu/packages/documentation.scm
index f533535f03..9425df707c 100644
--- a/gnu/packages/documentation.scm
+++ b/gnu/packages/documentation.scm
@@ -139,23 +139,10 @@ markup) can be customized and extended by the user.")
        ("libxml2" ,libxml2) ; provides xmllint for the tests
        ("python" ,python-2))) ; for creating the documentation
     (inputs
-     `(("bash" ,bash-minimal)
-       ,@(if (string-prefix? "armhf-" (%current-system))
-             `(("gcc-ice-patch" ,@(search-patches "doxygen-gcc-ice.patch")))
-             '())))
+     `(("bash" ,bash-minimal)))
     (arguments
      `(#:test-target "tests"
        #:phases (modify-phases %standard-phases
-                  ;; Work around an ICE that shows up on native compiles for
-                  ;; armhf-linux.
-                  ,@(if (string-prefix? "armhf-" (%current-system))
-                        `((add-after 'unpack 'apply-gcc-patch
-                            (lambda* (#:key inputs #:allow-other-keys)
-                              (let ((patch (assoc-ref inputs "gcc-ice-patch")))
-                                (invoke "patch" "-p1" "--force"
-                                        "--input" patch)))))
-                        '())
-
                   (add-before 'configure 'patch-sh
                               (lambda* (#:key inputs #:allow-other-keys)
                                 (substitute* "src/portable.cpp"
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index bcd4eafa53..a845c312d6 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -1625,15 +1625,16 @@ filters, new key bindings and faces.  It can be enabled by
   (package
     (name "emacs-pdf-tools")
     (version "0.80")
+    (home-page "https://github.com/politza/pdf-tools")
     (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://github.com/politza/pdf-tools/archive/v"
-                    version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference (url home-page)
+                                  (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "06imydn3a92vr57azpn1zhqc14kxyyslmyi9ldsyphan9b724gb6"))))
+                "1i4647vax5na73basc5dz4lh9kprir00fh8ps4i0l1y3ippnjs2s"))
+              (patches (search-patches "emacs-pdf-tools-poppler.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ; there are no tests
@@ -1658,6 +1659,8 @@ filters, new key bindings and faces.  It can be enabled by
            (lambda _ (chdir "../lisp") #t))
          (add-after 'enter-lisp-dir 'emacs-patch-variables
            (lambda* (#:key outputs #:allow-other-keys)
+             (for-each make-file-writable (find-files "."))
+
              ;; Set path to epdfinfo program.
              (emacs-substitute-variables "pdf-info.el"
                ("pdf-info-epdfinfo-program"
@@ -1691,7 +1694,6 @@ filters, new key bindings and faces.  It can be enabled by
 files.  The key difference is that pages are not pre-rendered by
 e.g. ghostscript and stored in the file-system, but rather created on-demand
 and stored in memory.")
-    (home-page "https://github.com/politza/pdf-tools")
     (license license:gpl3+)))
 
 (define-public emacs-dash
diff --git a/gnu/packages/file.scm b/gnu/packages/file.scm
index 0473c519d5..78f0360c2e 100644
--- a/gnu/packages/file.scm
+++ b/gnu/packages/file.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,14 +29,14 @@
 (define-public file
   (package
     (name "file")
-    (version "5.32")
+    (version "5.33")
     (source (origin
               (method url-fetch)
               (uri (string-append "ftp://ftp.astron.com/pub/file/file-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0l1bfa0icng9vdwya00ff48fhvjazi5610ylbhl35qi13d6xqfc6"))))
+                "1iipnwjkag7q04zjkaqic41r9nlw0ml6mhqian6qkkbisb1whlhw"))))
    (build-system gnu-build-system)
 
    ;; When cross-compiling, this package depends upon a native install of
diff --git a/gnu/packages/finance.scm b/gnu/packages/finance.scm
index 40df25ef40..7d7c3ab111 100644
--- a/gnu/packages/finance.scm
+++ b/gnu/packages/finance.scm
@@ -165,6 +165,13 @@ line client and a client based on Qt.")
        #:make-flags (list "ARGS=-E BaselineTest_cmd-org")
        #:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'boost-compat
+           (lambda _
+             (substitute* "src/utils.h"
+               ;; This library moved in Boost 1.66.  Remove for Ledger
+               ;; versions > 3.1.1.
+               (("boost/uuid/sha1.hpp") "boost/uuid/detail/sha1.hpp"))
+             #t))
          (add-before 'configure 'install-examples
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((examples (string-append (assoc-ref outputs "out")
diff --git a/gnu/packages/flex.scm b/gnu/packages/flex.scm
index 29c5c92766..e08b0c13db 100644
--- a/gnu/packages/flex.scm
+++ b/gnu/packages/flex.scm
@@ -45,22 +45,10 @@
     (build-system gnu-build-system)
     (inputs
      (let ((bison-for-tests
-            ;; Work around an incompatibility with Bison 3.0:
-            ;; <http://lists.gnu.org/archive/html/bug-bison/2013-09/msg00014.html>.
             (package
               (inherit bison)
-              (version "2.7.1")
-              (source (origin
-                        (method url-fetch)
-                        (uri (string-append
-                              "mirror://gnu/bison/"
-                              "bison-" version ".tar.xz"))
-                        (sha256
-                         (base32
-                          "1yx7isx67sdmyijvihgyra1f59fwdz7sqriginvavfj5yb5ss2dl"))))
-
-              ;; Unlike Bison 3.0, this version did not need Flex for its
-              ;; tests, so it allows us to break the cycle.
+              ;; Disable tests, since they require flex.
+              (arguments '(#:tests? #f))
               (inputs (alist-delete "flex" (package-inputs bison))))))
        `(("bison" ,bison-for-tests)
          ("indent" ,indent))))
diff --git a/gnu/packages/fltk.scm b/gnu/packages/fltk.scm
index a3c088c2e8..972506c8c5 100644
--- a/gnu/packages/fltk.scm
+++ b/gnu/packages/fltk.scm
@@ -115,6 +115,12 @@ UI builder called FLUID that can be used to create applications in minutes.")
        #:configure-flags '("--enable-gl")
        #:phases
        (modify-phases %standard-phases
+         (add-before 'configure 'setup-waf
+          (lambda* (#:key inputs #:allow-other-keys)
+            (let ((waf (assoc-ref inputs "waf")))
+              (delete-file "waf")
+              (copy-file (string-append waf "/bin/waf") "waf"))
+            #t))
          (add-before 'configure 'set-ldflags
            (lambda* (#:key outputs #:allow-other-keys)
              (setenv "LDFLAGS"
@@ -123,7 +129,8 @@ UI builder called FLUID that can be used to create applications in minutes.")
              #t)))))
     (inputs
      `(("libjpeg" ,libjpeg)
-       ("glu" ,glu)))
+       ("glu" ,glu)
+       ("waf" ,python-waf)))
     ;; ntk.pc lists "x11" and "xft" in Requires.private, and "cairo" in
     ;; Requires.
     (propagated-inputs
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index 09ba9b7e4a..2ff42945d7 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -7,6 +7,7 @@
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017 Nils Gillmann <ng0@n0.is>
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -55,15 +56,18 @@
 (define-public freetype
   (package
    (name "freetype")
-   (version "2.9")
+   (version "2.9.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://savannah/freetype/freetype-"
                                 version ".tar.bz2"))
             (sha256 (base32
-                     "12jcdz1in20yaa55izxalg3hm1pf7nydfrzps5bzb4zgihybmzz6"))
-            (patches (search-patches "freetype-CVE-2018-6942.patch"))))
+                     "0kg8w6qyiizlyzh4a8lpzslipcbv96hcg3rqqpnxba8ffbm8g3fv"))))
    (build-system gnu-build-system)
+   (arguments
+    ;; The use of "freetype-config" is deprecated, but other packages still
+    ;; depend on it.
+    `(#:configure-flags (list "--enable-freetype-config")))
    (native-inputs
     `(("pkg-config" ,pkg-config)))
    (propagated-inputs
@@ -286,14 +290,14 @@ fonts to/from the WOFF2 format.")
 (define-public fontconfig
   (package
    (name "fontconfig")
-   (version "2.13.0")
+   (version "2.13.1")
    (source (origin
             (method url-fetch)
             (uri (string-append
                    "https://www.freedesktop.org/software/fontconfig/release/fontconfig-"
                    version ".tar.bz2"))
             (sha256 (base32
-                     "1fgf28zgsqh7x6dw30n6zi9z679gx6dyfyahp55z7dsm454yipci"))))
+                     "0hb700a68kk0ip51wdlnjjc682kvlrmb6q920mzajykdk0mdsmgn"))))
    (build-system gnu-build-system)
    ;; In Requires or Requires.private of fontconfig.pc.
    (propagated-inputs `(("expat" ,expat)
@@ -428,7 +432,7 @@ applications should be.")
 (define-public graphite2
   (package
    (name "graphite2")
-   (version "1.3.11")
+   (version "1.3.12")
    (source
      (origin
        (method url-fetch)
@@ -436,7 +440,7 @@ applications should be.")
                            "download/" version "/" name "-" version ".tgz"))
        (sha256
         (base32
-         "0z5dcgh8r3678awq6fb8igik7xmar5m6z9xxwpkkhradhk8jxfds"))))
+         "1l1940d8fz67jm6a0x8cjb5p2dv48cvz3wcskwa83hamd70k15fd"))))
    (build-system cmake-build-system)
    (native-inputs
     `(("python" ,python-2) ; because of "import imap" in tests
@@ -586,7 +590,10 @@ definitions.")
              ("libxml2"         ,libxml2)
              ("pango"           ,pango)
              ("potrace"         ,potrace)
-             ("python"          ,python-wrapper)
+             ;; FIXME: We use Python 2 here because there is a bug in Python
+             ;; 3.7 that is triggered when Py_Main is called after Py_Init, as
+             ;; is done by fontforge.  This will be fixed in Python 3.7.1.
+             ("python"          ,python-2)
              ("zlib"            ,zlib)))
    (arguments
     '(#:phases
diff --git a/gnu/packages/freedesktop.scm b/gnu/packages/freedesktop.scm
index 431cbd0c30..293916c4d2 100644
--- a/gnu/packages/freedesktop.scm
+++ b/gnu/packages/freedesktop.scm
@@ -146,14 +146,14 @@ freedesktop.org project.")
 (define-public libinput
   (package
     (name "libinput")
-    (version "1.11.3")
+    (version "1.12.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://freedesktop.org/software/libinput/"
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "01nb1shnl871d939wgfd7nc9svclcnfjfhlq64b4yns2dvcr24gk"))))
+                "14l6bvgq76ls63qc9c448r435q9xiig0rv8ilx6rnjvlgg64h32p"))))
     (build-system meson-build-system)
     (arguments
      `(#:configure-flags '("-Ddocumentation=false")))
@@ -435,14 +435,14 @@ Python.")
 (define-public wayland
   (package
     (name "wayland")
-    (version "1.15.0")
+    (version "1.16.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://wayland.freedesktop.org/releases/"
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1c5fnys8hi71cnzjv5k7j0r8gx80p0yyqlrpmn06mmarhnxvwgzb"))))
+                "1xajhxad43izq9f7sbww1hlg42nayijy8xnp21kgpk09c6sw4wjf"))))
     (build-system gnu-build-system)
     (arguments
      `(#:parallel-tests? #f))
diff --git a/gnu/packages/fribidi.scm b/gnu/packages/fribidi.scm
index 0368779240..dfd2a77c20 100644
--- a/gnu/packages/fribidi.scm
+++ b/gnu/packages/fribidi.scm
@@ -27,7 +27,7 @@
 (define-public fribidi
   (package
     (name "fribidi")
-    (version "1.0.2")
+    (version "1.0.5")
     (source
       (origin
         (method url-fetch)
@@ -36,11 +36,8 @@
                         "/download/v" version "/fribidi-" version
                          ".tar.bz2"))
         (sha256
-          (base32 "0aw3i1g96axbr96flw4543dvhb8zlgb0w8314ks6cq2g1i9invdx"))))
+          (base32 "1kp4b1hpx2ky20ixgy2xhj5iygfl7ps5k9kglh1z5i7mhykg4r3a"))))
     (build-system gnu-build-system)
-    (arguments
-     `(#:configure-flags
-       (list "--disable-docs")))        ; TODO: enable; requires c2man
     (synopsis "Implementation of the Unicode bidirectional algorithm")
     (description
      "GNU FriBidi is an implementation of the Unicode Bidirectional
diff --git a/gnu/packages/gcal.scm b/gnu/packages/gcal.scm
index 425fa1f9a8..32d3849faa 100644
--- a/gnu/packages/gcal.scm
+++ b/gnu/packages/gcal.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -32,7 +32,23 @@
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1av11zkfirbixn05hyq4xvilin0ncddfjqzc4zd9pviyp506rdci"))))
+               "1av11zkfirbixn05hyq4xvilin0ncddfjqzc4zd9pviyp506rdci"))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                 ;; Adjust the bundled gnulib to work with glibc 2.28.  See e.g.
+                 ;; "m4-gnulib-libio.patch".  This is a phase rather than patch
+                 ;; or snippet to work around <https://bugs.gnu.org/32347>.
+                 (substitute* (find-files "lib" "\\.c$")
+                   (("#if defined _IO_ftrylockfile")
+                    "#if defined _IO_EOF_SEEN"))
+                 (substitute* "lib/stdio-impl.h"
+                   (("^/\\* BSD stdio derived implementations")
+                    (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                                   "# define _IO_IN_BACKUP 0x100\n"
+                                   "#endif\n\n"
+                                   "/* BSD stdio derived implementations")))
+                 #t))))
     (build-system gnu-build-system)
     (home-page "https://www.gnu.org/software/gcal/")
     (synopsis "Calculating and printing a wide variety of calendars")
diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm
index 0dd5d64464..8207104174 100644
--- a/gnu/packages/gcc.scm
+++ b/gnu/packages/gcc.scm
@@ -398,6 +398,7 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "14l06m7nvcvb0igkbip58x59w3nq6315k6jcz3wr9ch1rn9d44bc"))
               (patches (search-patches "gcc-4.9-libsanitizer-fix.patch"
+                                       "gcc-4.9-libsanitizer-ustat.patch"
                                        "gcc-arm-bug-71399.patch"
                                        "gcc-asan-missing-include.patch"
                                        "gcc-libvtv-runpath.patch"
@@ -432,6 +433,7 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "11zd1hgzkli3b2v70qsm2hyqppngd4616qc96lmm9zl2kl9yl32k"))
               (patches (search-patches "gcc-arm-bug-71399.patch"
+                                       "gcc-libsanitizer-ustat.patch"
                                        "gcc-strmov-store-file-names.patch"
                                        "gcc-5.0-libvtv-runpath.patch"
                                        "gcc-5-source-date-epoch-1.patch"
@@ -452,7 +454,8 @@ Go.  It also includes runtime support libraries for these languages.")
                      "$OBJDUMP_FOR_TARGET -T"))
                   #t))))
     (inputs
-     `(("isl" ,isl)
+     `(;; GCC5 needs <isl/band.h> which is removed in later versions.
+       ("isl" ,isl-0.18)
        ,@(package-inputs gcc-4.7)))))
 
 (define-public gcc-6
@@ -467,6 +470,7 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "1m0lr7938lw5d773dkvwld90hjlcq2282517d1gwvrfzmwgg42w5"))
               (patches (search-patches "gcc-libsanitizer-fix.patch"
+                                       "gcc-libsanitizer-ustat.patch"
                                        "gcc-strmov-store-file-names.patch"
                                        "gcc-6-source-date-epoch-1.patch"
                                        "gcc-6-source-date-epoch-2.patch"
@@ -511,6 +515,7 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "0p71bij6bfhzyrs8676a8jmpjsfz392s2rg862sdnsk30jpacb43"))
               (patches (search-patches "gcc-strmov-store-file-names.patch"
+                                       "gcc-libsanitizer-ustat.patch"
                                        "gcc-5.0-libvtv-runpath.patch"))))
     (description
      "GCC is the GNU Compiler Collection.  It provides compiler front-ends
@@ -854,7 +859,7 @@ as the 'native-search-paths' field."
 (define-public isl
   (package
     (name "isl")
-    (version "0.18")
+    (version "0.19")
     (source (origin
              (method url-fetch)
              (uri (list (string-append
@@ -865,7 +870,7 @@ as the 'native-search-paths' field."
                                        name "-" version ".tar.gz")))
              (sha256
               (base32
-               "06ybml6llhi4i56q90jnimbcgk1lpcdwhy9nxdxra2hxz3bhz2vb"))))
+               "1n4yz9rj24mv226hqbpw210ifvqkn8dgvpnkzf0s0lkq9zrjd5ym"))))
     (build-system gnu-build-system)
     (inputs `(("gmp" ,gmp)))
     (home-page "http://isl.gforge.inria.fr/")
@@ -883,6 +888,20 @@ reduction, transitive closures on maps (which may encode infinite graphs),
 dependence analysis and bounds on piecewise step-polynomials.")
     (license lgpl2.1+)))
 
+(define-public isl-0.18
+  (package
+    (inherit isl)
+    (version "0.18")
+    (source (origin
+              (method url-fetch)
+              (uri (list (string-append "http://isl.gforge.inria.fr/isl-"
+                                        version ".tar.bz2")
+                         (string-append %gcc-infrastructure
+                                        "isl-" version ".tar.gz")))
+              (sha256
+               (base32
+                "06ybml6llhi4i56q90jnimbcgk1lpcdwhy9nxdxra2hxz3bhz2vb"))))))
+
 (define-public isl-0.11
   (package
     (inherit isl)
diff --git a/gnu/packages/gd.scm b/gnu/packages/gd.scm
index 327a1f1545..a53a4f2c2f 100644
--- a/gnu/packages/gd.scm
+++ b/gnu/packages/gd.scm
@@ -39,7 +39,6 @@
 (define-public gd
   (package
     (name "gd")
-    (replacement gd/fixed)
     ;; Note: With libgd.org now pointing to github.com, genuine old
     ;; tarballs are no longer available.  Notably, versions 2.0.x are
     ;; missing.
@@ -52,7 +51,10 @@
              (sha256
               (base32
                "0lfy5f241sbv8s3splm2zqiaxv7lxrcshh875xryryk7yk5jqc4c"))
-             (patches (search-patches "gd-fix-tests-on-i686.patch"
+
+             (patches (search-patches "gd-CVE-2018-5711.patch"
+                                      "gd-CVE-2018-1000222.patch"
+                                      "gd-fix-tests-on-i686.patch"
                                       "gd-freetype-test-failure.patch"))))
     (build-system gnu-build-system)
     (arguments
@@ -92,16 +94,6 @@ most common applications of GD involve website development.")
                            "See COPYING file in the distribution."))
     (properties '((cpe-name . "libgd")))))
 
-(define-public gd/fixed
-  (hidden-package
-    (package
-      (inherit gd)
-      (source (origin
-                (inherit (package-source gd))
-                (patches (append (origin-patches (package-source gd))
-                                 (search-patches "gd-CVE-2018-5711.patch"
-                                                 "gd-CVE-2018-1000222.patch"))))))))
-
 (define-public perl-gd
   (package
     (name "perl-gd")
@@ -150,7 +142,7 @@ you can create PNG images on the fly or modify existing files.")
      '(#:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'set-env
-           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1"))))))
+           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1") #t)))))
     (native-inputs
      `(("perl-module-build" ,perl-module-build)))
     (propagated-inputs
diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm
index 518e18397b..b46451d94e 100644
--- a/gnu/packages/ghostscript.scm
+++ b/gnu/packages/ghostscript.scm
@@ -4,7 +4,7 @@
 ;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2013, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
-;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
@@ -55,7 +55,7 @@
             (sha256 (base32
                      "083xisy6z01zhm7p7rgk4bx9d6zlr8l20qkfv1g29ylnhgwzvij8"))))
    (build-system gnu-build-system)
-   (inputs `(("libjpeg-8" ,libjpeg-8)
+   (inputs `(("libjpeg" ,libjpeg)
              ("libtiff" ,libtiff)
              ("zlib" ,zlib)))
    (synopsis "Little CMS, a small-footprint colour management engine")
@@ -135,8 +135,7 @@ printing, and psresize, for adjusting page sizes.")
 (define-public ghostscript
   (package
     (name "ghostscript")
-    (replacement ghostscript/fixed)
-    (version "9.23")
+    (version "9.24")
     (source
       (origin
         (method url-fetch)
@@ -146,8 +145,9 @@ printing, and psresize, for adjusting page sizes.")
                             "/ghostscript-" version ".tar.xz"))
         (sha256
          (base32
-          "1ng8d9fm5lza7k1f7ybc791275c07z5hcmpkrl2i226nshkxrkhz"))
-        (patches (search-patches "ghostscript-runpath.patch"
+          "1mk922rnml93w2g42yxiyn8xqanc50cm65irrgh0b6lp4kgifjfl"))
+        (patches (search-patches "ghostscript-CVE-2018-16509.patch"
+                                 "ghostscript-bug-699708.patch"
                                  "ghostscript-no-header-creationdate.patch"
                                  "ghostscript-no-header-id.patch"
                                  "ghostscript-no-header-uuid.patch"))
@@ -166,7 +166,9 @@ printing, and psresize, for adjusting page sizes.")
     (arguments
      `(#:disallowed-references ("doc")
        #:configure-flags
-       (list "--with-system-libtiff"
+       (list (string-append "LDFLAGS=-Wl,-rpath="
+                            (assoc-ref %outputs "out") "/lib")
+             "--with-system-libtiff"
              "LIBS=-lz"
              (string-append "ZLIBDIR="
                             (assoc-ref %build-inputs "zlib") "/include")
@@ -184,6 +186,12 @@ printing, and psresize, for adjusting page sizes.")
                    '()))
        #:phases
        (modify-phases %standard-phases
+        (add-before 'configure 'create-output-directory
+          (lambda* (#:key outputs #:allow-other-keys)
+            ;; The configure script refuses to function if the directory
+            ;; specified as -rpath does not already exist.
+            (mkdir-p (string-append (assoc-ref outputs "out") "/lib"))
+            #t))
         (add-after 'configure 'remove-doc-reference
           (lambda _
             ;; Don't retain a reference to the 'doc' output in 'gs'.
@@ -254,44 +262,6 @@ output file formats and printers.")
     (home-page "https://www.ghostscript.com/")
     (license license:agpl3+)))
 
-(define-public ghostscript/fixed
-  (hidden-package
-    (package
-      (inherit ghostscript)
-      (version "9.24")
-      (source
-        (origin
-          (inherit (package-source ghostscript))
-          (uri (string-append "https://github.com/ArtifexSoftware/"
-                              "ghostpdl-downloads/releases/download/gs"
-                              (string-delete #\. version)
-                              "/ghostscript-" version ".tar.xz"))
-          (sha256
-           (base32
-            "1mk922rnml93w2g42yxiyn8xqanc50cm65irrgh0b6lp4kgifjfl"))
-          (patches (search-patches "ghostscript-CVE-2018-16509.patch"
-                                   "ghostscript-bug-699708.patch"
-                                   "ghostscript-no-header-creationdate.patch"
-                                   "ghostscript-no-header-id.patch"
-                                   "ghostscript-no-header-uuid.patch"))))
-      (arguments
-       (substitute-keyword-arguments (package-arguments ghostscript)
-         ((#:configure-flags flags)
-          ;; Notice that we removed the 'ghostscript-runpath' patch above.
-          ;; The reason is that it conflicts with an upstream change that
-          ;; takes LDFLAGS into account.
-          `(cons (string-append "LDFLAGS=-Wl,-rpath="
-                                (assoc-ref %outputs "out") "/lib")
-                 ,flags))
-         ((#:phases phases)
-          `(modify-phases ,phases
-             (add-before 'configure 'create-output-directory
-               (lambda* (#:key outputs #:allow-other-keys)
-                 ;; Unfortunately the configure script refuses to function if
-                 ;; the directory specified as -rpath does not already exist.
-                 (mkdir-p (string-append (assoc-ref outputs "out") "/lib"))
-                 #t)))))))))
-
 (define-public ghostscript/x
   (package/inherit ghostscript
     (name (string-append (package-name ghostscript) "-with-x"))
diff --git a/gnu/packages/gl.scm b/gnu/packages/gl.scm
index 06c43a0483..d7c112928f 100644
--- a/gnu/packages/gl.scm
+++ b/gnu/packages/gl.scm
@@ -220,7 +220,7 @@ also known as DXTn or DXTC) for Mesa.")
 (define-public mesa
   (package
     (name "mesa")
-    (version "18.1.5")
+    (version "18.1.8")
     (source
       (origin
         (method url-fetch)
@@ -232,7 +232,7 @@ also known as DXTn or DXTC) for Mesa.")
                                   version "/mesa-" version ".tar.xz")))
         (sha256
          (base32
-          "1sldv7l3g6jfx0yn16kvxlik1qiy037lypdqpvsqc0v6lvqydnv9"))
+          "06y28hpynb8w1qagznr85ml48hf8264w4ji6cmvm2fy7x5zyc6xx"))
         (patches
          (search-patches "mesa-skip-disk-cache-test.patch"))))
     (build-system gnu-build-system)
@@ -248,7 +248,7 @@ also known as DXTn or DXTC) for Mesa.")
         ("xorgproto" ,xorgproto)))
     (inputs
       `(("expat" ,expat)
-        ("libelf" ,libelf)    ;required for r600 when using llvm
+        ("libelf" ,elfutils)  ;required for r600 when using llvm
         ("libva" ,(force libva-without-mesa))
         ("libxml2" ,libxml2)
         ;; TODO: Add 'libxml2-python' for OpenGL ES 1.1 and 2.0 support
diff --git a/gnu/packages/glib.scm b/gnu/packages/glib.scm
index 703cd3f74e..491f688c8e 100644
--- a/gnu/packages/glib.scm
+++ b/gnu/packages/glib.scm
@@ -80,7 +80,7 @@
 (define dbus
   (package
     (name "dbus")
-    (version "1.12.6")
+    (version "1.12.10")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -88,7 +88,7 @@
                     version ".tar.gz"))
               (sha256
                (base32
-                "05picaq8j60wlwyi84qvw5liw3nd0cws9va3krnc3pms0wm906v2"))
+                "1xywijmgfad4m3cxp0b4l6kvypwc53ckmhwwzbrc6n32jwj3ssab"))
               (patches (search-patches "dbus-helper-search-path.patch"))))
     (build-system gnu-build-system)
     (arguments
@@ -150,7 +150,7 @@ shared NFS home directories.")
 (define glib
   (package
    (name "glib")
-   (version "2.56.0")
+   (version "2.56.2")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/"
@@ -158,7 +158,7 @@ shared NFS home directories.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1iqgi90fmpl3l23jm2iv44qp7hqsxvnv7978s18933bvx4bnxvzc"))
+              "12d738n1wpvrn39zvy9xazg5h6vzyiwsw8z1qibcj09mh4bbsjnn"))
             (patches (search-patches "glib-tests-timer.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"           ; everything
@@ -303,14 +303,14 @@ dynamic loading, and an object system.")
 (define gobject-introspection
   (package
     (name "gobject-introspection")
-    (version "1.56.0")
+    (version "1.56.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/"
                    "gobject-introspection/" (version-major+minor version)
                    "/gobject-introspection-" version ".tar.xz"))
              (sha256
-              (base32 "1y50pbn5qqbcv2h9rkz96wvv5jls2gma9bkqjq6wapmaszx5jw0d"))
+              (base32 "0jx2kryjd7l0vl5gb3qp1qjfy3cjiizvcd1snsm7pzwrzz67aa2v"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -598,7 +598,7 @@ useful for C++.")
 (define-public python-pygobject
   (package
     (name "python-pygobject")
-    (version "3.28.2")
+    (version "3.28.3")
     (source
      (origin
        (method url-fetch)
@@ -607,7 +607,7 @@ useful for C++.")
                            "/pygobject-" version ".tar.xz"))
        (sha256
         (base32
-         "1jpjws4v17wv99lbhks0g0152w0f70mnwpdn8ibzzfgw2kykli5c"))))
+         "1c6h3brzlyvzbpdsammnd957azmp6cbzqrd65r400vnh2l8f5lrx"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 376cf5ad39..b497b965bc 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -124,6 +124,7 @@
   #:use-module (gnu packages ssh)
   #:use-module (gnu packages xml)
   #:use-module (gnu packages gl)
+  #:use-module (gnu packages graphviz)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages spice)
   #:use-module (gnu packages tex)
@@ -942,14 +943,14 @@ guidelines.")
 (define-public shared-mime-info
   (package
     (name "shared-mime-info")
-    (version "1.8")
+    (version "1.9")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://freedesktop.org/~hadess/"
                                  "shared-mime-info-" version ".tar.xz"))
              (sha256
               (base32
-               "1sc96lv9dp1lkvs8dh3ngm3hbjb274d363dl9avhb61il3qmxx9a"))))
+               "10ywzhzg8v1xmb9sz5xbqaci90id38knswigynyl33i29vn360aw"))))
     (build-system gnu-build-system)
     (arguments
      ;; The build system appears not to be parallel-safe.
@@ -1180,7 +1181,7 @@ XML/CSS rendering engine.")
 (define-public libgsf
   (package
     (name "libgsf")
-    (version "1.14.43")
+    (version "1.14.44")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -1188,7 +1189,7 @@ XML/CSS rendering engine.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "05pf3h0dha3s20ddsrljbx7m94qyiqs5igwxx1ql0vlsdlylx50j"))))
+                "1ppzfk3zmmgrg9jh8vc4dacddbfngjslq2wpj94pcr3i0c8dxgk8"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -1320,9 +1321,13 @@ functionality was designed to be as reusable and portable as possible.")
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
-       ;; The programmer kindly gives us a hook to turn off deprecation
-       ;; warnings ...
-       '("DISABLE_DEPRECATED_CFLAGS=-DGLIB_DISABLE_DEPRECATION_WARNINGS")
+       '(;; We don't need static libraries, plus they don't build reproducibly
+         ;; (non-deterministic ordering of .o files in the archive.)
+         "--disable-static"
+
+         ;; The programmer kindly gives us a hook to turn off deprecation
+         ;; warnings ...
+         "DISABLE_DEPRECATED_CFLAGS=-DGLIB_DISABLE_DEPRECATION_WARNINGS")
        ;; ... which they then completly ignore !!
        #:phases
        (modify-phases %standard-phases
@@ -1342,7 +1347,8 @@ featuring mature C, C++ and Python bindings.")
     ;; Licence notice is unclear.  The Web page simply say "GPL" without giving
     ;; a version.  SOME of the code files have licence notices for GPLv2+.
     ;; The tarball contains files of the text of GPLv2 and LGPLv2.
-    (license license:gpl2+)))
+    (license license:gpl2+)
+    (properties `((upstream-name . "ORBit2")))))
 
 
 (define-public libbonobo
@@ -1370,7 +1376,14 @@ featuring mature C, C++ and Python bindings.")
            (lambda _
              (substitute* "activation-server/Makefile.in"
                (("-DG_DISABLE_DEPRECATED") "-DGLIB_DISABLE_DEPRECATION_WARNINGS"))
-             #t)))))
+             #t)))
+
+       ;; There's apparently a race condition between the server stub
+       ;; generation and linking of the example under 'samples/echo' that can
+       ;; lead do undefined references when building in parallel, as reported
+       ;; at <https://forums.gentoo.org/viewtopic-t-223376-start-550.html>.
+       ;; Thus, disable parallel builds.
+       #:parallel-build? #f))
     (inputs `(("popt" ,popt)
               ("libxml2" ,libxml2)))
     ;; The following are Required by the .pc file
@@ -2038,7 +2051,7 @@ passwords in the GNOME keyring.")
 (define-public vala
   (package
     (name "vala")
-    (version "0.36.3")
+    (version "0.40.9")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -2046,7 +2059,7 @@ passwords in the GNOME keyring.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0706izk9prxqclm7gv4f63diwnlc1llvfl5sc9ghqbgn076lx2mc"))))
+                "0yvaijkpahzz26sa37cyzbj75a9vbcbgvxbqzzb7hbcvfy009zy7"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -2054,20 +2067,25 @@ passwords in the GNOME keyring.")
          (add-before 'check 'pre-check
                      (lambda _
                        (setenv "CC" "gcc")
+                       (substitute* "valadoc/tests/testrunner.sh"
+                         (("export PKG_CONFIG_PATH=" m)
+                          (string-append m "$PKG_CONFIG_PATH:")))
                        ;; For missing '/etc/machine-id'.
                        (setenv "DBUS_FATAL_WARNINGS" "0")
-                       #t)))
-       ;; Build the Vala API generator
-       #:configure-flags '("--enable-vapigen")))
+                       #t)))))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("flex" ,flex)
        ("bison" ,bison)
        ("xsltproc" ,libxslt)
+       ("grep" ,grep)
+       ("sed" ,sed)
        ("dbus" ,dbus)                                     ; for dbus tests
        ("gobject-introspection" ,gobject-introspection))) ; for gir tests
+    (inputs
+     `(("graphviz" ,graphviz)))
     (propagated-inputs
-     `(("glib" ,glib))) ; required by libvala-0.26.pc
+     `(("glib" ,glib))) ; required by libvala-0.40.pc
     (home-page "https://live.gnome.org/Vala/")
     (synopsis "Compiler for the GObject type system")
     (description
@@ -5860,7 +5878,7 @@ is complete it provides a graphical representation of each selected folder.")
 (define-public gnome-backgrounds
   (package
     (name "gnome-backgrounds")
-    (version "3.26.2")
+    (version "3.28.0")
     (source
      (origin
        (method url-fetch)
@@ -5869,8 +5887,8 @@ is complete it provides a graphical representation of each selected folder.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0kzrh5h0cfby3rhsy31d1w1c0rr3wcc845kv6zibqw1x8v9si2rs"))))
-    (build-system glib-or-gtk-build-system)
+         "1qgim0yhzjgcq172y4vp5hqz4rh1ak38a7pgi6s7dq0wklyrcnxj"))))
+    (build-system meson-build-system)
     (native-inputs
      `(("intltool" ,intltool)))
     (home-page "https://git.gnome.org/browse/gnome-backgrounds")
diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index 46ca812a13..53fdc8200c 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -75,7 +75,7 @@
 (define-public libgpg-error
   (package
     (name "libgpg-error")
-    (version "1.28")
+    (version "1.32")
     (source
      (origin
       (method url-fetch)
@@ -83,8 +83,7 @@
                           version ".tar.bz2"))
       (sha256
        (base32
-        "0jfsfnh9bxlxiwxws60yah4ybjw2hshmvqp31pri4m4h8ivrbnry"))
-      (patches (search-patches "libgpg-error-aarch64-logging-fix.patch"))))
+        "1jj08ns4sh1hmafqp1giskvdicdz18la516va26jycy27kkwaif3"))))
     (build-system gnu-build-system)
     (home-page "https://gnupg.org")
     (synopsis "Library of error values for GnuPG components")
@@ -97,32 +96,19 @@ Daemon and possibly more in the future.")
     (properties '((ftp-server . "ftp.gnupg.org")
                   (ftp-directory . "/gcrypt/libgpg-error")))))
 
-;; Some packages (e.g. GPGME) require a newer libgpg-error to deal with
-;; error codes from recent GnuPG.  Remove this in the next rebuild cycle.
-(define-public libgpg-error-1.31
-  (package
-    (inherit libgpg-error)
-    (version "1.31")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://gnupg/libgpg-error/libgpg-error-"
-                                  version ".tar.bz2"))
-              (sha256
-               (base32
-                "1vx4nw6rxh2biy3h8n96fyr86q29h8gjl6837437i51jr4isil20"))))))
-
 (define-public libgcrypt
   (package
-    (replacement libgcrypt/fixed)
     (name "libgcrypt")
-    (version "1.8.2")
+    (version "1.8.3")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnupg/libgcrypt/libgcrypt-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "01sca9m8hm6b5v8hmqsfdjhyz013869p1f0fxw9ln52qfnp4q1n8"))))
+               "0z5gs1khzyknyfjr19k8gk4q148s6q987ya85cpn0iv70fz91v36"))
+             (patches
+              (search-patches "libgcrypt-make-yat2m-reproducible.patch"))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("libgpg-error-host" ,libgpg-error)))
@@ -148,19 +134,6 @@ generation.")
     (properties '((ftp-server . "ftp.gnupg.org")
                   (ftp-directory . "/gcrypt/libgcrypt")))))
 
-(define libgcrypt/fixed
-  (package
-    (inherit libgcrypt)
-    (name "libgcrypt")
-    (version "1.8.3")
-    (source (origin
-             (method url-fetch)
-             (uri (string-append "mirror://gnupg/libgcrypt/libgcrypt-"
-                                 version ".tar.bz2"))
-             (sha256
-              (base32
-               "0z5gs1khzyknyfjr19k8gk4q148s6q987ya85cpn0iv70fz91v36"))))))
-
 (define-public libassuan
   (package
     (name "libassuan")
@@ -409,7 +382,7 @@ libskba (working with X.509 certificates and CMS data).")
      `(("gnupg" ,gnupg)))
     (propagated-inputs
      ;; Needs to be propagated because gpgme.h includes gpg-error.h.
-     `(("libgpg-error" ,libgpg-error-1.31)))
+     `(("libgpg-error" ,libgpg-error)))
     (inputs
      `(("libassuan" ,libassuan)))
     (home-page "https://www.gnupg.org/related_software/gpgme/")
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index e1abe8c2cd..d6b1f4c2d6 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -39,6 +39,7 @@
   #:use-module (gnu packages audio)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
+  #:use-module (gnu packages check)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gtk)
@@ -417,7 +418,12 @@ in the Mozilla clients.")
              (setenv "DOMSUF" "(none)")
              (setenv "USE_IP" "TRUE")
              (setenv "IP_ADDRESS" "127.0.0.1")
-             (invoke "./nss/tests/all.sh")))
+
+             ;; The "PayPalEE.cert" certificate expires every six months,
+             ;; leading to test failures:
+             ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>.  To
+             ;; work around that, set the time to roughly the release date.
+             (invoke "faketime" "2018-09-01" "./nss/tests/all.sh")))
            (replace 'install
              (lambda* (#:key outputs #:allow-other-keys)
                (let* ((out (assoc-ref outputs "out"))
@@ -453,7 +459,8 @@ in the Mozilla clients.")
      `(("sqlite" ,sqlite)
        ("zlib" ,zlib)))
     (propagated-inputs `(("nspr" ,nspr))) ; required by nss.pc.
-    (native-inputs `(("perl" ,perl)))
+    (native-inputs `(("perl" ,perl)
+                     ("libfaketime" ,libfaketime))) ;for tests
 
     ;; The NSS test suite takes around 48 hours on Loongson 3A (MIPS) when
     ;; another build is happening concurrently on the same machine.
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 38df23a6c1..60890bf724 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -280,6 +280,15 @@ in the style of communicating sequential processes (@dfn{CSP}).")
                     (string-append
                      "\"-Wl,-rpath=" gcclib "\", \"-lgcc_s\", ")))
 
+                 ;; XXX Commit 65fa2b615b72c1fa61a7 in the Go repo.  We do this
+                 ;; without a patch because ((guix packages) patch-and-repack)
+                 ;; resets file mtimes, and parts of Go's test suite rely on
+                 ;; those timestamps.
+                 ;; <https://github.com/golang/go/issues/26369>
+                 (substitute* "cmd/internal/objfile/elf.go"
+                   (("PT_LOAD")
+                     "PT_LOAD && p.Flags&elf.PF_X != 0"))
+
                  ;; Disable failing tests: these tests attempt to access
                  ;; commands or network resources which are neither available
                  ;; nor necessary for the build to succeed.
diff --git a/gnu/packages/graphics.scm b/gnu/packages/graphics.scm
index c3c1a4a580..6e184d3334 100644
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@@ -85,7 +85,8 @@
                                   "blender-" version ".tar.gz"))
               (sha256
                (base32
-                "1g4kcdqmf67srzhi3hkdnr4z1ph4h9sza1pahz38mrj998q4r52c"))))
+                "1g4kcdqmf67srzhi3hkdnr4z1ph4h9sza1pahz38mrj998q4r52c"))
+              (patches (search-patches "blender-newer-ffmpeg.patch"))))
     (build-system cmake-build-system)
     (arguments
       (let ((python-version (version-major+minor (package-version python))))
@@ -141,7 +142,7 @@
        ("libjpeg" ,libjpeg)
        ("libpng" ,libpng)
        ("libtiff" ,libtiff)
-       ("ffmpeg-2.8" ,ffmpeg-2.8) ;<https://lists.gnu.org/archive/html/guix-devel/2016-04/msg01019.html>
+       ("ffmpeg" ,ffmpeg)
        ("fftw" ,fftw)
        ("jack" ,jack-1)
        ("libsndfile" ,libsndfile)
diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm
index 435c3e5b3a..f43a0fc2f5 100644
--- a/gnu/packages/gstreamer.scm
+++ b/gnu/packages/gstreamer.scm
@@ -102,7 +102,7 @@ arrays of data.")
 (define-public gstreamer
   (package
     (name "gstreamer")
-    (version "1.14.2")
+    (version "1.14.3")
     (source
      (origin
       (method url-fetch)
@@ -111,7 +111,7 @@ arrays of data.")
             version ".tar.xz"))
       (sha256
        (base32
-        "029fi3v0vrravysgfwhfkrb3ndg64sjmigbb0iwr7wpkk5r15mjb"))))
+        "0mh4755an4gk0z3ygqhjpdjk0r2cwswbpwfgl0x6qmnln4757bhk"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -150,7 +150,7 @@ This package provides the core library and elements.")
 (define-public gst-plugins-base
   (package
     (name "gst-plugins-base")
-    (version "1.14.2")
+    (version "1.14.3")
     (source
      (origin
       (method url-fetch)
@@ -158,7 +158,7 @@ This package provides the core library and elements.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0z0wy0p0nxxqhsis3n517d6ykldm02g7rca9fhq9kxb9m05yidx4"))))
+        "0lkr1fm3bz21nqq9vi5v74mlxw6dd6i7piw00fhc5zz0dg1ikczh"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (propagated-inputs
@@ -209,7 +209,7 @@ for the GStreamer multimedia library.")
 (define-public gst-plugins-good
   (package
     (name "gst-plugins-good")
-    (version "1.14.2")
+    (version "1.14.3")
     (source
      (origin
       (method url-fetch)
@@ -218,7 +218,7 @@ for the GStreamer multimedia library.")
             name "-" version ".tar.xz"))
       (sha256
        (base32
-        "1bfa4n6xhr4v4wga8pv1y00rm1aka498snw6kgszy2w624l5wmy0"))))
+        "0pgzgfqbfp8lz2ns68797xfxdr0cr5rpi93wd1h2grhbmzkbq4ji"))))
     (build-system gnu-build-system)
     (inputs
      `(("aalib" ,aalib)
@@ -271,14 +271,14 @@ developers consider to have good quality code and correct functionality.")
 (define-public gst-plugins-bad
   (package
     (name "gst-plugins-bad")
-    (version "1.14.2")
+    (version "1.14.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gstreamer.freedesktop.org/src/"
                                   name "/" name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1bqy3dn7q4kdkd4lqznyly8fv854d0hhncv88jk6ai4rf3dbgyil"))))
+                "1mczcna91f3kkk3yv5fkfa8nmqdr9d93aq9z4d8sv18vkiflw8mj"))))
     (outputs '("out" "doc"))
     (build-system gnu-build-system)
     (arguments
@@ -346,7 +346,7 @@ par compared to the rest.")
 (define-public gst-plugins-ugly
   (package
     (name "gst-plugins-ugly")
-    (version "1.14.2")
+    (version "1.14.3")
     (source
      (origin
        (method url-fetch)
@@ -354,7 +354,7 @@ par compared to the rest.")
                            name "/" name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0s9xrz8knfv06fj1nbv3iq4xj7dj4cnzj3xvgb7zs89rv7crgq2m"))))
+         "01i31g5rvw36rjlyi9w24n0g1xa6053d14vaiba6vqpas727z123"))))
     (build-system gnu-build-system)
     (inputs
      `(("gst-plugins-base" ,gst-plugins-base)
@@ -381,7 +381,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
 (define-public gst-libav
   (package
     (name "gst-libav")
-    (version "1.14.2")
+    (version "1.14.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -389,7 +389,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1pknqpjxq1l3vlprdsmxxwk0lwqa555fqd543k9vphngqlwiqdca"))
+                "0xxnb80yhfa42x4wx1928zydaal35b2mcj0zdcdsv1apnjdm40wv"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -417,7 +417,7 @@ compression formats through the use of the libav library.")
 (define-public python-gst
   (package
     (name "python-gst")
-    (version "1.14.2")
+    (version "1.14.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -425,7 +425,7 @@ compression formats through the use of the libav library.")
                     "gst-python-" version ".tar.xz"))
               (sha256
                (base32
-                "08nb011acyvlz48fqh8c084k0dlssz9b7wha7zzk797inidbwh6w"))))
+                "01w3mpimbm8drifhrkvpns79h15kd9h9v0dynr7yb12kjrnfghsg"))))
     (build-system gnu-build-system)
     (arguments
      ;; XXX: Factorize python-sitedir with python-build-system.
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 0d62b80833..08f92df96c 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -8,7 +8,7 @@
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
 ;;; Copyright © 2015 David Hashe <david.hashe@dhashe.com>
-;;; Copyright © 2015, 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
+;;; Coypright © 2015, 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Fabian Harfert <fhmgufs@web.de>
 ;;; Copyright © 2016 Kei Kebreau <kkebreau@posteo.net>
@@ -113,15 +113,16 @@ tools have full access to view and control running applications.")
 (define-public cairo
   (package
    (name "cairo")
-   (version "1.14.10")
+   (version "1.14.12")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://cairographics.org/releases/cairo-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "02banr0wxckq62nbhc3mqidfdh2q956i2r7w2hd9bjgjb238g1vy"))
-            (patches (search-patches "cairo-CVE-2016-9082.patch"))))
+              "05mzyxkvsfc1annjw2dja8vka01ampp9pp93lg09j8hba06g144c"))
+            (patches (search-patches "cairo-CVE-2016-9082.patch"
+                                     "cairo-setjmp-wrapper.patch"))))
    (build-system gnu-build-system)
    (propagated-inputs
     `(("fontconfig" ,fontconfig)
@@ -179,7 +180,7 @@ affine transformation (scale, rotation, shear, etc.).")
 (define-public harfbuzz
   (package
    (name "harfbuzz")
-   (version "1.7.6")
+   (version "1.8.8")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://www.freedesktop.org/software/"
@@ -187,7 +188,7 @@ affine transformation (scale, rotation, shear, etc.).")
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "16rf7qwgy1gza74v2ws79zdwwb1lpvgz2abwwm8ws9j82cwysyys"))))
+               "1ag3scnm1fcviqgx2p4858y433mr0ndqw6zccnccrqcr9mpcird8"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "bin")) ; 160K, only hb-view depend on cairo
@@ -218,8 +219,7 @@ affine transformation (scale, rotation, shear, etc.).")
 (define-public pango
   (package
    (name "pango")
-   (version "1.42.0")
-   (replacement pango-1.42.4)
+   (version "1.42.4")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/pango/"
@@ -227,18 +227,18 @@ affine transformation (scale, rotation, shear, etc.).")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0illn78nfwpa8y5knh9ir74wa1skc2hi8f3ny19zgpyf7n5dh94r"))))
+              "17bwb7dgbncrfsmchlib03k9n3xaalirb39g3yb43gg8cg6p8aqx"))))
    (build-system gnu-build-system)
    (propagated-inputs
     ;; These are all in Requires or Requires.private of the '.pc' files.
     `(("cairo" ,cairo)
+      ("fribidi" ,fribidi)
       ("fontconfig" ,fontconfig)
       ("freetype" ,freetype)
       ("glib" ,glib)
       ("harfbuzz" ,harfbuzz)))
    (inputs
-    `(("fribidi" ,fribidi)
-      ("zlib" ,zlib)
+    `(("zlib" ,zlib)
 
       ;; Some packages, such as Openbox, expect Pango to be built with the
       ;; optional libxft support.
@@ -255,19 +255,6 @@ used throughout the world.")
    (license license:lgpl2.0+)
    (home-page "https://developer.gnome.org/pango/")))
 
-(define-public pango-1.42.4
-  (package
-    (inherit pango)
-    (version "1.42.4")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://gnome/sources/pango/"
-                                  (version-major+minor version) "/"
-                                  "pango-" version ".tar.xz"))
-              (sha256
-               (base32
-                "17bwb7dgbncrfsmchlib03k9n3xaalirb39g3yb43gg8cg6p8aqx"))))))
-
 (define-public pangox-compat
   (package
     (name "pangox-compat")
@@ -318,6 +305,7 @@ functions which were removed.")
                      (string-append "-Wl,-rpath="
                                     (assoc-ref outputs "out") "/lib"))
              #t)))
+       #:python ,python-2 ;XXX: The bundled waf fails with Python 3.7.0.
        #:tests? #f)) ; no check target
     (inputs
      `(("gtk" ,gtk+-2)
@@ -457,7 +445,7 @@ highlighting and other features typical of a source code editor.")
 (define-public gdk-pixbuf
   (package
    (name "gdk-pixbuf")
-   (version "2.36.12")
+   (version "2.38.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -465,26 +453,39 @@ highlighting and other features typical of a source code editor.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0d534ysa6n9prd17wwzisq7mj6qkhwh8wcf8qgin1ar3hbs5ry7z"))))
-   (build-system gnu-build-system)
+              "0ixfmnxjylx06mjaw116apymwi1a8rnkmkbbvqaxxg2pfwy9fl6x"))))
+   (build-system meson-build-system)
    (arguments
-    '(#:configure-flags '("--with-x11")
+    '(#:configure-flags '("-Dinstalled-tests=false")
       #:phases
       (modify-phases %standard-phases
         (add-after
          'unpack 'disable-failing-tests
          (lambda _
-           (substitute* "tests/Makefile.in"
+           (substitute* "tests/meson.build"
              ;; XXX FIXME: This test fails on armhf machines with:
              ;; SKIP Not enough memory to load bitmap image
              ;; ERROR: cve-2015-4491 - too few tests run (expected 4, got 2)
-             (("cve-2015-4491\\$\\(EXEEXT\\) ") "")
+             ((".*'cve-2015-4491'.*") "")
              ;; XXX FIXME: This test fails with:
              ;; ERROR:pixbuf-jpeg.c:74:test_type9_rotation_exif_tag:
              ;; assertion failed (error == NULL): Data differ
              ;; (gdk-pixbuf-error-quark, 0)
-             (("pixbuf-jpeg\\$\\(EXEEXT\\) ") ""))
-           #t)))))
+             ((".*'pixbuf-jpeg'.*") "")
+             ;; Extend the timeout of the test suite.
+             ;; TODO: Check upstreaming effort:
+             ;; https://gitlab.gnome.org/GNOME/gdk-pixbuf/merge_requests/21
+             (("300") "1800"))
+           #t))
+        (add-before 'configure 'aid-install-script
+          (lambda* (#:key outputs #:allow-other-keys)
+            ;; "build-aux/post-install.sh" invokes `gdk-pixbuf-query-loaders`
+            ;; for updating loader.cache, but it's not on PATH.  Make it use
+            ;; the one we're installing.  XXX: Won't work when cross-compiling.
+            (substitute* "build-aux/post-install.sh"
+              (("gdk-pixbuf-query-loaders" match)
+               (string-append (assoc-ref outputs "out") "/bin/" match)))
+            #t)))))
    (propagated-inputs
     `(;; Required by gdk-pixbuf-2.0.pc
       ("glib" ,glib)
@@ -497,6 +498,7 @@ highlighting and other features typical of a source code editor.")
       ("libx11"  ,libx11)))
    (native-inputs
      `(("pkg-config" ,pkg-config)
+       ("gettext" ,gettext-minimal)
        ("glib" ,glib "bin")                               ; glib-mkenums, etc.
        ("gobject-introspection" ,gobject-introspection))) ; g-ir-compiler, etc.
    (synopsis "GNOME image loading and manipulation library")
@@ -516,7 +518,7 @@ in the GNOME project.")
      `(("librsvg" ,librsvg)
        ,@(package-inputs gdk-pixbuf)))
     (arguments
-     '(#:configure-flags '("--with-x11")
+     '(#:configure-flags '("-Dinstalled-tests=false")
        #:tests? #f ; tested by the gdk-pixbuf package already
        #:phases
        (modify-phases %standard-phases
@@ -585,7 +587,7 @@ is part of the GNOME accessibility project.")
 (define-public at-spi2-atk
   (package
    (name "at-spi2-atk")
-   (version "2.26.1")
+   (version "2.26.2")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -593,7 +595,7 @@ is part of the GNOME accessibility project.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0x9vc99ni46fg5dzlx67vbw0zqffr24gz8jvbdxbmzyvc5xw5w5l"))))
+              "0vkan52ab9vrkknnv8y4f1cspk8x7xd10qx92xk9ys71p851z2b1"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases
@@ -686,7 +688,7 @@ application suites.")
    (name "gtk+")
    ;; NOTE: When updating the version of 'gtk+', the hash of 'mate-themes' in
    ;;       mate.scm will also need to be updated.
-   (version "3.22.30")
+   (version "3.24.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -694,7 +696,7 @@ application suites.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0rv5k8fyi2i19k4zncai6vf429s6zy3kncr8vb6f3m034z0sb951"))
+              "1a1jbsh9fg5ykmwrcl3svy7xfvx0b87d314qsx9n483pj8w93s82"))
             (patches (search-patches "gtk3-respect-GUIX_GTK3_PATH.patch"
                                      "gtk3-respect-GUIX_GTK3_IM_MODULE_FILE.patch"))))
    (outputs '("out" "bin" "doc"))
@@ -730,9 +732,9 @@ application suites.")
       ("python-wrapper" ,python-wrapper)
       ;; By using a special xorg-server for GTK+'s tests, we reduce the impact
       ;; of updating xorg-server directly on the master branch.
-      ("xorg-server" ,xorg-server-1.19.3)))
+      ("xorg-server" ,xorg-server-for-tests)))
    (arguments
-    `(#:disallowed-references (,xorg-server-1.19.3)
+    `(#:disallowed-references (,xorg-server-for-tests)
       ;; 47 MiB goes to "out" (24 of which is locale data!), and 26 MiB goes
       ;; to "doc".
       #:configure-flags (list (string-append "--with-html-dir="
@@ -1061,7 +1063,7 @@ toolkit.")
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)
                      ("glib" ,glib "bin")        ;for 'glib-compile-resources'
-                     ("xorg-server" ,xorg-server-1.19.3)))
+                     ("xorg-server" ,xorg-server-for-tests)))
     (propagated-inputs
      `(("pangomm" ,pangomm)
        ("cairomm" ,cairomm)
@@ -1072,7 +1074,7 @@ toolkit.")
      `(;; XXX: Tests require C++14 or later.  Remove this when the default
        ;; compiler is >= GCC6.
        #:configure-flags '("CXXFLAGS=-std=gnu++14")
-       #:disallowed-references (,xorg-server-1.19.3)
+       #:disallowed-references (,xorg-server-for-tests)
        #:phases (modify-phases %standard-phases
                   (add-before 'check 'run-xvfb
                     (lambda* (#:key inputs #:allow-other-keys)
@@ -1153,7 +1155,7 @@ printing and other features typical of a source code editor.")
 (define-public python-pycairo
   (package
     (name "python-pycairo")
-    (version "1.16.3")
+    (version "1.17.1")
     (source
      (origin
       (method url-fetch)
@@ -1161,7 +1163,7 @@ printing and other features typical of a source code editor.")
                           version "/pycairo-" version ".tar.gz"))
       (sha256
        (base32
-        "1xq1bwhyi5imca5kvd28szh2rdzi8g0kaspwaqgsbczqskjj3csv"))))
+        "165n0g7gp2a0qi8558snvfans17x83jv2lv7bx4vr1rxjbn3a2hg"))))
     (build-system python-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -1356,7 +1358,7 @@ and routines to assist in editing internationalized text.")
                      ("check" ,check)
                      ("gettext" ,gettext-minimal)
                      ("glib:bin" ,glib "bin")
-                     ("xorg-server" ,xorg-server-1.19.3)))
+                     ("xorg-server" ,xorg-server-for-tests)))
     ;; Listed in 'Requires.private' of 'girara.pc'.
     (propagated-inputs `(("gtk+" ,gtk+)))
     (arguments
diff --git a/gnu/packages/guile-wm.scm b/gnu/packages/guile-wm.scm
index 364477be72..3755282403 100644
--- a/gnu/packages/guile-wm.scm
+++ b/gnu/packages/guile-wm.scm
@@ -56,7 +56,7 @@
                                            (string-append
                                             "--with-guile-site-ccache-dir="
                                             (assoc-ref %outputs "out")
-                                            "/share/guile/site/2.2"))))
+                                            "/lib/guile/2.2/site-ccache"))))
       (native-inputs `(("pkg-config" ,pkg-config)
                        ("texinfo" ,texinfo)))
       (inputs `(("guile" ,guile-2.2)
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 7fcb4a400c..c271c4b6a0 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -214,8 +214,7 @@ without requiring the source code to be rewritten.")
            (files '("share/guile/site/2.0")))
           (search-path-specification
            (variable "GUILE_LOAD_COMPILED_PATH")
-           (files '("lib/guile/2.0/site-ccache"
-                    "share/guile/site/2.0")))))
+           (files '("lib/guile/2.0/site-ccache")))))
 
    (synopsis "Scheme implementation intended especially for extensions")
    (description
@@ -244,7 +243,7 @@ without requiring the source code to be rewritten.")
 (define-public guile-2.2
   (package (inherit guile-2.0)
     (name "guile")
-    (version "2.2.3")
+    (version "2.2.4")
     (source (origin
               (method url-fetch)
 
@@ -254,7 +253,7 @@ without requiring the source code to be rewritten.")
                                   ".tar.xz"))
               (sha256
                (base32
-                "11j01agvnci2cx32wwpqs9078856yxmvs15gcsz7ganpkj2ahlw3"))
+                "07p3g0v2ba2vlfbfidqzlgbhnzdx46wh2rgc5gszq1mjyx5bks6r"))
               (modules '((guix build utils)))
 
               ;; Remove the pre-built object files.  Instead, build everything
@@ -273,8 +272,7 @@ without requiring the source code to be rewritten.")
             (files '("share/guile/site/2.2")))
            (search-path-specification
             (variable "GUILE_LOAD_COMPILED_PATH")
-            (files '("lib/guile/2.2/site-ccache"
-                     "share/guile/site/2.2")))))
+            (files '("lib/guile/2.2/site-ccache")))))
 
     (arguments
      (if (%current-target-system)
@@ -303,35 +301,6 @@ without requiring the source code to be rewritten.")
                   (max-silent-time . 36000))))) ;10 hours (needed on ARM
                                                 ;  when heavily loaded)
 
-(define-public guile-2.2.2
-  ;; Keep it so that, when 'guix' runs on 2.2.2, 'guix pull' compiles objects
-  ;; with 2.2.2, thereby avoiding the ABI incompatibility issues described in
-  ;; <https://bugs.gnu.org/29570>.
-  (package
-    (inherit guile-2.2)
-    (version "2.2.2")
-    (source (origin
-              (inherit (package-source guile-2.2))
-              (uri (string-append "mirror://gnu/guile/guile-" version
-                                  ".tar.xz"))
-              (sha256
-               (base32
-                "1azm25zcmxif0skxfrp11d2wc89nrzpjaann9yxdw6pvjxhs948w"))))))
-
-(define-public guile-2.2.4
-  ;; This version contains important bug fixes, in particular wrt. to crashes
-  ;; of multi-threaded code as used by 'guix pull' and grafting.
-  (package
-    (inherit guile-2.2)
-    (version "2.2.4")
-    (source (origin
-              (inherit (package-source guile-2.2))
-              (uri (string-append "mirror://gnu/guile/guile-" version
-                                  ".tar.xz"))
-              (sha256
-               (base32
-                "07p3g0v2ba2vlfbfidqzlgbhnzdx46wh2rgc5gszq1mjyx5bks6r"))))))
-
 (define-public guile-next
   ;; This is the upcoming Guile 3.0, with JIT support.
   (let ((commit "6f3357b0df64c4be17e72079864c09a542f1c779")
@@ -1633,7 +1602,7 @@ you send to a FIFO file.")
 (define-public guile-commonmark
   (package
     (name "guile-commonmark")
-    (version "0.1")
+    (version "0.1.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/OrangeShark/" name
@@ -1641,24 +1610,12 @@ you send to a FIFO file.")
                                   "/" name "-" version ".tar.gz"))
               (sha256
                (base32
-                "12cb5fqvvgc87f5xp0ih5az305wnjia89l5jba83d0r2p8bfy0b0"))
-              (modules '((guix build utils)))
-              (snippet
-               ;; Use the real effective version of Guile in directory names
-               ;; instead of a hard-coded "/2.0".
-               '(begin
-                  (substitute* "configure"
-                    (("ac_subst_vars='")
-                     "ac_subst_vars='GUILE_EFFECTIVE_VERSION\n"))
-                  (substitute* "Makefile.in"
-                    (("moddir =.*")
-                     "moddir = $(datadir)/guile/site/@GUILE_EFFECTIVE_VERSION@\n")
-                    (("godir =.*")
-                     "godir = $(libdir)/guile/@GUILE_EFFECTIVE_VERSION@/site-ccache\n"))
-                  #t))))
+                "0kzclwkfijj8xka3g9kfj53y67c34ndfy84swdbw3j7y962ndxq6"))))
     (build-system gnu-build-system)
     (inputs
      `(("guile" ,guile-2.2)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
     (synopsis "CommonMark parser for Guile")
     (description
      "guile-commonmark is a library for parsing CommonMark, a fully specified
@@ -2292,7 +2249,7 @@ tracker's SOAP service, such as @url{https://bugs.gnu.org}.")
          ("autoconf" ,autoconf)
          ("automake" ,automake)))
       (inputs
-       `(("guile" ,guile-2.2.4)))
+       `(("guile" ,guile-2.2)))
       (home-page "https://git.systemreboot.net/guile-email")
       (synopsis "Guile email parser")
       (description "This package provides an email parser written in pure
@@ -2321,7 +2278,7 @@ Guile.")
          ("automake" ,automake)
          ("texinfo" ,texinfo)))
       (inputs
-       `(("guile" ,guile-2.2.4)
+       `(("guile" ,guile-2.2)
          ("guile-email" ,guile-email))))))
 
 ;; There has not been any release yet.
diff --git a/gnu/packages/haskell.scm b/gnu/packages/haskell.scm
index 0a90ac523c..57435dca07 100644
--- a/gnu/packages/haskell.scm
+++ b/gnu/packages/haskell.scm
@@ -10619,6 +10619,7 @@ expose it from another module in the hierarchy.
            (lambda* (#:key outputs inputs tests? (configure-flags '())
                      #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))
+                    (name-version (strip-store-file-name out))
                     (input-dirs (match inputs
                                   (((_ . dir) ...)
                                    dir)
@@ -10629,8 +10630,7 @@ expose it from another module in the hierarchy.
                                     `(,(string-append "--bindir=" out "/bin"))
                                     `(,(string-append
                                         "--docdir=" out
-                                        "/share/doc/" ((@@ (guix build haskell-build-system)
-                                                           package-name-version) out)))
+                                        "/share/doc/" name-version))
                                     '("--libsubdir=$compiler/$pkg-$version")
                                     '("--package-db=../package.conf.d")
                                     '("--global")
diff --git a/gnu/packages/hurd.scm b/gnu/packages/hurd.scm
index d6c1fb5e64..938cb116ca 100644
--- a/gnu/packages/hurd.scm
+++ b/gnu/packages/hurd.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014, 2015, 2016, 2017 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
+;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,17 +25,25 @@
   #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system trivial)
+  #:use-module (gnu packages autotools)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages bison)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages base)
   #:use-module (guix git-download)
-  #:export (hurd-triplet?))
+  #:export (hurd-triplet?
+            hurd-target?))
 
 (define (hurd-triplet? triplet)
   (and (string-suffix? "-gnu" triplet)
        (not (string-contains triplet "linux"))))
 
+(define (hurd-target?)
+  "Return true if the cross-compilation target or the current system is
+GNU/Hurd."
+  (or (and=> (%current-target-system) hurd-triplet?)
+      (string-suffix? (%current-system) "-gnu")))
+
 (define (gnumach-source-url version)
   (string-append "mirror://gnu/gnumach/gnumach-"
                  version ".tar.gz"))
@@ -43,6 +52,10 @@
   (string-append "mirror://gnu/hurd/hurd-"
                  version ".tar.gz"))
 
+(define (patch-url repository commit)
+  (string-append "https://git.savannah.gnu.org/cgit/hurd/" repository
+                 ".git/patch/?id=" commit))
+
 (define-public gnumach-headers
   (package
     (name "gnumach-headers")
@@ -53,7 +66,24 @@
       (uri (gnumach-source-url version))
       (sha256
        (base32
-        "02hygsfpd2dljl5lg1vjjg9pizi9jyxd4aiiqzjshz6jax62jm9f"))))
+        "02hygsfpd2dljl5lg1vjjg9pizi9jyxd4aiiqzjshz6jax62jm9f"))
+      (patches (list (origin
+                       ;; This patch adds <mach/vm_wire.h>, which defines the
+                       ;; VM_WIRE_* constants needed by glibc 2.28.
+                       (method url-fetch)
+                       (uri (patch-url "gnumach" "2b0f19f602e08fd9d37268233b962674fd592634"))
+                       (sha256
+                        (base32
+                         "01iajnwsmka0w9hwjkxxijc4xfhwqbvlkw1w8n71hpnhfixd0y28"))
+                       (file-name "gnumach-vm-wire-header.patch"))))
+      (modules '((guix build utils)))
+      (snippet
+       '(begin
+          ;; Actually install vm_wire.h.
+          (substitute* "Makefile.in"
+            (("^include_mach_HEADERS =")
+             "include_mach_HEADERS = include/mach/vm_wire.h"))
+          #t))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -110,56 +140,71 @@ communication.")
     (license gpl2+)))
 
 (define-public hurd-headers
-  (package
-    (name "hurd-headers")
-    (version "0.9")
-    (source (origin
-              (method url-fetch)
-              (uri (hurd-source-url version))
-              (sha256
-               (base32
-                "1nw9gly0n7pyv3cpfm4mmxy4yccrx4g0lyrvd3vk2vil26jpbggw"))))
-    (build-system gnu-build-system)
-    (native-inputs
-     `(("mig" ,mig)))
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (replace 'install
-           (lambda _
-             (invoke "make" "install-headers" "no_deps=t")))
-         (delete 'build))
+  ;; Resort to a post-0.9 snapshot that provides the 'file_utimens' and
+  ;; 'file_exec_paths' RPCs that glibc 2.28 expects.
+  (let ((revision "0")
+        (commit "98b33905c89b7e5c309c74ae32302a5745901a6e"))
+   (package
+     (name "hurd-headers")
+     (version "0.9")
+     (source (origin
+               (method git-fetch)
+               (uri (git-reference
+                     (url "https://git.savannah.gnu.org/git/hurd/hurd.git")
+                     (commit commit)))
+               (sha256
+                (base32
+                 "1mj22sxgscas2675vrbxr477mwbxdj68pqcrh65lbir8qlssrgrf"))
+               (file-name (git-file-name name version))))
+     (build-system gnu-build-system)
+     (native-inputs
+      `(("mig" ,mig)
+        ("autoconf" ,autoconf)
+        ("automake" ,automake)))
+     (arguments
+      `(#:phases
+        (modify-phases %standard-phases
+          (replace 'install
+            (lambda _
+              (invoke "make" "install-headers" "no_deps=t")))
+          (delete 'build))
 
-       #:configure-flags '(;; Pretend we're on GNU/Hurd; 'configure' wants
-                           ;; that.
-                           ,@(if (%current-target-system)
-                                 '()
-                                 '("--host=i586-pc-gnu"))
+        #:configure-flags '( ;; Pretend we're on GNU/Hurd; 'configure' wants
+                            ;; that.
+                            ,@(if (%current-target-system)
+                                  '()
+                                  '("--host=i586-pc-gnu"))
 
-                           ;; Reduce set of dependencies.
-                           "--without-parted"
-                           "--disable-ncursesw"
-                           "--disable-test"
-                           "--without-libbz2"
-                           "--without-libz"
-                           ;; Skip the clnt_create check because it expects
-                           ;; a working glibc causing a circular dependency.
-                           "ac_cv_search_clnt_create=no")
+                            ;; Reduce set of dependencies.
+                            "--without-parted"
+                            "--disable-ncursesw"
+                            "--disable-test"
+                            "--without-libbz2"
+                            "--without-libz"
+                            ;; Skip the clnt_create check because it expects
+                            ;; a working glibc causing a circular dependency.
+                            "ac_cv_search_clnt_create=no"
 
-       #:tests? #f))
-    (home-page "https://www.gnu.org/software/hurd/hurd.html")
-    (synopsis "GNU Hurd headers")
-    (description
-     "This package provides C headers of the GNU Hurd, used to build the GNU C
+                            ;; Annihilate the checks for the 'file_exec_paths'
+                            ;; & co. libc functions to avoid "link tests are
+                            ;; not allowed after AC_NO_EXECUTABLES" error.
+                            "ac_cv_func_file_exec_paths=no"
+                            "ac_cv_func_exec_exec_paths=no"
+                            "ac_cv_func__hurd_exec_paths=no"
+                            "ac_cv_func_file_futimens=no")
+
+        #:tests? #f))
+     (home-page "https://www.gnu.org/software/hurd/hurd.html")
+     (synopsis "GNU Hurd headers")
+     (description
+      "This package provides C headers of the GNU Hurd, used to build the GNU C
 Library and other user programs.")
-    (license gpl2+)))
+     (license gpl2+))))
 
 (define-public hurd-minimal
   (package (inherit hurd-headers)
     (name "hurd-minimal")
     (inputs `(("glibc-hurd-headers" ,glibc/hurd-headers)))
-    (native-inputs
-     `(("mig" ,mig)))
     (arguments
      (substitute-keyword-arguments (package-arguments hurd-headers)
        ((#:phases _)
@@ -178,6 +223,11 @@ Library and other user programs.")
                  #t)))
            (replace 'build
              (lambda _
+               ;; Install <assert-backtrace.h> & co.
+               (invoke "make" "-Clibshouldbeinlibc"
+                       "../include/assert-backtrace.h")
+
+               ;; Build libihash.
                (invoke "make" "-Clibihash" "libihash.a")))))))
     (home-page "https://www.gnu.org/software/hurd/hurd.html")
     (synopsis "GNU Hurd libraries")
diff --git a/gnu/packages/icu4c.scm b/gnu/packages/icu4c.scm
index c4d3703794..2d28107e81 100644
--- a/gnu/packages/icu4c.scm
+++ b/gnu/packages/icu4c.scm
@@ -32,7 +32,7 @@
 (define-public icu4c
   (package
    (name "icu4c")
-   (version "61.1")
+   (version "62.1")
    (source (origin
             (method url-fetch)
             (uri (string-append
@@ -42,7 +42,7 @@
                   (string-map (lambda (x) (if (char=? x #\.) #\_ x)) version)
                   "-src.tgz"))
             (sha256
-             (base32 "1vxgkx0cyvdy00a9yd5khkx14r5kcndkax2wa99klm52x2dgh1yh"))))
+             (base32 "18ssgnwzzpm1g1fvbm9h1fvryiwxvvn5wc3fdakdsl33cs6qdn9x"))))
    (build-system gnu-build-system)
    (inputs
     `(("perl" ,perl)))
@@ -55,10 +55,24 @@
                     (string-prefix? "mips" s)))
               '("--with-data-packaging=archive")
               '()))
+        ,@(if (string-prefix? "i686" (or (%current-target-system)
+                                         (%current-system)))
+              ;; FIXME: Some tests are failing on i686:
+              ;; <https://unicode-org.atlassian.net/browse/ICU-20080>.
+              '(#:tests? #f)
+              '())
       #:phases
       (modify-phases %standard-phases
         (add-after 'unpack 'chdir-to-source
-          (lambda _ (chdir "source") #t)))))
+          (lambda _ (chdir "source") #t))
+        (add-after 'install 'avoid-coreutils-reference
+          ;; Don't keep a reference to the build tools.
+          (lambda* (#:key outputs #:allow-other-keys)
+            (let ((out (assoc-ref outputs "out")))
+              (substitute* (find-files (string-append out "/lib/icu")
+                                       "\\.inc$")
+                (("INSTALL_CMD=.*/bin/install") "INSTALL_CMD=install"))
+              #t))))))
    (synopsis "International Components for Unicode")
    (description
     "ICU is a set of C/C++ and Java libraries providing Unicode and
diff --git a/gnu/packages/idutils.scm b/gnu/packages/idutils.scm
index abab0c16bf..81715591b4 100644
--- a/gnu/packages/idutils.scm
+++ b/gnu/packages/idutils.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 208 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -35,7 +36,20 @@
              (sha256
               (base32
                "1hmai3422iaqnp34kkzxdnywl7n7pvlxp11vrw66ybxn9wxg90c1"))
-             (patches (search-patches "diffutils-gets-undeclared.patch"))))
+             (patches (search-patches "diffutils-gets-undeclared.patch"))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                 (substitute* (find-files "lib" "\\.c$")
+                   (("#if defined _IO_ftrylockfile")
+                    "#if defined _IO_EOF_SEEN"))
+                 (substitute* "lib/stdio-impl.h"
+                   (("^/\\* BSD stdio derived implementations")
+                    (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                                   "# define _IO_IN_BACKUP 0x100\n"
+                                   "#endif\n\n"
+                                   "/* BSD stdio derived implementations")))
+                 #t))))
     (build-system gnu-build-system)
     (native-inputs `(("emacs" ,emacs-minimal)))
     (home-page "https://www.gnu.org/software/idutils/")
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 7b72737504..207faede91 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -137,15 +137,15 @@ library.  It supports almost all PNG features and is extensible.")
          (add-after 'unpack 'patch-apng
            (lambda* (#:key inputs #:allow-other-keys)
              (define (apply-patch file)
-               (zero? (system* "patch" "-p1" "--force"
-                               "--input" file)))
+               (invoke "patch" "-p1" "--force"
+                       "--input" file))
              (let ((apng.gz (assoc-ref inputs "apng")))
                (format #t "Applying APNG patch '~a'...~%"
                        apng.gz)
-               (and
-                 (zero?
-                   (system (string-append "gunzip < " apng.gz " > the-patch")))
-                 (apply-patch "the-patch")))))
+               (invoke "sh" "-c"
+                       (string-append "gunzip < " apng.gz " > the-patch"))
+               (apply-patch "the-patch")
+               #t)))
          (add-before 'configure 'no-checks
            (lambda _
              (substitute* "Makefile.in"
@@ -240,7 +240,8 @@ in-memory raw vectors.")
                (string-append vardef (assoc-ref inputs "zlib") "/"))
               ;; The Makefile is written by hand and not using $PREFIX
               (("\\$\\(DESTDIR\\)/usr/")
-               (string-append (assoc-ref outputs "out") "/"))))))))
+               (string-append (assoc-ref outputs "out") "/")))
+            #t)))))
    (inputs
     `(("libpng" ,libpng)
       ("zlib" , zlib)))
@@ -312,13 +313,13 @@ Currently all documentation resides in @file{pnglite.h}.")
 (define-public libjpeg
   (package
    (name "libjpeg")
-   (version "9b")
+   (version "9c")
    (source (origin
             (method url-fetch)
             (uri (string-append "http://www.ijg.org/files/jpegsrc.v"
                    version ".tar.gz"))
             (sha256 (base32
-                     "0lnhpahgdwlrkd41lx6cr90r199f8mc6ydlh7jznj5klvacd63r4"))))
+                     "08kixcf3a7s9x91174abjnk1xbvj4v8crdc73zi4k9h3jfbm00k5"))))
    (build-system gnu-build-system)
    (synopsis "Library for handling JPEG files")
    (description
@@ -460,7 +461,6 @@ extracting icontainer icon files.")
 (define-public libtiff
   (package
    (name "libtiff")
-   (replacement libtiff/fixed)
    (version "4.0.9")
    (source
      (origin
@@ -471,7 +471,9 @@ extracting icontainer icon files.")
         (base32
          "1kfg4q01r4mqn7dj63ifhi6pmqzbf4xax6ni6kkk81ri5kndwyvf"))
        (patches (search-patches "libtiff-CVE-2017-9935.patch"
-                                "libtiff-CVE-2017-18013.patch"))))
+                                "libtiff-CVE-2017-18013.patch"
+                                "libtiff-CVE-2018-8905.patch"
+                                "libtiff-CVE-2018-10963.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "doc"))                           ;1.3 MiB of HTML documentation
@@ -493,17 +495,6 @@ collection of tools for doing simple manipulations of TIFF images.")
                                   "See COPYRIGHT in the distribution."))
    (home-page "http://www.simplesystems.org/libtiff/")))
 
-(define libtiff/fixed
-  (package
-    (inherit libtiff)
-    (source
-      (origin
-        (inherit (package-source libtiff))
-        (patches
-          (append (origin-patches (package-source libtiff))
-                  (search-patches "libtiff-CVE-2018-8905.patch"
-                                  "libtiff-CVE-2018-10963.patch")))))))
-
 (define-public leptonica
   (package
     (name "leptonica")
@@ -539,14 +530,15 @@ collection of tools for doing simple manipulations of TIFF images.")
        (modify-phases %standard-phases
          (add-after 'unpack 'autogen
            (lambda _
-             (zero? (system* "sh" "autobuild"))))
+             (invoke "sh" "autobuild")))
          (add-after 'unpack 'patch-reg-wrapper
            (lambda _
              (substitute* "prog/reg_wrapper.sh"
                ((" /bin/sh ")
                 (string-append " " (which "sh") " "))
                (("which gnuplot")
-                "true")))))))
+                "true"))
+             #t)))))
     (home-page "http://www.leptonica.com/")
     (synopsis "Library and tools for image processing and analysis")
     (description
@@ -561,18 +553,18 @@ arithmetic ops.")
 (define-public jbig2dec
   (package
     (name "jbig2dec")
-    (version "0.14")
-    (replacement jbig2dec-0.15)
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-         (string-append "https://github.com/ArtifexSoftware/ghostpdl-downloads/"
-                        "releases/download/gs922/" name "-" version ".tar.gz"))
-        (sha256
-          (base32 "0k01hp0q4275fj4rbr1gy64svfraw5w7wvwl08yjhvsnpb1rid11"))
-        (patches (search-patches "jbig2dec-ignore-testtest.patch"))))
+    (version "0.15")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/ArtifexSoftware"
+                                  "/ghostpdl-downloads/releases/download"
+                                  "/gs924/" name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0m1qwpbjbirgw2fqznbajdhdhh35d6xa2csr64lpjz735pvimykb"))
+              (patches (search-patches "jbig2dec-ignore-testtest.patch"))))
     (build-system gnu-build-system)
+    (arguments '(#:configure-flags '("--disable-static")))
     (synopsis "Decoder of the JBIG2 image compression format")
     (description
       "JBIG2 is designed for lossy or lossless encoding of 'bilevel' (1-bit
@@ -587,21 +579,6 @@ work.")
     (home-page "https://jbig2dec.com")
     (license license:gpl2+)))
 
-;; This is a bugfix release from an ongoing Ghostscript security audit.
-;; It was released alongside Ghostscript 9.24.
-(define-public jbig2dec-0.15
-  (package
-    (inherit jbig2dec)
-    (version "0.15")
-    (source (origin
-              (inherit (package-source jbig2dec))
-              (uri (string-append "https://github.com/ArtifexSoftware"
-                                  "/ghostpdl-downloads/releases/download/gs924/"
-                                  "jbig2dec-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0m1qwpbjbirgw2fqznbajdhdhh35d6xa2csr64lpjz735pvimykb"))))))
-
 (define-public openjpeg
   (package
     (name "openjpeg")
@@ -908,11 +885,15 @@ graphics image formats like PNG, BMP, JPEG, TIFF and others.")
     `(#:test-target "check"
       #:phases
       (modify-phases %standard-phases
-        ;; See https://github.com/ukoethe/vigra/issues/432
-        (add-after 'unpack 'disable-broken-test
+        (add-after 'unpack 'disable-broken-tests
           (lambda _
+            ;; See https://github.com/ukoethe/vigra/issues/432
             (substitute* "test/fourier/CMakeLists.txt"
               (("VIGRA_ADD_TEST.*") ""))
+            ;; This test fails with Numpy 1.15:
+            ;; <https://github.com/ukoethe/vigra/issues/436>.
+            (substitute* "vigranumpy/test/CMakeLists.txt"
+              (("test1\\.py") ""))
             #t)))
       #:configure-flags
         (list "-Wno-dev" ; suppress developer mode with lots of warnings
@@ -1162,7 +1143,7 @@ ISO/IEC 15444-1).")
        (modify-phases %standard-phases
          (add-after 'unpack 'autogen
            (lambda _
-             (zero? (system* "sh" "autogen.sh")))))))
+             (invoke "sh" "autogen.sh"))))))
     (synopsis "Scaling, colorspace conversion, and dithering library")
     (description "Zimg implements the commonly required image processing basics
 of scaling, colorspace conversion, and depth conversion.  A simple API enables
@@ -1195,7 +1176,8 @@ the programmer.")
                     ;; of the source tree, one level higher than expected
                     (lambda _
                       (substitute* "test/run_tests.bash"
-                        (("../build") "../../build")))))))
+                        (("../build") "../../build"))
+                      #t)))))
     (home-page "https://github.com/myint/perceptualdiff")
     (synopsis "Perceptual image comparison utility")
     (description "PerceptualDiff visually compares two images to determine
diff --git a/gnu/packages/inkscape.scm b/gnu/packages/inkscape.scm
index de9940df1c..1673cc602e 100644
--- a/gnu/packages/inkscape.scm
+++ b/gnu/packages/inkscape.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2014, 2016 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2016, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
@@ -54,7 +54,24 @@
                                   "inkscape-" version ".tar.bz2"))
               (sha256
                (base32
-                "1chng2yw8dsjxc9gf92aqv7plj11cav8ax321wmakmv5bb09cch6"))))
+                "1chng2yw8dsjxc9gf92aqv7plj11cav8ax321wmakmv5bb09cch6"))
+              (patches
+               (list (origin
+                       (method url-fetch)
+                       (uri (string-append "https://gitlab.com/inkscape/inkscape/commit/"
+                                           "a600c6438fef2f4c06f9a4a7d933d99fb054a973.diff"))
+                       (file-name "inkscape-poppler-compat.patch")
+                       (sha256
+                        (base32
+                         "19dam5vsy571xszgjddl5g0958dmcsv0wvgxidp4bhj2lban222i")))
+                     (origin
+                       (method url-fetch)
+                       (uri (string-append "https://gitlab.com/inkscape/inkscape/commit/"
+                                           "fa1c469aa8c005e07bb8676d72af9f7c16fae3e0.diff"))
+                       (file-name "inkscape-poppler-compat2.patch")
+                       (sha256
+                        (base32
+                         "14k9yrfjz4nx3bz9dk91q74mc0i7rvl2qzkwhcy1br71yqjvngn5")))))))
     (build-system cmake-build-system)
     (inputs
      `(("aspell" ,aspell)
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index d5bd11178b..a09bcfabe5 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -46,6 +46,7 @@
   #:use-module (gnu packages cpio)
   #:use-module (gnu packages cups)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages elf)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gawk)
   #:use-module (gnu packages gettext)
@@ -1672,6 +1673,190 @@ new Date();"))
                  '("jdk" "openjdk-src" "corba-drop" "jaxp-drop" "jaxws-drop"
                    "jdk-drop" "langtools-drop" "hotspot-drop")))))))
 
+(define-public openjdk9
+  (package
+    (name "openjdk")
+    (version "9.181")
+    (source (origin
+              (method url-fetch)
+              (uri "https://hg.openjdk.java.net/jdk/jdk/archive/3cc80be736f2.tar.bz2")
+              (file-name (string-append name "-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "01ihmyf7k5z17wbr7xig7y40l9f01d5zjgkcmawn1102hw5kchpq"))
+              (modules '((guix build utils)))
+              (snippet
+                `(begin
+                   (for-each delete-file (find-files "." ".*.bin$"))
+                   (for-each delete-file (find-files "." ".*.exe$"))
+                   (for-each delete-file (find-files "." ".*.jar$"))
+                   #t))))
+    (build-system gnu-build-system)
+    (outputs '("out" "jdk" "doc"))
+    (arguments
+     `(#:tests? #f; require jtreg
+       #:imported-modules
+       ((guix build syscalls)
+        ,@%gnu-build-system-modules)
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'patch-source-shebangs 'fix-java-shebangs
+           (lambda _
+             ;; This file was "fixed" by patch-source-shebangs, but it requires
+             ;; this exact first line.
+             (substitute* "jdk/make/data/blacklistedcertsconverter/blacklisted.certs.pem"
+               (("^#!.*") "#! java BlacklistedCertsConverter SHA-256\n"))
+             #t))
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             ;; TODO: unbundle libpng and lcms
+             (invoke "bash" "./configure"
+                     (string-append "--with-freetype=" (assoc-ref inputs "freetype"))
+                     "--disable-freetype-bundling"
+                     "--disable-warnings-as-errors"
+                     "--disable-hotspot-gtest"
+                     "--with-giflib=system"
+                     "--with-libjpeg=system"
+                     (string-append "--prefix=" (assoc-ref outputs "out")))
+             #t))
+         (replace 'build
+           (lambda _
+             (with-output-to-file ".src-rev"
+               (lambda _
+                 (display ,version)))
+             (setenv "GUIX_LD_WRAPPER_ALLOW_IMPURITIES" "yes")
+             (invoke "make" "all")
+             #t))
+         ;; Some of the libraries in the lib/ folder link to libjvm.so.
+         ;; But that shared object is located in the server/ folder, so it
+         ;; cannot be found.  This phase creates a symbolic link in the
+         ;; lib/ folder so that the other libraries can find it.
+         ;;
+         ;; See:
+         ;; https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00169.html
+         ;;
+         ;; FIXME: Find the bug in the build system, so that this symlink is
+         ;; not needed.
+         (add-after 'install 'install-libjvm
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((lib-out (string-append (assoc-ref outputs "out")
+                                             "/lib"))
+                    (lib-jdk (string-append (assoc-ref outputs "jdk")
+                                             "/lib")))
+               (symlink (string-append lib-jdk "/server/libjvm.so")
+                        (string-append lib-jdk "/libjvm.so"))
+               (symlink (string-append lib-out "/server/libjvm.so")
+                        (string-append lib-out "/libjvm.so")))
+             #t))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out"))
+                   (jdk (assoc-ref outputs "jdk"))
+                   (doc (assoc-ref outputs "doc"))
+                   (images (car (find-files "build" ".*-server-release"
+                                            #:directories? #t))))
+               (copy-recursively (string-append images "/images/jdk") jdk)
+               (copy-recursively (string-append images "/images/jre") out)
+               (copy-recursively (string-append images "/images/docs") doc))
+             #t))
+         (add-after 'install 'strip-zip-timestamps
+           (lambda* (#:key outputs #:allow-other-keys)
+             (use-modules (guix build syscalls))
+             (for-each (lambda (zip)
+                         (let ((dir (mkdtemp! "zip-contents.XXXXXX")))
+                           (with-directory-excursion dir
+                             (invoke "unzip" zip))
+                           (delete-file zip)
+                           (for-each (lambda (file)
+                                       (let ((s (lstat file)))
+                                         (unless (eq? (stat:type s) 'symlink)
+                                           (format #t "reset ~a~%" file)
+                                           (utime file 0 0 0 0))))
+                             (find-files dir #:directories? #t))
+                           (with-directory-excursion dir
+                             (let ((files (find-files "." ".*" #:directories? #t)))
+                               (apply invoke "zip" "-0" "-X" zip files)))))
+               (find-files (assoc-ref outputs "doc") ".*.zip$"))
+             #t)))))
+    (inputs
+     `(("alsa-lib" ,alsa-lib)
+       ("cups" ,cups)
+       ("fontconfig" ,fontconfig)
+       ("freetype" ,freetype)
+       ("giflib" ,giflib)
+       ("lcms" ,lcms)
+       ("libelf" ,libelf)
+       ("libjpeg" ,libjpeg)
+       ("libice" ,libice)
+       ("libpng" ,libpng)
+       ("libx11" ,libx11)
+       ("libxcomposite" ,libxcomposite)
+       ("libxi" ,libxi)
+       ("libxinerama" ,libxinerama)
+       ("libxrender" ,libxrender)
+       ("libxt" ,libxt)
+       ("libxtst" ,libxtst)))
+    (native-inputs
+     `(("icedtea-8" ,icedtea-8)
+       ("icedtea-8:jdk" ,icedtea-8 "jdk")
+       ("unzip" ,unzip)
+       ("which" ,which)
+       ("zip" ,zip)))
+    (home-page "https://openjdk.java.net/projects/jdk9/")
+    (synopsis "Java development kit")
+    (description
+     "This package provides the Java development kit OpenJDK.")
+    (license license:gpl2+)))
+
+(define-public openjdk10
+  (package
+    (inherit openjdk9)
+    (name "openjdk")
+    (version "10.46")
+    (source (origin
+              (method url-fetch)
+              (uri "http://hg.openjdk.java.net/jdk/jdk/archive/6fa770f9f8ab.tar.bz2")
+              (file-name (string-append name "-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "0zywq2203b4hx4jms9vbwvjcj1d3k2v3qpx4s33729fkpmid97r4"))
+              (modules '((guix build utils)))
+              (snippet
+                `(begin
+                   (for-each delete-file (find-files "." ".*.bin$"))
+                   (for-each delete-file (find-files "." ".*.exe$"))
+                   (for-each delete-file (find-files "." ".*.jar$"))
+                   #t))))
+    (arguments
+      (substitute-keyword-arguments (package-arguments openjdk9)
+        ((#:phases phases)
+         `(modify-phases ,phases
+            (replace 'fix-java-shebangs
+              (lambda _
+                ;; This file was "fixed" by patch-source-shebangs, but it requires
+                ;; this exact first line.
+                (substitute* "make/data/blacklistedcertsconverter/blacklisted.certs.pem"
+                  (("^#!.*") "#! java BlacklistedCertsConverter SHA-256\n"))
+                #t))
+            (replace 'configure
+              (lambda* (#:key inputs outputs #:allow-other-keys)
+                (invoke "bash" "./configure"
+                        (string-append "--with-freetype=" (assoc-ref inputs "freetype"))
+                        "--disable-freetype-bundling"
+                        "--disable-warnings-as-errors"
+                        "--disable-hotspot-gtest"
+                        "--with-giflib=system"
+                        "--with-libjpeg=system"
+                        "--with-native-debug-symbols=zipped"
+                        (string-append "--prefix=" (assoc-ref outputs "out")))
+                #t))))))
+    (native-inputs
+     `(("openjdk9" ,openjdk9)
+       ("openjdk9:jdk" ,openjdk9 "jdk")
+       ("unzip" ,unzip)
+       ("which" ,which)
+       ("zip" ,zip)))))
+
 (define-public icedtea icedtea-8)
 
 
diff --git a/gnu/packages/jemalloc.scm b/gnu/packages/jemalloc.scm
index 5086df7a1b..cb870208e4 100644
--- a/gnu/packages/jemalloc.scm
+++ b/gnu/packages/jemalloc.scm
@@ -32,7 +32,7 @@
 (define-public jemalloc
   (package
     (name "jemalloc")
-    (version "5.0.1")
+    (version "5.1.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -40,8 +40,7 @@
                     version "/jemalloc-" version ".tar.bz2"))
               (sha256
                (base32
-                "1sf3lzgb0y8nnyzmp4zrca3sngdxw3kfh20sna9z03jv74fph528"))
-              (patches (search-patches "jemalloc-arm-address-bits.patch"))))
+                "0s3jpcyhzia8d4k0xyc67is78kg416p9yc3c2f9w6fhhqqffd5jk"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/kerberos.scm b/gnu/packages/kerberos.scm
index 22d74d32df..508f9c4bd2 100644
--- a/gnu/packages/kerberos.scm
+++ b/gnu/packages/kerberos.scm
@@ -6,6 +6,7 @@
 ;;; Copyright © 2012, 2013 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2012, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -47,7 +48,7 @@
 (define-public mit-krb5
   (package
     (name "mit-krb5")
-    (version "1.16")
+    (version "1.16.1")
     (source (origin
               (method url-fetch)
               (uri (list
@@ -59,7 +60,7 @@
                                    "/krb5-" version ".tar.gz")))
               (sha256
                (base32
-                "024yjr15ij0qdnay0bcqfpclgfri0qa8iw4r5zdlryxhhdgi5szs"))))
+                "05qis9l93hhxaknbp0a2v5cr24fsy52fqx20aqqcgl1s9qwzwkr1"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("bison" ,bison)
@@ -116,7 +117,7 @@ cryptography.")
      '(;; This is required since we patch some of the build scripts.
        ;; Remove for the next Shishi release after 1.0.2 or when
        ;; removing 'shishi-fix-libgcrypt-detection.patch'.
-       #:configure-flags '("ac_cv_libgcrypt=yes")))
+       #:configure-flags '("ac_cv_libgcrypt=yes" "--disable-static")))
     (native-inputs `(("pkg-config" ,pkg-config)))
     (inputs
      `(("gnutls" ,gnutls)
diff --git a/gnu/packages/libbsd.scm b/gnu/packages/libbsd.scm
index 58b0be872c..a616de70bd 100644
--- a/gnu/packages/libbsd.scm
+++ b/gnu/packages/libbsd.scm
@@ -25,14 +25,14 @@
 (define-public libbsd
   (package
     (name "libbsd")
-    (version "0.8.7")
+    (version "0.9.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://libbsd.freedesktop.org/releases/"
                                   "libbsd-" version ".tar.xz"))
               (sha256
                (base32
-                "0c9bl49zs0xdddcwj5dh0lay9sxi2m1yi74848g8p87mb87g2j7m"))))
+                "1957w2wi7iqar978qlfsm220dwywnrh5m58nrnn9zmi74ds3bn2n"))))
     (build-system gnu-build-system)
     (synopsis "Utility functions from BSD systems")
     (description "This library provides useful functions commonly found on BSD
diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index a7752dc5f0..2de29707ca 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -122,24 +122,17 @@ limited support for fork events.")
 (define-public libuv
   (package
     (name "libuv")
-    (version "1.19.2")
+    (version "1.23.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "1msk9ac1z69whww88ibrwjqkd1apdla6l77cm2fwy5kigq0z5g3w"))))
+                "09yf7c71n8b80nbsv4lsmq5nqmb0rylhpx3z9jgkv5za9lr6sx6i"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:phases (modify-phases %standard-phases
-                  (add-after 'unpack 'autogen
-                    (lambda _
-                      ;; Fashionable people don't run 'make dist' these days, so
-                      ;; we need to do that ourselves.
-                      (invoke "sh" "autogen.sh"))))
-
-       ;; XXX: Some tests want /dev/tty, attempt to make connections, etc.
+     '(;; XXX: Some tests want /dev/tty, attempt to make connections, etc.
        #:tests? #f))
     (native-inputs `(("autoconf" ,autoconf-wrapper)
                      ("automake" ,automake)
@@ -159,6 +152,19 @@ resolution, asynchronous file system operations, and threading primitives.")
     ;; details.  Documentation is CC-BY 4.0 as of 1.12.0; see 'LICENSE-docs'.
     (license (list expat cc-by4.0))))
 
+;; This version is required for Node versions < 10.
+(define-public libuv-1.19
+  (package
+    (inherit libuv)
+    (version "1.19.2")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://dist.libuv.org/dist/v" version
+                                  "/libuv-v" version ".tar.gz"))
+              (sha256
+               (base32
+                "1msk9ac1z69whww88ibrwjqkd1apdla6l77cm2fwy5kigq0z5g3w"))))))
+
 (define-public perl-anyevent
   (package
     (name "perl-anyevent")
diff --git a/gnu/packages/libffi.scm b/gnu/packages/libffi.scm
index 0d54c305b2..01a5ea2049 100644
--- a/gnu/packages/libffi.scm
+++ b/gnu/packages/libffi.scm
@@ -50,7 +50,10 @@
               (patches (search-patches "libffi-3.2.1-complex-alpha.patch"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:phases
+     `(;; Prevent the build system from passing -march and -mtune to the
+       ;; compiler.  See "ax_cc_maxopt.m4" and "ax_gcc_archflag.m4".
+       #:configure-flags '("--enable-portable-binary" "--without-gcc-arch")
+       #:phases
        (modify-phases %standard-phases
          (add-after 'install 'post-install
            (lambda* (#:key outputs #:allow-other-keys)
@@ -79,13 +82,14 @@ conversions for values passed between the two languages.")
 (define-public python-cffi
   (package
     (name "python-cffi")
-    (version "1.11.4")
+    (version "1.11.5")
     (source
      (origin
       (method url-fetch)
       (uri (pypi-uri "cffi" version))
       (sha256
-       (base32 "07fiy4wqg8g08x38r04ydjr8n6g0g74gb8si8b6jhymijalq746z"))))
+       (base32 "1x3lrj928dcxx1k8k9gf3s4s3jwvzv8mc3kkyg1g7c3a1sc1f3z9"))
+      (patches (search-patches "python-cffi-x87-stack-clean.patch"))))
     (build-system python-build-system)
     (outputs '("out" "doc"))
     (inputs
diff --git a/gnu/packages/libidn.scm b/gnu/packages/libidn.scm
index 249c3f8458..719a0f0b4b 100644
--- a/gnu/packages/libidn.scm
+++ b/gnu/packages/libidn.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2017 Eric Bavier <bavier@member.fsf.org>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -32,26 +33,18 @@
 (define-public libidn
   (package
    (name "libidn")
-   (version "1.34")
+   (version "1.35")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/libidn/libidn-" version
                                 ".tar.gz"))
             (sha256
              (base32
-              "0g3fzypp0xjcgr90c5cyj57apx1cmy0c6y9lvw2qdcigbyby469p"))
-            (modules '((guix build utils)))
-            (snippet
-             '(begin
-                ;; The gnulib test-lock test is prone to writer starvation
-                ;; with our glibc@2.25, which prefers readers, so disable it.
-                ;; The gnulib commit b20e8afb0b2 should fix this once
-                ;; incorporated here.
-                (substitute* "lib/gltests/Makefile.in"
-                  (("test-lock\\$\\(EXEEXT\\) ") ""))
-                #t))))
+              "07pyy0afqikfq51z5kbzbj9ldbd12mri0zvx0mfv3ds6bc0g26pi"))))
    (build-system gnu-build-system)
-;; FIXME: No Java and C# libraries are currently built.
+   ;; FIXME: No Java and C# libraries are currently built.
+   (arguments
+    `(#:configure-flags '("--disable-static")))
    (synopsis "Internationalized string processing library")
    (description
      "libidn is a library implementing of the Stringprep, Punycode and IDNA
@@ -66,19 +59,21 @@ Java libraries.")
 (define-public libidn2
   (package
     (name "libidn2")
-    (version "2.0.4")
+    (version "2.0.5")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/libidn/" name "-" version
                                   ".tar.lz"))
               (sha256
                (base32
-                "00f2fyw5kwr9is3cdn5h9arzxp0lnvg0z9bb9zyfs0dq81gaqim4"))))
+                "0s4nkazy1xbs6bbq4farby1xhmhzk5bdclbil5gqdwyzxsgabxqg"))))
     (native-inputs
      `(("lzip" ,lzip)))
     (inputs
      `(("libunistring" ,libunistring)))
     (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags '("--disable-static")))
     (synopsis "Internationalized domain name library for IDNA2008")
     (description "Libidn2 is an internationalized domain library implementing
 the IDNA2008 specifications.   Libidn2 is believed to be a complete IDNA2008
diff --git a/gnu/packages/libreoffice.scm b/gnu/packages/libreoffice.scm
index abf16acb3d..45e2f63767 100644
--- a/gnu/packages/libreoffice.scm
+++ b/gnu/packages/libreoffice.scm
@@ -81,7 +81,7 @@
 (define-public ixion
   (package
     (name "ixion")
-    (version "0.13.0")
+    (version "0.14.1")
     (source
      (origin
        (method url-fetch)
@@ -89,7 +89,7 @@
                            version ".tar.xz"))
        (sha256
         (base32
-         "1rf76drzg593jzswwnh8kr2jangp8ylizqjspx57rld25g2n1qss"))))
+         "14gdd6div4l22vnz3jn2qjxgjly98ck6p8c1v7386c41rx7kilba"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
@@ -107,7 +107,7 @@ their dependencies automatically upon calculation.")
 (define-public orcus
   (package
     (name "orcus")
-    (version "0.13.4")
+    (version "0.14.1")
     (source
      (origin
        (method url-fetch)
@@ -115,7 +115,7 @@ their dependencies automatically upon calculation.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1r42waglxwmvvwl20fy49vzgfp1sis4j703f81iswzdyzqalq75p"))))
+         "1ays13a1x15j81dsrq0d3697v1bbqd3bfz3ajn6kb9d61y2drlgj"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
@@ -318,7 +318,16 @@ working with graphics in the WPG (WordPerfect Graphics) format.")
           ;; During configure, the boost headers are found, but linking
           ;; fails without the following flag.
           (string-append "--with-boost="
-                         (assoc-ref %build-inputs "boost")))))
+                         (assoc-ref %build-inputs "boost")))
+        #:phases (modify-phases %standard-phases
+                   (add-before 'build 'fix-boost-include
+                     (lambda _
+                       ;; This library moved in Boost and the compatibility
+                       ;; redirect is no longer available since version 1.68.0.
+                       (substitute* "src/libcmis/xml-utils.cxx"
+                         (("boost/uuid/sha1.hpp")
+                          "boost/uuid/detail/sha1.hpp"))
+                       #t)))))
     (home-page "https://github.com/tdf/libcmis")
     (synopsis "CMIS client library")
     (description "LibCMIS is a C++ client library for the CMIS interface.  It
@@ -402,7 +411,16 @@ CorelDRAW documents of all versions.")
                "0bfq9rwm040xhh7b3v0gsdavwvnrz4hkwnhpggarxk70mr3j7jcx"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:configure-flags '("--with-mdds=1.2")))
+     `(#:configure-flags '("--with-mdds=1.4")
+       #:phases (modify-phases %standard-phases
+                  (add-before 'configure 'support-mdds-1.4
+                    (lambda _
+                      ;; This package already works fine with mdds 1.4, but the
+                      ;; configure check is too strict.  Taken from upstream.
+                      (substitute* "configure"
+                        (("mdds=1\\.2") "mdds=1.4")
+                        (("mdds=\"1\\.2\"") "mdds=\"1.4\""))
+                      #t)))))
     (native-inputs
      `(("cppunit" ,cppunit)
        ("doxygen" ,doxygen)
@@ -941,8 +959,34 @@ converting QuarkXPress file format.  It supports versions 3.1 to 4.1.")
        (sha256
         (base32
          "0i4gf3qi16fg7dxq2l4vhkwh4f5lx7xd1ilpzcw26vccqkv3hvyl"))
-       (patches (search-patches "libreoffice-icu.patch"
-                                "libreoffice-glm.patch"))))
+       (patches
+        (append (list (origin
+                        ;; Support newer versions of Orcus and MDDS.  These patches
+                        ;; are taken from upstream, but we use the patches from Arch
+                        ;; because they are adapted for the release tarball.
+                        ;; Note: remove the related substitutions below when these
+                        ;; are no longer needed.
+                        (method url-fetch)
+                        (uri (string-append "https://git.archlinux.org/svntogit"
+                                            "/packages.git/plain/trunk/"
+                                            "0001-Update-orcus-to-0.14.0.patch?&id="
+                                            "4002fa927f2a143bd2ec008a0c400b2ce9f2c8a7"))
+                        (file-name "libreoffice-orcus.patch")
+                        (sha256
+                         (base32
+                          "0v1knblrmfzkb4g9pm5mdnrmjib59bznvca1ygbwlap2ln1h4mk0")))
+                      (origin
+                        (method url-fetch)
+                        (uri (string-append "https://git.archlinux.org/svntogit"
+                                            "/packages.git/plain/trunk/"
+                                            "0001-Update-mdds-to-1.4.1.patch?&id="
+                                            "4002fa927f2a143bd2ec008a0c400b2ce9f2c8a7"))
+                        (file-name "libreoffice-mdds.patch")
+                        (sha256
+                         (base32
+                          "0apbmammmp4pk473xiv5vk50r4c5gjvqzf9jkficksvz58q6114f"))))
+                (search-patches "libreoffice-icu.patch"
+                                "libreoffice-glm.patch")))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("bison" ,bison)
@@ -1031,6 +1075,13 @@ converting QuarkXPress file format.  It supports versions 3.1 to 4.1.")
                          "solenv/gbuild/platform/unxgcc.mk")
                  (("/bin/sh") (which "sh")))
 
+               ;; XXX: Adjust the checks for MDDS and liborcus to avoid having
+               ;; to re-bootstrap the whole thing.  Remove this with the related
+               ;; patches above.
+               (substitute* "configure"
+                 (("mdds-1.2 >= 1.2.3") "mdds-1.4 >= 1.4.1")
+                 (("liborcus-0.13 >= 0.13.3") "liborcus-0.14 >= 0.14.0"))
+
                ;; GPGME++ headers are installed in a gpgme++ subdirectory, but
                ;; files in "xmlsecurity/source/gpg/" and elsewhere expect to
                ;; find them on the include path without a prefix.
diff --git a/gnu/packages/libsigsegv.scm b/gnu/packages/libsigsegv.scm
index 7f63bb26c4..927a12f4cf 100644
--- a/gnu/packages/libsigsegv.scm
+++ b/gnu/packages/libsigsegv.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -38,20 +38,23 @@
    (home-page "https://www.gnu.org/software/libsigsegv/")
    (synopsis "Library for handling page faults")
    (arguments
-    ;; On MIPS, work around this error:
-    ;;
-    ;; In file included from fault-linux-mips-old.h:18:0,
-    ;;    [...]
-    ;; linux-libre-headers-cross-mips64el-linux-gnu-3.3.8/include/asm/sigcontext.h:57:8: error: redefinition of 'struct sigcontext'
-    (if (string-contains (or (%current-target-system) (%current-system))
-                         "mips64el")
-        `(#:phases (modify-phases %standard-phases
-                     (add-before 'configure 'patch-mips-old-h
-                       (lambda _
-                         (substitute* "src/fault-linux-mips-old.h"
-                           (("#include <asm/sigcontext\\.h>") ""))
-                         #t))))
-        '()))
+    `(;; The shared library isn't built by default but some packages need it.
+      #:configure-flags '("--enable-shared")
+
+      ;; On MIPS, work around this error:
+      ;;
+      ;; In file included from fault-linux-mips-old.h:18:0,
+      ;;    [...]
+      ;; linux-libre-headers-cross-mips64el-linux-gnu-3.3.8/include/asm/sigcontext.h:57:8: error: redefinition of 'struct sigcontext'
+      ,@(if (string-contains (or (%current-target-system) (%current-system))
+                             "mips64el")
+            `(#:phases (modify-phases %standard-phases
+                         (add-before 'configure 'patch-mips-old-h
+                           (lambda _
+                             (substitute* "src/fault-linux-mips-old.h"
+                               (("#include <asm/sigcontext\\.h>") ""))
+                             #t))))
+            '())))
    (description
     "GNU libsigsegv is a library to handle page faults, which occur when a
 program tries to access an unavailable region of memory, in user mode.  By
diff --git a/gnu/packages/libunistring.scm b/gnu/packages/libunistring.scm
index 6a3afd4f05..fda839be54 100644
--- a/gnu/packages/libunistring.scm
+++ b/gnu/packages/libunistring.scm
@@ -5,6 +5,8 @@
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2017 Eric Bavier <bavier@member.fsf.org>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -32,7 +34,7 @@
 (define-public libunistring
   (package
    (name "libunistring")
-   (version "0.9.9")
+   (version "0.9.10")
    (source (origin
             (method url-fetch)
             (uri (string-append
@@ -40,24 +42,25 @@
                   version ".tar.xz"))
             (sha256
              (base32
-              "0cx8v6862w7vvacbkcvg49kfx731ckdgaybmzw1zav71zkn97nd4"))
-            (modules '((guix build utils)))
-            (snippet
-             '(begin
-                ;; The gnulib test-lock test is prone to writer starvation
-                ;; with our glibc@2.25, which prefers readers, so disable it.
-                ;; The gnulib commit b20e8afb0b2 should fix this once
-                ;; incorporated here.
-                (substitute* "tests/Makefile.in"
-                  (("test-lock\\$\\(EXEEXT\\) ") ""))
-                #t))))
+              "1mq57h06622m6qc5cv347fc3qk5mj840axw3c0vd7qmnwk1v53zb"))))
    (propagated-inputs (libiconv-if-needed))
+   (outputs '("out" "static"))
    (build-system gnu-build-system)
    (arguments
     ;; Work around parallel build issue whereby C files may be compiled before
     ;; config.h is built: see <http://hydra.gnu.org/build/59381/nixlog/2/raw> and
     ;; <http://lists.openembedded.org/pipermail/openembedded-core/2012-April/059850.html>.
-    '(#:parallel-build? #f))
+    '(#:parallel-build? #f
+      #:phases (modify-phases %standard-phases
+                 (add-after 'install 'move-static-library
+                   (lambda* (#:key outputs #:allow-other-keys)
+                     (let ((out (assoc-ref outputs "out"))
+                           (static (assoc-ref outputs "static")))
+                       (with-directory-excursion (string-append out "/lib")
+                         (install-file "libunistring.a"
+                                       (string-append static "/lib"))
+                         (delete-file "libunistring.a")
+                         #t)))))))
    (synopsis "C library for manipulating Unicode strings")
    (description
     "GNU libunistring is a library providing functions to manipulate
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index b9f2963c12..9d61734f34 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -165,13 +165,13 @@ defconfig.  Return the appropriate make target if applicable, otherwise return
 (define-public linux-libre-headers
   (package
     (name "linux-libre-headers")
-    (version "4.14.26")
+    (version "4.14.67")
     (source (origin
              (method url-fetch)
              (uri (linux-libre-urls version))
              (sha256
               (base32
-               "1m2zr17wpasg5riysbaa4g5i492jzr93py2jm088ki818s4a9cm3"))))
+               "050zvdxjy6sc64q75pr1gxsmh49chwav2pwxz8xlif39bvahnrpg"))))
     (build-system gnu-build-system)
     (native-inputs `(("perl" ,perl)))
     (arguments
@@ -300,12 +300,6 @@ for ARCH and optionally VARIANT, or #f if there is no such configuration."
                  (or (%current-target-system) (%current-system)))
            ((or "x86_64" "i386")
             `(("gcc" ,gcc-7)))
-           ("arm64"
-            ;; Work around a binutils 2.30 bug where some kernel symbols would
-            ;; be incorrectly marked as relocatable:
-            ;; <https://sourceware.org/bugzilla/show_bug.cgi?id=22764>.
-            `(("ld-wrapper" ,(make-ld-wrapper "ld-wrapper"
-                                              #:binutils binutils/fixed))))
            (_
             '()))
        ,@(match (and configuration-file
@@ -488,17 +482,17 @@ It has been modified to remove all non-free binary blobs.")
 (define-public linux-pam
   (package
     (name "linux-pam")
-    (version "1.3.0")
+    (version "1.3.1")
     (source
      (origin
-      (method url-fetch)
-      (uri (string-append
-            "http://www.linux-pam.org/library/"
-            "Linux-PAM-" version ".tar.bz2"))
-      (sha256
-       (base32
-        "1fyi04d5nsh8ivd0rn2y0z83ylgc0licz7kifbb6xxi2ylgfs6i4"))
-      (patches (search-patches "linux-pam-no-setfsuid.patch"))))
+       (method url-fetch)
+       (uri (string-append
+             "https://github.com/linux-pam/linux-pam/releases/download/v"
+             version "/Linux-PAM-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1nyh9kdi3knhxcbv5v4snya0g3gff0m671lnvqcbygw3rm77mx7g"))
+       (patches (search-patches "linux-pam-no-setfsuid.patch"))))
 
     (build-system gnu-build-system)
     (native-inputs
@@ -580,7 +574,7 @@ providing the system administrator with some help in common tasks.")
 (define-public util-linux
   (package
     (name "util-linux")
-    (version "2.32")
+    (version "2.32.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://kernel.org/linux/utils/"
@@ -588,7 +582,7 @@ providing the system administrator with some help in common tasks.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0d2758kjll5xqm5fpp3sww1h66aahx161sf2b60jxqv4qymrfwvc"))
+                "1ck7d8srw5szpjq7v0gpmjahnjs6wgqzm311ki4gazww6xx71rl6"))
               (patches (search-patches "util-linux-tests.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -644,7 +638,14 @@ providing the system administrator with some help in common tasks.")
                                      (rename-file file
                                                   (string-append static "/"
                                                                  file)))
-                                   (find-files "lib" "\\.a$")))
+                                   (find-files "lib" "\\.a$"))
+
+                         ;; Remove references to the static library from the '.la'
+                         ;; files so that Libtool does the right thing when both
+                         ;; the shared and static library is available.
+                         (substitute* (find-files "lib" "\\.la$")
+                           (("old_library=.*") "old_library=''\n")))
+
                        #t))))))
     (inputs `(("zlib" ,zlib)
               ("ncurses" ,ncurses)
@@ -1250,7 +1251,8 @@ that the Ethernet protocol is much simpler than the IP protocol.")
                     (lambda _
                       ;; Don't attempt to create /var/lib/arpd.
                       (substitute* "Makefile"
-                        (("^.*ARPDDIR.*$") "")))))))
+                        (("^.*ARPDDIR.*$") ""))
+                      #t)))))
     (inputs
      `(("iptables" ,iptables)
        ("db4" ,bdb)))
@@ -2533,9 +2535,7 @@ in a digital read-out.")
   (package
     (name "perf")
     (version (package-version linux-libre))
-    (source (origin
-              (inherit (package-source linux-libre))
-              (patches (search-patches "perf-gcc-ice.patch"))))
+    (source (package-source linux-libre))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -3298,6 +3298,7 @@ and copy/paste text in the console and in xterm.")
               ("libuuid:static" ,util-linux "static")
               ("lzo" ,lzo)
               ("zlib" ,zlib)
+              ("zlib:static" ,zlib "static")
               ("zstd" ,zstd)))
     (native-inputs `(("pkg-config" ,pkg-config)
                      ("asciidoc" ,asciidoc)
@@ -3539,7 +3540,8 @@ from userspace.")
              (let* ((out (assoc-ref outputs "out"))
                     (sbin (string-append out "/sbin")))
                (symlink "mount.ntfs-3g"
-                        (string-append sbin "/mount.ntfs"))))))))
+                        (string-append sbin "/mount.ntfs")))
+             #t)))))
     (home-page "https://www.tuxera.com/community/open-source-ntfs-3g/")
     (synopsis "Read-write access to NTFS file systems")
     (description
@@ -3696,7 +3698,8 @@ from that to the system kernel's @file{/dev/random} machinery.")
      '(#:phases (modify-phases %standard-phases
                   (add-after 'unpack 'enter-subdirectory
                     (lambda _
-                      (chdir "tools/power/cpupower")))
+                      (chdir "tools/power/cpupower")
+                      #t))
                   (delete 'configure)
                   (add-before 'build 'fix-makefiles
                     (lambda _
@@ -3704,7 +3707,8 @@ from that to the system kernel's @file{/dev/random} machinery.")
                         (("/usr/") "/")
                         (("/bin/(install|pwd)" _ command) command))
                       (substitute* "bench/Makefile"
-                        (("\\$\\(CC\\) -o") "$(CC) $(LDFLAGS) -o")))))
+                        (("\\$\\(CC\\) -o") "$(CC) $(LDFLAGS) -o"))
+                      #t)))
        #:make-flags (let ((out (assoc-ref %outputs "out")))
                       (list (string-append "DESTDIR=" out)
                             (string-append "LDFLAGS=-Wl,-rpath=" out "/lib")
@@ -4016,9 +4020,11 @@ developers.")
                   ;; getver.sh uses ‘git --describe’, isn't worth an extra git
                   ;; dependency, and doesn't even work on release(!) tarballs.
                   (add-after 'unpack 'report-correct-version
-                    (lambda _ (substitute* "getver.sh"
-                                (("ver=unknown")
-                                 (string-append "ver=" ,version)))))
+                    (lambda _
+                      (substitute* "getver.sh"
+                        (("ver=unknown")
+                         (string-append "ver=" ,version)))
+                      #t))
                   (delete 'configure))  ; no configure script
        #:make-flags (list "CC=gcc"
                           (string-append "PREFIX=" %output))
@@ -4245,8 +4251,7 @@ Light is the successor of lightscript.")
              #t))
          (replace 'install
            (lambda _
-             (invoke "make" "install-tlp" "install-man")
-             #t))
+             (invoke "make" "install-tlp" "install-man")))
          (add-after 'install 'wrap
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let* ((bin (string-append (assoc-ref outputs "out") "/bin"))
diff --git a/gnu/packages/lirc.scm b/gnu/packages/lirc.scm
index 860822ce49..7ba2d44532 100644
--- a/gnu/packages/lirc.scm
+++ b/gnu/packages/lirc.scm
@@ -43,7 +43,8 @@
               (sha256
                (base32
                 "1whlyifvvc7w04ahq07nnk1h18wc8j7c6wnvlb6mszravxh3qxcb"))
-              (patches (search-patches "lirc-localstatedir.patch"))))
+              (patches (search-patches "lirc-localstatedir.patch"
+                                       "lirc-reproducible-build.patch"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags
diff --git a/gnu/packages/llvm.scm b/gnu/packages/llvm.scm
index dace546a47..8a9d1d312b 100644
--- a/gnu/packages/llvm.scm
+++ b/gnu/packages/llvm.scm
@@ -7,6 +7,7 @@
 ;;; Copyright © 2017 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tim Gesthuizen <tim.gesthuizen@yahoo.de>
 ;;; Copyright © 2018 Pierre Neidhardt <mail@ambrevar.xyz>
 ;;;
@@ -306,7 +307,8 @@ code analysis tools.")
    llvm-3.9.1
    "16gc2gdmp5c800qvydrdhsp0bzb97s8wrakl6i8a4lgslnqnf2fk"
    '("clang-runtime-asan-build-fixes.patch"
-     "clang-runtime-esan-build-fixes.patch")))
+     "clang-runtime-esan-build-fixes.patch"
+     "clang-3.5-libsanitizer-ustat-fix.patch")))
 
 (define-public clang-3.9.1
   (clang-from-llvm llvm-3.9.1 clang-runtime-3.9.1
@@ -330,7 +332,8 @@ code analysis tools.")
   (clang-runtime-from-llvm
    llvm-3.8
    "0p0y85c7izndbpg2l816z7z7558axq11d5pwkm4h11sdw7d13w0d"
-   '("clang-runtime-asan-build-fixes.patch")))
+   '("clang-runtime-asan-build-fixes.patch"
+     "clang-3.5-libsanitizer-ustat-fix.patch")))
 
 (define-public clang-3.8
   (clang-from-llvm llvm-3.8 clang-runtime-3.8
@@ -353,7 +356,8 @@ code analysis tools.")
   (clang-runtime-from-llvm
    llvm-3.7
    "10c1mz2q4bdq9bqfgr3dirc6hz1h3sq8573srd5q5lr7m7j6jiwx"
-   '("clang-runtime-asan-build-fixes.patch")))
+   '("clang-runtime-asan-build-fixes.patch"
+     "clang-3.5-libsanitizer-ustat-fix.patch")))
 
 (define-public clang-3.7
   (clang-from-llvm llvm-3.7 clang-runtime-3.7
diff --git a/gnu/packages/lsof.scm b/gnu/packages/lsof.scm
index 8b3ebe2945..311e244608 100644
--- a/gnu/packages/lsof.scm
+++ b/gnu/packages/lsof.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -77,6 +78,12 @@
             #t))
         (add-before 'check 'disable-failing-tests
           (lambda _
+            ;; In libc 2.28, the 'major' and 'minor' macros are provided by
+            ;; <sys/sysmacros.h> only so include it.
+            (substitute* "tests/LTlib.c"
+              (("#ifndef lint")
+               "#include <sys/sysmacros.h>\n\n#ifndef lint"))
+
             (substitute* "tests/Makefile"
               ;; Fails with ‘ERROR!!! client gethostbyaddr() failure’.
               (("(STDTST=.*) LTsock" _ prefix) prefix)
diff --git a/gnu/packages/m4.scm b/gnu/packages/m4.scm
index b223ce91d1..090f5578e3 100644
--- a/gnu/packages/m4.scm
+++ b/gnu/packages/m4.scm
@@ -32,6 +32,7 @@
             (method url-fetch)
             (uri (string-append "mirror://gnu/m4/m4-"
                                 version ".tar.xz"))
+            (patches (search-patches "m4-gnulib-libio.patch"))
             (sha256
              (base32
               "01sfjd5a4waqw83bibvmn522g69qfqvwig9i2qlgy154l1nfihgj"))))
diff --git a/gnu/packages/machine-learning.scm b/gnu/packages/machine-learning.scm
index a7df9dce06..5fb375c98c 100644
--- a/gnu/packages/machine-learning.scm
+++ b/gnu/packages/machine-learning.scm
@@ -334,13 +334,15 @@ algorithm.")
        (uri (string-append
              "https://www.imbs.uni-luebeck.de/fileadmin/files/Software"
              "/randomjungle/randomjungle-" version ".tar_.gz"))
+       (patches (search-patches "randomjungle-disable-static-build.patch"))
        (sha256
         (base32
          "12c8rf30cla71swx2mf4ww9mfd8jbdw5lnxd7dxhyw1ygrvg6y4w"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
-       (list (string-append "--with-boost="
+       (list "--disable-static"
+             (string-append "--with-boost="
                             (assoc-ref %build-inputs "boost")))
        #:phases
        (modify-phases %standard-phases
@@ -707,7 +709,7 @@ computing environments.")
 (define-public python-scikit-learn
   (package
     (name "python-scikit-learn")
-    (version "0.19.2")
+    (version "0.20.1")
     (source
      (origin
        (method git-fetch)
@@ -717,9 +719,7 @@ computing environments.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1dk9hdj01c0bny4ps78b7869fjw9gr6qklxf6wyql8h6nh4k19xm"))
-       (patches (search-patches
-                 "python-scikit-learn-fix-test-non-determinism.patch"))))
+         "0qv7ir1fy9vjar3llc72yxmfja3gxm5icdf0y3q57vsn3wcdglkz"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -730,11 +730,11 @@ computing environments.")
            (lambda _
              ;; Restrict OpenBLAS threads to prevent segfaults while testing!
              (setenv "OPENBLAS_NUM_THREADS" "1")
-             ;; Disable tests that require network access
-             (delete-file "sklearn/datasets/tests/test_mldata.py")
-             (delete-file "sklearn/datasets/tests/test_rcv1.py")
-             (invoke "pytest" "sklearn")
-             #t))
+
+             ;; Some tests require write access to $HOME.
+             (setenv "HOME" "/tmp")
+
+             (invoke "pytest" "sklearn" "-m" "not network")))
          ;; FIXME: This fails with permission denied
          (delete 'reset-gzip-timestamps))))
     (inputs
@@ -754,24 +754,7 @@ data analysis.")
     (license license:bsd-3)))
 
 (define-public python2-scikit-learn
-  (let ((parent (package-with-python2 python-scikit-learn)))
-    (package (inherit parent)
-      (arguments
-       (substitute-keyword-arguments (package-arguments parent)
-         ((#:phases phases)
-          `(modify-phases ,phases
-             (replace 'check
-               (lambda _
-                 ;; Restrict OpenBLAS threads to prevent segfaults while testing!
-                 (setenv "OPENBLAS_NUM_THREADS" "1")
-                 ;; Some tests expect to be able to write to HOME.
-                 (setenv "HOME" "/tmp")
-                 ;; Disable tests that require network access
-                 (delete-file "sklearn/datasets/tests/test_kddcup99.py")
-                 (delete-file "sklearn/datasets/tests/test_mldata.py")
-                 (delete-file "sklearn/datasets/tests/test_rcv1.py")
-                 (invoke "pytest" "sklearn")
-                 #t)))))))))
+  (package-with-python2 python-scikit-learn))
 
 (define-public python-autograd
   (let* ((commit "442205dfefe407beffb33550846434baa90c4de7")
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index bc544cc503..e88b315946 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -2681,7 +2681,7 @@ replacement for the @code{urlview} program.")
          ("guile-fibers" ,guile-fibers)
          ("guile-json" ,guile-json)
          ("guile-syntax-highlight" ,guile-syntax-highlight)
-         ("guile" ,guile-2.2.4)))
+         ("guile" ,guile-2.2)))
       (native-inputs
        `(("autoconf" ,autoconf)
          ("automake" ,automake)
diff --git a/gnu/packages/make-bootstrap.scm b/gnu/packages/make-bootstrap.scm
index 475749bbf6..65d632f64e 100644
--- a/gnu/packages/make-bootstrap.scm
+++ b/gnu/packages/make-bootstrap.scm
@@ -22,7 +22,7 @@
 (define-module (gnu packages make-bootstrap)
   #:use-module (guix utils)
   #:use-module (guix packages)
-  #:use-module (guix licenses)
+  #:use-module ((guix licenses) #:select (gpl3+))
   #:use-module (guix build-system trivial)
   #:use-module (guix build-system gnu)
   #:use-module ((gnu packages) #:select (search-patch))
@@ -34,6 +34,7 @@
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages bdw-gc)
+  #:use-module (gnu packages libunistring)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages hurd)
   #:use-module (gnu packages multiprecision)
@@ -440,6 +441,9 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                                                    "^gnu-user.*\\.h$"))
                       ((" -lgcc_s}}") "}}"))
                     #t)))))))
+     (inputs
+      `(("zlib:static" ,zlib "static")
+        ,@(package-inputs gcc)))
      (native-inputs
       (if (%current-target-system)
           `(;; When doing a Canadian cross, we need GMP/MPFR/MPC both
@@ -525,6 +529,10 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                   ;; Remove the 'debug' output (see above for the reason.)
                   (outputs (delete "debug" (package-outputs guile-2.2)))
 
+                  (inputs
+                   `(("libunistring:static" ,libunistring "static")
+                     ,@(package-inputs guile-2.2)))
+
                   (propagated-inputs
                    `(("bdw-gc" ,libgc)
                      ,@(alist-delete "bdw-gc"
diff --git a/gnu/packages/markup.scm b/gnu/packages/markup.scm
index cdcfbc7898..20da258029 100644
--- a/gnu/packages/markup.scm
+++ b/gnu/packages/markup.scm
@@ -173,7 +173,8 @@ convert it to structurally valid XHTML (or HTML).")
                 (string-append
                       "OTHERLDFLAGS = -lmarkdown -Wl,-rpath="
                       (assoc-ref inputs "discount")
-                      "/lib"))))))))
+                      "/lib")))
+             #t)))))
     (inputs
      `(("discount" ,discount)))
     (home-page
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index 3dabef441e..f1b5bb0646 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -322,15 +322,15 @@ enough to be used effectively as a scientific calculator.")
 (define-public double-conversion
   (package
     (name "double-conversion")
-    (version "3.0.0")
+    (version "3.1.0")
     (home-page "https://github.com/google/double-conversion")
     (source (origin
-              (method url-fetch)
-              (uri (string-append home-page "/archive/v" version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference (url home-page) (commit version)))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "059r1czs28ljjd388pn6l3njg1ghbf1cv3q9nkxv3dj2a8siabqm"))))
+                "123rb2p4snqagrybw66vnapchqdwn2rfpr1wcq0ya9gwbyl7xccx"))))
     (build-system cmake-build-system)
     (arguments
      '(#:test-target "test"
@@ -2600,15 +2600,16 @@ YACC = bison -pscotchyy -y -b y
            (replace
             'build
             (lambda _
-              (and
-               (zero? (system* "make"
-                               (format #f "-j~a" (parallel-job-count))
-                               "ptscotch" "ptesmumps"))
-               ;; Install the serial metis compatibility library
-               (zero? (system* "make" "-C" "libscotchmetis" "install")))))
-           (replace
-            'check
-            (lambda _ (zero? (system* "make" "ptcheck"))))))))
+              (invoke "make" (format #f "-j~a" (parallel-job-count))
+                      "ptscotch" "ptesmumps")
+
+              ;; Install the serial metis compatibility library
+              (invoke "make" "-C" "libscotchmetis" "install")))
+           (add-before 'check 'mpi-setup
+	     ,%openmpi-setup)
+           (replace 'check
+             (lambda _
+               (invoke "make" "ptcheck")))))))
     (synopsis "Programs and libraries for graph algorithms (with MPI)")))
 
 (define-public pt-scotch32
@@ -2622,15 +2623,15 @@ YACC = bison -pscotchyy -y -b y
         `(modify-phases ,scotch32-phases
            (replace 'build
              (lambda _
-               (and
-                (zero? (system* "make"
-                                (format #f "-j~a" (parallel-job-count))
-                                "ptscotch" "ptesmumps"))
-                ;; Install the serial metis compatibility library
-                (zero? (system* "make" "-C" "libscotchmetis" "install")))))
+               (invoke "make" (format #f "-j~a" (parallel-job-count))
+                       "ptscotch" "ptesmumps")
+               ;; Install the serial metis compatibility library
+               (invoke "make" "-C" "libscotchmetis" "install")))
+           (add-before 'check 'mpi-setup
+	     ,%openmpi-setup)
            (replace 'check
              (lambda _
-               (zero? (system* "make" "ptcheck"))))))))
+               (invoke "make" "ptcheck")))))))
     (synopsis
      "Programs and libraries for graph algorithms (with MPI and 32-bit integers)")))
 
@@ -2972,7 +2973,7 @@ parts of it.")
 (define-public openblas
   (package
     (name "openblas")
-    (version "0.3.2")
+    (version "0.3.3")
     (source
      (origin
        (method url-fetch)
@@ -2981,7 +2982,7 @@ parts of it.")
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32
-         "0b20km2jv7m6qiylrlvhq2vnmkmilb633mr8rhqmgbn1wqrp58jq"))))
+         "0cvlixnpc3cdvvn3f30phfvsgnqljqix6wn72ps9rj7xdhvw06jg"))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
diff --git a/gnu/packages/mono.scm b/gnu/packages/mono.scm
index 16c4f71dde..17f90fe30a 100644
--- a/gnu/packages/mono.scm
+++ b/gnu/packages/mono.scm
@@ -41,7 +41,8 @@
                     ".tar.bz2"))
               (sha256
                (base32
-                "0jibyvyv2jy8dq5ij0j00iq3v74r0y90dcjc3dkspcfbnn37cphn"))))
+                "0jibyvyv2jy8dq5ij0j00iq3v74r0y90dcjc3dkspcfbnn37cphn"))
+              (patches (search-patches "mono-mdoc-timestamping.patch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("gettext" ,gettext-minimal)
@@ -52,10 +53,26 @@
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'make-reproducible
+           (lambda _
+             (substitute* "mono/mini/Makefile.in"
+              (("build_date = [^;]*;")
+               "build_date = (void*) 0;"))
+             #t))
          (add-after 'unpack 'set-env
            (lambda _ ;;* (#:key inputs #:allow-other-keys)
              ;; all tests under mcs/class fail trying to access $HOME
-             (setenv "HOME" "/tmp")))
+             (setenv "HOME" "/tmp")
+             ;; ZIP files have "DOS time" which starts in Jan 1980.
+             (setenv "SOURCE_DATE_EPOCH" "315532800")
+             #t))
+         (add-after 'unpack 'fix-includes
+           (lambda _
+             ;; makedev is in <sys/sysmacros.h> now.  Include it.
+             (substitute* "mono/io-layer/processes.c"
+              (("#ifdef HAVE_SYS_MKDEV_H") "#if 1")
+              (("sys/mkdev.h") "sys/sysmacros.h"))
+             #t))
          (add-after 'unpack 'patch-tests
            (lambda _  ;;* (#:key inputs #:allow-other-keys)
              (substitute* "mono/tests/Makefile.in"
diff --git a/gnu/packages/music.scm b/gnu/packages/music.scm
index 071442d773..faf5aab09a 100644
--- a/gnu/packages/music.scm
+++ b/gnu/packages/music.scm
@@ -18,6 +18,7 @@
 ;;; Copyright © 2018 Stefan Reichör <stefan@xsteve.at>
 ;;; Copyright © 2018 Pierre Neidhardt <mail@ambrevar.xyz>
 ;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2018 Björn Höfling <bjoern.hoefling@bjoernhoefling.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -716,6 +717,7 @@ audio and video).")
     (build-system scons-build-system)
     (arguments
      `(#:scons-flags (list (string-append "PREFIX=" %output))
+       #:scons ,scons-python2
        #:tests? #f)) ;no "check" target
     (inputs
      `(("boost" ,boost)
@@ -2284,47 +2286,52 @@ follows a traditional multi-track tape recorder control paradigm.")
     (license license:gpl2+)))
 
 (define-public ams-lv2
-  (package
-    (name "ams-lv2")
-    (version "1.2.1")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/blablack/ams-lv2.git")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "1n1dnqnj24xhiy9323lj52nswr5120cj56fpckg802miss05sr6x"))))
-    (build-system waf-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'remove-sse-flags
-           (lambda* (#:key system #:allow-other-keys)
-             (when (not (or (string-prefix? "x86_64" system)
-                            (string-prefix? "i686" system)))
-               (substitute* "wscript"
-                 (("'-msse', '-mfpmath=sse', ") ""))
-             #t))))
-       #:tests? #f)) ; no tests
-    (inputs
-     `(("lv2" ,lv2)
-       ("lvtk" ,lvtk)
-       ("gtkmm" ,gtkmm-2)
-       ("gtk" ,gtk+-2)
-       ("cairo" ,cairo)
-       ("fftw" ,fftw)))
-    (native-inputs
-     `(("pkg-config" ,pkg-config)))
-    (home-page "https://objectivewave.wordpress.com/ams-lv2/")
-    (synopsis "Port of Alsa Modular Synth internal modules into LV2")
-    (description "This set of LV2 plugins is a port of the internal modules
+  ;; Version 1.2.1 built with Python 3.7 raises an error in the waf-script.
+  ;; Therefore, we take two more commmits than 1.2.1 that introduce an updated
+  ;; waf-script and fix one error.
+  (let ((commit "377d166db54a787b48979171c5652d2eb4f1bbb5")
+        (revision "1"))
+    (package
+      (name "ams-lv2")
+      (version (git-version "1.2.1" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/blablack/ams-lv2.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "1ndgxcxjxwidg7436k0nb5clxkyi878k1j999sbbd1gk2fm0kcqm"))))
+      (build-system waf-build-system)
+      (arguments
+       `(#:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'remove-sse-flags
+             (lambda* (#:key system #:allow-other-keys)
+               (unless (or (string-prefix? "x86_64" system)
+                              (string-prefix? "i686" system))
+                     (substitute* "wscript"
+                       (("'-msse', '-mfpmath=sse', ") "")))
+               #t)))
+         #:tests? #f)) ; no tests
+      (inputs
+       `(("lv2" ,lv2)
+         ("lvtk" ,lvtk)
+         ("gtkmm" ,gtkmm-2)
+         ("gtk" ,gtk+-2)
+         ("cairo" ,cairo)
+         ("fftw" ,fftw)))
+      (native-inputs
+       `(("pkg-config" ,pkg-config)))
+      (home-page "https://objectivewave.wordpress.com/ams-lv2/")
+      (synopsis "Port of Alsa Modular Synth internal modules into LV2")
+      (description "This set of LV2 plugins is a port of the internal modules
 found in Alsa Modular Synth.  These plugins are used to create modular
 synthesizers and contain: VCO, VCF, VCA, LFO, slew limiter, envelopes, sample
 and hold, etc.")
-    (license license:gpl2)))
+      (license license:gpl2))))
 
 (define-public gxtuner
   (package
diff --git a/gnu/packages/nettle.scm b/gnu/packages/nettle.scm
index 67a3062a5a..1212f32812 100644
--- a/gnu/packages/nettle.scm
+++ b/gnu/packages/nettle.scm
@@ -44,8 +44,22 @@
      ;; $libdir, which is not the case by default.  Work around it.
      '(#:configure-flags (list (string-append "LDFLAGS=-Wl,-rpath="
                                               (assoc-ref %outputs "out")
-                                              "/lib"))))
-    (outputs '("out" "debug"))
+                                              "/lib"))
+       #:phases (modify-phases %standard-phases
+                  (add-after 'install 'move-static-libraries
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (let ((out (assoc-ref outputs "out"))
+                            (slib (string-append (assoc-ref outputs "static")
+                                                 "/lib")))
+                        (mkdir-p slib)
+                        (with-directory-excursion (string-append out "/lib")
+                          (for-each (lambda (ar)
+                                      (rename-file ar (string-append
+                                                       slib "/"
+                                                       (basename ar))))
+                                    (find-files "." "\\.a$")))
+                        #t))))))
+    (outputs '("out" "debug" "static"))
     (native-inputs `(("m4" ,m4)))
     (propagated-inputs `(("gmp" ,gmp)))
     (home-page "https://www.lysator.liu.se/~nisse/nettle/")
diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index 5504742fa8..a9e1576733 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -144,7 +144,8 @@ or, more generally, MAC addresses of the same category of hardware.")
           'check 'disable-checkconf-test
           (lambda _
             (substitute* "src/Makefile"
-              (("^TESTS = .*") "TESTS = \n")))))))
+              (("^TESTS = .*") "TESTS = \n"))
+            #t)))))
     (home-page "http://www.remlab.net/miredo/")
     (synopsis "Teredo IPv6 tunneling software")
     (description
@@ -216,7 +217,7 @@ libwrap.so: $(LIB_OBJ)\n
              (substitute* "scaffold.c"
                (("extern char .malloc.*;") ""))
              ;; This, believe it or not, is the recommended way to build!
-             (zero? (system* "make" "REAL_DAEMON_DIR=/etc" "linux"))))
+             (invoke "make" "REAL_DAEMON_DIR=/etc" "linux")))
          ;; There is no make install stage, so we have to do it ourselves.
          (replace 'install
            (lambda _
@@ -251,7 +252,8 @@ libwrap.so: $(LIB_OBJ)\n
                (for-each
                 (lambda (x)
                   (install-file x (string-append out "/bin/")))
-                bins)))))))
+                bins))
+             #t)))))
     (home-page "http://www.porcupine.org")
     (synopsis  "Monitor and filter incoming requests for network services")
     (description "With this package you can monitor and filter incoming requests for
@@ -373,8 +375,8 @@ files contain direct mappings of the abstractions provided by the ØMQ C API.")
                ;; librdkafka++.so lacks RUNPATH for librdkafka.so
                (setenv "LDFLAGS"
                        (string-append "-Wl,-rpath=" out "/lib"))
-               (zero? (system* "./configure"
-                               (string-append "--prefix=" out)))))))))
+               (invoke "./configure"
+                       (string-append "--prefix=" out))))))))
     (native-inputs
      `(("python" ,python-wrapper)))
     (propagated-inputs
@@ -457,7 +459,8 @@ Ethernet devices.")
                            (bin (string-append out "/bin")))
                       (mkdir-p bin)
                       (copy-file "ifstatus"
-                                 (string-append bin "/ifstatus"))))))))
+                                 (string-append bin "/ifstatus")))
+                    #t)))))
     (inputs `(("ncurses" ,ncurses)))
     (home-page "http://ifstatus.sourceforge.net/graphic/index.html")
     (synopsis "Text based network interface status monitor")
@@ -511,14 +514,16 @@ and min/max network usage.")
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* "src/tun.c"
                (("PATH=[^ ]* ")
-                (string-append (assoc-ref inputs "net-tools") "/bin/")))))
+                (string-append (assoc-ref inputs "net-tools") "/bin/")))
+             #t))
          (add-before 'check 'delete-failing-tests
            ;; Avoid https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802105.
            (lambda _
              (substitute* "tests/common.c"
                (("tcase_add_test\\(tc, \
 test_parse_format_ipv(4(|_listen_all|_mapped_ipv6)|6)\\);")
-                "")))))
+                ""))
+             #t)))
        #:make-flags (list "CC=gcc"
                           (string-append "prefix=" (assoc-ref %outputs "out")))
        #:test-target "test"))
@@ -779,7 +784,8 @@ application stack itself.")
                (("ENV_CURL_BIN.get\\('curl'\\)")
                 (string-append "ENV_CURL_BIN.get('"
                                (assoc-ref inputs "curl")
-                               "/bin/curl')"))))))))
+                               "/bin/curl')")))
+             #t)))))
     (home-page "https://github.com/reorx/httpstat")
     (synopsis "Visualize curl statistics")
     (description
@@ -949,7 +955,7 @@ private (reserved).")
                             ,(string-append "PREFIX=" out)
                             "INSTALLDIRS=site")))
                (setenv "CONFIG_SHELL" (which "sh"))
-               (zero? (apply system* "perl" args))))))))
+               (apply invoke "perl" args)))))))
   (home-page "https://metacpan.org/release/Socket6")
   (synopsis
     "IPv6 related part of the C socket.h defines and structure manipulators for Perl")
@@ -1009,7 +1015,7 @@ offline emulation of DNS.")
                             ,(string-append "PREFIX=" out)
                             "INSTALLDIRS=site")))
                (setenv "CONFIG_SHELL" (which "sh"))
-               (zero? (apply system* "perl" args))))))))
+               (apply invoke "perl" args)))))))
   (home-page
     "https://metacpan.org/release/NetAddr-IP")
   (synopsis
@@ -1145,7 +1151,7 @@ sockets in Perl.")
        (modify-phases %standard-phases
          (replace 'check
                   (lambda _
-                    (zero? (system* "ctest" "-E" "url-test")))))))
+                    (invoke "ctest" "-E" "url-test"))))))
     (synopsis "Library providing automatic proxy configuration management")
     (description "Libproxy handles the details of HTTP/HTTPS proxy
 configuration for applications across all scenarios.  Applications using
@@ -1416,13 +1422,13 @@ procedure calls (RPCs).")
        (modify-phases %standard-phases
          (replace 'install
            (lambda _
-             (zero? (system* "make"
-                             ;; Don't try to create directories under /var.
-                             "RUNDIR=/tmp"
-                             "PKIDIR=/tmp"
-                             "LOGDIR=/tmp"
-                             "DBDIR=/tmp"
-                             "install")))))))
+             (invoke "make"
+                     ;; Don't try to create directories under /var.
+                     "RUNDIR=/tmp"
+                     "PKIDIR=/tmp"
+                     "LOGDIR=/tmp"
+                     "DBDIR=/tmp"
+                     "install"))))))
     (native-inputs
      `(("perl" ,perl)
        ("pkg-config" ,pkg-config)
@@ -1723,8 +1729,8 @@ interface and a programmable text output for scripting.")
            (lambda _ (chdir "libnet") #t))
          (add-before 'build 'build-doc
            (lambda* (#:key make-flags #:allow-other-keys)
-             (zero? (apply system* "make" "-C" "doc" "doc"
-                           make-flags)))))))
+             (apply invoke "make" "-C" "doc" "doc"
+                    make-flags))))))
     (native-inputs
      `(("autoconf" ,autoconf)
        ("automake" ,automake)
diff --git a/gnu/packages/nfs.scm b/gnu/packages/nfs.scm
index f6bb5b3b71..bdb36d272b 100644
--- a/gnu/packages/nfs.scm
+++ b/gnu/packages/nfs.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2017, 2018 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -60,6 +61,13 @@
          ,(string-append "--with-krb5=" (assoc-ref %build-inputs "mit-krb5")))
        #:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'fix-glibc-compatability
+           (lambda _
+             (substitute* '("utils/blkmapd/device-discovery.c"
+                            "utils/blkmapd/dm-device.c")
+               (("<sys/stat.h>")
+                "<sys/stat.h>\n#include <sys/sysmacros.h>"))
+             #t))
          (add-before 'configure 'adjust-command-file-names
            (lambda _
              ;; Remove assumptions of FHS from start-statd script
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index b525804bdb..a0221601dd 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -184,7 +184,7 @@
      `(("c-ares" ,c-ares)
        ("http-parser" ,http-parser)
        ("icu4c" ,icu4c)
-       ("libuv" ,libuv)
+       ("libuv" ,libuv-1.19)
        ("nghttp2" ,nghttp2 "lib")
        ("openssl" ,openssl)
        ("zlib" ,zlib)))
diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index 962a9c8cfe..850223cd4c 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -84,11 +84,9 @@
    (native-inputs `(("libtool" ,libtool)))
    (arguments
     `(#:tests? #f
+      #:configure-flags '("--disable-static")
       #:phases
       (modify-phases %standard-phases
-        (add-after 'configure 'provide-libtool
-          (lambda _ (copy-file (which "libtool") "libtool")
-            #t))
         (add-after 'install 'patch-sasl-path
           ;; Give -L arguments for cyrus-sasl to avoid propagation.
           (lambda* (#:key inputs outputs #:allow-other-keys)
diff --git a/gnu/packages/openstack.scm b/gnu/packages/openstack.scm
index 64e05c4b0e..c07f011c9d 100644
--- a/gnu/packages/openstack.scm
+++ b/gnu/packages/openstack.scm
@@ -182,7 +182,7 @@ guidelines}.")
        ("python-pbr" ,python-pbr)))
     (native-inputs
       `(("python-openstackdocstheme" ,python-openstackdocstheme)
-        ("python-sphinx" ,python-sphinx-1.6)
+        ("python-sphinx" ,python-sphinx)
         ("python-subunit" ,python-subunit)
         ("python-testrepository" ,python-testrepository)
         ("python-testtools" ,python-testtools)))
@@ -216,7 +216,7 @@ with mox as possible, but small enhancements have been made.")
      `(("python-dulwich" ,python-dulwich)
        ("python-pbr" ,python-pbr)))
     (native-inputs
-     `(("python-sphinx" ,python-sphinx-1.6)))
+     `(("python-sphinx" ,python-sphinx)))
     (home-page "https://docs.openstack.org/openstackdocstheme/latest/")
     (synopsis "OpenStack Docs Theme")
     (description
@@ -313,7 +313,7 @@ to docs.openstack.org and developer.openstack.org.")
        ("python-six" ,python-six)))
     (native-inputs
      `(("python-mock" ,python-mock)
-       ("python-sphinx" ,python-sphinx-1.6)
+       ("python-sphinx" ,python-sphinx)
        ("python-testrepository" ,python-testrepository)))
     (home-page "https://github.com/dreamhost/stevedore")
     (synopsis "Manage dynamic plugins for Python applications")
@@ -405,7 +405,7 @@ common features used in Tempest.")
        ("python-openstackdocstheme" ,python-openstackdocstheme)
        ("python-oslotest" ,python-oslotest)
        ("python-reno" ,python-reno)
-       ("python-sphinx" ,python-sphinx-1.6)
+       ("python-sphinx" ,python-sphinx)
        ("python-testrepository" ,python-testrepository)
        ("python-testscenarios" ,python-testscenarios)
        ("python-testtools" ,python-testtools)))
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index c4e9171022..c5ba65a863 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -267,9 +267,7 @@
          ("sqlite" ,sqlite)
          ("libgcrypt" ,libgcrypt)
 
-         ;; Use 2.2.4 to avoid various thread-safety issues while building
-         ;; code in parallel.
-         ("guile" ,guile-2.2.4)
+         ("guile" ,guile-2.2)
 
          ;; Many tests rely on the 'guile-bootstrap' package, which is why we
          ;; have it here.
@@ -570,13 +568,13 @@ transactions from C or Python.")
 (define-public diffoscope
   (package
     (name "diffoscope")
-    (version "105")
+    (version "106")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri name version))
               (sha256
                (base32
-                "0bqkwvrvlvybqfi73qv1k5xic2qzw5lv20imqadf1wc4l8vc0vq3"))))
+                "0qrfp7nha2n2s9h5ibcf7rqji1amh4cqbcf80m6anim6p3ik26da"))))
     (build-system python-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
@@ -587,6 +585,12 @@ transactions from C or Python.")
                     (lambda _
                       (substitute* "setup.py"
                         (("'python-magic',") ""))))
+                  ;; This test is broken because our `file` package has a
+                  ;; bug in berkeley-db file type detection.
+                  (add-after 'unpack 'remove-berkeley-test
+                    (lambda _
+                      (delete-file "tests/comparators/test_berkeley_db.py")
+                      #t))
                   (add-after 'unpack 'embed-tool-references
                     (lambda* (#:key inputs #:allow-other-keys)
                       (substitute* "diffoscope/comparators/utils/compare.py"
diff --git a/gnu/packages/patches/aegisub-boost68.patch b/gnu/packages/patches/aegisub-boost68.patch
new file mode 100644
index 0000000000..013721f3bd
--- /dev/null
+++ b/gnu/packages/patches/aegisub-boost68.patch
@@ -0,0 +1,35 @@
+Source: https://git.archlinux.org/svntogit/community.git/plain/trunk/boost-1.68.patch?h=packages/aegisub
+From d8336d2fed73c72d1227b343d6acfb991bc1651b Mon Sep 17 00:00:00 2001
+From: Jan Beich <jbeich@FreeBSD.org>
+Date: Mon, 9 Jul 2018 20:15:29 +0000
+Subject: [PATCH] Keep using std::distance after Boost 1.68
+
+src/search_replace_engine.cpp:256:14: error: call to
+      'distance' is ambiguous
+                                count += distance(
+                                         ^~~~~~~~
+/usr/include/c++/v1/iterator:511:1: note: candidate function [with _InputIter =
+      boost::u32regex_iterator<std::__1::__wrap_iter<const char *> >]
+distance(_InputIter __first, _InputIter __last)
+^
+/usr/local/include/boost/iterator/distance.hpp:49:9: note: candidate function [with SinglePassIterator =
+      boost::u32regex_iterator<std::__1::__wrap_iter<const char *> >]
+        distance(SinglePassIterator first, SinglePassIterator last)
+        ^
+---
+ src/search_replace_engine.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/search_replace_engine.cpp b/src/search_replace_engine.cpp
+index 594c21e5e..14c71680d 100644
+--- a/src/search_replace_engine.cpp
++++ b/src/search_replace_engine.cpp
+@@ -253,7 +253,7 @@ bool SearchReplaceEngine::ReplaceAll() {
+ 			if (MatchState ms = matches(&diag, 0)) {
+ 				auto& diag_field = diag.*get_dialogue_field(settings.field);
+ 				std::string const& text = diag_field.get();
+-				count += distance(
++				count += std::distance(
+ 					boost::u32regex_iterator<std::string::const_iterator>(begin(text), end(text), *ms.re),
+ 					boost::u32regex_iterator<std::string::const_iterator>());
+ 				diag_field = u32regex_replace(text, *ms.re, settings.replace_with);
diff --git a/gnu/packages/patches/binutils-aarch64-symbol-relocation.patch b/gnu/packages/patches/binutils-aarch64-symbol-relocation.patch
deleted file mode 100644
index fbd596862b..0000000000
--- a/gnu/packages/patches/binutils-aarch64-symbol-relocation.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-Fix a regression in Binutils 2.30 where some symbols are incorrectly assumed
-to be addresses:
-
-https://sourceware.org/bugzilla/show_bug.cgi?id=22764
-
-Patch taken from upstream (with ChangeLog entries and tests omitted):
-
-https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=279b2f94168ee91e02ccd070d27c983fc001fe12
-
-diff --git a/bfd/elfnn-aarch64.c b/bfd/elfnn-aarch64.c
-index af448f9..2737773 100644
---- a/bfd/elfnn-aarch64.c
-+++ b/bfd/elfnn-aarch64.c
-@@ -7189,10 +7189,19 @@ elfNN_aarch64_check_relocs (bfd *abfd, struct bfd_link_info *info,
- #if ARCH_SIZE == 64
- 	case BFD_RELOC_AARCH64_32:
- #endif
--	  if (bfd_link_pic (info)
--	      && (sec->flags & SEC_ALLOC) != 0
--	      && (sec->flags & SEC_READONLY) != 0)
-+	  if (bfd_link_pic (info) && (sec->flags & SEC_ALLOC) != 0)
- 	    {
-+	      if (h != NULL
-+		  /* This is an absolute symbol.  It represents a value instead
-+		     of an address.  */
-+		  && ((h->root.type == bfd_link_hash_defined
-+		       && bfd_is_abs_section (h->root.u.def.section))
-+		      /* This is an undefined symbol.  */
-+		      || h->root.type == bfd_link_hash_undefined))
-+		break;
-+
-+	      /* For local symbols, defined global symbols in a non-ABS section,
-+		 it is assumed that the value is an address.  */
- 	      int howto_index = bfd_r_type - BFD_RELOC_AARCH64_RELOC_START;
- 	      _bfd_error_handler
- 		/* xgettext:c-format */
diff --git a/gnu/packages/patches/blender-newer-ffmpeg.patch b/gnu/packages/patches/blender-newer-ffmpeg.patch
new file mode 100644
index 0000000000..363489bc70
--- /dev/null
+++ b/gnu/packages/patches/blender-newer-ffmpeg.patch
@@ -0,0 +1,80 @@
+https://sources.debian.org/data/main/b/blender/2.79.b+dfsg0-4/debian/patches/0008-fix_building_with_latest_versions_of_FFmpeg.patch
+
+From: Bastien Montagne <montagne29@wanadoo.fr>
+Date: Tue, 8 May 2018 16:00:52 +0200
+Subject: fix_building_with_latest_versions_of_FFmpeg
+
+Some years-old deprecated stuff has now been removed.
+
+Correct solution is probably to use valid defines etc. in own code, but
+this is more FFMEPG maintainer task (since it also may change how old
+FFMPEG we do support...).
+---
+ intern/ffmpeg/ffmpeg_compat.h                  | 39 ++++++++++++++++++++++++++
+ source/blender/blenkernel/intern/writeffmpeg.c |  3 +-
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/intern/ffmpeg/ffmpeg_compat.h b/intern/ffmpeg/ffmpeg_compat.h
+index 9c06c8a..f7f437c 100644
+--- a/intern/ffmpeg/ffmpeg_compat.h
++++ b/intern/ffmpeg/ffmpeg_compat.h
+@@ -109,6 +109,45 @@ int av_sample_fmt_is_planar(enum AVSampleFormat sample_fmt)
+ 
+ #endif
+ 
++/* XXX TODO Probably fix to correct modern flags in code? Not sure how old FFMPEG we want to support though,
++ * so for now this will do. */
++
++#ifndef FF_MIN_BUFFER_SIZE
++#  ifdef AV_INPUT_BUFFER_MIN_SIZE
++#    define FF_MIN_BUFFER_SIZE AV_INPUT_BUFFER_MIN_SIZE
++#  endif
++#endif
++
++#ifndef FF_INPUT_BUFFER_PADDING_SIZE
++#  ifdef AV_INPUT_BUFFER_PADDING_SIZE
++#    define FF_INPUT_BUFFER_PADDING_SIZE AV_INPUT_BUFFER_PADDING_SIZE
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_GLOBAL_HEADER
++#  ifdef AV_CODEC_FLAG_GLOBAL_HEADER
++#    define CODEC_FLAG_GLOBAL_HEADER AV_CODEC_FLAG_GLOBAL_HEADER
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_GLOBAL_HEADER
++#  ifdef AV_CODEC_FLAG_GLOBAL_HEADER
++#    define CODEC_FLAG_GLOBAL_HEADER AV_CODEC_FLAG_GLOBAL_HEADER
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_INTERLACED_DCT
++#  ifdef AV_CODEC_FLAG_INTERLACED_DCT
++#    define CODEC_FLAG_INTERLACED_DCT AV_CODEC_FLAG_INTERLACED_DCT
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_INTERLACED_ME
++#  ifdef AV_CODEC_FLAG_INTERLACED_ME
++#    define CODEC_FLAG_INTERLACED_ME AV_CODEC_FLAG_INTERLACED_ME
++#  endif
++#endif
++
+ /* FFmpeg upstream 1.0 is the first who added AV_ prefix. */
+ #if LIBAVCODEC_VERSION_INT < AV_VERSION_INT(54, 59, 100)
+ #  define AV_CODEC_ID_NONE CODEC_ID_NONE
+diff --git a/source/blender/blenkernel/intern/writeffmpeg.c b/source/blender/blenkernel/intern/writeffmpeg.c
+index a19e414..04d508a 100644
+--- a/source/blender/blenkernel/intern/writeffmpeg.c
++++ b/source/blender/blenkernel/intern/writeffmpeg.c
+@@ -605,7 +605,8 @@ static AVStream *alloc_video_stream(FFMpegContext *context, RenderData *rd, int
+ 	c->rc_buffer_aggressivity = 1.0;
+ #endif
+ 
+-	c->me_method = ME_EPZS;
++	/* Deprecated and not doing anything since July 2015, deleted in recent ffmpeg */
++	//c->me_method = ME_EPZS;
+ 	
+ 	codec = avcodec_find_encoder(c->codec_id);
+ 	if (!codec)
diff --git a/gnu/packages/patches/cairo-setjmp-wrapper.patch b/gnu/packages/patches/cairo-setjmp-wrapper.patch
new file mode 100644
index 0000000000..bffac6e041
--- /dev/null
+++ b/gnu/packages/patches/cairo-setjmp-wrapper.patch
@@ -0,0 +1,78 @@
+Revert faulty commit to avoid undefined behaviour:
+https://bugs.freedesktop.org/show_bug.cgi?id=104325
+
+Taken from this upstream commit:
+https://cgit.freedesktop.org/cairo/commit/?h=1.14&id=2acc4382c54bd8239361ceed14423412a343d311
+
+diff --git a/src/cairo-bentley-ottmann-rectangular.c b/src/cairo-bentley-ottmann-rectangular.c
+index cb2e30c..5541bdc 100644
+--- a/src/cairo-bentley-ottmann-rectangular.c
++++ b/src/cairo-bentley-ottmann-rectangular.c
+@@ -593,12 +593,6 @@ sweep_line_insert (sweep_line_t	*sweep, rectangle_t *rectangle)
+     pqueue_push (sweep, rectangle);
+ }
+ 
+-static int
+-sweep_line_setjmp (sweep_line_t *sweep_line)
+-{
+-    return setjmp (sweep_line->unwind);
+-}
+-
+ static cairo_status_t
+ _cairo_bentley_ottmann_tessellate_rectangular (rectangle_t	**rectangles,
+ 					       int			  num_rectangles,
+@@ -615,7 +609,7 @@ _cairo_bentley_ottmann_tessellate_rectangular (rectangle_t	**rectangles,
+ 		     rectangles, num_rectangles,
+ 		     fill_rule,
+ 		     do_traps, container);
+-    if ((status = sweep_line_setjmp (&sweep_line)))
++    if ((status = setjmp (sweep_line.unwind)))
+ 	return status;
+ 
+     rectangle = rectangle_pop_start (&sweep_line);
+diff --git a/src/cairo-png.c b/src/cairo-png.c
+index e64b14a..068617d 100644
+--- a/src/cairo-png.c
++++ b/src/cairo-png.c
+@@ -158,14 +158,6 @@ png_simple_warning_callback (png_structp png,
+      */
+ }
+ 
+-static int
+-png_setjmp (png_struct *png)
+-{
+-#ifdef PNG_SETJMP_SUPPORTED
+-    return setjmp (png_jmpbuf (png));
+-#endif
+-    return 0;
+-}
+ 
+ /* Starting with libpng-1.2.30, we must explicitly specify an output_flush_fn.
+  * Otherwise, we will segfault if we are writing to a stream. */
+@@ -237,8 +229,10 @@ write_png (cairo_surface_t	*surface,
+ 	goto BAIL4;
+     }
+ 
+-    if (png_setjmp (png))
++#ifdef PNG_SETJMP_SUPPORTED
++    if (setjmp (png_jmpbuf (png)))
+ 	goto BAIL4;
++#endif
+ 
+     png_set_write_fn (png, closure, write_func, png_simple_output_flush_fn);
+ 
+@@ -577,11 +571,12 @@ read_png (struct png_read_closure_t *png_closure)
+     png_set_read_fn (png, png_closure, stream_read_func);
+ 
+     status = CAIRO_STATUS_SUCCESS;
+-
+-    if (png_setjmp (png)) {
++#ifdef PNG_SETJMP_SUPPORTED
++    if (setjmp (png_jmpbuf (png))) {
+ 	surface = _cairo_surface_create_in_error (status);
+ 	goto BAIL;
+     }
++#endif
+ 
+     png_read_info (png, info);
+ 
diff --git a/gnu/packages/patches/casync-renameat2-declaration.patch b/gnu/packages/patches/casync-renameat2-declaration.patch
new file mode 100644
index 0000000000..74c2ca7b3c
--- /dev/null
+++ b/gnu/packages/patches/casync-renameat2-declaration.patch
@@ -0,0 +1,27 @@
+Fix build failure on glibc 2.28 where 'renameat2' would end up being
+declared twice: <https://github.com/systemd/casync/issues/166>.
+
+From 625244ca47e8ee1375d2d0092271bfd13b0913ea Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Tue, 13 Nov 2018 17:52:48 +0100
+Subject: [PATCH] meson.build: pass -D_GNU_SOURCE when checking for functions
+
+As described in #166, -D_GNU_SOURCE needs to be passed to the meson function
+availability checker. h/t to @tomeon for providing a link to the solution as
+well.
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index f42ed16..c0f741e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -78,6 +78,6 @@ foreach ident : [
+         ['copy_file_range',   '''#include <sys/syscall.h>
+                                  #include <unistd.h>'''],
+ ]
+-        have = cc.has_function(ident[0], prefix : ident[1])
++        have = cc.has_function(ident[0], args : '-D_GNU_SOURCE', prefix : ident[1])
+         conf.set10('HAVE_' + ident[0].to_upper(), have)
+ endforeach
diff --git a/gnu/packages/patches/ceph-detect-rocksdb.patch b/gnu/packages/patches/ceph-detect-rocksdb.patch
new file mode 100644
index 0000000000..badad6d1b9
--- /dev/null
+++ b/gnu/packages/patches/ceph-detect-rocksdb.patch
@@ -0,0 +1,24 @@
+Help the build system find system RocksDB.
+
+Taken from this upstream commit:
+https://github.com/ceph/ceph/commit/2ac26bd0e01fd6c82bd59936cf25c25173f7775a
+
+diff --git a/cmake/modules/Findrocksdb.cmake b/cmake/modules/Findrocksdb.cmake
+index f8369f73fc..5926647348 100644
+--- a/cmake/modules/Findrocksdb.cmake
++++ b/cmake/modules/Findrocksdb.cmake
+@@ -15,11 +15,11 @@ find_library(ROCKSDB_LIBRARIES rocksdb)
+ 
+ if(ROCKSDB_INCLUDE_DIR AND EXISTS "${ROCKSDB_INCLUDE_DIR}/rocksdb/version.h")
+   foreach(ver "MAJOR" "MINOR" "PATCH")
+-    file(STRINGS "${ROCKSDB_INCLUDE_DIR}/version.h" ROCKSDB_VER_${ver}_LINE
++    file(STRINGS "${ROCKSDB_INCLUDE_DIR}/rocksdb/version.h" ROCKSDB_VER_${ver}_LINE
+       REGEX "^#define[ \t]+ROCKSDB_${ver}[ \t]+[0-9]+$")
+     string(REGEX REPLACE "^#define[ \t]+ROCKSDB_${ver}[ \t]+([0-9]+)$"
+-      "\\1" ROCKSDB_VERSION_${ver} "${ROCKDB_VER_${ver}_LINE}")
+-    unset(${ROCKDB_VER_${ver}_LINE})
++      "\\1" ROCKSDB_VERSION_${ver} "${ROCKSDB_VER_${ver}_LINE}")
++    unset(${ROCKSDB_VER_${ver}_LINE})
+   endforeach()
+   set(ROCKSDB_VERSION_STRING
+     "${ROCKSDB_VERSION_MAJOR}.${ROCKSDB_VERSION_MINOR}.${ROCKSDB_VERSION_PATCH}")
diff --git a/gnu/packages/patches/ceph-rocksdb-compat.patch b/gnu/packages/patches/ceph-rocksdb-compat.patch
deleted file mode 100644
index 1a3c6b0b23..0000000000
--- a/gnu/packages/patches/ceph-rocksdb-compat.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-Fix compatibility with newer versions of RocksDB.
-
-Adapted from this upstream patch, with some additional changes for 12.2:
-https://github.com/ceph/ceph/commit/9d73a7121fdb1ae87cb1aa6f7d9d7a13f329ae68
-
-diff --git a/src/kv/RocksDBStore.cc b/src/kv/RocksDBStore.cc
-index 8660afe1886d..bc0de79e23cb 100644
---- a/src/kv/RocksDBStore.cc
-+++ b/src/kv/RocksDBStore.cc
-@@ -505,7 +505,7 @@
-   // considering performance overhead, default is disabled
-   if (g_conf->rocksdb_perf) {
-     rocksdb::SetPerfLevel(rocksdb::PerfLevel::kEnableTimeExceptForMutex);
--    rocksdb::perf_context.Reset();
-+    rocksdb::get_perf_context()->Reset();
-   }
- 
-   RocksDBTransactionImpl * _t =
-@@ -532,13 +532,13 @@
-     utime_t write_wal_time;
-     utime_t write_pre_and_post_process_time;
-     write_wal_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_wal_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_wal_time)/1000000000);
-     write_memtable_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_memtable_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_memtable_time)/1000000000);
-     write_delay_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_delay_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_delay_time)/1000000000);
-     write_pre_and_post_process_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_pre_and_post_process_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_pre_and_post_process_time)/1000000000);
-     logger->tinc(l_rocksdb_write_memtable_time, write_memtable_time);
-     logger->tinc(l_rocksdb_write_delay_time, write_delay_time);
-     logger->tinc(l_rocksdb_write_wal_time, write_wal_time);
-@@ -558,7 +558,7 @@
-   // considering performance overhead, default is disabled
-   if (g_conf->rocksdb_perf) {
-     rocksdb::SetPerfLevel(rocksdb::PerfLevel::kEnableTimeExceptForMutex);
--    rocksdb::perf_context.Reset();
-+    rocksdb::get_perf_context()->Reset();
-   }
- 
-   RocksDBTransactionImpl * _t =
-@@ -586,13 +586,13 @@
-     utime_t write_wal_time;
-     utime_t write_pre_and_post_process_time;
-     write_wal_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_wal_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_wal_time)/1000000000);
-     write_memtable_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_memtable_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_memtable_time)/1000000000);
-     write_delay_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_delay_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_delay_time)/1000000000);
-     write_pre_and_post_process_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_pre_and_post_process_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_pre_and_post_process_time)/1000000000);
-     logger->tinc(l_rocksdb_write_memtable_time, write_memtable_time);
-     logger->tinc(l_rocksdb_write_delay_time, write_delay_time);
-     logger->tinc(l_rocksdb_write_wal_time, write_wal_time);
diff --git a/gnu/packages/patches/ceph-skip-unittest_blockdev.patch b/gnu/packages/patches/ceph-skip-unittest_blockdev.patch
index 43b9984862..407bd93278 100644
--- a/gnu/packages/patches/ceph-skip-unittest_blockdev.patch
+++ b/gnu/packages/patches/ceph-skip-unittest_blockdev.patch
@@ -4,25 +4,21 @@ This test tries to walk a sysfs path and hits a null pointer exception.
 Expected: (dir) != (nullptr), actual: NULL vs 8-byte object <00-00 00-00 00-00 00-00>
 
 diff --git a/src/test/common/CMakeLists.txt b/src/test/common/CMakeLists.txt
-index 5172663898..ac84085eaa 100644
 --- a/src/test/common/CMakeLists.txt
 +++ b/src/test/common/CMakeLists.txt
-@@ -12,15 +12,6 @@ target_link_libraries(get_command_descriptions
+@@ -12,15 +12,6 @@
    ${CMAKE_DL_LIBS}
    )
  
 -if(HAVE_BLKID)
--# unittest_blkdev
--add_executable(unittest_blkdev
--  test_blkdev.cc
--  )
--add_ceph_unittest(unittest_blkdev ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/unittest_blkdev)
--target_link_libraries(unittest_blkdev global ${BLKID_LIBRARIES})
--endif(HAVE_BLKID)
+-  # unittest_blkdev
+-  add_executable(unittest_blkdev
+-    test_blkdev.cc
+-    )
+-  add_ceph_unittest(unittest_blkdev)
+-  target_link_libraries(unittest_blkdev ceph-common ${BLKID_LIBRARIES})
+-endif()
 -
  # unittest_bloom_filter
  add_executable(unittest_bloom_filter
    test_bloom_filter.cc
--- 
-2.11.1
-
diff --git a/gnu/packages/patches/ceph-volume-respect-PATH.patch b/gnu/packages/patches/ceph-volume-respect-PATH.patch
new file mode 100644
index 0000000000..08a9a15ddd
--- /dev/null
+++ b/gnu/packages/patches/ceph-volume-respect-PATH.patch
@@ -0,0 +1,22 @@
+Look for required tools in $PATH instead of just a handful locations.
+
+diff --git a/src/ceph-volume/ceph_volume/util/system.py b/src/ceph-volume/ceph_volume/util/system.py
+index b637f023a4..14516e1c65 100644
+--- a/src/ceph-volume/ceph_volume/util/system.py
++++ b/src/ceph-volume/ceph_volume/util/system.py
+@@ -33,14 +33,7 @@ def generate_uuid():
+ 
+ def which(executable):
+     """find the location of an executable"""
+-    locations = (
+-        '/usr/local/bin',
+-        '/bin',
+-        '/usr/bin',
+-        '/usr/local/sbin',
+-        '/usr/sbin',
+-        '/sbin',
+-    )
++    locations = os.getenv('PATH').split(':')
+ 
+     for location in locations:
+         executable_path = os.path.join(location, executable)
diff --git a/gnu/packages/patches/clang-3.5-libsanitizer-ustat-fix.patch b/gnu/packages/patches/clang-3.5-libsanitizer-ustat-fix.patch
new file mode 100644
index 0000000000..cfb09a8ce3
--- /dev/null
+++ b/gnu/packages/patches/clang-3.5-libsanitizer-ustat-fix.patch
@@ -0,0 +1,46 @@
+From d9d97cac3702b99a00cd113de98c41eb535d47ed Mon Sep 17 00:00:00 2001
+From: Efraim Flashner <efraim@flashner.co.il>
+Date: Sun, 14 Oct 2018 12:11:30 +0300
+Subject: [PATCH] patch modified from the gcc patch series, also dealing with
+ ustat.
+
+---
+ .../sanitizer_platform_limits_posix.cc            | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+index 29fea6e..570b9a5 100644
+--- a/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/lib/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -129,7 +129,6 @@
+ #include <sys/statvfs.h>
+ #include <sys/timex.h>
+ #include <sys/user.h>
+-#include <sys/ustat.h>
+ #include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+@@ -222,7 +221,19 @@ namespace __sanitizer {
+ #endif  // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  unsigned struct_ustat_sz = sizeof(struct ustat);
++  // Use pre-computed size of struct ustat to avoid <sys/ustat.h> which
++  // has been removed from glibc 2.28.
++#if defined(__aarch64__) || defined(__s390x__) || defined (__mips64) \
++  || defined(__powerpc64__) || defined(__arch64__) || defined(__sparcv9) \
++  || defined(__x86_64__)
++#define SIZEOF_STRUCT_USTAT 32
++#elif defined(__arm__) || defined(__i386__) || defined(__mips__) \
++  || defined(__powerpc__) || defined(__s390__)
++#define SIZEOF_STRUCT_USTAT 20
++#else
++#error Unknown size of struct ustat
++#endif
++  unsigned struct_ustat_sz = SIZEOF_STRUCT_USTAT;
+   unsigned struct_rlimit64_sz = sizeof(struct rlimit64);
+   unsigned struct_statvfs64_sz = sizeof(struct statvfs64);
+ #endif  // SANITIZER_LINUX && !SANITIZER_ANDROID
+-- 
+2.19.1
+
diff --git a/gnu/packages/patches/doxygen-gcc-ice.patch b/gnu/packages/patches/doxygen-gcc-ice.patch
deleted file mode 100644
index fbfedcb7ab..0000000000
--- a/gnu/packages/patches/doxygen-gcc-ice.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-Work around this GCC ICE: <https://bugs.gnu.org/31708>.  It shows up
-only when doing native compiles on armhf-linux.
-
-Yes it's a terrible patch, but it does the job.
-
---- doxygen-1.8.13/qtools/qutfcodec.cpp	1970-01-01 01:00:00.000000000 +0100
-+++ doxygen-1.8.13/qtools/qutfcodec.cpp	2018-06-08 14:14:29.614009929 +0200
-@@ -189,7 +189,7 @@ int QUtf16Codec::heuristicContentMatch(c
- }
- 
- 
--
-+volatile const void *bomPointer = &QChar::byteOrderMark;
- 
- class QUtf16Encoder : public QTextEncoder {
-     bool headerdone;
-@@ -209,7 +209,7 @@ public:
- 	    headerdone = TRUE;
- 	    len_in_out = (1+uc.length())*(int)sizeof(QChar);
- 	    QCString d(len_in_out);
--	    memcpy(d.rawData(),&QChar::byteOrderMark,sizeof(QChar));
-+	    memcpy(d.rawData(),(void *)bomPointer,sizeof(QChar));
- 	    memcpy(d.rawData()+sizeof(QChar),uc.unicode(),uc.length()*sizeof(QChar));
- 	    return d;
- 	}
diff --git a/gnu/packages/patches/emacs-pdf-tools-poppler.patch b/gnu/packages/patches/emacs-pdf-tools-poppler.patch
new file mode 100644
index 0000000000..0477508fa9
--- /dev/null
+++ b/gnu/packages/patches/emacs-pdf-tools-poppler.patch
@@ -0,0 +1,41 @@
+Fix build issue with recent Poppler:
+  <https://github.com/politza/pdf-tools/issues/372>.
+
+This combines upstream commits
+6cd76dec9aece2a8daa90f17ab77fbf773157a1d..50a5297b82e26cfd52f6c00645ddc1057099d6a7
+for this file.
+
+diff --git a/server/poppler-hack.cc b/server/poppler-hack.cc
+index 0c62f73..427f9df 100644
+--- a/server/poppler-hack.cc
++++ b/server/poppler-hack.cc
+@@ -51,7 +51,10 @@ GType poppler_annot_markup_get_type (void) G_GNUC_CONST;
+     double y2;
+   };
+ 
+-  char *_xpoppler_goo_string_to_utf8(GooString *s)
++  // This function does not modify its argument s, but for
++  // compatibility reasons (e.g. getLength in GooString.h before 2015)
++  // with older poppler code, it can't be declared as such.
++  char *_xpoppler_goo_string_to_utf8(/* const */ GooString *s)
+   {
+     char *result;
+ 
+@@ -85,7 +88,7 @@ GType poppler_annot_markup_get_type (void) G_GNUC_CONST;
+   // Set the rectangle of an annotation.  It was first added in v0.26.
+   void xpoppler_annot_set_rectangle (PopplerAnnot *a, PopplerRectangle *rectangle)
+   {
+-    GooString *state = a->annot->getAppearState ();
++    GooString *state = (GooString*) a->annot->getAppearState ();
+     char *ustate = _xpoppler_goo_string_to_utf8 (state);
+ 
+     a->annot->setRect (rectangle->x1, rectangle->y1,
+@@ -105,7 +108,7 @@ GType poppler_annot_markup_get_type (void) G_GNUC_CONST;
+     g_return_val_if_fail (POPPLER_IS_ANNOT_MARKUP (poppler_annot), NULL);
+ 
+     annot = static_cast<AnnotMarkup *>(POPPLER_ANNOT (poppler_annot)->annot);
+-    text = annot->getDate ();
++    text = (GooString*) annot->getDate ();
+ 
+     return text ? _xpoppler_goo_string_to_utf8 (text) : NULL;
+   }
diff --git a/gnu/packages/patches/findutils-gnulib-libio.patch b/gnu/packages/patches/findutils-gnulib-libio.patch
new file mode 100644
index 0000000000..79f9fd914d
--- /dev/null
+++ b/gnu/packages/patches/findutils-gnulib-libio.patch
@@ -0,0 +1,114 @@
+Adjust to removal of libio interface in glibc 2.28.
+
+Based on this gnulib commit:
+https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4af4a4a71827c0bc5e0ec67af23edef4f15cee8e
+
+diff --git a/gl/lib/fflush.c b/gl/lib/fflush.c
+index 5ae3e41..7a82470 100644
+--- a/gl/lib/fflush.c
++++ b/gl/lib/fflush.c
+@@ -33,7 +33,7 @@
+ #undef fflush
+ 
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+ /* Clear the stream's ungetc buffer, preserving the value of ftello (fp).  */
+ static void
+@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp)
+ 
+ #endif
+ 
+-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
++#if ! (defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
+ 
+ # if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
+ /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Android */
+@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream)
+   if (stream == NULL || ! freading (stream))
+     return fflush (stream);
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+   clear_ungetc_buffer_preserving_position (stream);
+ 
+diff --git a/gl/lib/fpurge.c b/gl/lib/fpurge.c
+index f313b22..ecdf82d 100644
+--- a/gl/lib/fpurge.c
++++ b/gl/lib/fpurge.c
+@@ -62,7 +62,7 @@ fpurge (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   fp->_IO_read_end = fp->_IO_read_ptr;
+   fp->_IO_write_ptr = fp->_IO_write_base;
+   /* Avoid memory leak when there is an active ungetc buffer.  */
+diff --git a/gl/lib/freadahead.c b/gl/lib/freadahead.c
+index 094daab..3f8101e 100644
+--- a/gl/lib/freadahead.c
++++ b/gl/lib/freadahead.c
+@@ -25,7 +25,7 @@
+ size_t
+ freadahead (FILE *fp)
+ {
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_write_ptr > fp->_IO_write_base)
+     return 0;
+   return (fp->_IO_read_end - fp->_IO_read_ptr)
+diff --git a/gl/lib/freading.c b/gl/lib/freading.c
+index 0512b19..8c48fe4 100644
+--- a/gl/lib/freading.c
++++ b/gl/lib/freading.c
+@@ -31,7 +31,7 @@ freading (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   return ((fp->_flags & _IO_NO_WRITES) != 0
+           || ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
+               && fp->_IO_read_base != NULL));
+diff --git a/gl/lib/fseeko.c b/gl/lib/fseeko.c
+index 1c65d2a..9026408 100644
+--- a/gl/lib/fseeko.c
++++ b/gl/lib/fseeko.c
+@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence)
+ #endif
+ 
+   /* These tests are based on fpurge.c.  */
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_read_end == fp->_IO_read_ptr
+       && fp->_IO_write_ptr == fp->_IO_write_base
+       && fp->_IO_save_base == NULL)
+@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence)
+           return -1;
+         }
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+       fp->_flags &= ~_IO_EOF_SEEN;
+       fp->_offset = pos;
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+diff --git a/gl/lib/stdio-impl.h b/gl/lib/stdio-impl.h
+index 502d891..ea38ee2 100644
+--- a/gl/lib/stdio-impl.h
++++ b/gl/lib/stdio-impl.h
+@@ -18,6 +18,12 @@
+    the same implementation of stdio extension API, except that some fields
+    have different naming conventions, or their access requires some casts.  */
+ 
++/* Glibc 2.28 made _IO_IN_BACKUP private.  For now, work around this
++   problem by defining it ourselves.  FIXME: Do not rely on glibc
++   internals.  */
++#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN
++# define _IO_IN_BACKUP 0x100
++#endif
+ 
+ /* BSD stdio derived implementations.  */
+ 
diff --git a/gnu/packages/patches/findutils-makedev.patch b/gnu/packages/patches/findutils-makedev.patch
new file mode 100644
index 0000000000..2f16c625d8
--- /dev/null
+++ b/gnu/packages/patches/findutils-makedev.patch
@@ -0,0 +1,22 @@
+Include <sys/sysmacros.h> for "makedev".
+
+Taken from this gnulib commit:
+https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4da63c5881f60f71999a943612da9112232b9161
+
+diff --git a/gl/lib/mountlist.c b/gl/lib/mountlist.c
+index bb4e4ee21..cf4020e2a 100644
+--- a/gl/lib/mountlist.c
++++ b/gl/lib/mountlist.c
+@@ -37,6 +37,12 @@
+ # include <sys/param.h>
+ #endif
+ 
++#if MAJOR_IN_MKDEV
++# include <sys/mkdev.h>
++#elif MAJOR_IN_SYSMACROS
++# include <sys/sysmacros.h>
++#endif
++
+ #if defined MOUNTED_GETFSSTAT   /* OSF_1 and Darwin1.3.x */
+ # if HAVE_SYS_UCRED_H
+ #  include <grp.h> /* needed on OSF V4.0 for definition of NGROUPS,
diff --git a/gnu/packages/patches/freetype-CVE-2018-6942.patch b/gnu/packages/patches/freetype-CVE-2018-6942.patch
deleted file mode 100644
index 680f357765..0000000000
--- a/gnu/packages/patches/freetype-CVE-2018-6942.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-Fix CVE-2018-6942:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6942
-https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6942.html
-
-Copied from upstream (ChangeLog section removed):
-https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=29c759284e305ec428703c9a5831d0b1fc3497ef
-
-diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
-index d855aaa..551f14a 100644
---- a/src/truetype/ttinterp.c
-+++ b/src/truetype/ttinterp.c
-@@ -7532,8 +7532,16 @@
-       return;
-     }
- 
--    for ( i = 0; i < num_axes; i++ )
--      args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
-+    if ( coords )
-+    {
-+      for ( i = 0; i < num_axes; i++ )
-+        args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */
-+    }
-+    else
-+    {
-+      for ( i = 0; i < num_axes; i++ )
-+        args[i] = 0;
-+    }
-   }
- 
- 
diff --git a/gnu/packages/patches/gcc-4.9-libsanitizer-ustat.patch b/gnu/packages/patches/gcc-4.9-libsanitizer-ustat.patch
new file mode 100644
index 0000000000..795881ab9b
--- /dev/null
+++ b/gnu/packages/patches/gcc-4.9-libsanitizer-ustat.patch
@@ -0,0 +1,37 @@
+Remove use of deprecated ustat interface in glibc 2.28:
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85835
+
+Adapted to GCC 4 series from this upstream patch:
+https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=260684
+
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -81,7 +81,6 @@
+ #include <sys/statvfs.h>
+ #include <sys/timex.h>
+ #include <sys/user.h>
+-#include <sys/ustat.h>
+ #include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+@@ -163,7 +162,19 @@
+   unsigned struct_old_utsname_sz = sizeof(struct old_utsname);
+   unsigned struct_oldold_utsname_sz = sizeof(struct oldold_utsname);
+   unsigned struct_itimerspec_sz = sizeof(struct itimerspec);
+-  unsigned struct_ustat_sz = sizeof(struct ustat);
++  // Use pre-computed size of struct ustat to avoid <sys/ustat.h> which
++  // has been removed from glibc 2.28.
++#if defined(__aarch64__) || defined(__s390x__) || defined (__mips64) \
++  || defined(__powerpc64__) || defined(__arch64__) || defined(__sparcv9) \
++  || defined(__x86_64__)
++#define SIZEOF_STRUCT_USTAT 32
++#elif defined(__arm__) || defined(__i386__) || defined(__mips__) \
++  || defined(__powerpc__) || defined(__s390__)
++#define SIZEOF_STRUCT_USTAT 20
++#else
++#error Unknown size of struct ustat
++#endif
++  unsigned struct_ustat_sz = SIZEOF_STRUCT_USTAT;
+ #endif // SANITIZER_LINUX
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
diff --git a/gnu/packages/patches/gcc-libsanitizer-ustat.patch b/gnu/packages/patches/gcc-libsanitizer-ustat.patch
new file mode 100644
index 0000000000..a4e0c6affa
--- /dev/null
+++ b/gnu/packages/patches/gcc-libsanitizer-ustat.patch
@@ -0,0 +1,41 @@
+Remove use of deprecated ustat interface in glibc 2.28:
+
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85835
+
+Taken from upstream:
+
+https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=260684
+
+diff --git a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
+index 858bb2184505..de18e56d11cf 100644
+--- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
++++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
+@@ -157,7 +157,6 @@ typedef struct user_fpregs elf_fpregset_t;
+ # include <sys/procfs.h>
+ #endif
+ #include <sys/user.h>
+-#include <sys/ustat.h>
+ #include <linux/cyclades.h>
+ #include <linux/if_eql.h>
+ #include <linux/if_plip.h>
+@@ -250,7 +249,19 @@ namespace __sanitizer {
+ #endif // SANITIZER_LINUX || SANITIZER_FREEBSD
+ 
+ #if SANITIZER_LINUX && !SANITIZER_ANDROID
+-  unsigned struct_ustat_sz = sizeof(struct ustat);
++  // Use pre-computed size of struct ustat to avoid <sys/ustat.h> which
++  // has been removed from glibc 2.28.
++#if defined(__aarch64__) || defined(__s390x__) || defined (__mips64) \
++  || defined(__powerpc64__) || defined(__arch64__) || defined(__sparcv9) \
++  || defined(__x86_64__)
++#define SIZEOF_STRUCT_USTAT 32
++#elif defined(__arm__) || defined(__i386__) || defined(__mips__) \
++  || defined(__powerpc__) || defined(__s390__)
++#define SIZEOF_STRUCT_USTAT 20
++#else
++#error Unknown size of struct ustat
++#endif
++  unsigned struct_ustat_sz = SIZEOF_STRUCT_USTAT;
+   unsigned struct_rlimit64_sz = sizeof(struct rlimit64);
+   unsigned struct_statvfs64_sz = sizeof(struct statvfs64);
+ #endif // SANITIZER_LINUX && !SANITIZER_ANDROID
diff --git a/gnu/packages/patches/gcc-strmov-store-file-names.patch b/gnu/packages/patches/gcc-strmov-store-file-names.patch
index 9f9162855d..7358de3326 100644
--- a/gnu/packages/patches/gcc-strmov-store-file-names.patch
+++ b/gnu/packages/patches/gcc-strmov-store-file-names.patch
@@ -15,7 +15,7 @@ and <https://bugs.gnu.org/30395>.
 
 --- gcc-5.3.0/gcc/builtins.c	2016-10-18 10:50:46.080616285 +0200
 +++ gcc-5.3.0/gcc/builtins.c	2016-11-09 15:26:43.693042737 +0100
-@@ -3192,6 +3192,54 @@ determine_block_size (tree len, rtx len_
+@@ -3192,6 +3192,58 @@ determine_block_size (tree len, rtx len_
  			  GET_MODE_MASK (GET_MODE (len_rtx)));
  }
  
@@ -35,9 +35,13 @@ and <https://bugs.gnu.org/30395>.
 +  if (TREE_CODE (str) == VAR_DECL
 +      && TREE_STATIC (str)
 +      && TREE_READONLY (str))
-+    /* STR may be a 'static const' variable whose initial value
-+       is a string constant.  See <https://bugs.gnu.org/30395>.  */
-+    str = DECL_INITIAL (str);
++    {
++      /* STR may be a 'static const' variable whose initial value
++         is a string constant.  See <https://bugs.gnu.org/30395>.  */
++      str = DECL_INITIAL (str);
++      if (str == NULL_TREE)
++        return false;
++    }
 +
 +  if (TREE_CODE (str) != STRING_CST)
 +    return false;
diff --git a/gnu/packages/patches/ghostscript-runpath.patch b/gnu/packages/patches/ghostscript-runpath.patch
deleted file mode 100644
index 9f161e45b3..0000000000
--- a/gnu/packages/patches/ghostscript-runpath.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/base/unix-dll.mak b/base/unix-dll.mak
-index 9d57a99..36ef1ff 100644
---- a/base/unix-dll.mak
-+++ b/base/unix-dll.mak
-@@ -171,11 +171,11 @@ gpdl-so-links-subtarget: $(GPDL_SO) $(UNIX_DLL_MAK) $(MAKEDIRS)
- # Build the small Ghostscript loaders, with Gtk+ and without
- $(GSSOC_XE): gs-so-links-subtarget $(PSSRC)$(SOC_LOADER) $(UNIX_DLL_MAK) $(MAKEDIRS)
- 	$(GLCC) -g -o $(GSSOC_XE) $(PSSRC)dxmainc.c \
--	-L$(BINDIR) -l$(GS_SO_BASE)
-+	-L$(BINDIR) -l$(GS_SO_BASE) -Wl,-rpath=$(libdir)
- 
- $(GSSOX_XE): gs-so-links-subtarget $(PSSRC)$(SOC_LOADER) $(UNIX_DLL_MAK) $(MAKEDIRS)
- 	$(GLCC) -g $(SOC_CFLAGS) -o $(GSSOX_XE) $(PSSRC)$(SOC_LOADER) \
--	-L$(BINDIR) -l$(GS_SO_BASE) $(SOC_LIBS)
-+	-L$(BINDIR) -l$(GS_SO_BASE) $(SOC_LIBS) -Wl,-rpath=$(libdir)
- 
- $(PCLSOC_XE): gpcl6-so-links-subtarget $(PLSRC)$(REALMAIN_SRC).c $(UNIX_DLL_MAK) $(MAKEDIRS)
- 	$(GLCC) -g -o $(PCLSOC_XE) $(PLSRC)$(REALMAIN_SRC).c -L$(BINDIR) -l$(PCL_SO_BASE)
diff --git a/gnu/packages/patches/glibc-2.28-git-fixes.patch b/gnu/packages/patches/glibc-2.28-git-fixes.patch
new file mode 100644
index 0000000000..7e370ef0b1
--- /dev/null
+++ b/gnu/packages/patches/glibc-2.28-git-fixes.patch
@@ -0,0 +1,248 @@
+This file contains fixes from the "release/2.28/master" branch:
+https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.28/master
+
+Currently we have these commits (sans tests and ChangeLog updates):
+7f11842e7483da7aa9fa3031be122021978ef600
+726e1554ce4db5e35af41cb0110c54c5e1232054
+4b25485f03158959cff45379eecc1d73c7dcdd11
+d05b05d1570ba3ae354a2f5a3cfeefb373b09979
+bfcfa22589f2b4277a65e60c6b736b6bbfbd87d0
+2f498f3d140ab5152bd784df2be7af7d9c5e63ed
+
+diff --git a/htl/Versions b/htl/Versions
+index 6a63a1b8a1..c5a616da10 100644
+--- a/htl/Versions
++++ b/htl/Versions
+@@ -150,6 +150,8 @@ libpthread {
+     __cthread_keycreate;
+     __cthread_getspecific;
+     __cthread_setspecific;
++    __pthread_getspecific;
++    __pthread_setspecific;
+     __pthread_getattr_np;
+     __pthread_attr_getstack;
+   }
+
+diff --git a/sysdeps/htl/pt-getspecific.c b/sysdeps/htl/pt-getspecific.c
+index a0227a67f6..64ddf9551a 100644
+--- a/sysdeps/htl/pt-getspecific.c
++++ b/sysdeps/htl/pt-getspecific.c
+@@ -36,3 +36,4 @@ __pthread_getspecific (pthread_key_t key)
+   return self->thread_specifics[key];
+ }
+ strong_alias (__pthread_getspecific, pthread_getspecific);
++hidden_def (__pthread_getspecific)
+diff --git a/sysdeps/htl/pt-setspecific.c b/sysdeps/htl/pt-setspecific.c
+index a46a12f157..02aff417ef 100644
+--- a/sysdeps/htl/pt-setspecific.c
++++ b/sysdeps/htl/pt-setspecific.c
+@@ -48,3 +48,4 @@ __pthread_setspecific (pthread_key_t key, const void *value)
+   return 0;
+ }
+ strong_alias (__pthread_setspecific, pthread_setspecific);
++hidden_def (__pthread_setspecific)
+diff --git a/sysdeps/htl/pthreadP.h b/sysdeps/htl/pthreadP.h
+index 132ac1718e..71c2fcd9c6 100644
+--- a/sysdeps/htl/pthreadP.h
++++ b/sysdeps/htl/pthreadP.h
+@@ -68,6 +68,8 @@ struct __pthread_cancelation_handler **___pthread_get_cleanup_stack (void) attri
+ 
+ #if IS_IN (libpthread)
+ hidden_proto (__pthread_key_create)
++hidden_proto (__pthread_getspecific)
++hidden_proto (__pthread_setspecific)
+ hidden_proto (_pthread_mutex_init)
+ #endif
+ 
+diff --git a/sysdeps/unix/sysv/linux/getdents64.c b/sysdeps/unix/sysv/linux/getdents64.c
+index 3bde0cf4f0..bc140b5a7f 100644
+--- a/sysdeps/unix/sysv/linux/getdents64.c
++++ b/sysdeps/unix/sysv/linux/getdents64.c
+@@ -33,41 +33,80 @@ strong_alias (__getdents64, __getdents)
+ # include <shlib-compat.h>
+ 
+ # if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
+-# include <olddirent.h>
++#  include <olddirent.h>
++#  include <unistd.h>
+ 
+-/* kernel definition of as of 3.2.  */
+-struct compat_linux_dirent
++static ssize_t
++handle_overflow (int fd, __off64_t offset, ssize_t count)
+ {
+-  /* Both d_ino and d_off are compat_ulong_t which are defined in all
+-     architectures as 'u32'.  */
+-  uint32_t        d_ino;
+-  uint32_t        d_off;
+-  unsigned short  d_reclen;
+-  char            d_name[1];
+-};
++  /* If this is the first entry in the buffer, we can report the
++     error.  */
++  if (count == 0)
++    {
++      __set_errno (EOVERFLOW);
++      return -1;
++    }
++
++  /* Otherwise, seek to the overflowing entry, so that the next call
++     will report the error, and return the data read so far..  */
++  if (__lseek64 (fd, offset, SEEK_SET) != 0)
++    return -1;
++  return count;
++}
+ 
+ ssize_t
+ __old_getdents64 (int fd, char *buf, size_t nbytes)
+ {
+-  ssize_t retval = INLINE_SYSCALL_CALL (getdents, fd, buf, nbytes);
++  /* We do not move the individual directory entries.  This is only
++     possible if the target type (struct __old_dirent64) is smaller
++     than the source type.  */
++  _Static_assert (offsetof (struct __old_dirent64, d_name)
++		  <= offsetof (struct dirent64, d_name),
++		  "__old_dirent64 is larger than dirent64");
++  _Static_assert (__alignof__ (struct __old_dirent64)
++		  <= __alignof__ (struct dirent64),
++		  "alignment of __old_dirent64 is larger than dirent64");
+ 
+-  /* The kernel added the d_type value after the name.  Change this now.  */
+-  if (retval != -1)
++  ssize_t retval = INLINE_SYSCALL_CALL (getdents64, fd, buf, nbytes);
++  if (retval > 0)
+     {
+-      union
+-      {
+-	struct compat_linux_dirent k;
+-	struct dirent u;
+-      } *kbuf = (void *) buf;
+-
+-      while ((char *) kbuf < buf + retval)
++      char *p = buf;
++      char *end = buf + retval;
++      while (p < end)
+ 	{
+-	  char d_type = *((char *) kbuf + kbuf->k.d_reclen - 1);
+-	  memmove (kbuf->u.d_name, kbuf->k.d_name,
+-		   strlen (kbuf->k.d_name) + 1);
+-	  kbuf->u.d_type = d_type;
++	  struct dirent64 *source = (struct dirent64 *) p;
++
++	  /* Copy out the fixed-size data.  */
++	  __ino_t ino = source->d_ino;
++	  __off64_t offset = source->d_off;
++	  unsigned int reclen = source->d_reclen;
++	  unsigned char type = source->d_type;
++
++	  /* Check for ino_t overflow.  */
++	  if (__glibc_unlikely (ino != source->d_ino))
++	    return handle_overflow (fd, offset, p - buf);
++
++	  /* Convert to the target layout.  Use a separate struct and
++	     memcpy to side-step aliasing issues.  */
++	  struct __old_dirent64 result;
++	  result.d_ino = ino;
++	  result.d_off = offset;
++	  result.d_reclen = reclen;
++	  result.d_type = type;
++
++	  /* Write the fixed-sized part of the result to the
++	     buffer.  */
++	  size_t result_name_offset = offsetof (struct __old_dirent64, d_name);
++	  memcpy (p, &result, result_name_offset);
++
++	  /* Adjust the position of the name if necessary.  Copy
++	     everything until the end of the record, including the
++	     terminating NUL byte.  */
++	  if (result_name_offset != offsetof (struct dirent64, d_name))
++	    memmove (p + result_name_offset, source->d_name,
++		     reclen - offsetof (struct dirent64, d_name));
+ 
+-	  kbuf = (void *) ((char *) kbuf + kbuf->k.d_reclen);
++	  p += reclen;
+ 	}
+      }
+   return retval;
+
+diff --git a/misc/error.c b/misc/error.c
+index b4e8b6c938..03378e2f2a 100644
+--- a/misc/error.c
++++ b/misc/error.c
+@@ -319,6 +319,7 @@ error (int status, int errnum, const char *message, ...)
+ 
+   va_start (args, message);
+   error_tail (status, errnum, message, args);
++  va_end (args);
+ 
+ #ifdef _LIBC
+   _IO_funlockfile (stderr);
+@@ -390,6 +391,7 @@ error_at_line (int status, int errnum, const char *file_name,
+ 
+   va_start (args, message);
+   error_tail (status, errnum, message, args);
++  va_end (args);
+ 
+ #ifdef _LIBC
+   _IO_funlockfile (stderr);
+
+diff --git a/nscd/nscd_conf.c b/nscd/nscd_conf.c
+index 265a02434d..7293b795b6 100644
+--- a/nscd/nscd_conf.c
++++ b/nscd/nscd_conf.c
+@@ -190,7 +190,10 @@ nscd_parse_file (const char *fname, struct database_dyn dbs[lastdb])
+ 	  if (!arg1)
+ 	    error (0, 0, _("Must specify user name for server-user option"));
+ 	  else
+-	    server_user = xstrdup (arg1);
++	    {
++	      free ((char *) server_user);
++	      server_user = xstrdup (arg1);
++	    }
+ 	}
+       else if (strcmp (entry, "stat-user") == 0)
+ 	{
+@@ -198,6 +201,7 @@ nscd_parse_file (const char *fname, struct database_dyn dbs[lastdb])
+ 	    error (0, 0, _("Must specify user name for stat-user option"));
+ 	  else
+ 	    {
++	      free ((char *) stat_user);
+ 	      stat_user = xstrdup (arg1);
+ 
+ 	      struct passwd *pw = getpwnam (stat_user);
+
+diff --git a/nss/nss_files/files-alias.c b/nss/nss_files/files-alias.c
+index cfd34b66b9..35b0bfc5d2 100644
+--- a/nss/nss_files/files-alias.c
++++ b/nss/nss_files/files-alias.c
+@@ -221,6 +221,13 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
+ 			{
+ 			  while (! feof_unlocked (listfile))
+ 			    {
++			      if (room_left < 2)
++				{
++				  free (old_line);
++				  fclose (listfile);
++				  goto no_more_room;
++				}
++
+ 			      first_unused[room_left - 1] = '\xff';
+ 			      line = fgets_unlocked (first_unused, room_left,
+ 						     listfile);
+@@ -229,6 +236,7 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
+ 			      if (first_unused[room_left - 1] != '\xff')
+ 				{
+ 				  free (old_line);
++				  fclose (listfile);
+ 				  goto no_more_room;
+ 				}
+ 
+@@ -256,6 +264,7 @@ get_next_alias (FILE *stream, const char *match, struct aliasent *result,
+ 						       + __alignof__ (char *)))
+ 					{
+ 					  free (old_line);
++					  fclose (listfile);
+ 					  goto no_more_room;
+ 					}
+ 				      room_left -= ((first_unused - cp)
+
diff --git a/gnu/packages/patches/grub-binutils-compat.patch b/gnu/packages/patches/grub-binutils-compat.patch
new file mode 100644
index 0000000000..2107869314
--- /dev/null
+++ b/gnu/packages/patches/grub-binutils-compat.patch
@@ -0,0 +1,53 @@
+Fix a relocation issue that shows up with recent binutils.
+
+Patch taken from upstream:
+https://git.sv.gnu.org/cgit/grub.git/commit/?id=842c390469e2c2e10b5aa36700324cd3bde25875
+
+diff --git a/grub-core/efiemu/i386/loadcore64.c b/grub-core/efiemu/i386/loadcore64.c
+index e49d0b6..18facf4 100644
+--- a/grub-core/efiemu/i386/loadcore64.c
++++ b/grub-core/efiemu/i386/loadcore64.c
+@@ -98,6 +98,7 @@ grub_arch_efiemu_relocate_symbols64 (grub_efiemu_segment_t segs,
+ 		    break;
+ 
+ 		  case R_X86_64_PC32:
++		  case R_X86_64_PLT32:
+ 		    err = grub_efiemu_write_value (addr,
+ 						   *addr32 + rel->r_addend
+ 						   + sym.off
+diff --git a/grub-core/kern/x86_64/dl.c b/grub-core/kern/x86_64/dl.c
+index 4406906..3a73e6e 100644
+--- a/grub-core/kern/x86_64/dl.c
++++ b/grub-core/kern/x86_64/dl.c
+@@ -70,6 +70,7 @@ grub_arch_dl_relocate_symbols (grub_dl_t mod, void *ehdr,
+ 	  break;
+ 
+ 	case R_X86_64_PC32:
++	case R_X86_64_PLT32:
+ 	  {
+ 	    grub_int64_t value;
+ 	    value = ((grub_int32_t) *addr32) + rel->r_addend + sym->st_value -
+diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
+index a2bb054..39d7efb 100644
+--- a/util/grub-mkimagexx.c
++++ b/util/grub-mkimagexx.c
+@@ -841,6 +841,7 @@ SUFFIX (relocate_addresses) (Elf_Ehdr *e, Elf_Shdr *sections,
+ 		  break;
+ 
+ 		case R_X86_64_PC32:
++		case R_X86_64_PLT32:
+ 		  {
+ 		    grub_uint32_t *t32 = (grub_uint32_t *) target;
+ 		    *t32 = grub_host_to_target64 (grub_target_to_host32 (*t32)
+diff --git a/util/grub-module-verifier.c b/util/grub-module-verifier.c
+index 9179285..a79271f 100644
+--- a/util/grub-module-verifier.c
++++ b/util/grub-module-verifier.c
+@@ -19,6 +19,7 @@ struct grub_module_verifier_arch archs[] = {
+       -1
+     }, (int[]){
+       R_X86_64_PC32,
++      R_X86_64_PLT32,
+       -1
+     }
+   },
diff --git a/gnu/packages/patches/jemalloc-arm-address-bits.patch b/gnu/packages/patches/jemalloc-arm-address-bits.patch
deleted file mode 100644
index f2ef24c25a..0000000000
--- a/gnu/packages/patches/jemalloc-arm-address-bits.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 8cfc9dec37b312a2686f602bbcdd102ca07cca99 Mon Sep 17 00:00:00 2001
-From: David Goldblatt <davidgoldblatt@fb.com>
-Date: Fri, 29 Sep 2017 13:54:08 -0700
-Subject: [PATCH] ARM: Don't extend bit LG_VADDR to compute high address bits.
-
-In userspace ARM on Linux, zero-ing the high bits is the correct way to do this.
-This doesn't fix the fact that we currently set LG_VADDR to 48 on ARM, when in
-fact larger virtual address sizes are coming soon.  We'll cross that bridge when
-we come to it.
----
- include/jemalloc/internal/rtree.h | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/include/jemalloc/internal/rtree.h b/include/jemalloc/internal/rtree.h
-index b5d4db39..4563db23 100644
---- a/include/jemalloc/internal/rtree.h
-+++ b/include/jemalloc/internal/rtree.h
-@@ -178,9 +178,21 @@ rtree_leaf_elm_bits_read(tsdn_t *tsdn, rtree_t *rtree, rtree_leaf_elm_t *elm,
- 
- JEMALLOC_ALWAYS_INLINE extent_t *
- rtree_leaf_elm_bits_extent_get(uintptr_t bits) {
-+#    ifdef __aarch64__
-+	/*
-+	 * aarch64 doesn't sign extend the highest virtual address bit to set
-+	 * the higher ones.  Instead, the high bits gets zeroed.
-+	 */
-+	uintptr_t high_bit_mask = ((uintptr_t)1 << LG_VADDR) - 1;
-+	/* Mask off the slab bit. */
-+	uintptr_t low_bit_mask = ~(uintptr_t)1;
-+	uintptr_t mask = high_bit_mask & low_bit_mask;
-+	return (extent_t *)(bits & mask);
-+#    else
- 	/* Restore sign-extended high bits, mask slab bit. */
- 	return (extent_t *)((uintptr_t)((intptr_t)(bits << RTREE_NHIB) >>
- 	    RTREE_NHIB) & ~((uintptr_t)0x1));
-+#    endif
- }
- 
- JEMALLOC_ALWAYS_INLINE szind_t
diff --git a/gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch b/gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch
new file mode 100644
index 0000000000..3056f0baad
--- /dev/null
+++ b/gnu/packages/patches/libgcrypt-make-yat2m-reproducible.patch
@@ -0,0 +1,32 @@
+Make yat2m in libgcrypt respect SOURCE_DATE_EPOCH, making
+the build reproducible.
+
+This was already fixed upstream in GnuPG:
+https://dev.gnupg.org/rG139de02b93773615bdd95e04a7f0c1ad73b4f6fb
+
+and in libgpg-error:
+https://dev.gnupg.org/rE5494a5728418938d2e42158bb646b07124184e64
+
+
+--- a/doc/yat2m.c 2017-11-23 19:16:58.000000000 +0100
++++ b/doc/yat2m.c 2017-08-28 12:22:54.000000000 +0200
+@@ -1475,6 +1484,7 @@
+ main (int argc, char **argv)
+ {
+   int last_argc = -1;
++  const char *s;
+ 
+   opt_source = "GNU";
+   opt_release = "";
+@@ -1608,6 +1618,11 @@
+   if (argc > 1)
+     die ("usage: " PGM " [OPTION] [FILE] (try --help for more information)\n");
+ 
++  /* Take care of supplied timestamp for reproducible builds.  See
++   * https://reproducible-builds.org/specs/source-date-epoch/  */
++  if (!opt_date && (s = getenv ("SOURCE_DATE_EPOCH")) && *s)
++    opt_date = s;
++
+   /* Start processing. */
+   if (argc && strcmp (*argv, "-"))
+     {
diff --git a/gnu/packages/patches/libgpg-error-aarch64-logging-fix.patch b/gnu/packages/patches/libgpg-error-aarch64-logging-fix.patch
deleted file mode 100644
index d848d639b2..0000000000
--- a/gnu/packages/patches/libgpg-error-aarch64-logging-fix.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=patch;h=791177de023574223eddf7288eb7c5a0721ac623
-
-From 791177de023574223eddf7288eb7c5a0721ac623 Mon Sep 17 00:00:00 2001
-From: Werner Koch <wk@gnupg.org>
-Date: Sun, 18 Mar 2018 17:39:43 +0100
-Subject: [PATCH] core: Fix regression on arm64 due to invalid use of va_list.
-
-* src/logging.c (_gpgrt_log_printhex): Provide a dummy arg instead of
-NULL.
---
-
-Fix
-Suggested-by: Jakub Wilk <jwilk@jwilk.net>
-
-Signed-off-by: Werner Koch <wk@gnupg.org>
----
- src/logging.c | 18 ++++++++++++++----
- 1 file changed, 14 insertions(+), 4 deletions(-)
-
-diff --git a/src/logging.c b/src/logging.c
-index 1a4f620..d01f974 100644
---- a/src/logging.c
-+++ b/src/logging.c
-@@ -1090,9 +1090,10 @@ _gpgrt_log_flush (void)
- 
- 
- /* Print a hexdump of (BUFFER,LENGTH).  With FMT passed as NULL print
-- * just the raw dump, with FMT being an empty string, print a trailing
-- * linefeed, otherwise print an entire debug line with the expanded
-- * FMT followed by a possible wrapped hexdump and a final LF.  */
-+ * just the raw dump (in this case ARG_PTR is not used), with FMT
-+ * being an empty string, print a trailing linefeed, otherwise print
-+ * an entire debug line with the expanded FMT followed by a possible
-+ * wrapped hexdump and a final LF.  */
- void
- _gpgrt_logv_printhex (const void *buffer, size_t length,
-                       const char *fmt, va_list arg_ptr)
-@@ -1150,7 +1151,16 @@ _gpgrt_log_printhex (const void *buffer, size_t length,
-       va_end (arg_ptr);
-     }
-   else
--    _gpgrt_logv_printhex (buffer, length, NULL, NULL);
-+    {
-+      /* va_list is not necessary a pointer and thus we can't use NULL
-+       * because that would conflict with platforms using a straight
-+       * struct for it (e.g. arm64).  We use a dummy variable instead;
-+       * the static is a simple way zero it out so to not get
-+       * complains about uninitialized use.  */
-+      static va_list dummy_argptr;
-+
-+      _gpgrt_logv_printhex (buffer, length, NULL, dummy_argptr);
-+    }
- }
- 
- 
--- 
-2.8.0.rc3
-
diff --git a/gnu/packages/patches/lirc-reproducible-build.patch b/gnu/packages/patches/lirc-reproducible-build.patch
new file mode 100644
index 0000000000..20f9344715
--- /dev/null
+++ b/gnu/packages/patches/lirc-reproducible-build.patch
@@ -0,0 +1,72 @@
+Build Lirc reproducibly.
+
+https://sourceforge.net/p/lirc/tickets/301/
+https://sourceforge.net/p/lirc/git/merge-requests/33/
+https://sourceforge.net/p/lirc/git/merge-requests/34/
+https://sourceforge.net/p/lirc/git/merge-requests/36/
+
+Index: lirc-0.10.1/tools/lirc-lsplugins.cpp
+===================================================================
+--- lirc-0.10.1.orig/tools/lirc-lsplugins.cpp
++++ lirc-0.10.1/tools/lirc-lsplugins.cpp
+@@ -415,10 +415,9 @@ static void print_header(void)
+ static void print_yaml_header(void)
+ {
+ 	static const char* const YAML_HEADER =
+-		"#\n# Generated by lirc-lsplugins --yaml (%s) at %s#\n ";
+-	const time_t now = time(NULL);
++		"#\n# Generated by lirc-lsplugins --yaml (%s)#\n ";
+ 
+-	printf(YAML_HEADER, VERSION, ctime(&now));
++	printf(YAML_HEADER, VERSION);
+ 	printf("\ndrivers:\n");
+ }
+ 
+Index: lirc-0.10.1/python-pkg/lirc/database.py
+===================================================================
+--- lirc-0.10.1.orig/python-pkg/lirc/database.py
++++ lirc-0.10.1/python-pkg/lirc/database.py
+@@ -156,7 +156,7 @@ class Database(object):
+             d['device_hint'] = hint
+ 
+         configs = {}
+-        for path in glob.glob(configdir + '/*.conf'):
++        for path in sorted(glob.glob(configdir + '/*.conf')):
+             with open(path) as f:
+                 cf = yaml.load(f.read())
+             configs[cf['config']['id']] = cf['config']
+Index: lirc-0.10.1/tools/irdb-get
+===================================================================
+--- lirc-0.10.1.orig/tools/irdb-get
++++ lirc-0.10.1/tools/irdb-get
+@@ -9,7 +9,6 @@ import fnmatch
+ import os
+ import os.path
+ import sys
+-import time
+ import urllib.error          # pylint: disable=no-name-in-module,F0401,E0611
+ import urllib.request        # pylint: disable=no-name-in-module,F0401,E0611
+ 
+@@ -193,7 +192,7 @@ def do_yaml_config():
+         lircmd_by_driver[driver].append("%s/%s" % (tokens[0], tokens[2]))
+ 
+     print("#")
+-    print("# Created by 'irdb-get yaml-config' at " + time.ctime())
++    print("# Created by 'irdb-get yaml-config'")
+     print("#")
+     print("\nlircd_by_driver:")
+     print_yaml_dict(lircd_by_driver)
+Index: lirc-0.10.1/tools/lirc-make-devinput
+===================================================================
+--- lirc-0.10.1.orig/tools/lirc-make-devinput
++++ lirc-0.10.1/tools/lirc-make-devinput
+@@ -61,8 +61,7 @@ if test -n "$lirc_map"; then
+ fi
+ 
+ 
+-echo "# Generated by $(basename $0) on $(uname -r)"
+-echo "# Date: $(date)"
++echo "# Generated by $(basename $0)"
+ cat <<EOF
+ 
+ begin remote
diff --git a/gnu/packages/patches/m4-gnulib-libio.patch b/gnu/packages/patches/m4-gnulib-libio.patch
new file mode 100644
index 0000000000..a26622ccf3
--- /dev/null
+++ b/gnu/packages/patches/m4-gnulib-libio.patch
@@ -0,0 +1,128 @@
+Adjust the bundled gnulib to cope with removal of libio interface in
+glibc 2.28.
+
+Based on this upstream patch, without hunks that do not apply to m4:
+https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4af4a4a71827c0bc5e0ec67af23edef4f15cee8e
+
+diff --git a/lib/fflush.c b/lib/fflush.c
+index 983ade0..a6edfa1 100644
+--- a/lib/fflush.c
++++ b/lib/fflush.c
+@@ -33,7 +33,7 @@
+ #undef fflush
+ 
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+ /* Clear the stream's ungetc buffer, preserving the value of ftello (fp).  */
+ static void
+@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp)
+ 
+ #endif
+ 
+-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
++#if ! (defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
+ 
+ # if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
+ /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
+@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream)
+   if (stream == NULL || ! freading (stream))
+     return fflush (stream);
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+   clear_ungetc_buffer_preserving_position (stream);
+ 
+diff --git a/lib/fpending.c b/lib/fpending.c
+index c84e3a5..789f50e 100644
+--- a/lib/fpending.c
++++ b/lib/fpending.c
+@@ -32,7 +32,7 @@ __fpending (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   return fp->_IO_write_ptr - fp->_IO_write_base;
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+   /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
+diff --git a/lib/fpurge.c b/lib/fpurge.c
+index b1d417c..3aedcc3 100644
+--- a/lib/fpurge.c
++++ b/lib/fpurge.c
+@@ -62,7 +62,7 @@ fpurge (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   fp->_IO_read_end = fp->_IO_read_ptr;
+   fp->_IO_write_ptr = fp->_IO_write_base;
+   /* Avoid memory leak when there is an active ungetc buffer.  */
+diff --git a/lib/freadahead.c b/lib/freadahead.c
+index c2ecb5b..23ec76e 100644
+--- a/lib/freadahead.c
++++ b/lib/freadahead.c
+@@ -30,7 +30,7 @@ extern size_t __sreadahead (FILE *);
+ size_t
+ freadahead (FILE *fp)
+ {
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_write_ptr > fp->_IO_write_base)
+     return 0;
+   return (fp->_IO_read_end - fp->_IO_read_ptr)
+diff --git a/lib/freading.c b/lib/freading.c
+index 73c28ac..c24d0c8 100644
+--- a/lib/freading.c
++++ b/lib/freading.c
+@@ -31,7 +31,7 @@ freading (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   return ((fp->_flags & _IO_NO_WRITES) != 0
+           || ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
+               && fp->_IO_read_base != NULL));
+diff --git a/lib/fseeko.c b/lib/fseeko.c
+index 0101ab5..193f4e8 100644
+--- a/lib/fseeko.c
++++ b/lib/fseeko.c
+@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence)
+ #endif
+ 
+   /* These tests are based on fpurge.c.  */
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_read_end == fp->_IO_read_ptr
+       && fp->_IO_write_ptr == fp->_IO_write_base
+       && fp->_IO_save_base == NULL)
+@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence)
+           return -1;
+         }
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+       fp->_flags &= ~_IO_EOF_SEEN;
+       fp->_offset = pos;
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+diff --git a/lib/stdio-impl.h b/lib/stdio-impl.h
+index 78d896e..05c5752 100644
+--- a/lib/stdio-impl.h
++++ b/lib/stdio-impl.h
+@@ -18,6 +18,12 @@
+    the same implementation of stdio extension API, except that some fields
+    have different naming conventions, or their access requires some casts.  */
+ 
++/* Glibc 2.28 made _IO_IN_BACKUP private.  For now, work around this
++   problem by defining it ourselves.  FIXME: Do not rely on glibc
++   internals.  */
++#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN
++# define _IO_IN_BACKUP 0x100
++#endif
+ 
+ /* BSD stdio derived implementations.  */
+ 
diff --git a/gnu/packages/patches/mariadb-gcc-ice.patch b/gnu/packages/patches/mariadb-gcc-ice.patch
deleted file mode 100644
index 59b188f45a..0000000000
--- a/gnu/packages/patches/mariadb-gcc-ice.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Work around this GCC ICE: <https://bugs.gnu.org/31708>.  It shows up
-only when doing native compiles on armhf-linux.
-
---- mariadb-10.1.33/plugin/semisync/semisync_master.cc	2018-07-28 02:13:12.604020250 +0200
-+++ mariadb-10.1.33/plugin/semisync/semisync_master.cc	2018-07-28 02:14:11.907753417 +0200
-@@ -847,6 +847,8 @@
-   return function_exit(kWho, 0);
- }
- 
-+volatile const void *kSyncHeaderPtr = &ReplSemiSyncMaster::kSyncHeader;
-+
- int ReplSemiSyncMaster::reserveSyncHeader(unsigned char *header,
- 					  unsigned long size)
- {
-@@ -873,7 +875,7 @@
-     /* Set the magic number and the sync status.  By default, no sync
-      * is required.
-      */
--    memcpy(header, kSyncHeader, sizeof(kSyncHeader));
-+    memcpy(header, (void *)kSyncHeaderPtr, sizeof(kSyncHeader));
-     hlen= sizeof(kSyncHeader);
-   }
-   return function_exit(kWho, hlen);
-
diff --git a/gnu/packages/patches/meson-for-build-rpath.patch b/gnu/packages/patches/meson-for-build-rpath.patch
index 59249e294d..ef9a73f07c 100644
--- a/gnu/packages/patches/meson-for-build-rpath.patch
+++ b/gnu/packages/patches/meson-for-build-rpath.patch
@@ -2,10 +2,10 @@ This patch removes a part of meson that clears the rpath upon installation.
 This will only be applied to a special version of meson, used for the
 meson-build-system.
 
-Patch by Peter Mikkelsen <petermikkelsen10@gmail.com>
+Original patch for Meson 0.42.0 by Peter Mikkelsen <petermikkelsen10@gmail.com>
 
---- meson-0.42.0/mesonbuild/minstall.py.orig	2017-09-09 01:49:39.147374148 +0200
-+++ meson-0.42.0/mesonbuild/minstall.py	2017-09-09 01:51:01.209134717 +0200
+--- meson-0.47.1/mesonbuild/minstall.py.old	2018-08-10 11:01:27.812327013 +0200
++++ meson-0.47.1/mesonbuild/minstall.py	2018-08-10 11:01:51.940368505 +0200
 @@ -436,15 +436,6 @@
                          print("Symlink creation does not work on this platform. "
                                "Skipping all symlinking.")
diff --git a/gnu/packages/patches/mono-mdoc-timestamping.patch b/gnu/packages/patches/mono-mdoc-timestamping.patch
new file mode 100644
index 0000000000..d5191a93eb
--- /dev/null
+++ b/gnu/packages/patches/mono-mdoc-timestamping.patch
@@ -0,0 +1,15 @@
+--- mono-4.4.1/mcs/class/monodoc/Monodoc/storage/ZipStorage.cs.orig	2018-11-26 22:16:25.008879747 +0100
++++ mono-4.4.1/mcs/class/monodoc/Monodoc/storage/ZipStorage.cs	2018-11-26 22:21:53.969770985 +0100
+@@ -74,6 +74,12 @@
+ 				id = GetNewCode ();
+ 
+ 			ZipEntry entry = new ZipEntry (id);
++			var SOURCE_DATE_EPOCH_string = Environment.GetEnvironmentVariable("SOURCE_DATE_EPOCH");
++			if (SOURCE_DATE_EPOCH_string != null)
++			{
++				var SOURCE_DATE_EPOCH = Convert.ToInt64(SOURCE_DATE_EPOCH_string);
++				entry.DateTime = new DateTime(SOURCE_DATE_EPOCH, DateTimeKind.Utc);
++			}
+ 			zipOutput.PutNextEntry (entry);
+ 		}
+ 
diff --git a/gnu/packages/patches/oath-toolkit-glibc-compat.patch b/gnu/packages/patches/oath-toolkit-glibc-compat.patch
new file mode 100644
index 0000000000..22814599e5
--- /dev/null
+++ b/gnu/packages/patches/oath-toolkit-glibc-compat.patch
@@ -0,0 +1,90 @@
+Adjust the bundled Gnulib to cope with removal of libio interface in Glibc 2.28.
+
+Based on this upstream gnulib patch:
+https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4af4a4a71827c0bc5e0ec67af23edef4f15cee8e
+
+--- a/liboath/gl/fflush.c
++++ b/liboath/gl/fflush.c
+@@ -33,7 +33,7 @@
+ #undef fflush
+ 
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+ /* Clear the stream's ungetc buffer, preserving the value of ftello (fp).  */
+ static void
+@@ -72,7 +72,7 @@
+ 
+ #endif
+ 
+-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
++#if ! (defined _IO_EOF_SEEN  || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
+ 
+ # if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
+ /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Android */
+@@ -148,7 +148,7 @@
+   if (stream == NULL || ! freading (stream))
+     return fflush (stream);
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+   clear_ungetc_buffer_preserving_position (stream);
+ 
+--- a/liboath/gl/fpurge.c
++++ b/liboath/gl/fpurge.c
+@@ -62,7 +62,7 @@
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   fp->_IO_read_end = fp->_IO_read_ptr;
+   fp->_IO_write_ptr = fp->_IO_write_base;
+   /* Avoid memory leak when there is an active ungetc buffer.  */
+--- a/libaoth/gl/freading.c
++++ b/liboath/gl/freading.c
+@@ -31,7 +31,7 @@
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   return ((fp->_flags & _IO_NO_WRITES) != 0
+           || ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
+               && fp->_IO_read_base != NULL));
+--- a/liboath/gl/fseeko.c
++++ b/liboath/gl/fseeko.c
+@@ -47,7 +47,7 @@
+ #endif
+ 
+   /* These tests are based on fpurge.c.  */
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN  || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_read_end == fp->_IO_read_ptr
+       && fp->_IO_write_ptr == fp->_IO_write_base
+       && fp->_IO_save_base == NULL)
+@@ -123,7 +123,7 @@
+           return -1;
+         }
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN  || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+       fp->_flags &= ~_IO_EOF_SEEN;
+       fp->_offset = pos;
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+--- a/liboath/gl/stdio-impl.h
++++ b/liboath/gl/stdio-impl.h
+@@ -18,6 +18,11 @@
+    the same implementation of stdio extension API, except that some fields
+    have different naming conventions, or their access requires some casts.  */
+ 
++/* Glibc 2.28 made _IO_IN_BACKUP private, so define it here for now.  */
++#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN
++# define _IO_IN_BACKUP 0x100
++#endif
++
+ /* BSD stdio derived implementations.  */
+ 
+ #if defined __NetBSD__                         /* NetBSD */
diff --git a/gnu/packages/patches/openssl-1.0.2-CVE-2018-0495.patch b/gnu/packages/patches/openssl-1.0.2-CVE-2018-0495.patch
deleted file mode 100644
index 2d54ed03b9..0000000000
--- a/gnu/packages/patches/openssl-1.0.2-CVE-2018-0495.patch
+++ /dev/null
@@ -1,215 +0,0 @@
-Fix CVE-2018-0495:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495
-https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/
-
-Patch copied from upstream source repository:
-
-https://github.com/openssl/openssl/commit/949ff36623eafc3523a9f91784992965018ffb05
-
-From 949ff36623eafc3523a9f91784992965018ffb05 Mon Sep 17 00:00:00 2001
-From: Matt Caswell <matt@openssl.org>
-Date: Fri, 25 May 2018 12:10:13 +0100
-Subject: [PATCH] Add blinding to an ECDSA signature
-
-Keegan Ryan (NCC Group) has demonstrated a side channel attack on an
-ECDSA signature operation. During signing the signer calculates:
-
-s:= k^-1 * (m + r * priv_key) mod order
-
-The addition operation above provides a sufficient signal for a
-flush+reload attack to derive the private key given sufficient signature
-operations.
-
-As a mitigation (based on a suggestion from Keegan) we add blinding to
-the operation so that:
-
-s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order
-
-Since this attack is a localhost side channel only no CVE is assigned.
-
-Reviewed-by: Rich Salz <rsalz@openssl.org>
----
- CHANGES                  |  4 ++
- crypto/ecdsa/ecdsatest.c |  9 ++++-
- crypto/ecdsa/ecs_ossl.c  | 82 ++++++++++++++++++++++++++++++++--------
- 3 files changed, 79 insertions(+), 16 deletions(-)
-
-diff --git a/crypto/ecdsa/ecdsatest.c b/crypto/ecdsa/ecdsatest.c
-index 0f301f86d9..a130fc9117 100644
---- a/crypto/ecdsa/ecdsatest.c
-+++ b/crypto/ecdsa/ecdsatest.c
-@@ -137,7 +137,7 @@ int restore_rand(void)
-         return 1;
- }
- 
--static int fbytes_counter = 0;
-+static int fbytes_counter = 0, use_fake = 0;
- static const char *numbers[8] = {
-     "651056770906015076056810763456358567190100156695615665659",
-     "6140507067065001063065065565667405560006161556565665656654",
-@@ -158,6 +158,11 @@ int fbytes(unsigned char *buf, int num)
-     int ret;
-     BIGNUM *tmp = NULL;
- 
-+    if (use_fake == 0)
-+        return old_rand->bytes(buf, num);
-+
-+    use_fake = 0;
-+
-     if (fbytes_counter >= 8)
-         return 0;
-     tmp = BN_new();
-@@ -199,11 +204,13 @@ int x9_62_test_internal(BIO *out, int nid, const char *r_in, const char *s_in)
-     /* create the key */
-     if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
-         goto x962_int_err;
-+    use_fake = 1;
-     if (!EC_KEY_generate_key(key))
-         goto x962_int_err;
-     BIO_printf(out, ".");
-     (void)BIO_flush(out);
-     /* create the signature */
-+    use_fake = 1;
-     signature = ECDSA_do_sign(digest, 20, key);
-     if (signature == NULL)
-         goto x962_int_err;
-diff --git a/crypto/ecdsa/ecs_ossl.c b/crypto/ecdsa/ecs_ossl.c
-index 16d4f59b9b..1d37551803 100644
---- a/crypto/ecdsa/ecs_ossl.c
-+++ b/crypto/ecdsa/ecs_ossl.c
-@@ -252,6 +252,7 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
- {
-     int ok = 0, i;
-     BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL, *order = NULL;
-+    BIGNUM *blind = NULL, *blindm = NULL;
-     const BIGNUM *ckinv;
-     BN_CTX *ctx = NULL;
-     const EC_GROUP *group;
-@@ -269,14 +270,25 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
-     }
- 
-     ret = ECDSA_SIG_new();
--    if (!ret) {
-+    if (ret == NULL) {
-         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
-         return NULL;
-     }
-     s = ret->s;
- 
--    if ((ctx = BN_CTX_new()) == NULL || (order = BN_new()) == NULL ||
--        (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {
-+    ctx = BN_CTX_new();
-+    if (ctx == NULL) {
-+        ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
-+        goto err;
-+    }
-+
-+    BN_CTX_start(ctx);
-+    order = BN_CTX_get(ctx);
-+    tmp = BN_CTX_get(ctx);
-+    m = BN_CTX_get(ctx);
-+    blind = BN_CTX_get(ctx);
-+    blindm = BN_CTX_get(ctx);
-+    if (blindm == NULL) {
-         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
-         goto err;
-     }
-@@ -315,26 +327,70 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
-             }
-         }
- 
--        if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
-+        /*
-+         * The normal signature calculation is:
-+         *
-+         *   s := k^-1 * (m + r * priv_key) mod order
-+         *
-+         * We will blind this to protect against side channel attacks
-+         *
-+         *   s := k^-1 * blind^-1 * (blind * m + blind * r * priv_key) mod order
-+         */
-+
-+        /* Generate a blinding value */
-+        do {
-+            if (!BN_rand(blind, BN_num_bits(order) - 1, -1, 0))
-+                goto err;
-+        } while (BN_is_zero(blind));
-+        BN_set_flags(blind, BN_FLG_CONSTTIME);
-+        BN_set_flags(blindm, BN_FLG_CONSTTIME);
-+        BN_set_flags(tmp, BN_FLG_CONSTTIME);
-+
-+        /* tmp := blind * priv_key * r mod order */
-+        if (!BN_mod_mul(tmp, blind, priv_key, order, ctx)) {
-+            ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-+            goto err;
-+        }
-+        if (!BN_mod_mul(tmp, tmp, ret->r, order, ctx)) {
-+            ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-+            goto err;
-+        }
-+
-+        /* blindm := blind * m mod order */
-+        if (!BN_mod_mul(blindm, blind, m, order, ctx)) {
-+            ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-+            goto err;
-+        }
-+
-+        /* s : = (blind * priv_key * r) + (blind * m) mod order */
-+        if (!BN_mod_add_quick(s, tmp, blindm, order)) {
-+            ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-+            goto err;
-+        }
-+
-+        /* s:= s * blind^-1 mod order */
-+        if (BN_mod_inverse(blind, blind, order, ctx) == NULL) {
-             ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-             goto err;
-         }
--        if (!BN_mod_add_quick(s, tmp, m, order)) {
-+        if (!BN_mod_mul(s, s, blind, order, ctx)) {
-             ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-             goto err;
-         }
-+
-+        /* s := s * k^-1 mod order */
-         if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
-             ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
-             goto err;
-         }
-+
-         if (BN_is_zero(s)) {
-             /*
-              * if kinv and r have been supplied by the caller don't to
-              * generate new kinv and r values
-              */
-             if (in_kinv != NULL && in_r != NULL) {
--                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,
--                         ECDSA_R_NEED_NEW_SETUP_VALUES);
-+                ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ECDSA_R_NEED_NEW_SETUP_VALUES);
-                 goto err;
-             }
-         } else
-@@ -349,15 +405,11 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
-         ECDSA_SIG_free(ret);
-         ret = NULL;
-     }
--    if (ctx)
-+    if (ctx != NULL) {
-+        BN_CTX_end(ctx);
-         BN_CTX_free(ctx);
--    if (m)
--        BN_clear_free(m);
--    if (tmp)
--        BN_clear_free(tmp);
--    if (order)
--        BN_free(order);
--    if (kinv)
-+    }
-+    if (kinv != NULL)
-         BN_clear_free(kinv);
-     return ret;
- }
--- 
-2.17.1
-
diff --git a/gnu/packages/patches/openssl-1.0.2-CVE-2018-0732.patch b/gnu/packages/patches/openssl-1.0.2-CVE-2018-0732.patch
deleted file mode 100644
index 50b95306a5..0000000000
--- a/gnu/packages/patches/openssl-1.0.2-CVE-2018-0732.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-Fix CVE-2018-0732:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0732
-
-Patch copied from upstream source repository:
-
-https://github.com/openssl/openssl/commit/3984ef0b72831da8b3ece4745cac4f8575b19098
-
-From 3984ef0b72831da8b3ece4745cac4f8575b19098 Mon Sep 17 00:00:00 2001
-From: Guido Vranken <guidovranken@gmail.com>
-Date: Mon, 11 Jun 2018 19:38:54 +0200
-Subject: [PATCH] Reject excessively large primes in DH key generation.
-
-CVE-2018-0732
-
-Signed-off-by: Guido Vranken <guidovranken@gmail.com>
-
-(cherry picked from commit 91f7361f47b082ae61ffe1a7b17bb2adf213c7fe)
-
-Reviewed-by: Tim Hudson <tjh@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/6457)
----
- crypto/dh/dh_key.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
-index 387558f146..f235e0d682 100644
---- a/crypto/dh/dh_key.c
-+++ b/crypto/dh/dh_key.c
-@@ -130,10 +130,15 @@ static int generate_key(DH *dh)
-     int ok = 0;
-     int generate_new_key = 0;
-     unsigned l;
--    BN_CTX *ctx;
-+    BN_CTX *ctx = NULL;
-     BN_MONT_CTX *mont = NULL;
-     BIGNUM *pub_key = NULL, *priv_key = NULL;
- 
-+    if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
-+        DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
-+        return 0;
-+    }
-+
-     ctx = BN_CTX_new();
-     if (ctx == NULL)
-         goto err;
--- 
-2.17.1
-
diff --git a/gnu/packages/patches/parted-glibc-compat.patch b/gnu/packages/patches/parted-glibc-compat.patch
new file mode 100644
index 0000000000..edf4afb0d1
--- /dev/null
+++ b/gnu/packages/patches/parted-glibc-compat.patch
@@ -0,0 +1,17 @@
+Include <sys/sysmacros.h> for "major" and "minor".
+
+Taken from upstream:
+https://git.savannah.gnu.org/cgit/parted.git/commit/?id=ba5e0451b51c983e40afd123b6e0d3eddb55e610
+
+diff --git a/libparted/arch/linux.c b/libparted/arch/linux.c
+index 31b98ab..7e86b51 100644
+--- a/libparted/arch/linux.c
++++ b/libparted/arch/linux.c
+@@ -41,6 +41,7 @@
+ #include <sys/utsname.h>        /* for uname() */
+ #include <scsi/scsi.h>
+ #include <assert.h>
++#include <sys/sysmacros.h>
+ #ifdef ENABLE_DEVICE_MAPPER
+ #include <libdevmapper.h>
+ #endif
diff --git a/gnu/packages/patches/perf-gcc-ice.patch b/gnu/packages/patches/perf-gcc-ice.patch
deleted file mode 100644
index 58ab5359c2..0000000000
--- a/gnu/packages/patches/perf-gcc-ice.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Work around this GCC ICE: <https://bugs.gnu.org/31708>.
-
---- linux-4.16.13/tools/perf/util/header.c	2018-06-04 11:30:39.368146035 +0200
-+++ linux-4.16.13/tools/perf/util/header.c	2018-06-04 11:34:04.667212378 +0200
-@@ -135,7 +135,7 @@ int do_write(struct feat_fd *ff, const v
- int write_padded(struct feat_fd *ff, const void *bf,
- 		 size_t count, size_t count_aligned)
- {
--	static const char zero_buf[NAME_ALIGN];
-+	static const char zero_buf[NAME_ALIGN] = { 0 };
- 	int err = do_write(ff, bf, count);
- 
- 	if (!err)
diff --git a/gnu/packages/patches/perl-archive-tar-CVE-2018-12015.patch b/gnu/packages/patches/perl-archive-tar-CVE-2018-12015.patch
deleted file mode 100644
index 6460cf5855..0000000000
--- a/gnu/packages/patches/perl-archive-tar-CVE-2018-12015.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-Fix CVE-2018-12015:
-
-https://security-tracker.debian.org/tracker/CVE-2018-12015
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12015
-https://rt.cpan.org/Ticket/Display.html?id=125523
-
-Patch taken from this upstream commit and adapted to apply to
-the bundled copy in the Perl distribution:
-
-https://github.com/jib/archive-tar-new/commit/ae65651eab053fc6dc4590dbb863a268215c1fc5
-
-diff --git a/cpan/Archive-Tar/lib/Archive/Tar.pm b/cpan/Archive-Tar/lib/Archive/Tar.pm
-index 6244369..a83975f 100644
---- a/cpan/Archive-Tar/lib/Archive/Tar.pm
-+++ b/cpan/Archive-Tar/lib/Archive/Tar.pm
-@@ -845,6 +845,20 @@ sub _extract_file {
-         return;
-     }
- 
-+    ### If a file system already contains a block device with the same name as
-+    ### the being extracted regular file, we would write the file's content
-+    ### to the block device. So remove the existing file (block device) now.
-+    ### If an archive contains multiple same-named entries, the last one
-+    ### should replace the previous ones. So remove the old file now.
-+    ### If the old entry is a symlink to a file outside of the CWD, the new
-+    ### entry would create a file there. This is CVE-2018-12015
-+    ### <https://rt.cpan.org/Ticket/Display.html?id=125523>.
-+    if (-l $full || -e _) {
-+	if (!unlink $full) {
-+	    $self->_error( qq[Could not remove old file '$full': $!] );
-+	    return;
-+	}
-+    }
-     if( length $entry->type && $entry->is_file ) {
-         my $fh = IO::File->new;
-         $fh->open( $full, '>' ) or (
diff --git a/gnu/packages/patches/perl-deterministic-ordering.patch b/gnu/packages/patches/perl-deterministic-ordering.patch
index 92e33ef135..be63d5cde3 100644
--- a/gnu/packages/patches/perl-deterministic-ordering.patch
+++ b/gnu/packages/patches/perl-deterministic-ordering.patch
@@ -12,10 +12,10 @@ reproducibility.
  cpan/Devel-PPPort/PPPort_xs.PL | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/cpan/Devel-PPPort/PPPort_xs.PL b/cpan/Devel-PPPort/PPPort_xs.PL
+diff --git a/dist/Devel-PPPort/PPPort_xs.PL b/dist/Devel-PPPort/PPPort_xs.PL
 index 5f18940..149f2fe 100644
---- a/cpan/Devel-PPPort/PPPort_xs.PL
-+++ b/cpan/Devel-PPPort/PPPort_xs.PL
+--- a/dist/Devel-PPPort/PPPort_xs.PL
++++ b/dist/Devel-PPPort/PPPort_xs.PL
 @@ -38,7 +38,7 @@ END
  my $file;
  my $sec;
diff --git a/gnu/packages/patches/perl-file-path-CVE-2017-6512.patch b/gnu/packages/patches/perl-file-path-CVE-2017-6512.patch
deleted file mode 100644
index 28ab067599..0000000000
--- a/gnu/packages/patches/perl-file-path-CVE-2017-6512.patch
+++ /dev/null
@@ -1,173 +0,0 @@
-Fix CVE-2017-6512:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6512
-https://rt.cpan.org/Public/Bug/Display.html?id=121951
-
-Patch copied from Debian, adapted to apply to the copy of File::Path in Perl
-5.24.0.
-
-https://github.com/jkeenan/File-Path/commit/e5ef95276ee8ad471c66ee574a5d42552b3a6af2
-https://anonscm.debian.org/cgit/perl/perl.git/diff/debian/patches/fixes/file_path_chmod_race.diff?id=e7b50f8fb6413f8ddfbbfda2d531615fb029e2d3
-
-From d760748be0efca7c05454440e24f3df77bf7cf5d Mon Sep 17 00:00:00 2001
-From: John Lightsey <john@nixnuts.net>
-Date: Tue, 2 May 2017 12:03:52 -0500
-Subject: Prevent directory chmod race attack.
-
-CVE-2017-6512 is a race condition attack where the chmod() of directories
-that cannot be entered is misused to change the permissions on other
-files or directories on the system. This has been corrected by limiting
-the directory-permission loosening logic to systems where fchmod() is
-supported.
-
-[Backported (whitespace adjustments) to File-Path 2.12 / perl 5.24 by
-Dominic Hargreaves for Debian.]
-
-Bug: https://rt.cpan.org/Public/Bug/Display.html?id=121951
-Bug-Debian: https://bugs.debian.org/863870
-Patch-Name: fixes/file_path_chmod_race.diff
----
- cpan/File-Path/lib/File/Path.pm | 39 +++++++++++++++++++++++++--------------
- cpan/File-Path/t/Path.t         | 40 ++++++++++++++++++++++++++--------------
- 2 files changed, 51 insertions(+), 28 deletions(-)
-
-diff --git a/cpan/File-Path/lib/File/Path.pm b/cpan/File-Path/lib/File/Path.pm
-index 034da1e..a824cc8 100644
---- a/cpan/File-Path/lib/File/Path.pm
-+++ b/cpan/File-Path/lib/File/Path.pm
-@@ -354,21 +354,32 @@ sub _rmtree {
- 
-                 # see if we can escalate privileges to get in
-                 # (e.g. funny protection mask such as -w- instead of rwx)
--                $perm &= oct '7777';
--                my $nperm = $perm | oct '700';
--                if (
--                    !(
--                           $arg->{safe}
--                        or $nperm == $perm
--                        or chmod( $nperm, $root )
--                    )
--                  )
--                {
--                    _error( $arg,
--                        "cannot make child directory read-write-exec", $canon );
--                    next ROOT_DIR;
-+                # This uses fchmod to avoid traversing outside of the proper
-+                # location (CVE-2017-6512)
-+                my $root_fh;
-+                if (open($root_fh, '<', $root)) {
-+                    my ($fh_dev, $fh_inode) = (stat $root_fh )[0,1];
-+                    $perm &= oct '7777';
-+                    my $nperm = $perm | oct '700';
-+                    local $@;
-+                    if (
-+                        !(
-+                            $arg->{safe}
-+                           or $nperm == $perm
-+                           or !-d _
-+                           or $fh_dev ne $ldev
-+                           or $fh_inode ne $lino
-+                           or eval { chmod( $nperm, $root_fh ) }
-+                        )
-+                      )
-+                    {
-+                        _error( $arg,
-+                            "cannot make child directory read-write-exec", $canon );
-+                        next ROOT_DIR;
-+                    }
-+                    close $root_fh;
-                 }
--                elsif ( !chdir($root) ) {
-+                if ( !chdir($root) ) {
-                     _error( $arg, "cannot chdir to child", $canon );
-                     next ROOT_DIR;
-                 }
-diff --git a/cpan/File-Path/t/Path.t b/cpan/File-Path/t/Path.t
-index ff52fd6..956ca09 100644
---- a/cpan/File-Path/t/Path.t
-+++ b/cpan/File-Path/t/Path.t
-@@ -3,7 +3,7 @@
- 
- use strict;
- 
--use Test::More tests => 127;
-+use Test::More tests => 126;
- use Config;
- use Fcntl ':mode';
- use lib 't/';
-@@ -18,6 +18,13 @@ BEGIN {
- 
- my $Is_VMS = $^O eq 'VMS';
- 
-+my $fchmod_supported = 0;
-+if (open my $fh, curdir()) {
-+    my ($perm) = (stat($fh))[2];
-+    $perm &= 07777;
-+    eval { $fchmod_supported = chmod( $perm, $fh); };
-+}
-+
- # first check for stupid permissions second for full, so we clean up
- # behind ourselves
- for my $perm (0111,0777) {
-@@ -299,16 +306,19 @@ is($created[0], $dir, "created directory (old style 3 mode undef) cross-check");
- 
- is(rmtree($dir, 0, undef), 1, "removed directory 3 verbose undef");
- 
--$dir = catdir($tmp_base,'G');
--$dir = VMS::Filespec::unixify($dir) if $Is_VMS;
-+SKIP: {
-+    skip "fchmod of directories not supported on this platform", 3 unless $fchmod_supported;
-+    $dir = catdir($tmp_base,'G');
-+    $dir = VMS::Filespec::unixify($dir) if $Is_VMS;
- 
--@created = mkpath($dir, undef, 0200);
-+    @created = mkpath($dir, undef, 0400);
- 
--is(scalar(@created), 1, "created write-only dir");
-+    is(scalar(@created), 1, "created read-only dir");
- 
--is($created[0], $dir, "created write-only directory cross-check");
-+    is($created[0], $dir, "created read-only directory cross-check");
- 
--is(rmtree($dir), 1, "removed write-only dir");
-+    is(rmtree($dir), 1, "removed read-only dir");
-+}
- 
- # borderline new-style heuristics
- if (chdir $tmp_base) {
-@@ -450,26 +460,28 @@ SKIP: {
- }
- 
- SKIP : {
--    my $skip_count = 19;
-+    my $skip_count = 18;
-     # this test will fail on Windows, as per:
-     #   http://perldoc.perl.org/perlport.html#chmod
- 
-     skip "Windows chmod test skipped", $skip_count
-         if $^O eq 'MSWin32';
-+    skip "fchmod() on directories is not supported on this platform", $skip_count
-+        unless $fchmod_supported;
-     my $mode;
-     my $octal_mode;
-     my @inputs = (
--      0777, 0700, 0070, 0007,
--      0333, 0300, 0030, 0003,
--      0111, 0100, 0010, 0001,
--      0731, 0713, 0317, 0371, 0173, 0137,
--      00 );
-+      0777, 0700, 0470, 0407,
-+      0433, 0400, 0430, 0403,
-+      0111, 0100, 0110, 0101,
-+      0731, 0713, 0317, 0371,
-+      0173, 0137);
-     my $input;
-     my $octal_input;
--    $dir = catdir($tmp_base, 'chmod_test');
- 
-     foreach (@inputs) {
-         $input = $_;
-+        $dir = catdir($tmp_base, sprintf("chmod_test%04o", $input));
-         # We can skip from here because 0 is last in the list.
-         skip "Mode of 0 means assume user defaults on VMS", 1
-           if ($input == 0 && $Is_VMS);
diff --git a/gnu/packages/patches/podofo-cmake-3.12.patch b/gnu/packages/patches/podofo-cmake-3.12.patch
new file mode 100644
index 0000000000..0a3c19b21a
--- /dev/null
+++ b/gnu/packages/patches/podofo-cmake-3.12.patch
@@ -0,0 +1,19 @@
+The build fails with cmake 3.12.0.  This patch will be obsolete with the next
+release.
+
+https://sourceforge.net/p/podofo/tickets/24/attachment/podofo-cmake-3.12.patch
+
+
+--- a/test/TokenizerTest/CMakeLists.txt	2018-07-20 18:26:02.921494293 +0200
++++ b/test/TokenizerTest/CMakeLists.txt	2018-07-20 18:34:53.727136443 +0200
+@@ -2,10 +2,3 @@
+ TARGET_LINK_LIBRARIES(TokenizerTest ${PODOFO_LIB} ${PODOFO_LIB_DEPENDS})
+ SET_TARGET_PROPERTIES(TokenizerTest PROPERTIES COMPILE_FLAGS "${PODOFO_CFLAGS}")
+ ADD_DEPENDENCIES(TokenizerTest ${PODOFO_DEPEND_TARGET})
+-
+-# Copy the test samples over to the build tree
+-ADD_CUSTOM_COMMAND(
+-    TARGET TokenizerTest
+-    POST_BUILD
+-    COMMAND "${CMAKE_COMMAND}" -E copy_directory "${CMAKE_CURRENT_SOURCE_DIR}/objects" "${CMAKE_CURRENT_BINARY_DIR}/objects"
+-    )
diff --git a/gnu/packages/patches/python-cffi-x87-stack-clean.patch b/gnu/packages/patches/python-cffi-x87-stack-clean.patch
new file mode 100644
index 0000000000..50243505ee
--- /dev/null
+++ b/gnu/packages/patches/python-cffi-x87-stack-clean.patch
@@ -0,0 +1,29 @@
+Fix test that fails on i686:
+
+https://bitbucket.org/cffi/cffi/issues/382
+
+This is a squashed version of these commits:
+https://bitbucket.org/cffi/cffi/commits/ef09637b2314
+https://bitbucket.org/cffi/cffi/commits/7a76a3815340
+
+diff -r 99940f1f5402 testing/cffi0/test_function.py
+--- a/testing/cffi0/test_function.py	Tue Feb 27 21:18:33 2018 +0100
++++ b/testing/cffi0/test_function.py	Sun Nov 11 16:26:23 2018 +0100
+@@ -45,14 +45,14 @@
+         assert x != math.sin(1.23)    # rounding effects
+         assert abs(x - math.sin(1.23)) < 1E-6
+ 
+-    def test_sin_no_return_value(self):
++    def test_lround_no_return_value(self):
+         # check that 'void'-returning functions work too
+         ffi = FFI(backend=self.Backend())
+         ffi.cdef("""
+-            void sin(double x);
++            void lround(double x);
+         """)
+         m = ffi.dlopen(lib_m)
+-        x = m.sin(1.23)
++        x = m.lround(1.23)
+         assert x is None
+ 
+     def test_dlopen_filename(self):
diff --git a/gnu/packages/patches/python-networkx2-reproducible-build.patch b/gnu/packages/patches/python-networkx2-reproducible-build.patch
deleted file mode 100644
index 8274767ab8..0000000000
--- a/gnu/packages/patches/python-networkx2-reproducible-build.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From c065b972ed294769a41936d6b9feb336473af5d1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?G=C3=A1bor=20Boskovits?= <boskovits@gmail.com>
-Date: Sat, 4 Nov 2017 15:28:47 +0100
-Subject: Fix SOURCE_DATE_EPOCH ignored bug (#2735)
-
-* Fix SOURCE_DATE_EPOCH ignored bug
-
-Fix a bug in networkx/release.py that makes build
-non-reproducible.
----
- networkx/release.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/networkx/release.py b/networkx/release.py
-index e81fc0c0..6322cf0d 100644
---- a/networkx/release.py
-+++ b/networkx/release.py
-@@ -135,7 +135,7 @@ def get_revision():
- 
- def get_info(dynamic=True):
-     # Date information
--    date_info = datetime.datetime.now()
-+    date_info = datetime.datetime.utcfromtimestamp(int(os.environ.get('SOURCE_DATE_EPOCH', time.time())))
-     date = time.asctime(date_info.timetuple())
- 
-     revision, version, version_info, vcs_info = None, None, None, None
--- 
-2.14.2
-
diff --git a/gnu/packages/patches/python-paste-remove-website-test.patch b/gnu/packages/patches/python-paste-remove-website-test.patch
deleted file mode 100644
index 93417fbe75..0000000000
--- a/gnu/packages/patches/python-paste-remove-website-test.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Remove the test to see if the Python Paste website is up.
-
-Obviously without network access there is no way for us to check this, and
-it's pretty strange to test a project's website when you really mean to test
-the project anyhow...
-
---- a/tests/test_proxy.py	2016-02-22 19:13:04.040117767 -0800
-+++ b/tests/test_proxy.py	2016-02-22 19:13:04.040117767 -0800
-@@ -1,12 +1,3 @@
- from paste import proxy
- from paste.fixture import TestApp
-
--def test_paste_website():
--    # Not the most robust test...
--    # need to test things like POSTing to pages, and getting from pages
--    # that don't set content-length.
--    app = proxy.Proxy('http://pythonpaste.org')
--    app = TestApp(app)
--    res = app.get('/')
--    assert 'documentation' in res
--
diff --git a/gnu/packages/patches/python-pillow-fix-failing-tests.patch b/gnu/packages/patches/python-pillow-fix-failing-tests.patch
deleted file mode 100644
index 2575d6f612..0000000000
--- a/gnu/packages/patches/python-pillow-fix-failing-tests.patch
+++ /dev/null
diff --git a/gnu/packages/patches/python-scikit-learn-fix-test-non-determinism.patch b/gnu/packages/patches/python-scikit-learn-fix-test-non-determinism.patch
deleted file mode 100644
index 90328cc0eb..0000000000
--- a/gnu/packages/patches/python-scikit-learn-fix-test-non-determinism.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-This patch stops a test sometimes failing because of non-determinism.  See
-https://github.com/scikit-learn/scikit-learn/pull/9542
-
-From ff9f6db6e8b59c2b3528c8137ed4054f57c1d7c4 Mon Sep 17 00:00:00 2001
-From: Hanmin Qin <qinhanmin2005@sina.com>
-Date: Sun, 13 Aug 2017 22:13:49 +0800
-Subject: [PATCH] add random_state
-
----
- sklearn/tests/test_kernel_ridge.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sklearn/tests/test_kernel_ridge.py b/sklearn/tests/test_kernel_ridge.py
-index 4750a096ac6..979875870b6 100644
---- a/sklearn/tests/test_kernel_ridge.py
-+++ b/sklearn/tests/test_kernel_ridge.py
-@@ -10,7 +10,7 @@
- from sklearn.utils.testing import assert_array_almost_equal
- 
- 
--X, y = make_regression(n_features=10)
-+X, y = make_regression(n_features=10, random_state=0)
- Xcsr = sp.csr_matrix(X)
- Xcsc = sp.csc_matrix(X)
- Y = np.array([y, y]).T
diff --git a/gnu/packages/patches/python-testtools.patch b/gnu/packages/patches/python-testtools.patch
new file mode 100644
index 0000000000..42536e50f9
--- /dev/null
+++ b/gnu/packages/patches/python-testtools.patch
@@ -0,0 +1,57 @@
+https://github.com/testing-cabal/testtools/commit/29004731f9c480b7c44a9c2605513d50d372898f.patch
+Should be fixed in the next release
+
+From 29004731f9c480b7c44a9c2605513d50d372898f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Thu, 17 May 2018 17:52:26 +0200
+Subject: [PATCH] Fix the tests on Python 3.7
+
+Exception's repr got changed not to include trailing comma
+
+Fixes https://github.com/testing-cabal/testtools/issues/270
+---
+ .travis.yml                                |  1 +
+ testtools/tests/matchers/test_exception.py | 11 +++++++++--
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/.travis.yml b/.travis.yml
+index 7f1f4db7..784608e0 100644
+--- a/.travis.yml
++++ b/.travis.yml
+@@ -5,6 +5,7 @@ python:
+   - "3.4"
+   - "3.5"
+   - "3.6"
++  - "3.7-dev"
+   - "pypy"
+ 
+ install:
+diff --git a/testtools/tests/matchers/test_exception.py b/testtools/tests/matchers/test_exception.py
+index 6cd80af1..acd39252 100644
+--- a/testtools/tests/matchers/test_exception.py
++++ b/testtools/tests/matchers/test_exception.py
+@@ -32,15 +32,22 @@ class TestMatchesExceptionInstanceInterface(TestCase, TestMatchersInterface):
+     matches_matches = [error_foo]
+     matches_mismatches = [error_bar, error_base_foo]
+ 
++    if sys.version_info >= (3, 7):
++        # exception's repr has changed
++        _e = ''
++    else:
++        _e = ','
++
+     str_examples = [
+-        ("MatchesException(Exception('foo',))",
++        ("MatchesException(Exception('foo'%s))" % _e,
+          MatchesException(Exception('foo')))
+         ]
+     describe_examples = [
+         ("%r is not a %r" % (Exception, ValueError),
+          error_base_foo,
+          MatchesException(ValueError("foo"))),
+-        ("ValueError('bar',) has different arguments to ValueError('foo',).",
++        ("ValueError('bar'%s) has different arguments to ValueError('foo'%s)."
++         % (_e, _e),
+          error_bar,
+          MatchesException(ValueError("foo"))),
+         ]
diff --git a/gnu/packages/patches/python2-CVE-2018-1060.patch b/gnu/packages/patches/python2-CVE-2018-1060.patch
deleted file mode 100644
index 5eb7ccfbc9..0000000000
--- a/gnu/packages/patches/python2-CVE-2018-1060.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Fix CVE-2018-1060:
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060
-
-Taken from upstream commit (sans test and NEWS):
-https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2
-
-diff --git a/Lib/poplib.py b/Lib/poplib.py
-index b91e5f72d2ca..a238510b38fc 100644
---- a/Lib/poplib.py
-+++ b/Lib/poplib.py
-@@ -274,7 +274,7 @@ def rpop(self, user):
-         return self._shortcmd('RPOP %s' % user)
- 
- 
--    timestamp = re.compile(r'\+OK.*(<[^>]+>)')
-+    timestamp = re.compile(br'\+OK.[^<]*(<.*>)')
- 
-     def apop(self, user, secret):
-         """Authorisation
-
diff --git a/gnu/packages/patches/python2-CVE-2018-1061.patch b/gnu/packages/patches/python2-CVE-2018-1061.patch
deleted file mode 100644
index 6caab24b4d..0000000000
--- a/gnu/packages/patches/python2-CVE-2018-1061.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Fix CVE-2018-1061:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061
-
-Taken from upstream commit (sans test and NEWS):
-https://github.com/python/cpython/commit/e052d40cea15f582b50947f7d906b39744dc62a2
-
-diff --git a/Lib/difflib.py b/Lib/difflib.py
-index 1c6fbdbedcb7..788a92df3f89 100644
---- a/Lib/difflib.py
-+++ b/Lib/difflib.py
-@@ -1103,7 +1103,7 @@ def _qformat(self, aline, bline, atags, btags):
- 
- import re
- 
--def IS_LINE_JUNK(line, pat=re.compile(r"\s*#?\s*$").match):
-+def IS_LINE_JUNK(line, pat=re.compile(r"\s*(?:#\s*)?$").match):
-     r"""
-     Return 1 for ignorable line: iff `line` is blank or contains a single '#'.
-
diff --git a/gnu/packages/patches/qt-5-renameat2.patch b/gnu/packages/patches/qt-5-renameat2.patch
new file mode 100644
index 0000000000..036070c7ff
--- /dev/null
+++ b/gnu/packages/patches/qt-5-renameat2.patch
@@ -0,0 +1,35 @@
+Avoid conflicting declaration of 'renameat2' on glibc 2.28
+(see <https://github.com/meta-qt5/meta-qt5/issues/94>.)
+
+Patch from <https://github.com/meta-qt5/meta-qt5/pull/95>
+by Andreas Müller <schnitzeltony@gmail.com>.
+
+---
+ src/corelib/io/qfilesystemengine_unix.cpp | 11 ++++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/corelib/io/qfilesystemengine_unix.cpp b/src/corelib/io/qfilesystemengine_unix.cpp
+index be6ce48d0cb..1bf1bebc7f1 100644
+--- a/qtbase/src/corelib/io/qfilesystemengine_unix.cpp
++++ b/qtbase/src/corelib/io/qfilesystemengine_unix.cpp
+@@ -98,6 +98,17 @@ extern "C" NSString *NSTemporaryDirectory();
+ #  define FICLONE       _IOW(0x94, 9, int)
+ #endif
+ 
++// renameat2/statx features for non bootstrapped build
++#ifndef QT_BOOTSTRAPPED
++#ifdef __GLIBC_PREREQ
++# define QT_FEATURE_renameat2 (__GLIBC_PREREQ(2, 28) ? 1 : -1)
++# define QT_FEATURE_statx (__GLIBC_PREREQ(2, 28) ? 1 : -1)
++#else
++# define QT_FEATURE_renameat2 -1
++# define QT_FEATURE_statx -1
++#endif
++#endif
++
+ #  if defined(Q_OS_ANDROID)
+ // renameat2() and statx() are disabled on Android because quite a few systems
+ // come with sandboxes that kill applications that make system calls outside a
+-- 
+2.14.4
+
diff --git a/gnu/packages/patches/randomjungle-disable-static-build.patch b/gnu/packages/patches/randomjungle-disable-static-build.patch
new file mode 100644
index 0000000000..3de6c269fd
--- /dev/null
+++ b/gnu/packages/patches/randomjungle-disable-static-build.patch
@@ -0,0 +1,14 @@
+Drop build time dependency on the static executables.
+
+--- a/src/Makefile.in	2018-11-25 20:27:10.691508925 +0100
++++ b/src/Makefile.in	2018-11-25 20:27:43.565631413 +0100
+@@ -34,8 +34,7 @@
+ POST_UNINSTALL = :
+ build_triplet = @build@
+ host_triplet = @host@
+-bin_PROGRAMS = rjungle$(EXEEXT) rjungle_static$(EXEEXT) \
+-	rjunglesparse$(EXEEXT) rjunglesparse_static$(EXEEXT)
++bin_PROGRAMS = rjungle$(EXEEXT) rjunglesparse$(EXEEXT)
+ subdir = src
+ DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
diff --git a/gnu/packages/patches/rust-mdbook-support-reproducible-builds-by-forcing-window.search.patch b/gnu/packages/patches/rust-reproducible-builds.patch
index ef7bf53b5d..ef7bf53b5d 100644
--- a/gnu/packages/patches/rust-mdbook-support-reproducible-builds-by-forcing-window.search.patch
+++ b/gnu/packages/patches/rust-reproducible-builds.patch
diff --git a/gnu/packages/patches/snappy-add-O2-flag-in-CmakeLists.txt.patch b/gnu/packages/patches/snappy-add-O2-flag-in-CmakeLists.txt.patch
new file mode 100644
index 0000000000..561763dabe
--- /dev/null
+++ b/gnu/packages/patches/snappy-add-O2-flag-in-CmakeLists.txt.patch
@@ -0,0 +1,36 @@
+From: Tobias Geerinckx-Rice <me@tobias.gr>
+Date: Sun, 26 Aug 2018 17:24:42 +0200
+Subject: [PATCH] snappy: Add O2 flag in CmakeLists.txt.
+
+Use ‘-O2’ optimisation when building with CMake, as is already done when
+using the Makefile. This patch was copied verbatim from the Snappy
+mailing list[0].
+
+[0]: <snappy-compression@googlegroups.com>
+
+From 903c72fb29b2db07b4abc38a5feb83d88f739d80 Mon Sep 17 00:00:00 2001
+From: huangwenjun <huangwenjun-hf@loongson.cn>
+Date: Fri, 10 Aug 2018 17:17:35 +0800
+Subject: [PATCH] Add O2 optimize flag in CmakeLists.txt.
+
+---
+ CMakeLists.txt | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 62ecd09..29e0cdc 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -6,6 +6,9 @@ set(CMAKE_CXX_STANDARD 11)
+ set(CMAKE_CXX_STANDARD_REQUIRED ON)
+ set(CMAKE_CXX_EXTENSIONS OFF)
+ 
++SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2")
++SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -O2")
++
+ # BUILD_SHARED_LIBS is a standard CMake variable, but we declare it here to make
+ # it prominent in the GUI.
+ option(BUILD_SHARED_LIBS "Build shared libraries(DLLs)." OFF)
+-- 
+2.1.0
+
diff --git a/gnu/packages/patches/swig-guile-gc.patch b/gnu/packages/patches/swig-guile-gc.patch
new file mode 100644
index 0000000000..0e745a6247
--- /dev/null
+++ b/gnu/packages/patches/swig-guile-gc.patch
@@ -0,0 +1,76 @@
+Fix garbage collection for Guile versions >= 2.0.12.  This issue showed
+up when running the tests on i686-linux.
+
+Taken from this upstream commit:
+https://github.com/swig/swig/commit/38f2ab0c30e369e63bbd0a6152108488d0de68e1
+
+diff --git a/Lib/guile/guile_scm_run.swg b/Lib/guile/guile_scm_run.swg
+index 274f197158..0d04cb7c62 100644
+--- a/Lib/guile/guile_scm_run.swg
++++ b/Lib/guile/guile_scm_run.swg
+@@ -99,6 +99,7 @@ SWIG_Guile_scm2newstr(SCM str, size_t *len) {
+ static int swig_initialized = 0;
+ static scm_t_bits swig_tag = 0;
+ static scm_t_bits swig_collectable_tag = 0;
++static scm_t_bits swig_finalized_tag = 0;
+ static scm_t_bits swig_destroyed_tag = 0;
+ static scm_t_bits swig_member_function_tag = 0;
+ static SCM swig_make_func = SCM_EOL;
+@@ -163,7 +164,19 @@ SWIG_Guile_PointerType(SCM object)
+   }
+   else scm_wrong_type_arg("SWIG-Guile-PointerType", 1, object);
+ }
+-  
++
++SWIGINTERN int
++SWIG_Guile_IsValidSmob(SCM smob)
++{
++  /* We do not accept smobs representing destroyed pointers, but we have to
++     allow finalized smobs because Guile >= 2.0.12 sets all smob instances
++     to the 'finalized' type before calling their 'free' function. This change
++     was introduced to Guile in commit 8dff3af087c6eaa83ae0d72aa8b22aef5c65d65d */
++  return SCM_SMOB_PREDICATE(swig_tag, smob)
++    || SCM_SMOB_PREDICATE(swig_collectable_tag, smob)
++    || SCM_SMOB_PREDICATE(swig_finalized_tag, smob);
++}
++
+ SWIGINTERN int
+ SWIG_Guile_ConvertPtr(SCM s, void **result, swig_type_info *type, int flags)
+ {
+@@ -179,8 +192,7 @@ SWIG_Guile_ConvertPtr(SCM s, void **result, swig_type_info *type, int flags)
+     *result = SCM_POINTER_VALUE(s);
+     return SWIG_OK;
+ #endif /* if SCM_MAJOR_VERSION >= 2 */
+-  } else if (SCM_SMOB_PREDICATE(swig_tag, smob) || SCM_SMOB_PREDICATE(swig_collectable_tag, smob)) {
+-    /* we do not accept smobs representing destroyed pointers */
++  } else if (SWIG_Guile_IsValidSmob(smob)) {
+     from = (swig_type_info *) SCM_CELL_WORD_2(smob);
+     if (!from) return SWIG_ERROR;
+     if (type) {
+@@ -239,7 +251,7 @@ SWIG_Guile_MarkPointerNoncollectable(SCM s)
+ {
+   SCM smob = SWIG_Guile_GetSmob(s);
+   if (!SCM_NULLP(smob)) {
+-    if (SCM_SMOB_PREDICATE(swig_tag, smob) || SCM_SMOB_PREDICATE(swig_collectable_tag, smob)) {
++    if (SWIG_Guile_IsValidSmob(smob)) {
+       SCM_SET_CELL_TYPE(smob, swig_tag);
+     }
+     else scm_wrong_type_arg(NULL, 0, s);
+@@ -252,7 +264,7 @@ SWIG_Guile_MarkPointerDestroyed(SCM s)
+ {
+   SCM smob = SWIG_Guile_GetSmob(s);
+   if (!SCM_NULLP(smob)) {
+-    if (SCM_SMOB_PREDICATE(swig_tag, smob) || SCM_SMOB_PREDICATE(swig_collectable_tag, smob)) {
++    if (SWIG_Guile_IsValidSmob(smob)) {
+       SCM_SET_CELL_TYPE(smob, swig_destroyed_tag);
+     }
+     else scm_wrong_type_arg(NULL, 0, s);
+@@ -419,6 +431,8 @@ SWIG_Guile_Init ()
+     scm_set_smob_print(swig_collectable_tag, print_collectable_swig);
+     scm_set_smob_equalp(swig_collectable_tag, equalp_swig);
+     scm_set_smob_free(swig_collectable_tag, free_swig);
++    /* For Guile >= 2.0.12. See libguile/smob.c:clear_smobnum */
++    swig_finalized_tag = swig_collectable_tag & ~0xff00;
+   }
+   if (ensure_smob_tag(swig_module, &swig_destroyed_tag,
+ 		      "destroyed-swig-pointer", "destroyed-swig-pointer-tag")) {
diff --git a/gnu/packages/patches/texinfo-5-perl-compat.patch b/gnu/packages/patches/texinfo-5-perl-compat.patch
new file mode 100644
index 0000000000..f16d6b4da8
--- /dev/null
+++ b/gnu/packages/patches/texinfo-5-perl-compat.patch
@@ -0,0 +1,19 @@
+Fix a deprecation warning with newer Perl that breaks some tests.
+
+--- a/tp/Texinfo/Parser.pm
++++ b/tp/Texinfo/Parser.pm
+@@ -5438,12 +5438,12 @@
+     }
+   } elsif ($command eq 'clickstyle') {
+     # REMACRO
+-    if ($line =~ /^\s+@([[:alnum:]][[:alnum:]\-]*)({})?\s*/) {
++    if ($line =~ /^\s+@([[:alnum:]][[:alnum:]\-]*)(\{})?\s*/) {
+       $args = ['@'.$1];
+       $self->{'clickstyle'} = $1
+         unless(_ignore_global_commands($self));
+       $remaining = $line;
+-      $remaining =~ s/^\s+@([[:alnum:]][[:alnum:]\-]*)({})?\s*(\@(c|comment)((\@|\s+).*)?)?//;
++      $remaining =~ s/^\s+@([[:alnum:]][[:alnum:]\-]*)(\{})?\s*(\@(c|comment)((\@|\s+).*)?)?//;
+       $has_comment = 1 if (defined($4));
+     } else {
+       $self->line_error (sprintf($self->__(
diff --git a/gnu/packages/patches/texinfo-perl-compat.patch b/gnu/packages/patches/texinfo-perl-compat.patch
new file mode 100644
index 0000000000..a7348fde0d
--- /dev/null
+++ b/gnu/packages/patches/texinfo-perl-compat.patch
@@ -0,0 +1,51 @@
+Fix compatibility with newer Perls.
+
+The first patch is taken from upstream:
+https://svn.savannah.gnu.org/viewvc/texinfo?view=revision&revision=8008
+
+The second gets rid of a deprecation warning that breaks some tests.
+Taken from Fedora: <https://bugzilla.redhat.com/show_bug.cgi?id=1590308>.
+
+--- trunk/tp/Texinfo/Convert/XSParagraph/xspara.c	2017/04/30 14:57:26	7765
++++ trunk/tp/Texinfo/Convert/XSParagraph/xspara.c	2018/07/13 15:39:29	8008
+@@ -248,6 +248,11 @@
+ 
+   dTHX;
+ 
++#if PERL_VERSION > 27 || (PERL_VERSION == 27 && PERL_SUBVERSION > 8)
++  /* needed due to thread-safe locale handling in newer perls */
++  switch_to_global_locale();
++#endif
++
+   if (setlocale (LC_CTYPE, "en_US.UTF-8")
+       || setlocale (LC_CTYPE, "en_US.utf8"))
+     goto success;
+@@ -320,6 +325,10 @@
+     {
+ success: ;
+       free (utf8_locale);
++#if PERL_VERSION > 27 || (PERL_VERSION == 27 && PERL_SUBVERSION > 8)
++      /* needed due to thread-safe locale handling in newer perls */
++      sync_locale();
++#endif
+       /*
+       fprintf (stderr, "tried to set LC_CTYPE to UTF-8.\n");
+       fprintf (stderr, "character encoding is: %s\n",
+
+diff -up texinfo-6.5/tp/Texinfo/Parser.pm.orig texinfo-6.5/tp/Texinfo/Parser.pm
+--- texinfo-6.5/tp/Texinfo/Parser.pm.orig	2018-06-12 13:40:29.356030136 +0200
++++ texinfo-6.5/tp/Texinfo/Parser.pm	2018-06-12 13:41:28.357725639 +0200
+@@ -5478,11 +5478,11 @@ sub _parse_special_misc_command($$$$)
+     }
+   } elsif ($command eq 'clickstyle') {
+     # REMACRO
+-    if ($line =~ /^\s+@([[:alnum:]][[:alnum:]\-]*)({})?\s*/) {
++    if ($line =~ /^\s+@([[:alnum:]][[:alnum:]\-]*)(\{})?\s*/) {
+       $args = ['@'.$1];
+       $self->{'clickstyle'} = $1;
+       $remaining = $line;
+-      $remaining =~ s/^\s+@([[:alnum:]][[:alnum:]\-]*)({})?\s*(\@(c|comment)((\@|\s+).*)?)?//;
++      $remaining =~ s/^\s+@([[:alnum:]][[:alnum:]\-]*)(\{})?\s*(\@(c|comment)((\@|\s+).*)?)?//;
+       $has_comment = 1 if (defined($4));
+     } else {
+       $self->line_error (sprintf($self->__(
diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 5719b7bb45..564a23d012 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -35,7 +35,7 @@
 (define-public pcre
   (package
    (name "pcre")
-   (version "8.41")
+   (version "8.42")
    (source (origin
             (method url-fetch)
             (uri (list
@@ -46,11 +46,12 @@
                                  version "/pcre-" version ".tar.bz2")))
             (sha256
              (base32
-              "0c5m469p5pd7jip621ipq6hbgh7128lzh7xndllfgh77ban7wb76"))))
+              "00ckpzlgyr16bnqx8fawa3afjgqxw5yxgs2l081vw23qi1y4pl1c"))))
    (build-system gnu-build-system)
    (outputs '("out"           ;library & headers
               "bin"           ;depends on Readline (adds 20MiB to the closure)
-              "doc"))         ;1.8 MiB of HTML
+              "doc"           ;1.8 MiB of HTML
+              "static"))      ;1.8 MiB static libraries
    (inputs `(("bzip2" ,bzip2)
              ("readline" ,readline)
              ("zlib" ,zlib)))
@@ -63,7 +64,19 @@
                           "--enable-unicode-properties"
                           "--enable-pcre16"
                           "--enable-pcre32"
-                          "--enable-jit")))
+                          "--enable-jit")
+      #:phases (modify-phases %standard-phases
+                 (add-after 'install 'move-static-libs
+                   (lambda* (#:key outputs #:allow-other-keys)
+                     (let ((source (string-append (assoc-ref outputs "out") "/lib"))
+                           (static (string-append (assoc-ref outputs "static") "/lib")))
+                       (mkdir-p static)
+                       (for-each (lambda (lib)
+                                   (link lib (string-append static "/"
+                                                            (basename lib)))
+                                   (delete-file lib))
+                                 (find-files source "\\.a$"))
+                       #t))))))
    (synopsis "Perl Compatible Regular Expressions")
    (description
     "The PCRE library is a set of functions that implement regular expression
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index 9243dcc460..65d7b26df3 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -83,20 +83,20 @@
   (package
    (name "poppler")
    (replacement poppler/fixed)
-   (version "0.63.0")
+   (version "0.68.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://poppler.freedesktop.org/poppler-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "04d1z1ygyb3llzc6s6c99wxafvljj2sc5b76djif34f7mzfqmk17"))))
+              "0n0f7mv24lzv9p3dlzakpdhqg7ygcvl6l40grcz95xldzgq083gr"))))
    (build-system cmake-build-system)
    ;; FIXME:
    ;;  use libcurl:        no
    (inputs `(("fontconfig" ,fontconfig)
              ("freetype" ,freetype)
-             ("libjpeg" ,libjpeg)
+             ("libjpeg" ,libjpeg-turbo)
              ("libpng" ,libpng)
              ("libtiff" ,libtiff)
              ("lcms" ,lcms)
@@ -107,8 +107,12 @@
              ;; GLib.  But of course, that Cairo must not depend on Poppler.
              ("cairo" ,(package (inherit cairo)
                          (inputs (alist-delete "poppler"
-                                               (package-inputs cairo)))))
-             ("glib" ,glib)))
+                                               (package-inputs cairo)))))))
+   (propagated-inputs
+    ;; As per poppler-cairo and poppler-glib.pc.
+    ;; XXX: Ideally we'd propagate Cairo too, but that would require a
+    ;; different solution to the circular dependency mentioned above.
+    `(("glib" ,glib)))
    (native-inputs
       `(("pkg-config" ,pkg-config)
         ("glib" ,glib "bin")                      ; glib-mkenums, etc.
@@ -509,7 +513,7 @@ by using the poppler rendering engine.")
 
                      ;; For tests.
                      ("check" ,check)
-                     ("xorg-server" ,xorg-server-1.19.3)))
+                     ("xorg-server" ,xorg-server-for-tests)))
     (inputs `(("sqlite" ,sqlite)))
     ;; Listed in 'Requires.private' of 'zathura.pc'.
     (propagated-inputs `(("cairo" ,cairo)
@@ -553,7 +557,8 @@ interaction.")
                                   "/podofo-" version ".tar.gz"))
               (sha256
                (base32
-                "0wj0y4zcmj4q79wrn3vv3xq4bb0vhhxs8yifafwy9f2sjm83c5p9"))))
+                "0wj0y4zcmj4q79wrn3vv3xq4bb0vhhxs8yifafwy9f2sjm83c5p9"))
+              (patches (search-patches "podofo-cmake-3.12.patch"))))
     (build-system cmake-build-system)
     (native-inputs
      `(("cppunit" ,cppunit)
@@ -656,14 +661,14 @@ line tools for batch rendering @command{pdfdraw}, rewriting files
 (define-public qpdf
   (package
    (name "qpdf")
-   (version "8.1.0")
+   (version "8.2.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://sourceforge/qpdf/qpdf/" version
                                 "/qpdf-" version ".tar.gz"))
             (sha256
              (base32
-              "1m3hcgip6bzjx4gd7wq1328p8zi3pq5savzncdyln6l0lcklh7vx"))
+              "1jdb0jj72fjdp6xip4m7yz31r5x13zs7h4smnxsycgw3vbmx6igl"))
             (modules '((guix build utils)))
             (snippet
              ;; Replace shebang with the bi-lingual shell/Perl trick to remove
diff --git a/gnu/packages/perl-check.scm b/gnu/packages/perl-check.scm
index 98b4e392c7..d0abb39254 100644
--- a/gnu/packages/perl-check.scm
+++ b/gnu/packages/perl-check.scm
@@ -82,7 +82,7 @@ lexically, just dynamically.")
      '(#:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'set-env
-           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1"))))))
+           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1") #t)))))
     (propagated-inputs
      `(("perl-importer" ,perl-importer)
        ("perl-term-table" ,perl-term-table)
diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm
index cbdf070e89..8c854e88df 100644
--- a/gnu/packages/perl.scm
+++ b/gnu/packages/perl.scm
@@ -43,9 +43,9 @@
   #:use-module (gnu packages)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system perl)
-  #:use-module (guix utils) ;substitute-keyword-arguments for perl-5.26.2
   #:use-module (gnu packages base)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages freedesktop)
@@ -62,17 +62,15 @@
   ;; Yeah, Perl...  It is required early in the bootstrap process by Linux.
   (package
     (name "perl")
-    (version "5.26.1")
-    (replacement perl/fixed)
+    (version "5.28.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://cpan/src/5.0/perl-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "1p81wwvr5jb81m41d07kfywk5gvbk0axdrnvhc2aghcdbr4alqz7"))
+               "1a3f822lcl8dr8v0hk80yyhpzqlljg49z9flb48rs3nbsij9z4ky"))
              (patches (search-patches
-                       "perl-file-path-CVE-2017-6512.patch"
                        "perl-no-sys-dirs.patch"
                        "perl-autosplit-default-time.patch"
                        "perl-deterministic-ordering.patch"
@@ -163,41 +161,6 @@ more.")
     (home-page "http://www.perl.org/")
     (license gpl1+)))                          ; or "Artistic"
 
-;; Fixes CVE-2018-6797, CVE-2018-6798, and CVE-2018-6913.
-;; See <https://metacpan.org/changes/release/SHAY/perl-5.26.2>.
-(define perl-5.26.2
-  (package
-    (inherit perl)
-    (version "5.26.2")
-    (source (origin
-              (inherit (package-source perl))
-              (uri (string-append "mirror://cpan/src/5.0/perl-"
-                                  version ".tar.gz"))
-              (patches (append (origin-patches (package-source perl))
-                               (search-patches "perl-archive-tar-CVE-2018-12015.patch")))
-              (sha256
-               (base32
-                "03gpnxx1g6hvlh0v4aqx00580h787sfywp1vlvw64q2xcbm9qbsp"))))))
-
-;; When grafting perl, complications arise when the replacement perl has a
-;; different version number than the original.  So, here we create a version
-;; of perl-5.26.2 that thinks it is version 5.26.1.  See
-;; <https://bugs.gnu.org/31210> and <https://bugs.gnu.org/31216>.
-(define perl/fixed
-  (package
-    (inherit perl-5.26.2)
-    (version "5.26.1")
-    (arguments
-     (substitute-keyword-arguments (package-arguments perl-5.26.2)
-       ((#:phases phases)
-        `(modify-phases ,phases
-           (add-after 'unpack 'revert-perl-subversion
-             (lambda _
-               (substitute* "patchlevel.h"
-                 (("^#define PERL_SUBVERSION	2")
-                  "#define PERL_SUBVERSION	1"))
-               #t))))))))
-
 (define-public perl-algorithm-c3
   (package
     (name "perl-algorithm-c3")
@@ -2914,7 +2877,8 @@ interface for the RFC 2104 HMAC mechanism.")
          (add-after 'build 'set-permissions
            (lambda _
              ;; Make MD5.so read-write so it can be stripped.
-             (chmod "blib/arch/auto/Digest/MD5/MD5.so" #o755))))))
+             (chmod "blib/arch/auto/Digest/MD5/MD5.so" #o755)
+             #t)))))
     (home-page "https://metacpan.org/release/Digest-MD5")
     (synopsis "Perl interface to the MD-5 algorithm")
     (description
@@ -3040,7 +3004,7 @@ also known as JIS 2000.")
      '(#:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'set-env
-           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1"))))))
+           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1") #t)))))
     (home-page "https://metacpan.org/release/Encode-HanExtra")
     (synopsis "Additional Chinese encodings")
     (description "This Perl module provides Chinese encodings that are not
@@ -4315,7 +4279,8 @@ run interactively.  It also has an option to capture output/error buffers.")
                    (lambda _
                      ;; This test fails, and we're not really interested in
                      ;; it, so disable it.
-                     (delete-file "t/win32_compile.t"))))))
+                     (delete-file "t/win32_compile.t")
+                     #t)))))
     (home-page "https://metacpan.org/release/IPC-Run")
     (synopsis "Run system() and background procs w/ piping, redirs, ptys")
     (description "IPC::Run allows you run and interact with child processes
@@ -5286,7 +5251,7 @@ examine the contents, and perform some simple tasks.  It can also load the
 (define-public perl-module-runtime
   (package
     (name "perl-module-runtime")
-    (version "0.014")
+    (version "0.016")
     (source
      (origin
        (method url-fetch)
@@ -5294,7 +5259,7 @@ examine the contents, and perform some simple tasks.  It can also load the
                            "Module-Runtime-" version ".tar.gz"))
        (sha256
         (base32
-         "19326f094jmjs6mgpwkyisid54k67w34br8yfh0gvaaml87gwi2c"))))
+         "097hy2czwkxlppri32m599ph0xfvfsbf0a5y23a4fdc38v32wc38"))))
     (build-system perl-build-system)
     (native-inputs `(("perl-module-build" ,perl-module-build)))
     (home-page "https://metacpan.org/release/Module-Runtime")
@@ -6904,7 +6869,8 @@ directory specifications in a cross-platform manner.")
              (substitute* "Cwd.pm"
                (("'/bin/pwd'")
                 (string-append "'" (assoc-ref inputs "coreutils")
-                               "/bin/pwd'"))))))))
+                               "/bin/pwd'")))
+             #t)))))
     (inputs
      `(("coreutils" ,coreutils)))
     (home-page "https://metacpan.org/release/PathTools")
@@ -9036,6 +9002,9 @@ defined by Annex #11 is used to determine breaking positions.")
                (base32
                 "1xnhazbdvpyfpnxd90krzhxkvabf8fa2ji6xzlrf75j6nz8251zs"))))
     (build-system perl-build-system)
+    ;; FIXME: Tests fail on 32-bit architectures:
+    ;; <https://rt.cpan.org/Public/Bug/Display.html?id=127007>.
+    (arguments `(#:tests? ,(target-64bit?)))
     (native-inputs
      `(("perl-test-fatal" ,perl-test-fatal)
        ("perl-test-leaktrace" ,perl-test-leaktrace)
diff --git a/gnu/packages/photo.scm b/gnu/packages/photo.scm
index 1aa24b1eed..1b1458a285 100644
--- a/gnu/packages/photo.scm
+++ b/gnu/packages/photo.scm
@@ -227,7 +227,8 @@ MTP, and much more.")
                     (pm  (find-files out "^ExifTool\\.pm$"))
                     (lib (dirname (dirname (car pm)))))
                (wrap-program (string-append out "/bin/exiftool")
-                             `("PERL5LIB" prefix (,lib)))))))))
+                 `("PERL5LIB" prefix (,lib)))
+               #t))))))
     (home-page "https://metacpan.org/release/Image-ExifTool")
     (synopsis "Program and Perl library to manipulate EXIF and other metadata")
     (description "This package provides the @code{exiftool} command and the
diff --git a/gnu/packages/php.scm b/gnu/packages/php.scm
index a22591d377..a28cb31e5c 100644
--- a/gnu/packages/php.scm
+++ b/gnu/packages/php.scm
@@ -50,16 +50,6 @@
   #:use-module (guix build-system gnu)
   #:use-module ((guix licenses) #:prefix license:))
 
-(define gd-for-php
-  (package
-    (inherit gd)
-    (source (origin
-             (inherit (package-source gd))
-             (patches (search-patches "gd-fix-tests-on-i686.patch"
-                                      "gd-freetype-test-failure.patch"
-                                      "gd-CVE-2018-5711.patch"
-                                      "gd-CVE-2018-1000222.patch"))))))
-
 (define-public php
   (package
     (name "php")
@@ -318,7 +308,7 @@
        ("curl" ,curl)
        ("cyrus-sasl" ,cyrus-sasl)
        ("freetype" ,freetype)
-       ("gd" ,gd-for-php)
+       ("gd" ,gd)
        ("gdbm" ,gdbm)
        ("glibc" ,glibc)
        ("gmp" ,gmp)
diff --git a/gnu/packages/python-crypto.scm b/gnu/packages/python-crypto.scm
index 1d08578c3d..1c7640ac5f 100644
--- a/gnu/packages/python-crypto.scm
+++ b/gnu/packages/python-crypto.scm
@@ -341,13 +341,13 @@ password storage.")
 (define-public python-certifi
   (package
     (name "python-certifi")
-    (version "2017.1.23")
+    (version "2018.8.13")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "certifi" version))
               (sha256
                (base32
-                "1klrzl3hgvcf2mjk00g0k3kk1p2z27vzwnxivwar4vhjmjvpz1w1"))))
+                "1x7jy10rz3100g9iw7c2czcw2z4lqfaalsd8yg991l4d82hnh7ac"))))
     (build-system python-build-system)
     (home-page "https://certifi.io/")
     (synopsis "Python CA certificate bundle")
diff --git a/gnu/packages/python-web.scm b/gnu/packages/python-web.scm
index ecd141efca..f05047bb9c 100644
--- a/gnu/packages/python-web.scm
+++ b/gnu/packages/python-web.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
-;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
 ;;; Copyright © 2016, 2017 Danny Milosavljevic <dannym+a@scratchpost.org>
 ;;; Copyright © 2013, 2014, 2015, 2016 Andreas Enge <andreas@enge.fr>
@@ -438,7 +438,15 @@ C, yielding parse times that can be a thirtieth of the html5lib parse times.")
     (arguments
      ;; The tests attempt to access external web servers, so we cannot run
      ;; them.  Furthermore, they are skipped altogether when using Python 2.
-     '(#:tests? #f))
+     '(#:tests? #f
+       #:phases (modify-phases %standard-phases
+                    (add-before 'build 'configure-tls-backend
+                      (lambda _
+                        ;; XXX: PycURL fails to automatically determine which TLS
+                        ;; backend to use when cURL is built with --disable-static.
+                        ;; See setup.py and <https://github.com/pycurl/pycurl/pull/147>.
+                        (setenv "PYCURL_SSL_LIBRARY" "gnutls")
+                        #t)))))
     (native-inputs
      `(("python-nose" ,python-nose)
        ("python-bottle" ,python-bottle)))
@@ -1400,14 +1408,14 @@ authenticated session objects providing things like keep-alive.")
 (define-public python-urllib3
   (package
     (name "python-urllib3")
-    (version "1.18.1")
+    (version "1.23")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "urllib3" version))
         (sha256
          (base32
-          "1wb8aqnq53vzh2amrv8kc66f3h6fx217y0q62y6n30a64p2yqmam"))))
+          "1bvbd35q3zdcd7gsv38fwpizy7p06dr0154g5gfybrvnbvhwb2m6"))))
     (build-system python-build-system)
     (arguments `(#:tests? #f))
     (native-inputs
@@ -2667,19 +2675,25 @@ available in Django, but is a standalone package.")
 (define-public python-paste
   (package
     (name "python-paste")
-    (version "2.0.3")
+    (version "3.0.4")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Paste" version))
        (sha256
         (base32
-         "062jk0nlxf6lb2wwj6zc20rlvrwsnikpkh90y0dn8cjch93s6ii3"))
-       (patches (search-patches "python-paste-remove-website-test.patch"
-                                "python-paste-remove-timing-test.patch"))))
+         "01w26w9jyfkh0mfydhfz3dwy3pj3fw7mzvj0lna3vs8hyx1hwl0n"))
+       (patches (search-patches "python-paste-remove-timing-test.patch"))
+       (modules '((guix build utils)))
+       (snippet
+        '(begin
+           ;; This test calls out to the internet.
+           (delete-file "tests/test_proxy.py") #t))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-nose" ,python-nose)))
+     `(("python-pytest" ,python-pytest)
+       ("python-pytest-runner" ,python-pytest-runner)
+       ("python-nose" ,python-nose)))
     (propagated-inputs
      `(("python-six" ,python-six)))
     (home-page "http://pythonpaste.org")
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 302eb89cf9..c951d6a78b 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -143,12 +143,13 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
-  #:use-module (srfi srfi-1))
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26))
 
 (define-public python-2.7
   (package
     (name "python2")
-    (version "2.7.14")
+    (version "2.7.15")
     (replacement python-2/fixed)
     (source
      (origin
@@ -157,7 +158,7 @@
                           version "/Python-" version ".tar.xz"))
       (sha256
        (base32
-        "0rka541ys16jwzcnnvjp2v12m4cwgd2jp6wj4kj511p715pb5zvi"))
+        "0x2mvz9dp11wj7p5ccvmk9s0hzjk2fa1m462p395l4r6bfnb3n92"))
       (patches (search-patches "python-2.7-search-paths.patch"
                                "python-2-deterministic-build-info.patch"
                                "python-2.7-site-prefixes.patch"
@@ -182,23 +183,7 @@
                "tk"))                     ;tkinter; adds 50 MiB to the closure
     (build-system gnu-build-system)
     (arguments
-     `(;; 356 tests OK.
-       ;; 6 tests failed:
-       ;;     test_compileall test_distutils test_import test_shutil test_socket
-       ;;     test_subprocess
-       ;; 39 tests skipped:
-       ;;     test_aepack test_al test_applesingle test_bsddb test_bsddb185
-       ;;     test_bsddb3 test_cd test_cl test_codecmaps_cn test_codecmaps_hk
-       ;;     test_codecmaps_jp test_codecmaps_kr test_codecmaps_tw test_curses
-       ;;     test_dl test_gdb test_gl test_imageop test_imgfile test_ioctl
-       ;;     test_kqueue test_linuxaudiodev test_macos test_macostools
-       ;;     test_msilib test_ossaudiodev test_scriptpackages test_smtpnet
-       ;;     test_socketserver test_startfile test_sunaudiodev test_timeout
-       ;;     test_tk test_ttk_guionly test_urllib2net test_urllibnet
-       ;;     test_winreg test_winsound test_zipfile64
-       ;; 4 skips unexpected on linux2:
-       ;;     test_bsddb test_bsddb3 test_gdb test_ioctl
-       #:test-target "test"
+     `(#:test-target "test"
        #:configure-flags
        (list "--enable-shared"                    ;allow embedding
              "--with-system-ffi"                  ;build ctypes
@@ -223,11 +208,6 @@
                                     "Lib/test/support/__init__.py"
                                     "Lib/test/test_subprocess.py"))
                (("/bin/sh") (which "sh")))
-
-             ;; Use zero as the timestamp in .pyc files so that builds are
-             ;; deterministic.  TODO: Remove it when this variable is set in
-             ;; gnu-build-system.scm.
-             (setenv "SOURCE_DATE_EPOCH" "1")
              #t))
           (add-before 'configure 'do-not-record-configure-flags
             (lambda* (#:key configure-flags #:allow-other-keys)
@@ -281,19 +261,14 @@
                                             ((or "." "..") #f)
                                             (file
                                              (not
+                                              ;; FIXME: Add the 'support' directory
+                                              ;; in the next rebuild cycle, since it
+                                              ;; moved in 2.7.14.  See also
+                                              ;; python2-futures below.
                                               (string-prefix? "test_support."
                                                               file))))))
                        (call-with-output-file "__init__.py" (const #t))
                        #t)))))))
-          (add-before 'strip 'make-libraries-writable
-            (lambda* (#:key outputs #:allow-other-keys)
-              ;; Make .so files writable so they can be stripped.
-              (let ((out (assoc-ref outputs "out")))
-                (for-each (lambda (file)
-                            (chmod file #o755))
-                          (find-files (string-append out "/lib")
-                                      "\\.so"))
-                #t)))
           (add-after 'install 'move-tk-inter
             (lambda* (#:key outputs #:allow-other-keys)
               ;; When Tkinter support is built move it to a separate output so
@@ -353,9 +328,7 @@ data types.")
               (inherit (package-source python-2))
               (patches (append
                         (origin-patches (package-source python-2))
-                        (search-patches "python2-CVE-2018-1060.patch"
-                                        "python2-CVE-2018-1061.patch"
-                                        "python2-CVE-2018-14647.patch"
+                        (search-patches "python2-CVE-2018-14647.patch"
                                         "python2-CVE-2018-1000802.patch")))))))
 
 (define-public python2-called-python
@@ -367,10 +340,10 @@ data types.")
     (name "python")
     (properties `((superseded . ,python-2)))))
 
-(define-public python-3.6
+(define-public python-3.7
   (package (inherit python-2)
     (name "python")
-    (version "3.6.5")
+    (version "3.7.0")
     (replacement python-3/fixed)
     (source (origin
               (method url-fetch)
@@ -384,66 +357,39 @@ data types.")
               (patch-flags '("-p0"))
               (sha256
                (base32
-                "19l7inxm056jjw33zz97z0m02hsi7jnnx5kyb76abj5ml4xhad7l"))
+                "0j9mic5c9lbd2b20wka7hily7szz740wy9ilfrczxap63rnrk0h3"))
               (snippet
                '(begin
                   (for-each delete-file
-                            '("Lib/ctypes/test/test_structures.py" ; fails on aarch64
-                              "Lib/ctypes/test/test_win32.py" ; fails on aarch64
-                              "Lib/test/test_fcntl.py")) ; fails on aarch64
+                            '(;; This test may hang and eventually run out of
+                              ;; memory on some systems:
+                              ;; <https://bugs.python.org/issue34587>
+                              "Lib/test/test_socket.py"
+
+                              ;; These tests fail on AArch64.
+                              "Lib/ctypes/test/test_win32.py"
+                              "Lib/test/test_fcntl.py"
+                              "Lib/test/test_posix.py"))
                   #t))))
     (arguments
      (substitute-keyword-arguments (package-arguments python-2)
-       ((#:tests? _) #t)
        ((#:phases phases)
-        `(modify-phases ,phases
-           (add-after 'unpack 'patch-timestamp-for-pyc-files
-             (lambda _
-               ;; We set DETERMINISTIC_BUILD to only override the mtime when
-               ;; building with Guix, lest we break auto-compilation in
-               ;; environments.
-               (setenv "DETERMINISTIC_BUILD" "1")
-               (substitute* "Lib/py_compile.py"
-                 (("source_stats\\['mtime'\\]")
-                  "(1 if 'DETERMINISTIC_BUILD' in os.environ else source_stats['mtime'])"))
-
-               ;; Use deterministic hashes for strings, bytes, and datetime
-               ;; objects.
-               (setenv "PYTHONHASHSEED" "0")
-
-               ;; Reset mtime when validating bytecode header.
-               (substitute* "Lib/importlib/_bootstrap_external.py"
-                 (("source_mtime = int\\(source_stats\\['mtime'\\]\\)")
-                  "source_mtime = 1"))
-               #t))
-           ;; These tests fail because of our change to the bytecode
-           ;; validation.  They fail because expected exceptions do not get
-           ;; thrown.  This seems to be no problem.
-           (add-after 'unpack 'disable-broken-bytecode-tests
-             (lambda _
-               (substitute* "Lib/test/test_importlib/source/test_file_loader.py"
-                 (("test_bad_marshal")
-                  "disable_test_bad_marshal")
-                 (("test_no_marshal")
-                  "disable_test_no_marshal")
-                 (("test_non_code_marshal")
-                  "disable_test_non_code_marshal"))
-               #t))
-           ;; Unset DETERMINISTIC_BUILD to allow for tests that check that
-           ;; stale pyc files are rebuilt.
-           (add-before 'check 'allow-non-deterministic-compilation
-             (lambda _ (unsetenv "DETERMINISTIC_BUILD") #t))
-           ;; We need to rebuild all pyc files for three different
-           ;; optimization levels to replace all files that were not built
-           ;; deterministically.
-
-           ;; FIXME: Without this phase we have close to 2000 files that
+       `(modify-phases ,phases
+          ;; Unset SOURCE_DATE_EPOCH while running the test-suite and set it
+          ;; again afterwards.  See <https://bugs.python.org/issue34022>.
+          (add-before 'check 'unset-SOURCE_DATE_EPOCH
+            (lambda _ (unsetenv "SOURCE_DATE_EPOCH") #t))
+          (add-after 'check 'reset-SOURCE_DATE_EPOCH
+            (lambda _ (setenv "SOURCE_DATE_EPOCH" "1") #t))
+           ;; FIXME: Without this phase we have close to 400 files that
            ;; differ across different builds of this package.  With this phase
-           ;; there are about 500 files left that differ.
-           (add-after 'install 'rebuild-bytecode
+           ;; there are 44 files left that differ.
+           (add-after 'remove-tests 'rebuild-bytecode
              (lambda* (#:key outputs #:allow-other-keys)
-               (setenv "DETERMINISTIC_BUILD" "1")
                (let ((out (assoc-ref outputs "out")))
+                 ;; Disable hash randomization to ensure the generated .pycs
+                 ;; are reproducible.
+                 (setenv "PYTHONHASHSEED" "0")
                  (for-each
                   (lambda (opt)
                     (format #t "Compiling with optimization level: ~a\n"
@@ -455,8 +401,7 @@ data types.")
                                          "-m" "compileall"
                                          "-f" ; force rebuild
                                          ;; Don't build lib2to3, because it's Python 2 code.
-                                         ;; Also don't build obviously broken test code.
-                                         "-x" "(lib2to3|test/bad.*)"
+                                         "-x" "lib2to3/.*"
                                          ,file)))
                               (find-files out "\\.py$")))
                   (list '() '("-O") '("-OO")))
@@ -469,7 +414,7 @@ data types.")
                                         "/site-packages"))))))))
 
 ;; Current 3.x version.
-(define-public python-3 python-3.6)
+(define-public python-3 python-3.7)
 
 (define python-3/fixed
   (package
@@ -477,17 +422,7 @@ data types.")
     (source (origin
               (inherit (package-source python-3))
               (patches (append (origin-patches (package-source python-3))
-                               (search-patches "python-CVE-2018-14647.patch")))))
-    (arguments
-     (substitute-keyword-arguments (package-arguments python-3)
-       ((#:phases phases)
-        `(modify-phases ,phases
-           (add-after 'unpack 'delete-broken-test
-             (lambda _
-               ;; Delete test which fails on recent kernels:
-               ;; <https://bugs.python.org/issue34587>.
-               (delete-file "Lib/test/test_socket.py")
-               #t))))))))
+                               (search-patches "python-CVE-2018-14647.patch")))))))
 
 ;; Current major version.
 (define-public python python-3)
@@ -715,18 +650,24 @@ by @code{binstar}, @code{binstar-build} and @code{chalmers}.")
 (define-public python-babel
   (package
     (name "python-babel")
-    (version "2.3.4")
+    (version "2.6.0")
     (source
      (origin
       (method url-fetch)
       (uri (pypi-uri "Babel" version))
       (sha256
        (base32
-        "0x98qqqw35xllpcama013a9788ly84z8dm1w2wwfpxh2710c8df5"))))
+        "08rxmbx2s4irp0w0gmn498vns5xy0fagm0fg33xa772jiks51flc"))))
     (build-system python-build-system)
+    (native-inputs
+     `(("python-freezegun" ,python-freezegun)
+       ("python-pytest" ,python-pytest)))
     (propagated-inputs
      `(("python-pytz" ,python-pytz)))
-    (arguments `(#:tests? #f)) ; no test target
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda _ (invoke "pytest" "-vv"))))))
     (home-page "http://babel.pocoo.org/")
     (synopsis
      "Tools for internationalizing Python applications")
@@ -970,14 +911,14 @@ version identifier.")
 (define-public python-setuptools
   (package
     (name "python-setuptools")
-    (version "31.0.0")
+    (version "40.0.0")
     (source
      (origin
       (method url-fetch)
-      (uri (pypi-uri "setuptools" version))
+      (uri (pypi-uri "setuptools" version ".zip"))
       (sha256
        (base32
-        "0ypybh4hx3bv4vhg2dc74xpj1g56ggnaffm87k4abhwjwq6wq608"))
+        "0pq116lr14gnc62v76nk0npkm6krb2mpp7p9ab369zgv4n7dnah1"))
       (modules '((guix build utils)))
       (snippet
        '(begin
@@ -1273,13 +1214,13 @@ human-friendly syntax.")
 (define-public python-pandas
   (package
     (name "python-pandas")
-    (version "0.23.1")
+    (version "0.23.4")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pandas" version))
        (sha256
-        (base32 "142nvwb01r2wv42y2cz40bx33hd8ffh6s6gynapg859fmzr2mdah"))))
+        (base32 "1x54pd7hr3y7qahx6b5bf2wzj54xvl8r3s1h4pl254pnmi3wl92v"))))
     (build-system python-build-system)
     (arguments
      `(#:modules ((guix build utils)
@@ -1294,18 +1235,23 @@ human-friendly syntax.")
                               (getcwd) "/build/"
                               (car (scandir "build"
                                             (cut string-prefix? "lib." <>))))))
+                        ;; Disable the "strict data files" option which causes
+                        ;; the build to error out if required data files are not
+                        ;; available (as is the case with PyPI archives).
+                        (substitute* "setup.cfg"
+                          (("addopts = --strict-data-files") "addopts = "))
                         (with-directory-excursion build-directory
                           ;; Delete tests that require "moto" which is not yet in Guix.
                           (for-each delete-file
                                     '("pandas/tests/io/conftest.py"
                                       "pandas/tests/io/json/test_compression.py"
+                                      "pandas/tests/io/parser/test_network.py"
                                       "pandas/tests/io/test_excel.py"
                                       "pandas/tests/io/test_parquet.py"))
-                          (invoke "pytest" "-v" "pandas" "-k"
-                                  (string-append
-                                   "not network and not disabled"
-                                   ;; XXX: Due to the deleted tests above.
-                                   " and not test_read_s3_jsonl")))))))))
+                          (invoke "pytest" "-vv" "pandas" "--skip-slow"
+                                  "--skip-network" "-k"
+                                  ;; XXX: Due to the deleted tests above.
+                                  "not test_read_s3_jsonl"))))))))
     (propagated-inputs
      `(("python-numpy" ,python-numpy)
        ("python-pytz" ,python-pytz)
@@ -1816,14 +1762,14 @@ matching them against a list of media-ranges.")
 (define-public python-py
   (package
     (name "python-py")
-    (version "1.5.3")
+    (version "1.5.4")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "py" version))
        (sha256
         (base32
-         "10gq2lckvgwlk9w6yzijhzkarx44hsaknd0ypa08wlnpjnsgmj99"))))
+         "1xxvwfn82457djf55f5n2c94699rfqnk43br8fif2r2q8gvrmm9z"))))
     (build-system python-build-system)
     (arguments
      ;; FIXME: "ImportError: 'test' module incorrectly imported from
@@ -1831,7 +1777,9 @@ matching them against a list of media-ranges.")
      ;; Expected '/tmp/guix-build-python-py-1.4.31.drv-0/py-1.4.31/py'.
      ;; Is this module globally installed?"
      '(#:tests? #f))
-    (home-page "https://pylib.readthedocs.io/")
+    (native-inputs
+     `(("python-setuptools-scm" ,python-setuptools-scm)))
+    (home-page "https://github.com/pytest-dev/py")
     (synopsis "Python library for parsing, I/O, instrospection, and logging")
     (description
      "Py is a Python library for file name parsing, .ini file parsing, I/O,
@@ -2233,6 +2181,42 @@ easier to build concurrent applications.")
 (define-public python2-pykka
   (package-with-python2 python-pykka))
 
+(define-public python-pympler
+  (package
+    (name "python-pympler")
+    (home-page "https://pythonhosted.org/Pympler/")
+    (version "0.5")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "Pympler" version))
+              (sha256
+               (base32
+                "03qwsbilqgvnbl3a1jmpgixbr2kq6m3fvdlzyr3wdp01bwlc85kx"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (delete 'check)
+                  (add-after 'install 'check
+                    (lambda* (#:key inputs outputs #:allow-other-keys)
+                      (add-installed-pythonpath inputs outputs)
+                      (invoke "python" "setup.py" "test"))))))
+    (synopsis "Measure, monitor and analyze memory behavior")
+    (description
+     "Pympler is a development tool to measure, monitor and analyze
+the memory behavior of Python objects in a running Python application.
+
+By pympling a Python application, detailed insight in the size and the
+lifetime of Python objects can be obtained.  Undesirable or unexpected
+runtime behavior like memory bloat and other @samp{pymples} can easily
+be identified.
+
+A web profiling frontend exposes process statistics, garbage
+visualisation and class tracker statistics.")
+    (license license:asl2.0)))
+
+(define-public python2-pympler
+  (package-with-python2 python-pympler))
+
 (define-public python-itsdangerous
   (package
     (name "python-itsdangerous")
@@ -2321,7 +2305,7 @@ object.")
 (define-public python-markupsafe
   (package
     (name "python-markupsafe")
-    (version "0.23")
+    (version "1.0")
     (source
      (origin
        (method url-fetch)
@@ -2330,7 +2314,7 @@ object.")
              version ".tar.gz"))
        (sha256
         (base32
-         "1hvip33wva3fnmvfp9x5klqri7hpl1hkgqmjbss18nmrb7zimv54"))))
+         "0rdn1s8x9ni7ss8rfiacj7x1085lx8mh2zdwqslnw8xc3l4nkgm6"))))
     (build-system python-build-system)
     (home-page "https://github.com/mitsuhiko/markupsafe")
     (synopsis "XML/HTML/XHTML markup safe string implementation for Python")
@@ -2345,14 +2329,14 @@ for Python.")
 (define-public python-jinja2
   (package
     (name "python-jinja2")
-    (version "2.9.6")
+    (version "2.10")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Jinja2" version))
        (sha256
         (base32
-         "1zzrkywhziqffrzks14kzixz7nd4yh2vc0fb04a68vfd2ai03anx"))))
+         "190l36hfw3wb2n3n68yacjabxyb1pnxwn7vjx96cmjj002xy2jzq"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-markupsafe" ,python-markupsafe)))
@@ -2482,26 +2466,17 @@ reStructuredText.")
 (define-public python-sphinxcontrib-websupport
   (package
     (name "python-sphinxcontrib-websupport")
-    (version "1.0.1")
+    (version "1.1.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "sphinxcontrib-websupport" version))
               (sha256
                (base32
-                "1f9f0wjpi9nhikbyaz6d19s7qvzdf1nq2g5dsh640fma4q9rd1bs"))))
+                "1ff3ix76xi1y6m99qxhaq5161ix9swwzydilvdya07mgbcvpzr4x"))))
     (build-system python-build-system)
-    (propagated-inputs
-     `(("python-mock" ,python-mock)
-       ("python-pytest" ,python-pytest)
-       ("python-xapian-bindings" ,python-xapian-bindings)))
-    ;; Needed for running the test suite
-    (native-inputs
-     `(("python-six" ,python-six)
-       ("python-jinja2" ,python-jinja2)
-       ("python-docutils" ,python-docutils)
-       ("python-sphinx" ,python-sphinx)
-       ("python-sqlalchemy" ,python-sqlalchemy)
-       ("python-whoosh" ,python-whoosh)))
+    (arguments
+     ;; FIXME: Tests depend on Sphinx, which depends on this.
+     `(#:tests? #f))
     (home-page "http://sphinx-doc.org/")
     (synopsis "Sphinx API for web applications")
     (description "This package provides a Python API to easily integrate
@@ -2509,17 +2484,20 @@ Sphinx documentation into your web application.  It provides tools to
 integrate Sphinx documents in web templates and to handle searches.")
     (license license:bsd-3)))
 
+(define-public python2-sphinxcontrib-websupport
+  (package-with-python2 python-sphinxcontrib-websupport))
+
 (define-public python-sphinx
   (package
     (name "python-sphinx")
-    (version "1.5.1")
+    (version "1.7.7")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Sphinx" version))
        (sha256
         (base32
-         "1i8p9idnli4gr0y4x67yakbdk5w6a0xjzhrg6bg51y9d1fi7fslf"))))
+         "0pkkbfj7cl157q550gcs45am5y78ps0h7q6455d64s1zmw01jlvi"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -2528,7 +2506,15 @@ integrate Sphinx documents in web templates and to handle searches.")
            (lambda _
              ;; Requires Internet access.
              (delete-file "tests/test_build_linkcheck.py")
-             (zero? (system* "make" "test")))))))
+             (substitute* "tests/test_build_latex.py"
+               (("@pytest.mark.sphinx\\('latex', testroot='images'\\)")
+                "@pytest.mark.skip()"))
+             (when (which "python")
+               ;; XXX: These tests are broken when using Python2:
+               ;; <https://github.com/sphinx-doc/sphinx/issues/4710>.
+               (delete-file "tests/test_api_translator.py")
+               (delete-file "tests/test_setup_command.py"))
+             (invoke "make" "test"))))))
     (propagated-inputs
      `(("python-imagesize" ,python-imagesize)
        ("python-sphinx-alabaster-theme"
@@ -2537,14 +2523,18 @@ integrate Sphinx documents in web templates and to handle searches.")
        ("python-snowballstemmer" ,python-snowballstemmer)
        ("python-docutils" ,python-docutils)
        ("python-jinja2" ,python-jinja2)
+       ("python-packaging" ,python-packaging)
        ("python-pygments" ,python-pygments)
        ("python-requests" ,python-requests)
-       ("python-six" ,python-six)))
+       ("python-six" ,python-six)
+       ("python-sphinxcontrib-websupport" ,python-sphinxcontrib-websupport)))
     (native-inputs
      `(("graphviz" ,graphviz)
+       ("imagemagick" ,imagemagick)                    ;for "convert"
        ("python-html5lib" ,python-html5lib)
        ("python-mock" ,python-mock)
-       ("python-nose" ,python-nose)))
+       ("python-nose" ,python-nose)
+       ("python-pytest" ,python-pytest)))
     (home-page "http://sphinx-doc.org/")
     (synopsis "Python documentation generator")
     (description "Sphinx is a tool that makes it easy to create documentation
@@ -2553,62 +2543,6 @@ sources.")
     (license license:bsd-3)
     (properties `((python2-variant . ,(delay python2-sphinx))))))
 
-(define-public python-sphinx-1.6
-  (package (inherit python-sphinx)
-    (name "python-sphinx")
-    (version "1.6.4")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "Sphinx" version))
-              (sha256
-               (base32
-                "0gjakw9fv5pwqb5yyclxycs36sapxizk1vx6mkcdizmzgzcfy0gi"))))
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (replace 'check
-           (lambda _
-             ;; Requires Internet access.
-             (delete-file "tests/test_build_linkcheck.py")
-             (substitute* "tests/test_build_latex.py"
-               (("@pytest.mark.sphinx\\('latex', testroot='images'\\)")
-                "@pytest.mark.skip()"))
-             (zero? (system* "make" "test")))))))
-    (propagated-inputs
-     `(("python-sphinxcontrib-websupport" ,python-sphinxcontrib-websupport)
-       ,@(package-propagated-inputs python-sphinx)))
-    (native-inputs
-     `(("python-pytest" ,python-pytest)
-       ("imagemagick" ,imagemagick) ; for "convert"
-       ,@(package-native-inputs python-sphinx)))
-    (properties `((python2-variant . ,(delay python2-sphinx-1.6))))))
-
-(define-public python2-sphinx-1.6
-  (let ((base (package-with-python2 (strip-python2-variant python-sphinx-1.6))))
-    (package
-      (inherit base)
-      (propagated-inputs
-       `(("python2-typing" ,python2-typing)
-         ,@(package-propagated-inputs base)))
-      (native-inputs `(("python2-enum34" ,python2-enum34)
-                       ,@(package-native-inputs base))))))
-
-(define-public python-sphinx-1.5.3
-  (package
-    (inherit python-sphinx)
-    (name "python-sphinx")
-    (version "1.5.3")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri "Sphinx" version))
-       (sha256
-        (base32
-         "0kw1axswbvaavr8ggyf4qr6hnisnrzlbkkcdada69vk1x9xjassg"))))
-    (native-inputs
-     `(("python-pytest" ,python-pytest)
-       ,@(package-native-inputs python-sphinx)))))
-
 (define-public python2-sphinx
   (let ((base (package-with-python2 (strip-python2-variant python-sphinx))))
     (package
@@ -2617,6 +2551,7 @@ sources.")
                        ("python2-enum34" ,python2-enum34)
                        ,@(package-native-inputs base)))
       (propagated-inputs `(("python2-pytz" ,python2-pytz)
+                           ("python2-typing" ,python2-typing)
                        ,@(package-propagated-inputs base))))))
 
 (define-public python-sphinx-gallery
@@ -2960,7 +2895,11 @@ and is very extensible.")
                '())
 
          (replace 'check
-           (lambda _ (invoke "python" "runtests.py" "-vv"))))))
+           (lambda _
+             ;; The "with_outer_raising" test fails with Python 3.7.  See
+             ;; https://github.com/cython/cython/issues/2454
+             (delete-file "tests/run/generators_py.py")
+             (invoke "python" "runtests.py" "-vv"))))))
     (home-page "http://cython.org/")
     (synopsis "C extensions for Python")
     (description "Cython is an optimising static compiler for both the Python
@@ -3004,7 +2943,7 @@ between language specification and implementation aspects.")
 (define-public python-numpy
   (package
     (name "python-numpy")
-    (version "1.14.6")
+    (version "1.15.4")
     (source
      (origin
        (method url-fetch)
@@ -3013,14 +2952,14 @@ between language specification and implementation aspects.")
              version "/numpy-" version ".tar.gz"))
        (sha256
         (base32
-         "1k426vnmmd4pds09zgn75g6w92823ry75zrzwjhzjvg7s63ipc31"))))
+         "102vcl2qq4pjbm7a3d67vkkvn4466ngia1d8wi5avqwqh8j0jvkn"))))
     (build-system python-build-system)
     (inputs
      `(("openblas" ,openblas)
        ("lapack" ,lapack)))
     (native-inputs
      `(("python-cython" ,python-cython)
-       ("python-nose" ,python-nose)
+       ("python-pytest" ,python-pytest)
        ("gfortran" ,gfortran)))
     (arguments
      `(#:phases
@@ -3065,9 +3004,12 @@ include_dirs = ~a/include
            (lambda* (#:key outputs inputs #:allow-other-keys)
              ;; Make installed package available for running the tests
              (add-installed-pythonpath inputs outputs)
+             ;; Make sure "f2py" etc is found.
+             (setenv "PATH" (string-append (assoc-ref outputs "out") "/bin"
+                                           ":" (getenv "PATH")))
              (with-directory-excursion "/tmp"
-               (zero? (system* "python" "-c"
-                               "import numpy; numpy.test(verbose=2)"))))))))
+               (invoke "python" "-c"
+                       "import numpy; numpy.test(verbose=2)")))))))
     (home-page "http://www.numpy.org/")
     (synopsis "Fundamental package for scientific computing with Python")
     (description "NumPy is the fundamental package for scientific computing
@@ -3114,6 +3056,8 @@ include_dirs = ~a/include:~a/include
                            (assoc-ref inputs "openblas")
                            (assoc-ref inputs "lapack"))))
                #t))))))
+    (native-inputs
+     `(("python2-nose" ,python2-nose)))
     (description "NumPy is the fundamental package for scientific computing
 with Python.  It contains among other things: a powerful N-dimensional array
 object, sophisticated (broadcasting) functions, tools for integrating C/C++
@@ -3432,25 +3376,14 @@ that client code uses to construct the grammar directly in Python code.")
 (define-public python-numpydoc
   (package
     (name "python-numpydoc")
-    (version "0.5")
+    (version "0.8.0")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append
-             "https://pypi.python.org/packages/source/n/numpydoc/numpydoc-"
-             version ".tar.gz"))
+       (uri (pypi-uri "numpydoc" version))
        (sha256
         (base32
-         "0d4dnifaxkll50jx6czj05y8cb4ny60njd2wz299sj2jxfy51w4k"))
-       (modules '((guix build utils)))
-       (snippet
-        '(begin
-           ;; Drop a test requiring matplotlib, which we cannot add as an
-           ;; input since it would create a circular dependency: Extend the
-           ;; test for Python 3, where it is already dropped, to Python 2.
-           (substitute* "numpydoc/tests/test_plot_directive.py"
-             (("3") "2"))
-           #t))))
+         "1zazxg3m8j4fksv3f7v7vpf4bj9qb1vj3r326am0vdip141vzx31"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-sphinx" ,python-sphinx)))
@@ -3670,7 +3603,7 @@ toolkits.")
     (native-inputs
      `(("python-matplotlib" ,python-matplotlib)
        ("python-colorspacious" ,python-colorspacious)
-       ("python-sphinx" ,python-sphinx-1.6)
+       ("python-sphinx" ,python-sphinx)
        ("python-sphinx-gallery" ,python-sphinx-gallery)
        ("python-numpydoc" ,python-numpydoc)
        ("python-ipython" ,python-ipython)
@@ -3819,14 +3752,14 @@ functions.")
 (define-public python-scipy
   (package
     (name "python-scipy")
-    (version "1.0.1")
+    (version "1.1.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "scipy" version))
        (sha256
         (base32
-         "1fj0r7bg0cfk5clvl57ga06y9bfh05iwlv1dqqs1r6pd89wccfc7"))))
+         "1lfg686w6vv2m2dfs8v9d0bf2i18z7wz5vgzjnkgmpr4hi0550w7"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-numpy" ,python-numpy)
@@ -3957,14 +3890,14 @@ as the original project seems to have been abandoned circa 2007.")
 (define-public python-pycodestyle
   (package
     (name "python-pycodestyle")
-    (version "2.3.1")
+    (version "2.4.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "pycodestyle" version))
         (sha256
           (base32
-            "0rk78b66p57ala26mdldl9lafr48blv5s659sah9q50qnfjmc8k8"))))
+            "0fhy4vnlgpjq4qd1wdnl6pvdw7rah0ypmn8c9mkhz8clsndskz6b"))))
     (build-system python-build-system)
     (home-page "https://pycodestyle.readthedocs.io/")
     (synopsis "Python style guide checker")
@@ -4117,7 +4050,7 @@ services for your Python modules and applications.")
 (define-public python-olefile
   (package
     (name "python-olefile")
-    (version "0.44")
+    (version "0.45.1")
     (source
      (origin
        (method url-fetch)
@@ -4126,7 +4059,7 @@ services for your Python modules and applications.")
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32
-         "1wmxbrhyqjry2000zx0zdhqdqxhgi06nz7sbzjlh222q2zjv1gpj"))))
+         "18ai19zwagm6nli14k8bii31ipbab2rp7plrvsm6gmfql551a8ai"))))
     (build-system python-build-system)
     (home-page
      "https://www.decalage.info/python/olefileio")
@@ -4143,19 +4076,17 @@ the OleFileIO module from PIL, the Python Image Library.")
 (define-public python-pillow
   (package
     (name "python-pillow")
-    (version "4.3.0")
+    (version "5.2.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Pillow" version))
        (sha256
         (base32
-         "09xmn7rl6840sli2iz1k3fgxfgmri2nqz6vkinmb9mgg8ifp2z59"))
-       (patch-flags '("-p1" "--binary"))
-       (patches (search-patches "python-pillow-fix-failing-tests.patch"))))
+         "1ary9mj2ddllq3lkxgn6aac7qxqiwbcg2pacrl94py58ql9x9czq"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-nose"       ,python-nose)))
+     `(("python-pytest"       ,python-pytest)))
     (inputs
      `(("freetype" ,freetype)
        ("lcms"     ,lcms)
@@ -4176,9 +4107,8 @@ the OleFileIO module from PIL, the Python Image Library.")
                        ;; Make installed package available for running the
                        ;; tests
                        (add-installed-pythonpath inputs outputs)
-                       (and (zero? (system* "python" "selftest.py"
-                                            "--installed"))
-                            (zero? (system* "python" "test-installed.py"))))))
+                       (invoke "python" "selftest.py" "--installed")
+                       (invoke "python" "-m" "pytest" "-vv"))))
                  (delete 'check))))
     (home-page "https://pypi.python.org/pypi/Pillow")
     (synopsis "Fork of the Python Imaging Library")
@@ -4199,14 +4129,14 @@ a general image processing tool.")
 (define-public python-pycparser
   (package
     (name "python-pycparser")
-    (version "2.17")
+    (version "2.18")
     (source
      (origin
       (method url-fetch)
       (uri (pypi-uri "pycparser" version))
       (sha256
        (base32
-        "1dkkjri0miidqb1zcqhqljfa34fcy9k5akasgwsv6k622zlk3b0a"))))
+        "09mjyw82ibqzl449g7swy8bfxnfpmas0815d2rkdjlcqw81wma4r"))))
     (outputs '("out" "doc"))
     (build-system python-build-system)
     (native-inputs
@@ -4243,14 +4173,14 @@ a front-end for C compilers or analysis tools.")
 (define-public python-xcffib
   (package
     (name "python-xcffib")
-    (version "0.5.1")
+    (version "0.6.0")
     (source
      (origin
       (method url-fetch)
       (uri (pypi-uri "xcffib" version))
       (sha256
        (base32
-        "09gbnmr5vn58mm8xi3fmd7fz6743cks6c46dphnxzwax6zsxmy60"))))
+        "04k91yxyb3pgc5lvxmivh8w71yjrap2g57yk3s73x4rm4nvjq51n"))))
     (build-system python-build-system)
     (inputs
      `(("libxcb" ,libxcb)))
@@ -4289,17 +4219,14 @@ support for Python 3 and PyPy.  It is based on cffi.")
 (define-public python-cairocffi
   (package
     (name "python-cairocffi")
-    (version "0.8.0")
+    (version "0.9.0")
     (source
      (origin
       (method url-fetch)
-      ;; The archive on pypi is missing the 'utils' directory!
-      (uri (string-append "https://github.com/Kozea/cairocffi/archive/v"
-                          version ".tar.gz"))
-      (file-name (string-append name "-" version ".tar.gz"))
+      (uri (pypi-uri "cairocffi" version))
       (sha256
        (base32
-        "1rk2dvy3fxrga6bvvxc2fi5lbaynm5h4a0w0aaxyn3bc77rszjg9"))
+        "0dq3k4zhqd8cwsf3nyjqvjqm8wkvrjn1wjf44rl3v0h8kqx6qf0m"))
       (patches (search-patches "python-cairocffi-dlopen-path.patch"))))
     (build-system python-build-system)
     (outputs '("out" "doc"))
@@ -4312,14 +4239,14 @@ support for Python 3 and PyPy.  It is based on cffi.")
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("python-pytest" ,python-pytest)
+       ("python-pytest-cov" ,python-pytest-cov)
+       ("python-pytest-runner" ,python-pytest-runner)
        ("python-sphinx" ,python-sphinx)
        ("python-docutils" ,python-docutils)))
     (propagated-inputs
      `(("python-xcffib" ,python-xcffib))) ; used at run time
     (arguments
-     `(;; FIXME: Tests cannot find 'libcairo.so.2'.
-       #:tests? #t
-       #:phases
+     `(#:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'patch-paths
            (lambda* (#:key inputs outputs #:allow-other-keys)
@@ -4535,13 +4462,13 @@ displayed.")
 (define-public python-pexpect
   (package
     (name "python-pexpect")
-    (version "4.2.1")
+    (version "4.6.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pexpect" version))
        (sha256
-        (base32 "14ls7k99pwvl21zqv65kzrhccv50j89m5ij1hf0slmsvlxjj84rx"))))
+        (base32 "1fla85g47iaxxpjhp9vkxdnv4pgc7rplfy6ja491smrrk0jqi3ia"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -4584,13 +4511,13 @@ child application and control it as if a human were typing commands.")
 (define-public python-setuptools-scm
   (package
     (name "python-setuptools-scm")
-    (version "1.15.6")
+    (version "3.1.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "setuptools_scm" version))
               (sha256
                (base32
-                "0pzvfmx8s20yrgkgwfbxaspz2x1g38qv61jpm0ns91lrb22ldas9"))))
+                "0h4bglwfz8b9prqljv8z3w9rgydfyxzaj05bm1y6zs5m6shz548i"))))
     (build-system python-build-system)
     (home-page "https://github.com/pypa/setuptools_scm/")
     (synopsis "Manage Python package versions in SCM metadata")
@@ -4713,25 +4640,25 @@ away.")
 (define-public python-traitlets
   (package
     (name "python-traitlets")
-    (version "4.2.0")
+    (version "4.3.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "traitlets" version))
        (sha256
         (base32
-         "1afy08sa5n9gnkvh3da49c16zkyv598vchv0p1hp7zzjy8895hz4"))))
+         "0dbq7sx26xqz5ixs711k5nc88p8a0nqyz6162pwks5dpcz9d4jww"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
        (modify-phases %standard-phases
-         (replace 'check (lambda _ (zero? (system* "nosetests")))))))
+         (replace 'check (lambda _ (invoke "pytest" "-vv" "traitlets"))))))
     (propagated-inputs
      `(("python-ipython-genutils" ,python-ipython-genutils)
-       ("python-decorator" ,python-decorator)))
+       ("python-decorator" ,python-decorator)))    ;not needed for >4.3.2
     (native-inputs
-     `(("python-mock" ,python-mock)
-       ("python-nose" ,python-nose)))
+     `(("python-pytest" ,python-pytest)))
+    (properties `((python2-variant . ,(delay python2-traitlets))))
     (home-page "https://ipython.org")
     (synopsis "Configuration system for Python applications")
     (description
@@ -4744,7 +4671,12 @@ without using the configuration machinery.")
     (license license:bsd-3)))
 
 (define-public python2-traitlets
-  (package-with-python2 python-traitlets))
+  (let ((traitlets (package-with-python2 (strip-python2-variant python-traitlets))))
+    (package
+      (inherit traitlets)
+      (propagated-inputs
+       `(("python2-enum34" ,python2-enum34)
+         ,@(package-propagated-inputs traitlets))))))
 
 (define-public python-jupyter-core
   (package
@@ -5094,15 +5026,15 @@ parsing (browser/HTTP) user agent strings.")
 (define-public python-dbus
   (package
     (name "python-dbus")
-    (version "1.2.0")
+    (version "1.2.8")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append
-             "https://dbus.freedesktop.org/releases/dbus-python/dbus-python-"
-             version ".tar.gz"))
+       (uri (string-append "https://dbus.freedesktop.org/releases/dbus-python/"
+                           "dbus-python-" version ".tar.gz"))
        (sha256
-        (base32 "1py62qir966lvdkngg0v8k1khsqxwk5m4s8nflpk1agk5f5nqb71"))))
+        (base32
+         "0vvvjmiwnc9cjlks3gcdk43ap7llhlpz7cm1wbw0nc2yfsxjpwdb"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -5118,7 +5050,7 @@ parsing (browser/HTTP) user agent strings.")
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (inputs
-     `(("python" ,python)
+     `(("python" ,python-wrapper)
        ("dbus-glib" ,dbus-glib)))
     (synopsis "Python bindings for D-bus")
     (description "python-dbus provides bindings for libdbus, the reference
@@ -5140,14 +5072,14 @@ implementation of D-Bus.")
 (define-public python-lxml
   (package
     (name "python-lxml")
-    (version "3.8.0")
+    (version "4.2.4")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "lxml" version))
         (sha256
          (base32
-          "15nvf6n285n282682qyw3wihsncb0x5amdhyi4b83bfa2nz74vvk"))))
+          "1jk336k0kw616gfhqk1wwxsjjwz0flld0n294lz8kxch610bxbz2"))))
     (build-system python-build-system)
     (inputs
       `(("libxml2" ,libxml2)
@@ -5168,14 +5100,14 @@ libxml2 and libxslt.")
 (define-public python-beautifulsoup4
   (package
     (name "python-beautifulsoup4")
-    (version "4.5.3")
+    (version "4.6.3")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "beautifulsoup4" version))
        (sha256
         (base32
-         "0glaw1vyxnbp03fni7h5496n6iib0n5iim4gax1n0ngscs9s075j"))))
+         "041dhalzjciw6qyzzq7a2k4h1yvyk76xigp35hv5ibnn448ydy4h"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -5256,25 +5188,6 @@ of the structure, dynamics, and functions of complex networks.")
 (define-public python2-networkx
   (package-with-python2 python-networkx))
 
-;; Define new package, because the current version of python-colormath does
-;; not build against 2.0.
-(define-public python-networkx2
-  (package (inherit python-networkx)
-    (name "python-networkx2")
-    (version "2.0")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri "networkx" version ".zip"))
-       (sha256
-        (base32
-         "1ajl2jp8qry9nyjzzkqpy0vmsr14d23z1qk7y0vr5iwjbpvzhpyd"))
-       (patches
-        (search-patches "python-networkx2-reproducible-build.patch"))))))
-
-(define-public python2-networkx2
-  (package-with-python2 python-networkx2))
-
 (define-public python-datrie
   (package
     (name "python-datrie")
@@ -5287,6 +5200,14 @@ of the structure, dynamics, and functions of complex networks.")
         (base32
          "08r0if7dry2q7p34gf7ffyrlnf4bdvnprxgydlfxgfnvq8f3f4bs"))))
     (build-system python-build-system)
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (add-before 'build 'cythonize
+                    (lambda _
+                      ;; Regenerate Cython classes to solve ABI issues with Python
+                      ;; 3.7.0.  See <https://github.com/pytries/datrie/issues/52>.
+                      (invoke "cython" "src/datrie.pyx" "src/cdatrie.pxd"
+                              "src/stdio_ext.pxd" "-a"))))))
     (native-inputs
      `(("python-cython" ,python-cython)
        ("python-hypothesis" ,python-hypothesis)
@@ -5682,14 +5603,14 @@ so it might be a tiny bit slower.")
 (define-public python-waf
   (package
     (name "python-waf")
-    (version "1.9.8")
+    (version "2.0.11")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://waf.io/"
                                   "waf-" version ".tar.bz2"))
               (sha256
                (base32
-                "0wl4cnmp06lfxqjxaan58bqxn27smhydz0sg5prrfbl3bsw4gv6q"))))
+                "13zrniwkmfqgsgzi9v5m1367fppp9yzrz6z2ny6hy8dmpb8mj4z4"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
@@ -5720,13 +5641,13 @@ applications.")
 (define-public python-pyzmq
   (package
     (name "python-pyzmq")
-    (version "15.1.0")
+    (version "17.1.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyzmq" version))
        (sha256
-        (base32 "13fhwnlvsvxv72kfhqbpn6qi7msh8mc8377mpabv32skk2cjfnxx"))))
+        (base32 "1pyxxrz60f88ffm0y6vpbx3q8jcr9ybz8fcilihwzwhh36n84ax7"))))
     (build-system python-build-system)
     (arguments
      `(#:configure-flags
@@ -5776,14 +5697,14 @@ PEP 8.")
 (define-public python-pyflakes
   (package
     (name "python-pyflakes")
-    (version "1.5.0")
+    (version "2.0.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "pyflakes" version))
         (sha256
           (base32
-            "1x1pcca4a24k4pw8x1c77sgi58cg1wl2k38mp8a25k608pzls3da"))))
+            "0jba28czyvimdc72llms3f17swp3i8jdcabf5w0j00adfbn64xls"))))
     (build-system python-build-system)
     (home-page
       "https://github.com/pyflakes/pyflakes")
@@ -5878,52 +5799,93 @@ complexity of Python source code.")
 (define-public python2-pyflakes-0.8.1
   (package-with-python2 python-pyflakes-0.8.1))
 
-(define-public python-flake8
+;; This package is used by hypothesis which has thousands of dependent packages.
+;; FIXME: Consolidate this with "python-flake8" below in the next rebuild cycle.
+(define-public python-flake8-3.5
   (package
     (name "python-flake8")
-    (version "3.4.1")
+    (version "3.5.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "flake8" version))
         (sha256
           (base32
-            "1n0i38592vy3q0x2a9bf8z6rhhn04i30wsn5i5zzcj7qkxvl8062"))))
+            "184b33grvvjmiwlv9kyd7yng9qv5ld24154j70z332xxg9gjclvj"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         ;; Two errors don't seem to have assigned codes.
+         (add-after 'unpack 'delete-broken-test
+           (lambda _ (delete-file "tests/unit/test_pyflakes_codes.py") #t))
+         (add-after 'unpack 'fix-problem-with-pycodestyle
+           (lambda _
+             ;; See https://gitlab.com/pycqa/flake8/merge_requests/230
+             ;; This should no longer be needed with the next release.
+             (substitute* "setup.py"
+               (("PEP8_PLUGIN\\('break_around_binary_operator'\\),")
+                "PEP8_PLUGIN('break_after_binary_operator'),\
+PEP8_PLUGIN('break_before_binary_operator'),"))
+             #t))
          (delete 'check)
          (add-after 'install 'check
-          (lambda* (#:key inputs outputs #:allow-other-keys)
-            (add-installed-pythonpath inputs outputs)
-            (zero? (system* "pytest" "-v")))))))
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (add-installed-pythonpath inputs outputs)
+             (invoke "pytest" "-v")
+             #t)))))
     (propagated-inputs
-      `(("python-pycodestyle" ,python-pycodestyle)
-        ("python-pyflakes" ,python-pyflakes)
-        ;; flake8 depends on a newer setuptools than provided by python.
-        ("python-setuptools" ,python-setuptools)
-        ("python-mccabe" ,python-mccabe)))
+     `(("python-pycodestyle" ,python-pycodestyle)
+       ("python-pyflakes" ,python-pyflakes)
+       ("python-mccabe" ,python-mccabe)))
     (native-inputs
-      `(("python-mock" ,python-mock) ; TODO: only required for < 3.3
-        ("python-pytest" ,python-pytest-bootstrap)
-        ("python-pytest-runner" ,python-pytest-runner)))
+     `(("python-mock" ,python-mock)
+       ("python-pytest" ,python-pytest-bootstrap)
+       ("python-pytest-runner" ,python-pytest-runner)))
     (home-page "https://gitlab.com/pycqa/flake8")
     (synopsis
       "The modular source code checker: pep8, pyflakes and co")
     (description
       "Flake8 is a wrapper around PyFlakes, pep8 and python-mccabe.")
-    (properties `((python2-variant . ,(delay python2-flake8))))
+    (properties `((python2-variant . ,(delay python2-flake8-3.5))))
     (license license:expat)))
 
-(define-public python2-flake8
-  (let ((base (package-with-python2 (strip-python2-variant python-flake8))))
+(define-public python2-flake8-3.5
+  (let ((base (package-with-python2 (strip-python2-variant python-flake8-3.5))))
     (package (inherit base)
       (propagated-inputs
        `(("python2-configparser" ,python2-configparser)
          ("python2-enum34" ,python2-enum34)
           ,@(package-propagated-inputs base))))))
 
+;; Version 3.5.0 has compatibility issues with Pyflakes 2.0, so we need
+;; this newer version.  Keep it as a separate variable for now to avoid
+;; rebuilding "python-hypothesis"; this should be removed in the next
+;; rebuild cycle.
+(define-public python-flake8
+  (package
+    (inherit python-flake8-3.5)
+    (version "3.6.0")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "flake8" version))
+              (sha256
+               (base32
+                "0w0nprx22rbvrrkbfx9v5jc5gskbm08g219l7r8wai8zfswgadba"))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments python-flake8-3.5)
+       ((#:phases phases)
+        `(modify-phases ,phases
+           (delete 'delete-broken-test)
+           (delete 'fix-problem-with-pycodestyle)))))
+    (properties `((python2-variant . ,(delay python2-flake8))))))
+
+(define-public python2-flake8
+  (let ((base (package-with-python2 (strip-python2-variant python-flake8))))
+    (package (inherit base)
+             (propagated-inputs
+              (package-propagated-inputs python2-flake8-3.5)))))
+
 ;; python-hacking requires flake8 <2.6.0.
 (define-public python-flake8-2.5
   (package
@@ -6152,28 +6114,18 @@ add functionality and customization to your projects with their own plugins.")
 (define-public python-fonttools
   (package
     (name "python-fonttools")
-    (version "3.15.1")
+    (version "3.28.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "fonttools" version ".zip"))
               (sha256
                (base32
-                "1hhj97izwliy0vybmza72d90l5d4mcn50y8akq7kyccfl82vdx4d"))))
+                "0vsvjhidpb5kywpjgz1j3fywzkddxkb0afqai18qa3h6lqjyxwpb"))))
     (build-system python-build-system)
-    (arguments
-     '(#:test-target "check"
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'patch-setuppy
-           ;; Remove the undocumented "extra_path" argument, which adds an
-           ;; intervening directories between site-packages and the package
-           ;; directory.
-           (lambda _
-             (substitute* "setup.py"
-               (("^[ \t]*extra_path *= *'FontTools',") ""))
-             #t)))))
     (native-inputs
-     `(("unzip" ,unzip)))
+     `(("unzip" ,unzip)
+       ("python-pytest" ,python-pytest)
+       ("python-pytest-runner" ,python-pytest-runner)))
     (home-page "https://github.com/behdad/fonttools")
     (synopsis "Tools to manipulate font files")
     (description
@@ -6182,9 +6134,7 @@ supports reading and writing of TrueType/OpenType fonts, reading and writing
 of AFM files, reading (and partially writing) of PS Type 1 fonts.  The package
 also contains a tool called “TTX” which converts TrueType/OpenType fonts to and
 from an XML-based format.")
-    (license (license:non-copyleft
-              "file://LICENSE.txt"
-              "See LICENSE.txt in the distribution."))))
+    (license license:expat)))
 
 (define-public python2-fonttools
   (package-with-python2 python-fonttools))
@@ -6237,13 +6187,13 @@ should be stored on various operating systems.")
 (define-public python-llfuse
   (package
     (name "python-llfuse")
-    (version "1.3.3")
+    (version "1.3.5")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "llfuse" version ".tar.bz2"))
               (sha256
                (base32
-                "1rqww632y2zz71xmr6ch7yq80kvza9mhqr2z773k0d8l1lwzl575"))))
+                "1n7a90jww3ly49fm7x27m3xw3la3qfrnykcakga654g6kcyjlhbf"))))
     (build-system python-build-system)
     (inputs
      `(("fuse" ,fuse)
@@ -6556,13 +6506,13 @@ implementations of ASN.1-based codecs and protocols.")
 (define-public python-ipaddress
   (package
     (name "python-ipaddress")
-    (version "1.0.19")
+    (version "1.0.22")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "ipaddress" version))
               (sha256
                (base32
-                "10agaa1cys1bk1ycpl2w8lky9vjx8h1xh1z29mg0niqx0638c390"))))
+                "0b570bm6xqpjwqis15pvdy6lyvvzfndjvkynilcddjj5x98wfimi"))))
     (build-system python-build-system)
     (home-page "https://github.com/phihag/ipaddress")
     (synopsis "IP address manipulation library")
@@ -6608,14 +6558,14 @@ versions of Python.")
 (define-public python-idna
   (package
     (name "python-idna")
-    (version "2.6")
+    (version "2.7")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "idna" version))
        (sha256
         (base32
-         "13qaab6d0s15gknz8v3zbcfmbj6v86hn9pjxgkdf62ch13imssic"))))
+         "05jam7d31767dr12x0rbvvs8lxnpb1mhdb2zdlfxgh83z6k3hjk8"))))
     (build-system python-build-system)
     (home-page "https://github.com/kjd/idna")
     (synopsis "Internationalized domain names in applications")
@@ -7416,25 +7366,26 @@ be set via config files and/or environment variables.")
 @code{ArgumentParser} object.")
     (license license:asl2.0)))
 
-(define-public python-contextlib2
+(define-public python2-contextlib2
   (package
-    (name "python-contextlib2")
-    (version "0.4.0")
+    (name "python2-contextlib2")
+    (version "0.5.5")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "contextlib2" version))
        (sha256
         (base32
-         "0cmp131dlh0d0zvw0aza1zd13glvngzk8lb4avks0hm7yxwdr9am"))))
+         "0j6ad6lwwyc9kv71skj098v5l7x5biyj2hs4lc5x1kcixqcr97sh"))))
     (build-system python-build-system)
     (arguments
-     `(#:phases
+     `(#:python ,python-2
+       #:phases
        (modify-phases %standard-phases
          (replace 'check
-           (lambda _ (zero?
-                      (system*
-                       "python" "test_contextlib2.py" "-v")))))))
+           (lambda _ (invoke "python" "test_contextlib2.py" "-v"))))))
+    (native-inputs
+     `(("python2-unittest2" ,python2-unittest2)))
     (home-page "http://contextlib2.readthedocs.org/")
     (synopsis "Tools for decorators and context managers")
     (description "This module is primarily a backport of the Python
@@ -7444,9 +7395,6 @@ managers.  It also contains additional features that are not part of
 the standard library.")
     (license license:psfl)))
 
-(define-public python2-contextlib2
-  (package-with-python2 python-contextlib2))
-
 (define-public python-texttable
   (package
     (name "python-texttable")
@@ -7590,13 +7538,13 @@ minimal and fast API targeting the following uses:
 (define-public python-icalendar
   (package
     (name "python-icalendar")
-    (version "4.0.2")
+    (version "4.0.3")
     (source (origin
              (method url-fetch)
              (uri (pypi-uri "icalendar" version))
              (sha256
               (base32
-               "13003kw2vbas1ha146vv3x2rdg9k7w38rdzxj63vi1i67jgjldl0"))))
+               "0mk3dk1dxkcm46jy48v27j2w2349iv4sbimqj1yb5js43mx49hh7"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-dateutil" ,python-dateutil)
@@ -7824,16 +7772,20 @@ otherwise matches 3.2’s API.")
 (define-public python2-futures
   (package
     (name "python2-futures")
-    (version "3.0.5")
+    (version "3.2.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "futures" version))
         (sha256
          (base32
-          "1pw1z4329xvlabdpwqa6b7v2fxf7hl64m4cgr22ckbym8m8m4hh5"))))
+          "0rdjmmsab550kxsssdq49jcniz77zlkpw4pvi9hvib3lsskjmh4y"))))
     (build-system python-build-system)
-    (arguments `(#:python ,python-2))
+    (arguments `(#:python ,python-2
+                 ;; FIXME: Python 2.7.14 moved the test.support library,
+                 ;; but our package has not yet been adjusted.  Enable
+                 ;; tests when the python2 package has been fixed.
+                 #:tests? #f))
     (home-page "https://github.com/agronholm/pythonfutures")
     (synopsis
      "Backport of the concurrent.futures package from Python 3.2")
@@ -7925,15 +7877,17 @@ library as well as on the command line.")
 (define-public python-pluggy
   (package
    (name "python-pluggy")
-   (version "0.6.0")
+   (version "0.7.1")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri "pluggy" version))
      (sha256
       (base32
-       "1zqckndfn85l1cd8pndw212zg1bq9fkg1nnj32kp2mppppsyg2kz"))))
+       "1qbn70mksmr03hac6jgp6fiqc4l7859z8dchx2x950vhlij87swm"))))
    (build-system python-build-system)
+   (native-inputs
+    `(("python-setuptools-scm" ,python-setuptools-scm)))
    (synopsis "Plugin and hook calling mechanism for Python")
    (description "Pluggy is an extraction of the plugin manager as used by
 Pytest but stripped of Pytest specific details.")
@@ -8641,6 +8595,15 @@ ambiguities (forward vs. backward slashes, etc.).
 @end enumerate")
     (license license:expat)))
 
+(define-public python2-pathlib2-bootstrap
+  (hidden-package
+   (package
+     (inherit python2-pathlib2)
+     (name "python2-pathlib2-bootstrap")
+     (propagated-inputs
+      `(("python2-scandir" ,python2-scandir)
+        ("python2-six" ,python2-six-bootstrap))))))
+
 (define-public python-jellyfish
   (package
     (name "python-jellyfish")
@@ -8889,23 +8852,10 @@ LDFLAGS and parse the output to build extensions with setup.py.")
 files.  It contains a drop-in replacement for the I/O interface in the
 standard library's @code{bz2} module, including features from the latest
 development version of CPython that are not available in older releases.")
-    (license license:asl2.0)
-    (properties `((python2-variant . ,(delay python2-bz2file))))))
+    (license license:asl2.0)))
 
 (define-public python2-bz2file
-  (let ((base (package-with-python2
-               (strip-python2-variant python-bz2file))))
-    (package
-      (inherit base)
-      (arguments
-       `(#:python ,python-2
-         #:phases
-         (modify-phases %standard-phases
-           ;; 'python setup.py test' does not work as of 0.98.
-           ;; There is only the one test file, so we run it directly.
-           (replace 'check
-                    (lambda _ (zero? (system* "python"
-                                              "test_bz2file.py"))))))))))
+  (package-with-python2 python-bz2file))
 
 (define-public python-future
   (package
@@ -9090,6 +9040,14 @@ own code, responding to click events and updating clock every second.")
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         (add-before 'check 'adjust-tests
+           (lambda _
+             (when (which "python3")
+               ;; Adjust the example output to match that of Python 3.7:
+               ;; <https://github.com/ionelmc/python-tblib/issues/36>.
+               (substitute* "README.rst"
+                 (("Exception\\('fail',") "Exception('fail'"))
+               #t)))
          (replace 'check
            (lambda _
              ;; Upstream runs tests after installation and the package itself
@@ -9098,7 +9056,7 @@ own code, responding to click events and updating clock every second.")
              (setenv "PYTHONPATH"
                      (string-append (getcwd) "/build/lib:"
                                     (getenv "PYTHONPATH")))
-             (zero? (system* "py.test" "-vv" "tests" "README.rst")))))))
+             (invoke "py.test" "-vv" "tests" "README.rst"))))))
     (native-inputs
      `(("python-pytest" ,python-pytest)
        ("python-six" ,python-six)))
@@ -9122,13 +9080,13 @@ multiple processes (imagine multiprocessing, billiard, futures, celery etc).
 (define-public python-greenlet
   (package
     (name "python-greenlet")
-    (version "0.4.11")
+    (version "0.4.14")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "greenlet" version))
               (sha256
                (base32
-                "1xhik26j4f3kc4qw9xmj0c567rb5h1zryb4ijwqnqwwjvfhbv59h"))))
+                "1bsij3bwdhz2chq4ar2v6jqbh69yc7k9ymh41jd8vrdd2n52dk7i"))))
     (build-system python-build-system)
     (home-page "https://greenlet.readthedocs.io/")
     (synopsis "Lightweight in-process concurrent programming")
@@ -9142,16 +9100,40 @@ are synchronized with data exchanges on \"channels\".")
 (define-public python2-greenlet
   (package-with-python2 python-greenlet))
 
+(define-public python-objgraph
+  (package
+    (name "python-objgraph")
+    (version "3.4.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "objgraph" version))
+       (sha256
+        (base32
+         "184m09am5gpbqfaiy7l0hwh476mczbrly1dffs0rw2p1d1i2q32a"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-graphviz" ,python-graphviz)))
+    (native-inputs
+     `(("python-mock" ,python-mock)
+       ("graphviz" ,graphviz)))
+    (home-page "https://mg.pov.lt/objgraph/")
+    (synopsis "Draw Python object reference graphs with graphviz")
+    (description
+     "This package provides tools to draw Python object reference graphs with
+graphviz.")
+    (license license:expat)))
+
 (define-public python-gevent
   (package
     (name "python-gevent")
-    (version "1.2.2")
+    (version "1.3.7")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "gevent" version))
               (sha256
                (base32
-                "0bbbjvi423y9k9xagrcsimnayaqymg6f2dj76m9z3mjpkjpci4a7"))
+                "0b0fr04qdk1p4sniv87fh8z5psac60x01pv054kpgi94520g81iz"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -9161,6 +9143,7 @@ are synchronized with data exchanges on \"channels\".")
     (build-system python-build-system)
     (arguments
      `(#:modules ((ice-9 ftw)
+                  (ice-9 match)
                   (srfi srfi-26)
                   (guix build utils)
                   (guix build python-build-system))
@@ -9183,11 +9166,21 @@ are synchronized with data exchanges on \"channels\".")
                                 (find-files "src/greentest" "\\.py$"))
                       #t))
                   (add-before 'build 'do-not-use-bundled-sources
-                    (lambda _
+                    (lambda* (#:key inputs #:allow-other-keys)
                       (setenv "CONFIG_SHELL" (which "bash"))
                       (setenv "LIBEV_EMBED" "false")
                       (setenv "CARES_EMBED" "false")
                       (setenv "EMBED" "false")
+
+                      (let ((greenlet (string-append
+                                       (assoc-ref inputs "python-greenlet")
+                                       "/include")))
+                        (match (scandir greenlet
+                                        (lambda (item)
+                                          (string-prefix? "python" item)))
+                          ((python)
+                           (setenv "CPATH"
+                                   (string-append greenlet "/" python)))))
                       #t))
                   (replace 'check
                     (lambda _
@@ -9208,7 +9201,8 @@ are synchronized with data exchanges on \"channels\".")
                                                  (make-regexp "test_+(subprocess|core)")
                                                  <>)))))))))
     (propagated-inputs
-     `(("python-greenlet" ,python-greenlet)))
+     `(("python-greenlet" ,python-greenlet)
+       ("python-objgraph" ,python-objgraph)))
     (native-inputs
      `(("libev-source" ,(package-source libev))
        ("python-six" ,python-six)))
@@ -9220,10 +9214,27 @@ are synchronized with data exchanges on \"channels\".")
     (description
      "gevent is a coroutine-based Python networking library that uses greenlet
 to provide a high-level synchronous API on top of the libev event loop.")
-    (license license:expat)))
+    (license license:expat)
+    (properties `((python2-variant . ,(delay python2-gevent))))))
 
 (define-public python2-gevent
-  (package-with-python2 python-gevent))
+  (let ((base (package-with-python2
+               (strip-python2-variant python-gevent))))
+    (package
+      (inherit base)
+      (arguments
+       (substitute-keyword-arguments (package-arguments base)
+         ((#:phases phases)
+          `(modify-phases ,phases
+             (add-before 'check 'skip-timer-test
+               (lambda _
+                 ;; XXX: Skip 'TestTimerResolution', which appears to be
+                 ;; unreliable.
+                 (substitute* "src/greentest/test__core_timer.py"
+                   (("not greentest.RUNNING_ON_CI") "False"))
+                 #t))))))
+      (native-inputs `(,@(package-native-inputs python-gevent)
+                       ("python-mock" ,python2-mock))))))
 
 (define-public python-fastimport
   (package
@@ -9282,14 +9293,14 @@ focus on event-based network programming and multiprotocol integration.")
 (define-public python-pika
   (package
     (name "python-pika")
-    (version "0.10.0")
+    (version "0.12.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "pika" version))
         (sha256
          (base32
-          "0nb4h08di432lv7dy2v9kpwgk0w92f24sqc2hw2s9vwr5b8v8xvj"))))
+          "0ld7akgm93s8pfa4dsx9qlzlhj76zspbr5m9ms0ns09yd2w4aq9h"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-pyev" ,python-pyev)
@@ -9856,32 +9867,25 @@ etc.")
 (define-public python-stem
   (package
     (name "python-stem")
-    (version "1.6.0")
+    (version "1.7.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "stem" version))
        (sha256
         (base32
-         "1va9p3ij7lxg6ixfsvaql06dn11l3fgpxmss1dhlvafm7sqizznp"))))
+         "1awiglfiajnx2hva9aqpj3fmdvdb4qg7cwnlfyih827m68y3cq8v"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
        (modify-phases %standard-phases
-         (add-before 'check 'fix-test-environment
-           (lambda _
-             ;; Fixes: FileNotFoundError: [Errno 2] No such file or directory:
-             ;; '/tmp/guix-build-python-stem-1.6.0.drv-0/stem-1.6.0/.gitignore'.
-             (with-output-to-file ".gitignore"
-               (lambda _ (format #t "%")))
-             #t))
          (replace 'check
            (lambda _
              (invoke "./run_tests.py" "--unit")
              #t)))))
     (native-inputs
      `(("python-mock" ,python-mock)
-       ("python-pep8" ,python-pep8)
+       ("python-pycodestyle" ,python-pycodestyle)
        ("python-pyflakes" ,python-pyflakes)))
     (home-page "https://stem.torproject.org/")
     (synopsis
@@ -10623,21 +10627,17 @@ Record Format (DWARF).")
 (define-public python-imagesize
   (package
     (name "python-imagesize")
-    (version "0.7.1")
+    (version "1.0.0")
     (source
       (origin
       (method url-fetch)
       (uri (pypi-uri "imagesize" version))
       (sha256
         (base32
-          "0qk07k0z4241lkzzjji7z4da04pcvg7bfc4xz1934zlqhwmwdcha"))))
+          "05b3p62r7rbcvvbk5vknr3bhcq9b2airysn6ric534mng136wcjv"))))
     (build-system python-build-system)
-    (arguments
-     '(;; Test files are not distributed on PyPi:
-       ;; https://github.com/shibukawa/imagesize_py/issues/7
-       #:tests? #f))
     (home-page "https://github.com/shibukawa/imagesize_py")
-    (synopsis "Gets image size of files in variaous formats in Python")
+    (synopsis "Gets image size of files in various formats in Python")
     (description
       "This package allows determination of image size from
 PNG, JPEG, JPEG2000 and GIF files in pure Python.")
@@ -10727,23 +10727,53 @@ possible on all supported Python versions.")
       (propagated-inputs `(("python2-bz2file" ,python2-bz2file)
                            ,@(package-propagated-inputs base))))))
 
-(define-public python2-cheetah
+(define-public python-cheetah
   (package
-    (name "python2-cheetah")
-    (version "2.4.4")
+    (name "python-cheetah")
+    (version "3.1.0")
     (source
       (origin
         (method url-fetch)
-        (uri (pypi-uri "Cheetah" version))
+        (uri (pypi-uri "Cheetah3" version))
         (sha256
           (base32
-            "0l5mm4lnysjkzpjr95q5ydm9xc8bv43fxmr79ypybrf1y0lq4c5y"))))
+           "1ihag9cxll6b86fc8v5lkhmr3brdbi4yiz16zpgw79yylmv8fgr9"))))
     (build-system python-build-system)
     (arguments
-     `(#:python ,python-2))
-    (propagated-inputs
-     `(("python2-markdown" ,python2-markdown)))
-    (home-page "https://pythonhosted.org/Cheetah/")
+     `(#:modules ((guix build utils)
+                  (guix build python-build-system)
+                  (ice-9 ftw)
+                  (srfi srfi-1)
+                  (srfi srfi-26))
+       #:phases (modify-phases %standard-phases
+                  (add-after 'unpack 'use-absolute-python
+                    (lambda _
+                      (substitute* "Cheetah/CheetahWrapper.py"
+                        (("#!/usr/bin/env python")
+                         (string-append "#!" (which "python"))))
+                      #t))
+                  (replace 'check
+                    (lambda _
+                      (let ((cwd (getcwd)))
+                        (setenv "PYTHONPATH"
+                                (string-append
+                                 cwd "/build/"
+                                 (find (cut string-prefix? "lib" <>)
+                                       (scandir (string-append cwd "/build")))
+                                 ":" (getenv "PYTHONPATH")))
+                        (setenv "PATH"
+                                (string-append (getenv "PATH")
+                                               ":" cwd "/bin"))
+                        (setenv "TMPDIR" "/tmp")
+
+                        (substitute* "Cheetah/Tests/Test.py"
+                          (("unittest.TextTestRunner\\(\\)")
+                           "unittest.TextTestRunner(verbosity=2)"))
+
+                        (invoke "python" "Cheetah/Tests/Test.py")))))))
+    (propagated-inputs
+     `(("python-markdown" ,python-markdown)))    ;optional
+    (home-page "http://cheetahtemplate.org/")
     (synopsis "Template engine")
     (description "Cheetah is a text-based template engine and Python code
 generator.
@@ -10771,6 +10801,9 @@ Features:
 @end enumerate")
     (license (license:x11-style "file://LICENSE"))))
 
+(define-public python2-cheetah
+  (package-with-python2 python-cheetah))
+
 (define-public python-dulwich
   (package
     (name "python-dulwich")
@@ -11104,6 +11137,32 @@ projects.")
 (define-public python2-incremental
   (package-with-python2 python-incremental))
 
+(define-public python-invoke
+  (package
+    (name "python-invoke")
+    (home-page "http://www.pyinvoke.org/")
+    (version "1.1.0")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "invoke" version))
+              (sha256
+               (base32
+                "0aiy1xvk1f91246zxd1zqrm679vdvd10h843a2na41cqr3cflpi6"))))
+    (build-system python-build-system)
+    (arguments
+     ;; XXX: Requires many dependencies that are not yet in Guix.
+     `(#:tests? #f))
+    (synopsis "Pythonic task execution")
+    (description
+     "Invoke is a Python task execution tool and library, drawing inspiration
+from various sources to arrive at a powerful and clean feature set.  It is
+evolved from the Fabric project, but focuses on local and abstract concerns
+instead of servers and network commands.")
+    (license license:bsd-3)))
+
+(define-public python2-invoke
+  (package-with-python2 python-invoke))
+
 (define-public python-automat
   (package
     (name "python-automat")
@@ -11187,17 +11246,36 @@ and bit flag values.")
 (define-public python-attrs
   (package
     (name "python-attrs")
-    (version "17.4.0")
+    (version "18.2.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "attrs" version))
               (sha256
                (base32
-                "1jafnn1kzd6qhxgprhx6y6ik1r5m2rilx25syzcmq03azp660y8w"))))
+                "0s9ydh058wmmf5v391pym877x4ahxg45dw6a0w4c7s5wgpigdjqh"))))
     (build-system python-build-system)
+    (arguments
+     `(#:modules ((guix build utils)
+                  (guix build python-build-system)
+                  (ice-9 ftw)
+                  (srfi srfi-1)
+                  (srfi srfi-26))
+       #:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda _
+                      (let ((cwd (getcwd)))
+                        (setenv "PYTHONPATH"
+                                (string-append
+                                 cwd "/build/"
+                                 (find (cut string-prefix? "lib" <>)
+                                       (scandir (string-append cwd "/build")))
+                                 ":"
+                                 (getenv "PYTHONPATH")))
+                        (invoke "python" "-m" "pytest")))))))
     (native-inputs
      `(("python-coverage" ,python-coverage)
        ("python-hypothesis" ,python-hypothesis)
+       ("python-pympler" ,python-pympler)
        ("python-pytest" ,python-pytest)
        ("python-six" ,python-six)
        ("python-sphinx" ,python-sphinx)
@@ -11216,6 +11294,15 @@ protocols.")
   (package
     (inherit python-attrs)
     (name "python-attrs-bootstrap")
+    ;; Keep this on a fixed version so python-attrs can be updated without
+    ;; triggering a mass-rebuild.  FIXME: Update this in the next rebuild cycle.
+    (version "17.4.0")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "attrs" version))
+              (sha256
+               (base32
+                "1jafnn1kzd6qhxgprhx6y6ik1r5m2rilx25syzcmq03azp660y8w"))))
     (native-inputs `())
     (arguments `(#:tests? #f))))
 
@@ -11375,28 +11462,37 @@ clone, while other processes access the original tree.")
 (define-public python-astroid
   (package
     (name "python-astroid")
-    (version "1.5.3")
+    (version "2.0.4")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append
-             "https://github.com/PyCQA/astroid/archive/astroid-"
-             version ".tar.gz"))
+       (uri (pypi-uri "astroid" version))
        (sha256
         (base32
-         "0isn5p7f9n48hmksgbrj7dkm9dyglnayzn5jngk37qywg8a74ngn"))))
+         "138svbm88w5k0y2nvl4svyas1jfhcc5iy0d2ywkbcpn9kq8ks0f7"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-lazy-object-proxy" ,python-lazy-object-proxy)
        ("python-six" ,python-six)
        ("python-wrapt" ,python-wrapt)))
+    (native-inputs
+     `(("python-dateutil" ,python-dateutil)
+       ("python-nose" ,python-nose)
+       ("python-pytest" ,python-pytest)
+       ("python-pytest-runner" ,python-pytest-runner)))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+            (add-after 'unpack 'remove-spurious-test
+              (lambda _
+                ;; This can be removed after upgrading from python-3.7
+                ;; https://github.com/PyCQA/astroid/issues/593
+                ;; https://bugs.python.org/issue34056
+                (delete-file "astroid/tests/unittest_modutils.py")
+                #t))
          (replace 'check
-                  (lambda _
-                    (zero? (system* "python" "-m" "unittest" "discover"
-                                    "-p" "unittest*.py")))))))
+           (lambda _
+             (invoke "pytest" "astroid"))))))
     (home-page "https://github.com/PyCQA/astroid")
     (synopsis "Common base representation of python source code for pylint and
 other projects")
@@ -11416,12 +11512,35 @@ builds partial trees by inspecting living objects.")
   (let ((base (package-with-python2
                (strip-python2-variant python-astroid))))
     (package (inherit base)
-             (propagated-inputs
-              `(("python2-backports-functools-lru-cache"
-                 ,python2-backports-functools-lru-cache)
-                ("python2-enum34" ,python2-enum34)
-                ("python2-singledispatch" ,python2-singledispatch)
-                ,@(package-propagated-inputs base))))))
+    ;; Version 2.x removes python2 support.
+    (version "1.6.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "astroid" version))
+       (sha256
+        (base32
+         "0fir4b67sm7shcacah9n61pvq313m523jb4q80sycrh3p8nmi6zw"))))
+    (arguments
+      (substitute-keyword-arguments (package-arguments base)
+        ((#:phases phases)
+         `(modify-phases ,phases
+            (add-after 'unpack 'remove-spurious-test
+              (lambda _
+                ;; https://github.com/PyCQA/astroid/issues/276
+                (delete-file "astroid/tests/unittest_brain.py")
+                #t))
+            (replace 'check
+              (lambda _
+                (invoke"python" "-m" "unittest" "discover"
+                                "-p" "unittest*.py")))))))
+    (native-inputs `())
+    (propagated-inputs
+      `(("python2-backports-functools-lru-cache"
+         ,python2-backports-functools-lru-cache)
+        ("python2-enum34" ,python2-enum34)
+        ("python2-singledispatch" ,python2-singledispatch)
+        ,@(package-propagated-inputs base))))))
 
 (define-public python-isort
   (package
@@ -11718,13 +11837,13 @@ It supports both normal and Unicode strings.")
 (define-public python-scandir
   (package
     (name "python-scandir")
-    (version "1.7")
+    (version "1.9.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "scandir" version))
        (sha256
-        (base32 "0gbnhjzg42rj87ljv9kb648rfxph69ly3c8r9841dxy4d7l5pmdj"))))
+        (base32 "0r3hvf1a9jm1rkqgx40gxkmccknkaiqjavs8lccgq9s8khh5x5s4"))))
     (build-system python-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
@@ -11844,15 +11963,19 @@ several utilities, as well as an API for building localization tools.")
 (define-public python-packaging
   (package
     (name "python-packaging")
-    (version "16.8")
+    (version "17.1")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "packaging" version))
         (sha256
          (base32
-          "17k1xbjshackwvbsnxqixbph8rbqhz4bf4g3al5xyzhavxgq6l2x"))))
+          "0nrpayk8kij1zm9sjnk38ldz3a6705ggvw8ljylqbrb4vmqbf6gh"))))
     (build-system python-build-system)
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda _ (invoke "py.test" "-vv"))))))
     (native-inputs
      `(("python-pretend" ,python-pretend)
        ("python-pytest" ,python-pytest)))
@@ -12893,26 +13016,40 @@ belong to tagged versions.")
 (define-public python-pyclipper
   (package
     (name "python-pyclipper")
-    (version "1.0.6")
+    (version "1.1.0.post1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyclipper" version ".zip"))
        (sha256
         (base32
-         "1zpmwv3bya3j984y5cf9x9d5108kf6mxldcba68wiq0frv5qrssw"))))
+         "0ldbkbnx94an4zzrwb1sxmg6k0jgk4cwmvcdyy8y5k1zslc612wa"))
+      (modules '((guix build utils)))
+      (snippet
+       '(begin
+          ;; This file is generated by Cython.
+          (delete-file "pyclipper/pyclipper.cpp") #t))))
     (build-system python-build-system)
     (arguments
-     `(#:tests? #f)); 8 Tests fail, 37 succeed
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'cythonize-sources
+           (lambda _
+             (with-directory-excursion "pyclipper"
+               (invoke "cython" "--cplus" "pyclipper.pyx")))))))
     (propagated-inputs
      `(("python-setuptools-scm-git-archive" ,python-setuptools-scm-git-archive)))
     (native-inputs
-     `(("unzip" ,unzip)))
+     `(("python-cython" ,python-cython)
+       ("python-pytest" ,python-pytest)
+       ("python-pytest-runner" ,python-pytest-runner)
+       ("python-unittest2" ,python-unittest2)
+       ("unzip" ,unzip)))
     (home-page "https://github.com/greginvm/pyclipper")
     (synopsis "Wrapper for Angus Johnson's Clipper library")
     (description
      "Pyclipper is a Cython wrapper for the C++ translation of the
-  Angus Johnson's polygon clipping Clipper library (ver. 6.2.1).")
+Angus Johnson's polygon clipping Clipper library (ver. 6.4.2).")
     (license license:expat)))
 
 (define-public python2-pyclipper
@@ -13255,14 +13392,14 @@ user's @file{~/Trash} directory.")
 (define-public python-yapf
   (package
     (name "python-yapf")
-    (version "0.21.0")
+    (version "0.24.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "yapf" version))
        (sha256
         (base32
-         "144gc7d6b1415vh02409rnb8qd5kxi6mxlr7y64d5cizgxbf72kx"))))
+         "0anwby0ydmyzcsgjc5dn1ryddwvii4dq61vck447q0n96npnzfyf"))))
     (build-system python-build-system)
     (home-page "https://github.com/google/yapf")
     (synopsis "Formatter for Python code")
@@ -13652,15 +13789,29 @@ file system events on Linux.")
 (define-public python-more-itertools
   (package
     (name "python-more-itertools")
-    (version "4.1.0")
+    (version "4.3.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "more-itertools" version))
        (sha256
         (base32
-         "0i3ch700g5fyjp692gprlnzbysl8w0sa2vijbp3s40drvk67xkn9"))))
+         "17h3na0rdh8xq30w4b9pizgkdxmm51896bxw600x84jflg9vaxn4"))))
     (build-system python-build-system)
+    (arguments
+     `(,@(if (any (cute string-prefix? <> (or (%current-system)
+                                              (%current-target-system)))
+                  '("armhf" "i686"))
+        '(#:phases
+          (modify-phases %standard-phases
+          ;; This is required for 32-bit hardware.
+          ;; TODO: Try to remove this when upgrading.
+          (add-after 'unpack 'patch-test
+            (lambda _
+              (substitute* "more_itertools/tests/test_more.py"
+                (("10 \\*\\* 10") "9 ** 9"))
+              #t))))
+        '())))
     (propagated-inputs
      `(("python-six" ,python-six-bootstrap)))
     (home-page "https://github.com/erikrose/more-itertools")
@@ -13994,10 +14145,16 @@ introspection.")
 @item Inter-process locks
 @item Generic helpers
 @end itemize\n")
+    (properties `((python2-variant . ,(delay python2-fasteners))))
     (license license:asl2.0)))
 
 (define-public python2-fasteners
-  (package-with-python2 python-fasteners))
+  (let ((base (package-with-python2 (strip-python2-variant python-fasteners))))
+    (package
+      (inherit base)
+      (propagated-inputs
+       `(("python2-futures" ,python2-futures)
+         ,@(package-propagated-inputs base))))))
 
 (define-public python-requests-file
   (package
diff --git a/gnu/packages/qt.scm b/gnu/packages/qt.scm
index 36f8aef694..2b8b5923aa 100644
--- a/gnu/packages/qt.scm
+++ b/gnu/packages/qt.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2014, 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
-;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015, 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 Nils Gillmann <ng0@n0.is>
 ;;; Copyright © 2016 Thomas Danckaert <post@thomasdanckaert.be>
@@ -122,6 +122,7 @@ system, and the core design of Django is reused in Grantlee.")
              (sha256
               (base32
                "10faac59jvz6dxxljdkaknlxazpnaxgvqdcszabfbbkc1f24n466"))
+             (patches (search-patches "qt-5-renameat2.patch"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -624,7 +625,6 @@ system, and the core design of Django is reused in Grantlee.")
                  ;; kernels that the glibc supports, including the RHEL6
                  ;; (2.6.32) and RHEL7 (3.10) kernels.
                  "-no-feature-getentropy"  ; requires Linux 3.17
-                 "-no-feature-renameat2"   ; requires Linux 3.16
 
                  ;; Do not build examples; if desired, these could go
                  ;; into a separate output, but for the time being, we
diff --git a/gnu/packages/readline.scm b/gnu/packages/readline.scm
index 4695e9fc71..59fa8af8af 100644
--- a/gnu/packages/readline.scm
+++ b/gnu/packages/readline.scm
@@ -48,7 +48,9 @@
   (patch-series
    (1 "0xm3sxvwmss7ddyfb11n6pgcqd1aglnpy15g143vzcf75snb7hcs")
    (2 "0n1dxmqsbjgrfxb1hgk5c6lsraw4ncbnzxlsx7m35nym6lncjiw7")
-   (3 "1027kmymniizcy0zbdlrczxfx3clxcdln5yq05q9yzlc6y9slhwy")))
+   (3 "1027kmymniizcy0zbdlrczxfx3clxcdln5yq05q9yzlc6y9slhwy")
+   (4 "0r3bbaf12iz8m02z6p3fzww2m365fhn71xmzab2p62gj54s6h9gr")
+   (5 "0lxpa4f72y2nsgj6fgrhjk2nmmxvccys6aciwfxwchb5f21rq5fa")))
 
 (define-public readline
   (package
diff --git a/gnu/packages/rust.scm b/gnu/packages/rust.scm
index a56faad079..ef40431733 100644
--- a/gnu/packages/rust.scm
+++ b/gnu/packages/rust.scm
@@ -41,7 +41,6 @@
   #:use-module (gnu packages python)
   #:use-module (gnu packages ssh)
   #:use-module (gnu packages tls)
-  #:use-module (gnu packages version-control)
   #:use-module (gnu packages)
   #:use-module (guix build-system cargo)
   #:use-module (guix build-system gnu)
@@ -387,7 +386,6 @@ test = { path = \"../libtest\" }
        ("cmake" ,cmake)
        ("flex" ,flex) ; For the tests
        ("gdb" ,gdb)   ; For the tests
-       ("git" ,git)
        ("procps" ,procps) ; For the tests
        ("python-2" ,python-2)
        ("rustc-bootstrap" ,mrustc)
@@ -446,6 +444,13 @@ safety and thread safety guarantees.")
                  ;; i686-linux.
                  (substitute* "src/tools/cargo/tests/test.rs"
                    (("fn cargo_test_env") "#[ignore]\nfn cargo_test_env"))
+
+                 ;; These tests pull in a dependency on "git", which changes
+                 ;; too frequently take part in the Rust toolchain.
+                 (substitute* "src/tools/cargo/tests/new.rs"
+                   (("fn author_prefers_cargo") "#[ignore]\nfn author_prefers_cargo")
+                   (("fn finds_author_git") "#[ignore]\nfn finds_author_git")
+                   (("fn finds_local_author_git") "#[ignore]\nfn finds_local_author_git"))
                  #t))
              (add-after 'patch-cargo-tests 'ignore-glibc-2.27-incompatible-test
                ;; https://github.com/rust-lang/rust/issues/47863
@@ -571,8 +576,20 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
                  #t)))))))))
 
 (define-public rust-1.22
-  (rust-bootstrapped-package rust-1.21 "1.22.1"
-                             "1lrzzp0nh7s61wgfs2h6ilaqi6iq89f1pd1yaf65l87bssyl4ylb"))
+  (let ((base-rust (rust-bootstrapped-package rust-1.21 "1.22.1"
+                    "1lrzzp0nh7s61wgfs2h6ilaqi6iq89f1pd1yaf65l87bssyl4ylb")))
+    (package
+      (inherit base-rust)
+      (arguments
+       (substitute-keyword-arguments (package-arguments base-rust)
+         ((#:phases phases)
+          `(modify-phases ,phases
+             (add-after 'unpack 'remove-flaky-test
+               (lambda _
+                 ;; See <https://github.com/rust-lang/rust/issues/43402>.
+                 (when (file-exists? "src/test/run-make/issue-26092")
+                   (delete-file-recursively "src/test/run-make/issue-26092"))
+                 #t)))))))))
 
 (define-public rust-1.23
   (let ((base-rust (rust-bootstrapped-package rust-1.22 "1.23.0"
@@ -678,6 +695,12 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
                  ;; i686-linux.
                  (substitute* "src/tools/cargo/tests/testsuite/test.rs"
                    (("fn cargo_test_env") "#[ignore]\nfn cargo_test_env"))
+
+                 ;; Avoid dependency on "git".
+                 (substitute* "src/tools/cargo/tests/testsuite/new.rs"
+                   (("fn author_prefers_cargo") "#[ignore]\nfn author_prefers_cargo")
+                   (("fn finds_author_git") "#[ignore]\nfn finds_author_git")
+                   (("fn finds_local_author_git") "#[ignore]\nfn finds_local_author_git"))
                  #t))
              (add-after 'patch-cargo-tests 'disable-cargo-test-for-nightly-channel
                (lambda* _
@@ -702,7 +725,7 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
                                     '("rust-coresimd-doctest.patch"
                                       "rust-bootstrap-stage0-test.patch"
                                       "rust-1.25-accept-more-detailed-gdb-lines.patch"
-                                      "rust-mdbook-support-reproducible-builds-by-forcing-window.search.patch"))))
+                                      "rust-reproducible-builds.patch"))))
     (package
       (inherit base-rust)
       (arguments
@@ -731,7 +754,7 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
                                     '("rust-coresimd-doctest.patch"
                                       "rust-bootstrap-stage0-test.patch"
                                       "rust-1.25-accept-more-detailed-gdb-lines.patch"
-                                      "rust-mdbook-support-reproducible-builds-by-forcing-window.search.patch"))))
+                                      "rust-reproducible-builds.patch"))))
     (package
       (inherit base-rust)
       (inputs
diff --git a/gnu/packages/samba.scm b/gnu/packages/samba.scm
index ff237c96ce..b927bbbf9b 100644
--- a/gnu/packages/samba.scm
+++ b/gnu/packages/samba.scm
@@ -397,6 +397,18 @@ key-value pair databases and a real LDAP database.")
               (method url-fetch)
               (uri (string-append "https://www.samba.org/ftp/ppp/ppp-"
                                   version ".tar.gz"))
+              (patches
+               (list (origin
+                       ;; Use OpenSSL for cryptography instead of the obsolete glibc
+                       ;; crypto functions that were removed in glibc 2.28.
+                       (method url-fetch)
+                       (uri (string-append "https://github.com/paulusmack/ppp/commit/"
+                                           "3c7b86229f7bd2600d74db14b1fe5b3896be3875"
+                                           ".patch"))
+                       (file-name "ppp-use-openssl-crypto.patch")
+                       (sha256
+                        (base32
+                         "0qlbi247lx3injpy8a1gcij9yilik0vfaibkpvdp88k3sa1rs69z")))))
               (sha256
                (base32
                 "0c7vrjxl52pdwi4ckrvfjr08b31lfpgwf3pp0cqy76a77vfs7q02"))))
@@ -409,15 +421,19 @@ key-value pair databases and a real LDAP database.")
          (add-before 'configure 'patch-Makefile
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((libc    (assoc-ref inputs "libc"))
+                   (openssl (assoc-ref inputs "openssl"))
                    (libpcap (assoc-ref inputs "libpcap")))
                (substitute* "pppd/Makefile.linux"
                  (("/usr/include/crypt\\.h")
                   (string-append libc "/include/crypt.h"))
+                 (("/usr/include/openssl")
+                  (string-append openssl "/include/openssl"))
                  (("/usr/include/pcap-bpf.h")
                   (string-append libpcap "/include/pcap-bpf.h")))
                #t))))))
     (inputs
-     `(("libpcap" ,libpcap)))
+     `(("libpcap" ,libpcap)
+       ("openssl" ,(@ (gnu packages tls) openssl))))
     (synopsis "Implementation of the Point-to-Point Protocol")
     (home-page "https://ppp.samba.org/")
     (description
diff --git a/gnu/packages/simulation.scm b/gnu/packages/simulation.scm
index 6144e236a7..c080a16ce7 100644
--- a/gnu/packages/simulation.scm
+++ b/gnu/packages/simulation.scm
@@ -70,7 +70,16 @@
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32 "0cgxh4h2hf50qbvvdg5miwc2nympb0nrv3md96vb3gbs9vk8vq9d"))
-       (patches (search-patches "openfoam-4.1-cleanup.patch"))))
+       (patches (search-patches "openfoam-4.1-cleanup.patch"))
+       (modules '((guix build utils)))
+       (snippet
+        '(begin
+           ;; Include <sys/sysmacros.h>, which is where glibc >= 2.28 provides
+           ;; 'major' and 'minor'.
+           (substitute* "src/OSspecific/POSIX/fileStat.C"
+             (("#include <unistd\\.h>")
+              "#include <unistd.h>\n#include <sys/sysmacros.h>\n"))
+           #t))))
     (build-system gnu-build-system)
     (inputs
      `(("boost" ,boost)
diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index fb121a0581..94e6aa8438 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -211,6 +211,10 @@ which allows users to view a desktop computing environment.")
       `(#:configure-flags
         '("--enable-lz4"
           "--enable-automated-tests")
+
+        ;; Several tests appear to be opening the same sockets concurrently.
+        #:parallel-tests? #f
+
         #:phases (modify-phases %standard-phases
                    (add-before 'check 'use-empty-ssl-cert-file
                      (lambda _ (setenv "SSL_CERT_FILE" "/dev/null") #t)))))
diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index 5ea5148cbc..5c954eae35 100644
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -116,23 +116,10 @@ applications.")
    (propagated-inputs `(("libgcrypt" ,libgcrypt)
                         ("zlib" ,zlib)))
    (arguments `(#:configure-flags `("--with-libgcrypt")
-                #:phases
-                ;; FIXME: In the next core-updates cycle, replace the entire
-                ;; following ,(...) form with its first 'modify-phases'
-                ;; subform.  The change made here is only strictly needed on
-                ;; MIPS, but should work on any system.  For now, we apply it
-                ;; only to MIPS to avoid forcing thousands of rebuilds on
-                ;; other systems.
-                ,(if (string-prefix? "mips" (or (%current-target-system)
-                                                (%current-system)))
-                     '(modify-phases %standard-phases
-                        (replace 'bootstrap
-                          (lambda _
-                            (invoke "autoreconf" "-v"))))
-                     '(modify-phases %standard-phases
-                        (add-before 'configure 'autoreconf
-                          (lambda _
-                            (invoke "autoreconf" "-v")))))))
+                #:phases (modify-phases %standard-phases
+                           (replace 'bootstrap
+                             (lambda _
+                               (invoke "autoreconf" "-v"))))))
    (native-inputs `(("autoconf" ,autoconf)
                     ("automake" ,automake)))
    (synopsis "Client-side C library implementing the SSH2 protocol")
diff --git a/gnu/packages/statistics.scm b/gnu/packages/statistics.scm
index 2e75981de3..66f57ac879 100644
--- a/gnu/packages/statistics.scm
+++ b/gnu/packages/statistics.scm
@@ -248,9 +248,9 @@ as.POSIXct(if (\"\" != Sys.getenv(\"SOURCE_DATE_EPOCH\")) {\
                                     "/share/zoneinfo"))
              #t))
          (add-after 'build 'make-info
-           (lambda _ (invoke "make" "info") #t))
+          (lambda _ (invoke "make" "info")))
          (add-after 'build 'install-info
-           (lambda _ (invoke "make" "install-info") #t)))
+          (lambda _ (invoke "make" "install-info"))))
        #:configure-flags
        `(;; We build the recommended packages here, because they are needed in
          ;; order to run the test suite.  We disable them in the r-minimal
diff --git a/gnu/packages/storage.scm b/gnu/packages/storage.scm
index 11f6f9d7e8..5051ccd986 100644
--- a/gnu/packages/storage.scm
+++ b/gnu/packages/storage.scm
@@ -26,6 +26,7 @@
   #:use-module (gnu packages)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages assembly)
+  #:use-module (gnu packages authentication)
   #:use-module (gnu packages bdw-gc)
   #:use-module (gnu packages boost)
   #:use-module (gnu packages check)
@@ -35,6 +36,7 @@
   #:use-module (gnu packages curl)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages disk)
+  #:use-module (gnu packages gcc)
   #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages gperf)
   #:use-module (gnu packages jemalloc)
@@ -51,18 +53,19 @@
 (define-public ceph
   (package
     (name "ceph")
-    (version "12.2.5")
+    (version "13.2.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://download.ceph.com/tarballs/ceph-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1ydc3mfvc0vpnpfnfmissvsrsj4jyxgzc2pcl1a4vdr3bwkcglp3"))
+                "0h483n9iy0fkbqrhf7k0dzspwdpcaswkjwmc5n5c600fr6s1v9pk"))
               (patches
                (search-patches "ceph-skip-unittest_blockdev.patch"
                                "ceph-skip-collect-sys-info-test.patch"
-                               "ceph-rocksdb-compat.patch"
+                               "ceph-detect-rocksdb.patch"
+                               "ceph-volume-respect-PATH.patch"
                                "ceph-disable-cpu-optimizations.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -76,7 +79,7 @@
                               ;"src/zstd"
                               ;"src/civetweb"
                               "src/test/downloads"
-                              "src/dpdk"
+                              "src/rapidjson"
                               "src/spdk"
                               "src/rocksdb"
                               "src/boost"))
@@ -100,13 +103,14 @@
                               (assoc-ref %build-inputs "keyutils") "/include")
                "-DCMAKE_INSTALL_LOCALSTATEDIR=/var"
                "-DENABLE_SHARED=ON"
-               "-DWITH_EMBEDDED=OFF"
                "-DWITH_SYSTEM_ROCKSDB=ON"
                "-DWITH_SYSTEM_BOOST=ON"
                "-DWITH_PYTHON3=ON"
                ;; TODO: Enable these when available in Guix.
+               "-DWITH_MGR_DASHBOARD_FRONTEND=OFF"       ;requires node + nodeenv
                "-DWITH_BABELTRACE=OFF"
                "-DWITH_LTTNG=OFF"
+               "-DWITH_SPDK=OFF"
                "-DWITH_XFS=OFF"
                "-DWITH_XIO=OFF"
                ;; Use jemalloc instead of tcmalloc.
@@ -184,9 +188,6 @@
                ;; /tmp/ceph-disk-virtualenv/bin/ceph-disk, but somehow
                ;; src/ceph-disk/CMakeLists.txt fails to create it.
                (substitute* "src/test/CMakeLists.txt"
-                 ;; FIXME: "create cannot load compressor of type zlib"
-                 ;; "libceph_zlib.so: undefined symbol: isal_deflate"
-                 (("^add_subdirectory\\(compressor\\)") "")
                  ;; FIXME: These tests fails because `ceph-disk'
                  ;; is not available.
                  (("^add_ceph_test\\(test-ceph-helpers\\.sh.*$") "\n")
@@ -235,6 +236,11 @@
                  (("^add_ceph_test\\(osd-copy-from\\.sh.*$") "\n")
                  (("^add_ceph_test\\(osd-fast-mark-down\\.sh.*$") "\n"))
                #t)))
+         (add-before 'configure 'gcc-workaround
+           (lambda _
+             (unsetenv "C_INCLUDE_PATH")
+             (unsetenv "CPLUS_INCLUDE_PATH")
+             #t))
          (add-before 'check 'set-check-environment
            (lambda _
              ;; Run tests in parallel.
@@ -262,28 +268,28 @@
          (add-after 'install 'wrap-python-scripts
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))
-                    (ceph (string-append out "/bin/ceph"))
-                    (ceph-disk (string-append out "/bin/ceph-disk"))
-                    (ceph-detect-init (string-append
-                                       out "/bin/ceph-detect-init"))
-
+                    (scripts '("ceph" "ceph-mgr" "ceph-volume"
+                               "ceph-detect-init"
+                               "ceph-disk")) ;deprecated
                     (prettytable (assoc-ref inputs "python2-prettytable"))
-
+                    (six (assoc-ref inputs "python2-six"))
                     (sitedir (lambda (package)
                                (string-append package
                                               "/lib/python2.7/site-packages")))
                     (PYTHONPATH (string-append
                                  (sitedir out) ":"
+                                 (sitedir six) ":"
                                  (sitedir prettytable))))
                (for-each (lambda (executable)
-                           (wrap-program executable
+                           (wrap-program (string-append out "/bin/" executable)
                              `("PYTHONPATH" ":" prefix (,PYTHONPATH))))
-                         (list ceph ceph-disk ceph-detect-init))
+                         scripts)
                #t))))))
     (outputs
      '("out" "lib"))
     (native-inputs
-     `(("gperf" ,gperf)
+     `(("gcc" ,gcc-7)                      ;7 or later is required
+       ("gperf" ,gperf)
        ("pkg-config" ,pkg-config)
        ("python-cython" ,python-cython)
        ("python-sphinx" ,python-sphinx)
@@ -329,13 +335,16 @@
        ("libatomic-ops" ,libatomic-ops)
        ("lua" ,lua)
        ("lz4" ,lz4)
+       ("oath-toolkit" ,oath-toolkit)
        ("openldap" ,openldap)
        ("openssl" ,openssl)
        ("nss" ,nss)
        ("parted" ,parted)
        ("python@2" ,python-2)
        ("python2-prettytable" ,python2-prettytable)      ;used by ceph_daemon.py
+       ("python2-six" ,python2-six)                      ;for ceph-mgr + plugins
        ("python@3" ,python-3)
+       ("rapidjson" ,rapidjson)
        ("rocksdb" ,rocksdb)
        ("snappy" ,snappy)
        ("udev" ,eudev)
diff --git a/gnu/packages/swig.scm b/gnu/packages/swig.scm
index b931db412b..61f6a8ccfe 100644
--- a/gnu/packages/swig.scm
+++ b/gnu/packages/swig.scm
@@ -22,6 +22,7 @@
   #:use-module (guix download)
   #:use-module (guix licenses)
   #:use-module (guix build-system gnu)
+  #:use-module (gnu packages)
   #:use-module (gnu packages pcre)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages boost)
@@ -37,6 +38,7 @@
              (uri (string-append "mirror://sourceforge/" name "/" name "/"
                                  name "-" version "/"
                                  name "-" version ".tar.gz"))
+             (patches (search-patches "swig-guile-gc.patch"))
              (sha256
               (base32
                "0kf99ygrjs5616gsqhz1l7bib3a12izmxi7g48bwblbymr3z9ybw"))))
diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
index a50ff2fee0..7e0da38285 100644
--- a/gnu/packages/sync.scm
+++ b/gnu/packages/sync.scm
@@ -217,7 +217,8 @@ and does not hamper local file system performance.")
               (sha256
                (base32
                 "0znkp3fcksrykcsv06y2mjvf2lbwmin25snmvfa8i5qfm3f4rm88"))
-              (file-name (string-append name "-" version "-checkout"))))
+              (file-name (string-append name "-" version "-checkout"))
+              (patches (search-patches "casync-renameat2-declaration.patch"))))
     (build-system meson-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
diff --git a/gnu/packages/tcl.scm b/gnu/packages/tcl.scm
index f7d3e0ec7d..b8c85eb844 100644
--- a/gnu/packages/tcl.scm
+++ b/gnu/packages/tcl.scm
@@ -2,7 +2,7 @@
 ;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2018 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014 Eric Bavier <bavier@member.fsf.org>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2017 Kei Kebreau <kkebreau@posteo.net>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
@@ -25,6 +25,7 @@
 (define-module (gnu packages tcl)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system perl)
   #:use-module (gnu packages)
@@ -145,13 +146,22 @@ X11 GUIs.")
              (patches (search-patches "tk-find-library.patch"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:phases (modify-phases %standard-phases
+     `(#:phases (modify-phases %standard-phases
                   (add-before
                    'configure 'pre-configure
                    (lambda _
                      (chdir "unix")
                      #t))
                   (add-after
+                   'install 'create-wish-symlink
+                   (lambda* (#:key outputs #:allow-other-keys)
+                     (let ((out (assoc-ref outputs "out")))
+                       (symlink (string-append out "/bin/wish"
+                                               ,(version-major+minor
+                                                  (package-version tk)))
+                                (string-append out "/bin/wish")))
+                     #t))
+                  (add-after
                    'install 'add-fontconfig-flag
                    (lambda* (#:key inputs outputs #:allow-other-keys)
                      ;; Add the missing -L flag for Fontconfig in 'tk.pc' and
@@ -179,7 +189,7 @@ X11 GUIs.")
     (propagated-inputs `(("libx11" ,libx11)
                          ("libxext" ,libxext)))
 
-    (home-page "http://www.tcl.tk/")
+    (home-page "https://www.tcl.tk/")
     (synopsis "Graphical user interface toolkit for Tcl")
     (description
      "Tk is a graphical toolkit for building graphical user
diff --git a/gnu/packages/terminals.scm b/gnu/packages/terminals.scm
index 18da27fbc0..369e79bf5b 100644
--- a/gnu/packages/terminals.scm
+++ b/gnu/packages/terminals.scm
@@ -242,9 +242,10 @@ compatibility to existing emulators like xterm, gnome-terminal, konsole, etc.")
       (build-system gnu-build-system)
       (arguments
        `(#:phases (modify-phases %standard-phases
-                    (add-after 'unpack 'autogen.sh
+                    (replace 'bootstrap
                       (lambda _
-                        (zero? (system* "sh" "autogen.sh"))))
+                        (setenv "NOCONFIGURE" "indeed")
+                        (invoke "sh" "autogen.sh")))
                     ;; Use elogind instead of systemd.
                     (add-before 'configure 'remove-systemd
                       (lambda _
diff --git a/gnu/packages/tex.scm b/gnu/packages/tex.scm
index f8b11f7e1a..916aa54d58 100644
--- a/gnu/packages/tex.scm
+++ b/gnu/packages/tex.scm
@@ -76,42 +76,41 @@
 (define texlive-extra-src
   (origin
     (method url-fetch)
-    (uri "ftp://tug.org/historic/systems/texlive/2017/texlive-20170524-extra.tar.xz")
+    (uri "ftp://tug.org/historic/systems/texlive/2018/texlive-20180414-extra.tar.xz")
     (sha256 (base32
-              "0zvd2zskk78ig114mfj24g15qys41hzqv59fmqpirdbgq9c9gr5g"))))
+             "0a83kymxc8zmlxjb0y1gf6mx7qnf0hxffwkivwh5yh138y2rfhsv"))))
 
 (define texlive-texmf-src
   (origin
     (method url-fetch)
-    (uri "ftp://tug.org/historic/systems/texlive/2017/texlive-20170524-texmf.tar.xz")
+    (uri "ftp://tug.org/historic/systems/texlive/2018/texlive-20180414-texmf.tar.xz")
     (sha256 (base32
-              "1v69y3kgkbk24f7s4dfkknwd317mqmck5jgpyb35wqgqfy5p0qrz"))))
+             "1b8zigzg8raxkhhzphcmynf84rbdbj2ym2qkz24v8n0qx82zmqms"))))
 
 (define-public texlive-bin
   (package
    (name "texlive-bin")
-   (version "20170524")
+   (version "20180414")
    (source
     (origin
-     (method url-fetch)
-      (uri (string-append "ftp://tug.org/historic/systems/texlive/2017/"
+      (method url-fetch)
+      (uri (string-append "ftp://tug.org/historic/systems/texlive/2018/"
                           "texlive-" version "-source.tar.xz"))
+      (sha256
+       (base32
+        "0khyi6h015r2zfqgg0a44a2j7vmr1cy42knw7jbss237yvakc07y"))
       (patches
        (list
-        ;; This is required for compatibility with Poppler >= 0.58.
-        ;; See <http://tutex.tug.org/pipermail/tex-k/2017-September/002809.html>
-        ;; and <https://bugs.archlinux.org/task/55720> for some discussion.
+        ;; This is required for compatibility with Poppler 0.64.0 and to fix a
+        ;; segmentation fault in dvipdfm-x from XeTeX.
         (origin
           (method url-fetch)
-          (uri (string-append "https://git.archlinux.org/svntogit/packages.git/plain"
-                              "/trunk/texlive-poppler-0.59.patch?h=packages/texlive-bin"
-                              "&id=ba2de374e2b21ecc4b85cc9777f2f15c4d356c61"))
+          (uri (string-append "http://www.linuxfromscratch.org/patches/blfs/"
+                              "svn/texlive-" version "-source-upstream_fixes-1.patch"))
           (file-name "texlive-poppler-compat.patch")
           (sha256
            (base32
-            "1c4ikq4kxw48bi3i33bzpabrjvbk01fwjr2lz20gkc9kv8l0bg3n")))))
-      (sha256 (base32
-               "1amjrxyasplv4alfwcxwnw4nrx7dz2ydmddkq16k6hg90i9njq81"))))
+            "0f8vhyj167y4xj0jx47vkybrcacfpxw0wdn1b777yq3xmhlahhlg")))))))
    (build-system gnu-build-system)
    (inputs
     `(("texlive-extra-src" ,texlive-extra-src)
@@ -175,47 +174,62 @@
                   (not (or (string-prefix? "aarch64" s)
                            (string-prefix? "mips64" s))))
       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'configure-ghostscript-executable
-           ;; ps2eps.pl uses the "gswin32c" ghostscript executable on Windows,
-           ;; and the "gs" ghostscript executable on Unix. It detects Unix by
-           ;; checking for the existence of the /usr/bin directory. Since
-           ;; GuixSD does not have /usr/bin, it is also detected as Windows.
-           (lambda* (#:key inputs #:allow-other-keys)
-             (substitute* "utils/ps2eps/ps2eps-src/bin/ps2eps.pl"
-               (("gswin32c") "gs"))
-             (substitute* "texk/texlive/linked_scripts/epstopdf/epstopdf.pl"
-               (("\"gs\"")
-                (string-append "\"" (assoc-ref inputs "ghostscript") "/bin/gs\"")))
-             #t))
-         (add-after 'install 'postint
-           (lambda* (#:key inputs outputs #:allow-other-keys #:rest args)
-             (let* ((out (assoc-ref outputs "out"))
-                    (share (string-append out "/share"))
-                    (texlive-extra (assoc-ref inputs "texlive-extra-src"))
-                    (unpack (assoc-ref %standard-phases 'unpack))
-                    (patch-source-shebangs
-                      (assoc-ref %standard-phases 'patch-source-shebangs)))
-               ;; Create symbolic links for the latex variants and their
-               ;; man pages.
-               (with-directory-excursion (string-append out "/bin/")
-                 (for-each symlink
-                 '("pdftex" "pdftex"   "xetex"   "luatex")
-                 '("latex"  "pdflatex" "xelatex" "lualatex")))
-               (with-directory-excursion (string-append share "/man/man1/")
-                 (symlink "luatex.1" "lualatex.1"))
-               ;; Unpack texlive-extra and install tlpkg.
-               (mkdir "texlive-extra")
-               (with-directory-excursion "texlive-extra"
-                 (apply unpack (list #:source texlive-extra))
-                 (apply patch-source-shebangs (list #:source texlive-extra))
-                 (invoke "mv" "tlpkg" share))
-               ;; texlua shebangs are not patched by the patch-source-shebangs
-               ;; phase because the texlua executable does not exist at that
-               ;; time.
-               (setenv "PATH" (string-append (getenv "PATH") ":" out "/bin"))
-               (with-directory-excursion out
-                 (patch-source-shebangs))))))))
+      (modify-phases %standard-phases
+        (add-after 'unpack 'configure-ghostscript-executable
+          ;; ps2eps.pl uses the "gswin32c" ghostscript executable on Windows,
+          ;; and the "gs" ghostscript executable on Unix. It detects Unix by
+          ;; checking for the existence of the /usr/bin directory. Since
+          ;; GuixSD does not have /usr/bin, it is also detected as Windows.
+          (lambda* (#:key inputs #:allow-other-keys)
+            (substitute* "utils/ps2eps/ps2eps-src/bin/ps2eps.pl"
+              (("gswin32c") "gs"))
+            (substitute* "texk/texlive/linked_scripts/epstopdf/epstopdf.pl"
+              (("\"gs\"")
+               (string-append "\"" (assoc-ref inputs "ghostscript") "/bin/gs\"")))
+            #t))
+        (add-after 'unpack 'use-code-for-new-poppler
+          (lambda _
+            (copy-file "texk/web2c/pdftexdir/pdftoepdf-newpoppler.cc"
+                       "texk/web2c/pdftexdir/pdftoepdf.cc")
+            (copy-file "texk/web2c/pdftexdir/pdftosrc-newpoppler.cc"
+                       "texk/web2c/pdftexdir/pdftosrc.cc")
+            #t))
+        (add-after 'unpack 'disable-failing-test
+          (lambda _
+            ;; FIXME: This test fails on 32-bit architectures since Glibc 2.28:
+            ;; <https://bugzilla.redhat.com/show_bug.cgi?id=1631847>.
+            (substitute* "texk/web2c/omegafonts/check.test"
+              (("^\\./omfonts -ofm2opl \\$srcdir/tests/check tests/xcheck \\|\\| exit 1")
+               "./omfonts -ofm2opl $srcdir/tests/check tests/xcheck || exit 77"))
+            #t))
+        (add-after 'install 'postint
+          (lambda* (#:key inputs outputs #:allow-other-keys #:rest args)
+            (let* ((out (assoc-ref outputs "out"))
+                   (share (string-append out "/share"))
+                   (texlive-extra (assoc-ref inputs "texlive-extra-src"))
+                   (unpack (assoc-ref %standard-phases 'unpack))
+                   (patch-source-shebangs
+                    (assoc-ref %standard-phases 'patch-source-shebangs)))
+              ;; Create symbolic links for the latex variants and their
+              ;; man pages.
+              (with-directory-excursion (string-append out "/bin/")
+                (for-each symlink
+                          '("pdftex" "pdftex"   "xetex"   "luatex")
+                          '("latex"  "pdflatex" "xelatex" "lualatex")))
+              (with-directory-excursion (string-append share "/man/man1/")
+                (symlink "luatex.1" "lualatex.1"))
+              ;; Unpack texlive-extra and install tlpkg.
+              (mkdir "texlive-extra")
+              (with-directory-excursion "texlive-extra"
+                (apply unpack (list #:source texlive-extra))
+                (apply patch-source-shebangs (list #:source texlive-extra))
+                (invoke "mv" "tlpkg" share))
+              ;; texlua shebangs are not patched by the patch-source-shebangs
+              ;; phase because the texlua executable does not exist at that
+              ;; time.
+              (setenv "PATH" (string-append (getenv "PATH") ":" out "/bin"))
+              (with-directory-excursion out
+                (patch-source-shebangs))))))))
    (synopsis "TeX Live, a package of the TeX typesetting system")
    (description
     "TeX Live provides a comprehensive TeX document production system.
@@ -3995,7 +4009,7 @@ directly generate PDF documents instead of DVI.")
 (define texlive-texmf
   (package
    (name "texlive-texmf")
-   (version "2017")
+   (version "20180414")
    (source texlive-texmf-src)
    (build-system gnu-build-system)
    (inputs
@@ -4067,7 +4081,7 @@ This package contains the complete tree of texmf-dist data.")
 (define-public texlive
   (package
    (name "texlive")
-   (version "2017")
+   (version "20180414")
    (source #f)
    (build-system trivial-build-system)
    (inputs `(("bash" ,bash) ; for wrap-program
diff --git a/gnu/packages/texinfo.scm b/gnu/packages/texinfo.scm
index 109a24bf62..fa98bd56b8 100644
--- a/gnu/packages/texinfo.scm
+++ b/gnu/packages/texinfo.scm
@@ -37,6 +37,7 @@
               (method url-fetch)
               (uri (string-append "mirror://gnu/texinfo/texinfo-"
                                   version ".tar.xz"))
+              (patches (search-patches "texinfo-perl-compat.patch"))
               (sha256
                (base32
                 "0qjzvbvnv9003xdrcpi3jp7y68j4hq2ciw9frh2hghh698zlnxvp"))))
@@ -68,6 +69,7 @@ is on expressing the content semantically, avoiding physical markup commands.")
               (method url-fetch)
               (uri (string-append "mirror://gnu/texinfo/texinfo-"
                                   version ".tar.xz"))
+              (patches (search-patches "texinfo-5-perl-compat.patch"))
               (sha256
                (base32
                 "1njfwh2z34r2c4r0iqa7v24wmjzvsfyz4vplzry8ln3479lfywal"))))
diff --git a/gnu/packages/textutils.scm b/gnu/packages/textutils.scm
index e9a4ab3d68..cda79231f1 100644
--- a/gnu/packages/textutils.scm
+++ b/gnu/packages/textutils.scm
@@ -198,6 +198,11 @@ encoding, supporting Unicode version 9.0.0.")
        (sha256
         (base32 "0jiybkb2z58wa2msvllnphr4js2hvjvh988pavb3mzkgr6ihwbkr"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (replace 'bootstrap
+           (lambda _ (invoke "sh" "reconf"))))))
     (native-inputs
      `(("autoconf" ,autoconf)
        ("automake" ,automake)
diff --git a/gnu/packages/time.scm b/gnu/packages/time.scm
index 69aff5efaa..895cf6ac3b 100644
--- a/gnu/packages/time.scm
+++ b/gnu/packages/time.scm
@@ -88,17 +88,15 @@ to a file.")
 (define-public python-pytz
   (package
     (name "python-pytz")
-    (version "2017.3")
+    (version "2018.5")
     (source
      (origin
       (method url-fetch)
-      (uri (pypi-uri "pytz" version ".zip"))
+      (uri (pypi-uri "pytz" version ".tar.gz"))
       (sha256
        (base32
-        "1dw5l527vcafvdqq4wadwl7ikhb2sssz0v0cssibh8890kyczr7s"))))
+        "0xzj5gkpdn2da8m6j47chlp6zrzcypv9m0fjv4236q3jw4fyzfgz"))))
     (build-system python-build-system)
-    (native-inputs
-     `(("unzip" ,unzip)))
     (home-page "http://pythonhosted.org/pytz")
     (synopsis "Python timezone library")
     (description "This library brings the Olson tz database into Python.  It
@@ -143,15 +141,17 @@ Pendulum instances.")
 (define-public python-dateutil
   (package
     (name "python-dateutil")
-    (version "2.6.1")
+    (version "2.7.3")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "python-dateutil" version))
        (sha256
         (base32
-         "1jkahssf0ir5ssxc3ydbp8cpv77limn8d4s77szb2nrgl2r3h749"))))
+         "1f7h54lg0w2ckch7592xpjkh8dg87k2br256h0iw49zn6bg02w72"))))
     (build-system python-build-system)
+    (native-inputs
+     `(("python-setuptools-scm" ,python-setuptools-scm)))
     (propagated-inputs
      `(("python-six" ,python-six)))
     (home-page "https://dateutil.readthedocs.io/en/stable/")
@@ -159,7 +159,10 @@ Pendulum instances.")
     (description
      "The dateutil module provides powerful extensions to the standard
 datetime module, available in Python 2.3+.")
-    (license bsd-3)))
+    ;; The license was changed from the three-clause BSD license to a dual
+    ;; Apache 2.0/BSD-3 variant at 2017-12-01.  Some code is only available as
+    ;; BSD-3 still; but all new code is dual licensed (the user can choose).
+    (license (list bsd-3 asl2.0))))
 
 (define-public python2-dateutil
   (package-with-python2 python-dateutil))
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 2da4874e79..01c68d2e35 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -80,6 +80,8 @@
        (base32
         "1jlc1iahj8k3haz28j55nzg7sgni5h41vqy461i1bpbx6668wlky"))))
     (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags '("--disable-static")))
     (native-inputs `(("perl" ,perl)))
     (home-page "https://www.gnu.org/software/libtasn1/")
     (synopsis "ASN.1 library")
@@ -260,8 +262,7 @@ required structures.")
 (define-public openssl
   (package
    (name "openssl")
-   (replacement openssl/fixed)
-   (version "1.0.2o")
+   (version "1.0.2p")
    (source (origin
              (method url-fetch)
              (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -273,7 +274,7 @@ required structures.")
                                        "/" name "-" version ".tar.gz")))
              (sha256
               (base32
-               "0kcy13l701054nhpbd901mz32v1kn4g311z0nifd83xs2jbmqgzc"))
+               "003xh9f898i56344vpvpxxxzmikivxig4xwlm7vbi7m8n43qxaah"))
              (patches (search-patches "openssl-runpath.patch"
                                       "openssl-c-rehash-in.patch"))))
    (build-system gnu-build-system)
@@ -316,15 +317,7 @@ required structures.")
                      (string-append "--openssldir=" out
                                     "/share/openssl-" ,version)
 
-                     (string-append "--prefix=" out)
-
-                     ;; XXX FIXME: Work around a code generation bug in GCC
-                     ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
-                     ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
-                     ,@(if (and (not (%current-target-system))
-                                (string-prefix? "armhf" (%current-system)))
-                           '("-mfpu=vfpv3")
-                           '())))))
+                     (string-append "--prefix=" out)))))
         (add-after
          'install 'make-libraries-writable
          (lambda* (#:key outputs #:allow-other-keys)
@@ -397,15 +390,6 @@ required structures.")
    (license license:openssl)
    (home-page "https://www.openssl.org/")))
 
-(define openssl/fixed
-  (package
-    (inherit openssl)
-    (source (origin
-              (inherit (package-source openssl))
-              (patches (append (origin-patches (package-source openssl))
-                               (search-patches "openssl-1.0.2-CVE-2018-0495.patch"
-                                               "openssl-1.0.2-CVE-2018-0732.patch")))))))
-
 (define-public openssl-next
   (package
     (inherit openssl)
@@ -616,7 +600,7 @@ netcat implementation that supports TLS.")
      `(("python-nose" ,python-nose)
        ("python-mock" ,python-mock)
        ;; For documentation
-       ("python-sphinx" ,python-sphinx-1.6)
+       ("python-sphinx" ,python-sphinx)
        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
        ("python-sphinx-repoze-autointerface" ,python-sphinx-repoze-autointerface)
        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
diff --git a/gnu/packages/tv.scm b/gnu/packages/tv.scm
index ef67ad37f2..2196162956 100644
--- a/gnu/packages/tv.scm
+++ b/gnu/packages/tv.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015, 2016, 2017, 2018 Alex Kost <alezost@gmail.com>
+;;; Copyright © 208 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -43,6 +44,15 @@
                (base32
                 "1367rl3n6qxwf30lqyz234zpb43s9xjhig3hrvbg7cbqcl8g4fs0"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'fix-glibc-compatability
+           (lambda _
+             (substitute* "src/get_media_devices.c"
+               (("<sys/stat.h>")
+                "<sys/stat.h>\n#include <sys/sysmacros.h>"))
+             #t)))))
     (inputs
      `(("alsa-lib" ,alsa-lib)
        ("libx11" ,libx11)
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index c80e429ff1..fc6caf3ff8 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -1440,7 +1440,8 @@ YouTube.com and many more sites.")
                (("os\\.path\\.join\\('/usr', 'share'")
                 (string-append "os.path.join('"
                                (assoc-ref %outputs "out")
-                               "', 'share'"))))))))
+                               "', 'share'")))
+             #t)))))
     (inputs
      `(("python2-wxpython" ,python2-wxpython)
        ("youtube-dl" ,youtube-dl)))
@@ -1778,67 +1779,68 @@ for use with HTML5 video.")
        (add-before 'patch-source-shebangs 'unpack-ffmpeg
          (lambda _
            (with-directory-excursion "avidemux_core/ffmpeg_package"
-             (system* "tar" "xf" "ffmpeg-2.7.6.tar.bz2")
-             (delete-file "ffmpeg-2.7.6.tar.bz2"))))
+             (invoke "tar" "xf" "ffmpeg-2.7.6.tar.bz2")
+             (delete-file "ffmpeg-2.7.6.tar.bz2"))
+           #t))
        (add-after 'patch-source-shebangs 'repack-ffmpeg
          (lambda _
            (with-directory-excursion "avidemux_core/ffmpeg_package"
              (substitute* "ffmpeg-2.7.6/configure"
                (("#! /bin/sh") (string-append "#!" (which "sh"))))
-             (system* "tar" "cjf" "ffmpeg-2.7.6.tar.bz2" "ffmpeg-2.7.6"
-                      ;; avoid non-determinism in the archive
-                      "--sort=name" "--mtime=@0"
-                      "--owner=root:0" "--group=root:0")
-             (delete-file-recursively "ffmpeg-2.7.6"))))
+             (invoke "tar" "cjf" "ffmpeg-2.7.6.tar.bz2" "ffmpeg-2.7.6"
+                     ;; avoid non-determinism in the archive
+                     "--sort=name" "--mtime=@0"
+                     "--owner=root:0" "--group=root:0")
+             (delete-file-recursively "ffmpeg-2.7.6"))
+           #t))
        (replace 'configure
          (lambda _
            ;; Copy-paste settings from the cmake build system.
            (setenv "CMAKE_LIBRARY_PATH" (getenv "LIBRARY_PATH"))
-           (setenv "CMAKE_INCLUDE_PATH" (getenv "C_INCLUDE_PATH"))))
+           (setenv "CMAKE_INCLUDE_PATH" (getenv "C_INCLUDE_PATH"))
+           #t))
        (replace 'build
          (lambda* (#:key inputs outputs #:allow-other-keys)
-           (let*
-             ((out (assoc-ref outputs "out"))
-              (lib (string-append out "/lib"))
-              (top (getcwd))
-              (sdl (assoc-ref inputs "sdl"))
-              (build_component
-                (lambda* (component srcdir #:optional (args '()))
-                  (let ((builddir (string-append "build_" component)))
-                    (mkdir builddir)
-                    (with-directory-excursion builddir
-                      (zero?
-                        (and
-                          (apply system* "cmake"
-                                 "-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=TRUE"
-                                 (string-append "-DCMAKE_INSTALL_PREFIX=" out)
-                                 (string-append "-DCMAKE_INSTALL_RPATH=" lib)
-                                 (string-append "-DCMAKE_SHARED_LINKER_FLAGS="
-                                                "\"-Wl,-rpath=" lib "\"")
-                                 (string-append "-DAVIDEMUX_SOURCE_DIR=" top)
-                                 (string-append "-DSDL_INCLUDE_DIR="
-                                                sdl "/include/SDL")
-                                 (string-append "../" srcdir)
-                                 "-DENABLE_QT5=True"
-                                 args)
-                         (system* "make" "-j"
+           (let* ((out (assoc-ref outputs "out"))
+                  (lib (string-append out "/lib"))
+                  (top (getcwd))
+                  (sdl (assoc-ref inputs "sdl"))
+                  (build_component
+                   (lambda* (component srcdir #:optional (args '()))
+                     (let ((builddir (string-append "build_" component)))
+                       (mkdir builddir)
+                       (with-directory-excursion builddir
+                         (apply invoke "cmake"
+                                "-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=TRUE"
+                                (string-append "-DCMAKE_INSTALL_PREFIX=" out)
+                                (string-append "-DCMAKE_INSTALL_RPATH=" lib)
+                                (string-append "-DCMAKE_SHARED_LINKER_FLAGS="
+                                               "\"-Wl,-rpath=" lib "\"")
+                                (string-append "-DAVIDEMUX_SOURCE_DIR=" top)
+                                (string-append "-DSDL_INCLUDE_DIR="
+                                               sdl "/include/SDL")
+                                (string-append "../" srcdir)
+                                "-DENABLE_QT5=True"
+                                args)
+                         (invoke "make" "-j"
                                  (number->string (parallel-job-count)))
-                         (system* "make" "install"))))))))
+                         (invoke "make" "install"))))))
              (mkdir out)
-             (and (build_component "core" "avidemux_core")
-                  (build_component "cli" "avidemux/cli")
-                  (build_component "qt4" "avidemux/qt4")
-                  (build_component "plugins_common" "avidemux_plugins"
-                                  '("-DPLUGIN_UI=COMMON"))
-                  (build_component "plugins_cli" "avidemux_plugins"
-                                  '("-DPLUGIN_UI=CLI"))
-                  (build_component "plugins_qt4" "avidemux_plugins"
-                                  '("-DPLUGIN_UI=QT4"))
-                  (build_component "plugins_settings" "avidemux_plugins"
-                                  '("-DPLUGIN_UI=SETTINGS")))
+             (build_component "core" "avidemux_core")
+             (build_component "cli" "avidemux/cli")
+             (build_component "qt4" "avidemux/qt4")
+             (build_component "plugins_common" "avidemux_plugins"
+                              '("-DPLUGIN_UI=COMMON"))
+             (build_component "plugins_cli" "avidemux_plugins"
+                              '("-DPLUGIN_UI=CLI"))
+             (build_component "plugins_qt4" "avidemux_plugins"
+                              '("-DPLUGIN_UI=QT4"))
+             (build_component "plugins_settings" "avidemux_plugins"
+                              '("-DPLUGIN_UI=SETTINGS"))
              ;; Remove .exe and .dll file.
              (delete-file-recursively
-               (string-append out "/share/ADM6_addons")))))
+              (string-append out "/share/ADM6_addons"))
+             #t)))
        (delete 'install))))
     (home-page "http://fixounet.free.fr/avidemux/")
     (synopsis "Video editor")
@@ -1918,7 +1920,8 @@ format changes.")
           (lambda _
             (chdir "build/generic")
             (substitute* "configure"
-              (("#! /bin/sh") (string-append "#!" (which "sh")))))))
+              (("#! /bin/sh") (string-append "#!" (which "sh"))))
+            #t)))
        ;; No 'check' target.
        #:tests? #f))
     (home-page "https://www.xvid.com/")
@@ -1991,7 +1994,8 @@ from sites like Twitch.tv and pipes them into a video player of choice.")
              (lambda* (#:key outputs #:allow-other-keys)
                (install-file "plugins/rofi-twitchy"
                              (string-append (assoc-ref outputs "out")
-                                            "/bin")))))))
+                                            "/bin"))
+               #t)))))
       (inputs
        `(("python-requests" ,python-requests)
          ("streamlink" ,streamlink)))
@@ -2825,7 +2829,8 @@ programmers to access a standard API to open and decompress media files.")
               (sha256
                (base32
                 "11b83qazc8h0iidyj1rprnnjdivj1lpphvpa08y53n42bfa36pn5"))
-              (patches (search-patches "aegisub-icu59-include-unistr.patch"))))
+              (patches (search-patches "aegisub-icu59-include-unistr.patch"
+                                       "aegisub-boost68.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 6b6a1cf9fa..750b760362 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -509,7 +509,7 @@ libraries for working with JNLP applets.")
 (define-public jansson
   (package
     (name "jansson")
-    (version "2.10")
+    (version "2.11")
     (source (origin
              (method url-fetch)
              (uri
@@ -517,7 +517,7 @@ libraries for working with JNLP applets.")
                              version ".tar.gz"))
              (sha256
               (base32
-               "0iv4rxsnamqm3ldpg7dyhjq0x9cp023nc7ac820jdd3pwb8ml8bq"))))
+               "1x5jllzzqamq6kahx9d9a5mrarm9m3f30vfxvcqpi6p4mcnz91bf"))))
     (build-system gnu-build-system)
     (home-page "http://www.digip.org/jansson/")
     (synopsis "JSON C library")
@@ -5803,6 +5803,7 @@ Instagram and YouTube.")
        (uri (git-reference
              (url "https://github.com/linkchecker/linkchecker")
              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
        (sha256
         (base32
          "03ihjmc4bqxxqv71bb43r2f23sx0xnbq1k2fsg9fw05qa5s9x187"))))
@@ -6693,7 +6694,7 @@ derivation by David Revoy from the original MonsterID by Andreas Gohr.")
 (define-public nghttp2
   (package
     (name "nghttp2")
-    (version "1.31.1")
+    (version "1.32.0")
     (source
      (origin
        (method url-fetch)
@@ -6702,7 +6703,7 @@ derivation by David Revoy from the original MonsterID by Andreas Gohr.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "00z1687m4wi2gbgkijbv099l9hs1sjlyzbhh8jhn0xssx4xcifb5"))))
+         "0zbgp8f80h2zlfn8cd2ldrmgl81jzcdh1141n71aqmfckzaqj2kh"))))
     (build-system gnu-build-system)
     (outputs (list "out"
                    "lib"))              ; only libnghttp2
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index 257b39609b..82ed065a3f 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -158,14 +158,14 @@ avoiding password prompts when X11 forwarding has already been setup.")
 (define-public libxkbcommon
   (package
     (name "libxkbcommon")
-    (version "0.8.0")
+    (version "0.8.2")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://xkbcommon.org/download/" name "-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0vgy84vfbig5bqznr137h5arjidnfwrxrdli0pxyn2jfn1fjcag8"))))
+               "136mdq11lrwg6rjmm44lmysxxgb9c35p4sq6k0cd129x82rw9f3s"))))
     (build-system gnu-build-system)
     (inputs
      `(("libx11" ,libx11)
@@ -244,7 +244,8 @@ X11 (yet).")
                (mkdir-p (string-append out "/lib"))
                (setenv "PREFIX" out)
                (setenv "LDFLAGS" (string-append "-Wl,-rpath=" out "/lib"))
-               (setenv "CC" "gcc")))))))
+               (setenv "CC" "gcc")
+               #t))))))
     (native-inputs `(("perl" ,perl))) ; for pod2man
     (inputs `(("libx11" ,libx11)
               ("libxext" ,libxext)
@@ -317,7 +318,7 @@ rasterisation.")
 (define-public libdrm
   (package
     (name "libdrm")
-    (version "2.4.92")
+    (version "2.4.93")
     (source
       (origin
         (method url-fetch)
@@ -327,7 +328,7 @@ rasterisation.")
                ".tar.bz2"))
         (sha256
          (base32
-          "1yirzx8hmlvv6r0l7lb3zxmgy5la2mri9al0k16xqfg19pdqzr79"))
+          "0g6d9wsnb7lx8r1m4kq8js0wsc5jl20cz1csnlh6z9s8jpfd313f"))
         (patches (search-patches "libdrm-symbol-check.patch"))))
     (build-system gnu-build-system)
     (arguments
@@ -478,7 +479,7 @@ move windows, switch between desktops, etc.).")
                     (doc (string-append out "/share/doc/scrot")))
                (mkdir-p doc)
                (invoke "make" "install"
-                        (string-append "docsdir=" doc))))))))
+                       (string-append "docsdir=" doc))))))))
     (inputs
      `(("libx11" ,libx11)
        ("giblib" ,giblib)))
@@ -1005,7 +1006,8 @@ color temperature should be set to match the lamps in your room.")
            (lambda _
              (substitute* '("driver/Makefile.in" "po/Makefile.in.in")
                (("@GTK_DATADIR@") "@datadir@")
-               (("@PO_DATADIR@") "@datadir@")))))
+               (("@PO_DATADIR@") "@datadir@"))
+             #t)))
        #:configure-flags '("--with-pam" "--with-proc-interrupts"
                            "--without-readdisplay")
        #:make-flags (list (string-append "AD_DIR="
@@ -1165,7 +1167,8 @@ by name.")
          (add-after 'unpack 'fix-installation-prefix
            (lambda _
              (substitute* "CMakeLists.txt"
-               (("/etc") "${CMAKE_INSTALL_PREFIX}/etc")))))))
+               (("/etc") "${CMAKE_INSTALL_PREFIX}/etc"))
+             #t)))))
     (inputs
      `(("gtk+" ,gtk+-2)
        ("imlib2" ,imlib2)
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index 347ac878a3..3ac01133e5 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -66,14 +66,14 @@
 (define-public expat
   (package
     (name "expat")
-    (version "2.2.5")
+    (version "2.2.6")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/expat/expat/"
                                  version "/expat-" version ".tar.bz2"))
              (sha256
               (base32
-               "1xpd78sp7m34jqrw5x13bz7kgz0n6aj15wn4zj4gfx3ypbpk5p6r"))))
+               "1wl1x93b5w457ddsdgj0lh7yjq4q6l7wfbgwhagkc8fm2qkkrd0p"))))
     (build-system gnu-build-system)
     (home-page "https://libexpat.github.io/")
     (synopsis "Stream-oriented XML parser library written in C")
@@ -131,8 +131,23 @@ hierarchical form with variable field lengths.")
               (base32
                "0ci7is75bwqqw2p32vxvrk6ds51ik7qgx73m920rakv5jlayax0b"))))
     (build-system gnu-build-system)
+    (outputs '("out" "static"))
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (add-after 'install 'move-static-libs
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (let ((src (string-append (assoc-ref outputs "out") "/lib"))
+                            (dst (string-append (assoc-ref outputs "static")
+                                                "/lib")))
+                        (mkdir-p dst)
+                        (for-each (lambda (ar)
+                                    (rename-file ar (string-append dst "/"
+                                                                   (basename ar))))
+                                  (find-files src "\\.a$"))
+                        #t))))))
     (home-page "http://www.xmlsoft.org/")
     (synopsis "C parser for XML")
+    (inputs `(("xz" ,xz)))
     (propagated-inputs `(("zlib" ,zlib))) ; libxml2.la says '-lz'.
     (native-inputs `(("perl" ,perl)))
     ;; $XML_CATALOG_FILES lists 'catalog.xml' files found in under the 'xml'
@@ -153,6 +168,7 @@ project (but it is usable outside of the Gnome platform).")
   (package/inherit libxml2
     (name "python-libxml2")
     (build-system python-build-system)
+    (outputs '("out"))
     (arguments
      `(;; XXX: Tests are specified in 'Makefile.am', but not in 'setup.py'.
        #:tests? #f
@@ -171,7 +187,8 @@ project (but it is usable outside of the Gnome platform).")
                  (format #f "ROOT = r'~a'" libxml2))
                 ;; For 'iconv.h'.
                 (("/opt/include")
-                 (string-append glibc "/include")))))))))
+                 (string-append glibc "/include"))))
+            #t)))))
     (inputs `(("libxml2" ,libxml2)))
     (synopsis "Python bindings for the libxml2 library")))
 
@@ -536,7 +553,8 @@ that allow you to generate HTML from an RSS, convert between 0.9, 0.91, and
                      (setenv "PERL5LIB"
                              (string-append (getenv "PERL5LIB") ":"
                                             (assoc-ref outputs "out")
-                                            "/lib/perl5/site_perl")))))))
+                                            "/lib/perl5/site_perl"))
+                     #t)))))
     (home-page "https://metacpan.org/release/XML-SAX")
     (synopsis "Perl API for XML")
     (description "XML::SAX consists of several framework classes for using and
@@ -1204,7 +1222,7 @@ elements to their parents
              (substitute* "test/run"
                ;; Run tests with `python' only
                (("^(PYTHON_VERSIONS = ).*" all m) (string-append m "['']")))
-             (zero? (system* "test/run")))))))
+             (invoke "test/run"))))))
     (home-page "https://github.com/dilshod/xlsx2csv")
     (synopsis "XLSX to CSV converter")
     (description
@@ -1253,7 +1271,7 @@ files.  It is designed to be fast and to handle large input files.")
          ;; Bootstrapping is required in order to fix the test driver script.
          (replace 'bootstrap
            (lambda _
-             (zero? (system* "bash" "bootstrap")))))))
+             (invoke "bash" "bootstrap"))))))
     (native-inputs
      `(("unzip" ,unzip)
        ("autoconf" ,autoconf)
@@ -1854,7 +1872,8 @@ low memory footprint.")
        (modify-phases %standard-phases
          (add-before 'build 'copy-resources
            (lambda _
-             (copy-recursively "src/main/resources" "build/classes"))))))
+             (copy-recursively "src/main/resources" "build/classes")
+             #t)))))
     (inputs
      `(("java-xpp3" ,java-xpp3)))
     (native-inputs
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 1b54296dc1..9aa65291b9 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -3829,7 +3829,7 @@ extension to the X11 protocol.  It includes:
 (define-public xkeyboard-config
   (package
     (name "xkeyboard-config")
-    (version "2.23.1")
+    (version "2.24")
     (source
       (origin
         (method url-fetch)
@@ -3839,7 +3839,7 @@ extension to the X11 protocol.  It includes:
               ".tar.bz2"))
         (sha256
           (base32
-            "1wq27cs1c9y7d1d7zp5yhq29paj9smajdb68lyvm28d2zq2vqjra"))))
+            "1my4786pd7iv5x392r9skj3qclmbd26nqzvh2fllwkkbyj08bcci"))))
     (build-system gnu-build-system)
     (inputs
       `(("gettext" ,gettext-minimal)
@@ -5193,21 +5193,10 @@ draggable titlebars and borders.")
 ;; This package is intended to be used when building GTK+.
 ;; Note: It's currently marked as "hidden" to avoid having two non-eq?
 ;; packages with the same name and version.
-(define-public xorg-server-1.19.3
+(define-public xorg-server-for-tests
   (hidden-package
    (package
-     (inherit xorg-server)
-     (name "xorg-server")
-     (version "1.19.3")
-     (source
-      (origin
-        (method url-fetch)
-        (uri (string-append
-              "mirror://xorg/individual/xserver/"
-              name "-" version ".tar.bz2"))
-        (sha256
-         (base32
-          "162s1v901djr57gxmmk4airk8hiwcz79dqyz72972x1lw1k82yk7")))))))
+     (inherit xorg-server))))
 
 (define-public xorg-server-xwayland
   (package
@@ -5233,8 +5222,7 @@ draggable titlebars and borders.")
 (define-public libx11
   (package
     (name "libx11")
-    (version "1.6.5")
-    (replacement libx11-1.6.6)
+    (version "1.6.6")
     (source
       (origin
         (method url-fetch)
@@ -5244,7 +5232,7 @@ draggable titlebars and borders.")
                ".tar.bz2"))
         (sha256
           (base32
-            "0pa3cfp6h9rl2vxmkph65250gfqyki0ccqyaan6bl9d25gdr0f2d"))))
+            "0ks1mxlda7nxfmffihi15ljsn50q8dknl33i2xag8xzc80fiizk5"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc"))                            ;8 MiB of man pages + XML
@@ -5264,20 +5252,6 @@ draggable titlebars and borders.")
     (description "Xorg Core X11 protocol client library.")
     (license license:x11)))
 
-;; Replacement package to fix multiple security bugs:
-;; <http://seclists.org/oss-sec/2018/q3/146>.
-(define-public libx11-1.6.6
-  (package
-    (inherit libx11)
-    (version "1.6.6")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://xorg/individual/lib/libX11-"
-                                  version ".tar.bz2"))
-              (sha256
-               (base32
-                "0ks1mxlda7nxfmffihi15ljsn50q8dknl33i2xag8xzc80fiizk5"))))))
-
 ;; packages of height 5 in the propagated-inputs tree
 
 (define-public libxcursor
@@ -5965,7 +5939,7 @@ Conventions Manual) and some of the @dfn{EWMH}
                   (add-after 'unpack 'autogen
                               (lambda _
                                 (setenv "NOCONFIGURE" "t")
-                                (zero? (system* "sh" "autogen.sh")))))))
+                                (invoke "sh" "autogen.sh"))))))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("autoconf" ,autoconf)