Merge branch 'staging'

21 files changed, 109 insertions, 182 deletions

diff --git a/gnu/local.mk b/gnu/local.mk
index b7fa503257..b40cb1247b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1164,7 +1164,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/mcrypt-CVE-2012-4527.patch			\
   %D%/packages/patches/mes-remove-store-name.patch		\
   %D%/packages/patches/mesa-skip-disk-cache-test.patch		\
-  %D%/packages/patches/mesa-timespec-test-32bit.patch		\
   %D%/packages/patches/mescc-tools-boot.patch			\
   %D%/packages/patches/meson-for-build-rpath.patch		\
   %D%/packages/patches/metabat-fix-compilation.patch		\
@@ -1206,7 +1205,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/ngircd-handle-zombies.patch		\
   %D%/packages/patches/nm-plugin-path.patch			\
   %D%/packages/patches/nsis-env-passthru.patch			\
-  %D%/packages/patches/nss-CVE-2019-11745.patch			\
   %D%/packages/patches/nss-freebl-stubs.patch			\
   %D%/packages/patches/nss-increase-test-timeout.patch		\
   %D%/packages/patches/nss-pkgconfig.patch			\
@@ -1240,7 +1238,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/openssl-c-rehash-in.patch		\
   %D%/packages/patches/openssl-CVE-2019-1559.patch		\
   %D%/packages/patches/open-zwave-hidapi.patch			\
-  %D%/packages/patches/orc-typedef-enum.patch			\
   %D%/packages/patches/orpheus-cast-errors-and-includes.patch	\
   %D%/packages/patches/osip-CVE-2017-7853.patch			\
   %D%/packages/patches/ots-no-include-missing-file.patch	\
@@ -1251,7 +1248,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/pam-mount-luks2-support.patch		\
   %D%/packages/patches/patchutils-test-perms.patch		\
   %D%/packages/patches/patch-hurd-path-max.patch		\
-  %D%/packages/patches/pcre2-fix-jit_match-crash.patch		\
   %D%/packages/patches/perl-autosplit-default-time.patch	\
   %D%/packages/patches/perl-deterministic-ordering.patch	\
   %D%/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \
diff --git a/gnu/packages/check.scm b/gnu/packages/check.scm
index 77e78520fa..9de658e790 100644
--- a/gnu/packages/check.scm
+++ b/gnu/packages/check.scm
@@ -78,7 +78,7 @@
 (define-public check
   (package
     (name "check")
-    (version "0.12.0")
+    (version "0.13.0")
     (source
      (origin
       (method url-fetch)
@@ -86,7 +86,7 @@
                           version "/check-" version ".tar.gz"))
       (sha256
        (base32
-        "0d22h8xshmbpl9hba9ch3xj8vb9ybm5akpsbbh7yj07fic4h2hj6"))))
+        "02crar51gniijrrl9p8f9maibnwc33n76kw5cqr7xk3s8hqnncy4"))))
     (build-system gnu-build-system)
     (home-page "https://libcheck.github.io/check/")
     (synopsis "Unit test framework for C")
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index 0f048bb682..8f3cdf6211 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -58,7 +58,7 @@
 (define-public cups-filters
   (package
     (name "cups-filters")
-    (version "1.25.11")
+    (version "1.25.13")
     (source(origin
               (method url-fetch)
               (uri
@@ -66,7 +66,7 @@
                               "cups-filters-" version ".tar.xz"))
               (sha256
                (base32
-                "0ni8krr4rf5833livn9401cd41gspjvxj0iiqnc1rfg3x90i0fxh"))
+                "1z3b7p6pp6yzvzl2nip9q0gn4fr5k9qwpnnhqqkiaaf3b1nfswjj"))
               (modules '((guix build utils)))
               (snippet
                ;; install backends, banners and filters to cups-filters output
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 393dbee6d0..32c57f3607 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -687,7 +687,7 @@ Language.")
 (define-public mariadb
   (package
     (name "mariadb")
-    (version "10.1.41")
+    (version "10.1.43")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://downloads.mariadb.com/MariaDB"
@@ -695,7 +695,7 @@ Language.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1wh0073lqw3d9xs150bf2q3qvjwa6886mfi9khmsn7p8vapw6irb"))
+                "1pxyq37q4p7515by7k8hs3l3css68f3bm3akx99vw4m1rxwwbm63"))
               (patches (search-patches "mariadb-client-test-32bit.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -816,6 +816,12 @@ Language.")
                          disabled-tests)
                (close-port unstable-tests)
 
+               ;; XXX: This test fails because it expects a latin1 charset and
+               ;; collation.  See <https://jira.mariadb.org/browse/MDEV-21264>.
+               (substitute* "mysql-test/r/gis_notembedded.result"
+                 (("latin1_swedish_ci") "utf8_general_ci")
+                 (("\tlatin1") "\tutf8"))
+
                (substitute* "mysql-test/mysql-test-run.pl"
                  (("/bin/ls") (which "ls"))
                  (("/bin/sh") (which "sh")))
@@ -846,10 +852,11 @@ Language.")
              #t))
          (add-after
           'install 'post-install
-          (lambda* (#:key outputs #:allow-other-keys)
+          (lambda* (#:key inputs outputs #:allow-other-keys)
             (let* ((out     (assoc-ref outputs "out"))
                    (dev     (assoc-ref outputs "dev"))
-                   (lib     (assoc-ref outputs "lib")))
+                   (lib     (assoc-ref outputs "lib"))
+                   (openssl (assoc-ref inputs "openssl")))
               (substitute* (string-append out "/bin/mysql_install_db")
                 (("basedir=\"\"")
                  (string-append "basedir=\"" out "\"")))
@@ -871,6 +878,14 @@ Language.")
                            (string-append dev "/share/pkgconfig"))
               (rename-file (string-append out "/bin/mysql_config")
                            (string-append dev "/bin/mysql_config"))
+
+              ;; Embed an absolute reference to OpenSSL in mysql_config
+              ;; and the pkg-config file to avoid propagation.
+              (substitute* (list (string-append dev "/bin/mysql_config")
+                                 (string-append dev "/share/pkgconfig/mariadb.pc"))
+                (("-lssl -lcrypto" all)
+                 (string-append "-L" openssl "/lib " all)))
+
               #t))))))
     (native-inputs
      `(("bison" ,bison)
@@ -884,12 +899,11 @@ Language.")
        ("libaio" ,libaio)
        ("libxml2" ,libxml2)
        ("ncurses" ,ncurses)
+       ("openssl" ,openssl-1.0)
+       ("pam" ,linux-pam)
        ("pcre" ,pcre)
        ("xz" ,xz)
        ("zlib" ,zlib)))
-    (propagated-inputs
-     ;; mariadb.pc says -lssl -lcrypto, so propagate it.
-     `(("openssl" ,openssl-1.0)))
     ;; The test suite is very resource intensive and can take more than three
     ;; hours on a x86_64 system.  Give slow and busy machines some leeway.
     (properties '((timeout . 64800)))        ;18 hours
@@ -931,14 +945,14 @@ as a drop-in replacement of MySQL.")
 (define-public postgresql
   (package
     (name "postgresql")
-    (version "10.10")
+    (version "10.11")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://ftp.postgresql.org/pub/source/v"
                                   version "/postgresql-" version ".tar.bz2"))
               (sha256
                (base32
-                "0lzj46dwd9cw94gnqm36bxd7jlhfdyqjrfzr3c4xd3prfn2rnkxd"))
+                "02fcmvbh0mhplj3s2jd24s642ysx7bggnf0h8bs5amh7dgzi8p8d"))
               (patches (search-patches "postgresql-disable-resolve_symlinks.patch"))))
     (build-system gnu-build-system)
     (arguments
diff --git a/gnu/packages/freedesktop.scm b/gnu/packages/freedesktop.scm
index a26cbea542..7066685dee 100644
--- a/gnu/packages/freedesktop.scm
+++ b/gnu/packages/freedesktop.scm
@@ -155,14 +155,14 @@ freedesktop.org project.")
 (define-public libinput
   (package
     (name "libinput")
-    (version "1.14.1")
+    (version "1.14.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://freedesktop.org/software/libinput/"
                                   "libinput-" version ".tar.xz"))
               (sha256
                (base32
-                "0w7fas37mp2k06f12i3lnj717lw73asziknj6z51kh1m50ja6cz3"))))
+                "1dy58j8dvr7ri34bx0lppmh5638m956azgwk501w373hi42kmsqg"))))
     (build-system meson-build-system)
     (arguments
      `(#:configure-flags '("-Ddocumentation=false")
diff --git a/gnu/packages/gl.scm b/gnu/packages/gl.scm
index 194e141faf..077b009688 100644
--- a/gnu/packages/gl.scm
+++ b/gnu/packages/gl.scm
@@ -230,7 +230,7 @@ also known as DXTn or DXTC) for Mesa.")
 (define-public mesa
   (package
     (name "mesa")
-    (version "19.2.1")
+    (version "19.2.7")
     (source
       (origin
         (method url-fetch)
@@ -242,10 +242,9 @@ also known as DXTn or DXTC) for Mesa.")
                                   version "/mesa-" version ".tar.xz")))
         (sha256
          (base32
-          "1s81kwcjkkahnf5y5mshmd3q9j057hhsai7awpq6yb6im2hkriac"))
+          "17jp8ghipgz62vqqz5llskxypkcmgf8gnlgnj0pyvnbgi6vryyg3"))
         (patches
-         (search-patches "mesa-skip-disk-cache-test.patch"
-                         "mesa-timespec-test-32bit.patch"))))
+         (search-patches "mesa-skip-disk-cache-test.patch"))))
     (build-system meson-build-system)
     (propagated-inputs
       `(;; The following are in the Requires.private field of gl.pc.
@@ -605,7 +604,7 @@ OpenGL graphics API.")
 (define-public libepoxy
   (package
     (name "libepoxy")
-    (version "1.5.3")
+    (version "1.5.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -613,7 +612,7 @@ OpenGL graphics API.")
                     version "/libepoxy-" version ".tar.xz"))
               (sha256
                (base32
-                "0ga3qjv50x37my6pw5xr14g5n6z78hy5s8s06kays8c3ab2mha80"))))
+                "1ll9fach4v30dsyd47s5ial4gaiwihzr2afb77vxxzzy3mlcrlhb"))))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm
index 51b9d8f11c..323e3ccfee 100644
--- a/gnu/packages/gstreamer.scm
+++ b/gnu/packages/gstreamer.scm
@@ -69,15 +69,14 @@
 (define-public orc
   (package
     (name "orc")
-    (version "0.4.30")
+    (version "0.4.31")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gstreamer.freedesktop.org/data/src/"
                                   "orc/orc-" version ".tar.xz"))
-              (patches (search-patches "orc-typedef-enum.patch"))
               (sha256
                (base32
-                "0wj93im7i8a6546q2r8sp39yjfbxflkc0ygb0b8iqsd58qhvjhds"))))
+                "0xb0c7q3xv1ldmz5ipybazb01gy3cijj8622dcx7rbm9lq85zax0"))))
     (build-system meson-build-system)
     (arguments
      `(#:phases
@@ -107,7 +106,7 @@ arrays of data.")
 (define-public gstreamer
   (package
     (name "gstreamer")
-    (version "1.16.1")
+    (version "1.16.2")
     (source
      (origin
       (method url-fetch)
@@ -116,7 +115,7 @@ arrays of data.")
             version ".tar.xz"))
       (sha256
        (base32
-        "0z9pyhf6zm1r0spw6zym80bvbyx6h8xg9h6535csbnn48ws1q882"))))
+        "0kp93622y29pck8asvil1fmzf55s2gx76wv475a6izc3cwj49w73"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -155,7 +154,7 @@ This package provides the core library and elements.")
 (define-public gst-plugins-base
   (package
     (name "gst-plugins-base")
-    (version "1.16.1")
+    (version "1.16.2")
     (source
      (origin
       (method url-fetch)
@@ -163,7 +162,7 @@ This package provides the core library and elements.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0aybbwnzm15074smdk2bamj3ssck3hjvmilvgh49f19xjf4w8g2w"))))
+        "0sl1hxlyq46r02k7z70v09vx1gi4rcypqmzra9jid93lzvi76gmi"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (propagated-inputs
@@ -214,7 +213,7 @@ for the GStreamer multimedia library.")
 (define-public gst-plugins-good
   (package
     (name "gst-plugins-good")
-    (version "1.16.1")
+    (version "1.16.2")
     (source
      (origin
       (method url-fetch)
@@ -223,7 +222,7 @@ for the GStreamer multimedia library.")
             name "-" version ".tar.xz"))
       (sha256
        (base32
-        "07wgz9anf4ram2snp8n1wv6l0q3pd00iaw8bvw3wgklg05lvxflz"))))
+        "068k3cbv1yf3gbllfdzqsg263kzwh21y8dpwr0wvgh15vapkpfs0"))))
     (build-system gnu-build-system)
     (inputs
      `(("aalib" ,aalib)
@@ -277,23 +276,18 @@ developers consider to have good quality code and correct functionality.")
 (define-public gst-plugins-bad
   (package
     (name "gst-plugins-bad")
-    (version "1.16.1")
+    (version "1.16.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gstreamer.freedesktop.org/src/"
                                   name "/" name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1dddqacxgp77f3nl153x5a6139wdphc9phds2fpqb2cv6faiqj2n"))))
+                "0x0y0hm0ga3zqi5q4090hw5sjh59y1ry9ak16qsaascm72i7mjzi"))))
     (outputs '("out" "doc"))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f ; XXX: 13 of 53 tests fail
-
-       ;; FIXME: OpenEXR 2.4.0 requires C++ 11 or later.  Remove when the
-       ;; default compiler is >= GCC 5.
-       #:make-flags '("CXXFLAGS=-std=gnu++11")
-
        #:configure-flags
        (list (string-append "--with-html-dir="
                             (assoc-ref %outputs "doc")
@@ -357,7 +351,7 @@ par compared to the rest.")
 (define-public gst-plugins-ugly
   (package
     (name "gst-plugins-ugly")
-    (version "1.16.1")
+    (version "1.16.2")
     (source
      (origin
        (method url-fetch)
@@ -365,7 +359,7 @@ par compared to the rest.")
                            name "/" name "-" version ".tar.xz"))
        (sha256
         (base32
-         "07cajqjs8pqchpf2sm87hljx4ibwvkiavqxmacxsr5airar17yab"))))
+         "1jpvc32x6q01zjkfgh6gmq6aaikiyfwwnhj7bmvn52syhrdl202m"))))
     (build-system gnu-build-system)
     (inputs
      `(("gst-plugins-base" ,gst-plugins-base)
@@ -392,7 +386,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
 (define-public gst-libav
   (package
     (name "gst-libav")
-    (version "1.16.1")
+    (version "1.16.2")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -400,7 +394,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1i31ra0l77cfahb6k5xpx45zwvpskzm848aijsbbx9x4x65799g8"))
+                "1wpfilc98bad9nsv3y1qapxp35dvn2mvwvrmqwrsj58cf09gc967"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -428,7 +422,7 @@ compression formats through the use of the libav library.")
 (define-public python-gst
   (package
     (name "python-gst")
-    (version "1.16.1")
+    (version "1.16.2")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -436,7 +430,7 @@ compression formats through the use of the libav library.")
                     "gst-python-" version ".tar.xz"))
               (sha256
                (base32
-                "12bl6kc0ny2vyf6klas2bwqcv0pi55q9ns5zw261px16a6awhsdl"))))
+                "1a48ca66izmm8hnp608jv5isg3jxb0vlfmhns0bg9nbkilag7390"))))
     (build-system gnu-build-system)
     (arguments
      `(#:modules ((guix build gnu-build-system)
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 777601ed97..db88c84413 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -89,7 +89,7 @@
 (define-public atk
   (package
    (name "atk")
-   (version "2.32.0")
+   (version "2.34.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -97,7 +97,7 @@
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1k4i817bd2w5b9z394f2yyx95591l2746wa40am0vvz4gzdgwhfb"))))
+              "1jwp16r6p5z66k4b2v8zlzhyshhwlmyi27ippkrgqr8jsary7w6l"))))
    (build-system meson-build-system)
    (propagated-inputs `(("glib" ,glib))) ; required by atk.pc
    (native-inputs
@@ -552,7 +552,7 @@ in the GNOME project.")
 (define-public at-spi2-core
   (package
    (name "at-spi2-core")
-   (version "2.32.1")
+   (version "2.34.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -560,7 +560,7 @@ in the GNOME project.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0lqd7gsl471v6538iighkvb21gjglcb9pklvas32rjpsxcvsjaiw"))))
+              "1ihixwhh3c16q6253qj9gf69741rb2pi51822a4rylsfcyywsafn"))))
    (build-system meson-build-system)
    (outputs '("out" "doc"))
    (arguments
@@ -621,7 +621,7 @@ is part of the GNOME accessibility project.")
 (define-public at-spi2-atk
   (package
    (name "at-spi2-atk")
-   (version "2.32.0")
+   (version "2.34.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -629,7 +629,7 @@ is part of the GNOME accessibility project.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0p54wx6f6q7s8w0b1j0sgw87pikllp79q5g3lfiwqazs779ycl8b"))))
+              "05ncp7s5nddjinffs26mcvpbd63vk1m3cv5y530p3plgfhqgjvbp"))))
    (build-system meson-build-system)
    (arguments
     '(#:phases
@@ -722,7 +722,7 @@ application suites.")
 (define-public gtk+
   (package (inherit gtk+-2)
    (name "gtk+")
-   (version "3.24.12")
+   (version "3.24.13")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -730,7 +730,7 @@ application suites.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "10xyyhlfb0yk4hglngxh2zsv9xrxkqv343df8h01dvagc6jyp10k"))
+              "1a9hi7k59q0kqx0n3xhsk1ly23w9g9ncllnay1756g0yrww5qxsc"))
             (patches (search-patches "gtk3-respect-GUIX_GTK3_PATH.patch"
                                      "gtk3-respect-GUIX_GTK3_IM_MODULE_FILE.patch"))))
    (outputs '("out" "bin" "doc"))
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index e07ab15aec..a518b69b8e 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1128,7 +1128,8 @@ language bindings to VIGRA.")
     (arguments
      '(#:configure-flags '("--enable-libwebpmux"
                            "--enable-libwebpdemux"
-                           "--enable-libwebpdecoder")))
+                           "--enable-libwebpdecoder"
+                           "--disable-static")))
     (home-page "https://developers.google.com/speed/webp/")
     (synopsis "Lossless and lossy image compression")
     (description
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index b8189c8ca8..e6a178713a 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -48,14 +48,14 @@
     ;; The 7 release series has an incompatible API, while the 6 series is still
     ;; maintained. Don't update to 7 until we've made sure that the ImageMagick
     ;; users are ready for the 7-series API.
-    (version "6.9.10-68")
+    (version "6.9.10-78")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1jxjxhnvznpbdigry2cgxx94cx6k6y3rs40a464n5yln29s1qlz1"))))
+               "178sai7r0w2hwv01is25c8mxf9lc2ba0l16qm45h9vv49y5dy08q"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--with-frozenpaths" "--without-gcc-arch")
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 21ebff1ab3..501a010b25 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -1540,7 +1540,7 @@ intercept and print the system calls executed by the program.")
 (define-public alsa-lib
   (package
     (name "alsa-lib")
-    (version "1.1.9")
+    (version "1.2.1.2")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -1548,8 +1548,12 @@ intercept and print the system calls executed by the program.")
                    version ".tar.bz2"))
              (sha256
               (base32
-               "0jwr9g4yxg9gj6xx0sb2r6wrdl8amrjd19hilkrq4rirynp770s8"))))
+               "0hvrx0ipzqbcx4y1cmr9bgm9niifzkrhsb1ddgzzdwbk6q72d3lm"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:configure-flags (list (string-append "LDFLAGS=-Wl,-rpath="
+                                              (assoc-ref %outputs "out")
+                                              "/lib"))))
     (home-page "https://www.alsa-project.org/")
     (synopsis "The Advanced Linux Sound Architecture libraries")
     (description
@@ -1560,14 +1564,14 @@ MIDI functionality to the Linux-based operating system.")
 (define-public alsa-utils
   (package
     (name "alsa-utils")
-    (version "1.1.9")
+    (version "1.2.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp.alsa-project.org/pub/utils/"
                                  name "-" version ".tar.bz2"))
              (sha256
               (base32
-               "0fi11b7r8hg1bdjw74s8sqx8rc4qb310jaj9lsia9labvfyjrpsx"))))
+               "039c19b7091is0czl9jlrfczp7pp1jpdri0vvc4k07gl3skhn48b"))))
     (build-system gnu-build-system)
     (arguments
      ;; XXX: Disable man page creation until we have DocBook.
@@ -1614,14 +1618,14 @@ MIDI functionality to the Linux-based operating system.")
 (define-public alsa-plugins
   (package
     (name "alsa-plugins")
-    (version "1.1.9")
+    (version "1.2.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp.alsa-project.org/pub/plugins/"
                                  name "-" version ".tar.bz2"))
              (sha256
               (base32
-               "01zrg0h2jw9dlj9233vjsn916yf4f2s667yry6xsn8d57lq745qn"))))
+               "1nj8cpbi05rb62yzs01c1k7lymdn1ch229b599hbhd0psixdx52d"))))
     (build-system gnu-build-system)
     ;; TODO: Split libavcodec and speex if possible. It looks like they can not
     ;; be split, there are references to both in files.
@@ -2644,7 +2648,7 @@ from the module-init-tools project.")
   ;; The post-systemd fork, maintained by Gentoo.
   (package
     (name "eudev")
-    (version "3.2.8")
+    (version "3.2.9")
     (source (origin
               (method git-fetch)
               (uri (git-reference (url "https://github.com/gentoo/eudev")
@@ -2652,7 +2656,7 @@ from the module-init-tools project.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1g95yzzx4qxm5qhhylbi930lrq4gsbz207n72018nkvswj6gmpjw"))
+                "1g9z3d33m0i3hmbhm0wxpvkzf6ac7xj1drwcfrhzlfhhi63sg9h7"))
               (patches (search-patches "eudev-rules-directory.patch"))))
     (build-system gnu-build-system)
     (arguments
@@ -3778,7 +3782,7 @@ Bluetooth audio output devices like headphones or loudspeakers.")
 (define-public bluez
   (package
     (name "bluez")
-    (version "5.51")
+    (version "5.52")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -3786,7 +3790,7 @@ Bluetooth audio output devices like headphones or loudspeakers.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "1fpbsl9kkfq6mn6n0dg4h0il4c7fzhwhn79gh907k5b2kwszpvgb"))))
+                "02jng21lp6fb3c2bh6vf9y7cj4gaxwk29dfc32ncy0lj0gi4q57p"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index 4f421f6e9d..2e34f8e26f 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -34,7 +34,7 @@
 (define-public nspr
   (package
     (name "nspr")
-    (version "4.22")
+    (version "4.24")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -42,7 +42,7 @@
                    version "/src/nspr-" version ".tar.gz"))
              (sha256
               (base32
-               "0c6ljv3bdqhc169srbpjy0cs52xk715p04zy08rcjvl54k6bdr69"))))
+               "1l0ksiny032jijgk0g76wf0kiq673i01izj7jrs2h5d1yq6rm9ch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)))
@@ -70,8 +70,7 @@ in the Mozilla clients.")
 (define-public nss
   (package
     (name "nss")
-    (version "3.46.1")
-    (replacement nss/fixed)
+    (version "3.48")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -82,7 +81,7 @@ in the Mozilla clients.")
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "0l9ns44rlkp1bpblplspfbqmyhb8rhvc89y56kqh725rgpny1xrv"))
+                "1b7qs1q7jqhw9dvkdznanzhc5dyq4bwx0biywszy3qx4hqm8571z"))
               ;; Create nss.pc and nss-config.
               (patches (search-patches "nss-pkgconfig.patch"
                                        "nss-freebl-stubs.patch"
@@ -131,7 +130,7 @@ in the Mozilla clients.")
              ;; leading to test failures:
              ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>.  To
              ;; work around that, set the time to roughly the release date.
-             (invoke "faketime" "2019-10-01" "./nss/tests/all.sh")))
+             (invoke "faketime" "2019-12-01" "./nss/tests/all.sh")))
            (replace 'install
              (lambda* (#:key outputs #:allow-other-keys)
                (let* ((out (assoc-ref outputs "out"))
@@ -184,11 +183,3 @@ applications.  Applications built with NSS can support SSL v2 and v3, TLS,
 PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
 security standards.")
     (license license:mpl2.0)))
-
-(define nss/fixed
-  (package
-    (inherit nss)
-    (source (origin
-              (inherit (package-source nss))
-              (patches (append (search-patches "nss-CVE-2019-11745.patch")
-                               (origin-patches (package-source nss))))))))
diff --git a/gnu/packages/patches/mesa-timespec-test-32bit.patch b/gnu/packages/patches/mesa-timespec-test-32bit.patch
deleted file mode 100644
index 3e4890f3a4..0000000000
--- a/gnu/packages/patches/mesa-timespec-test-32bit.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Fix a test failure on 32-bit systems.
-
-Taken from upstream:
-https://gitlab.freedesktop.org/mesa/mesa/commit/dd1dba80b9ee74ec8b90761285a8262e374bf8ef
-
-diff --git a/src/util/tests/timespec/timespec_test.cpp b/src/util/tests/timespec/timespec_test.cpp
---- a/src/util/tests/timespec/timespec_test.cpp
-+++ b/src/util/tests/timespec/timespec_test.cpp
-@@ -206,7 +206,7 @@ TEST(timespec_test, timespec_from_nsec)
- 
-    timespec_from_nsec(&a, UINT64_MAX);
-    EXPECT_EQ(a.tv_nsec, UINT64_MAX % NSEC_PER_SEC);
--   EXPECT_EQ(a.tv_sec, UINT64_MAX / NSEC_PER_SEC);
-+   EXPECT_EQ(a.tv_sec, (time_t)(UINT64_MAX / NSEC_PER_SEC));
- }
- 
- TEST(timespec_test, timespec_from_usec)
diff --git a/gnu/packages/patches/nss-CVE-2019-11745.patch b/gnu/packages/patches/nss-CVE-2019-11745.patch
deleted file mode 100644
index ae0eeda3c8..0000000000
--- a/gnu/packages/patches/nss-CVE-2019-11745.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Fix CVE-2019-11745 (Out-of-bounds write when passing an output buffer smaller
-than the block size to NSC_EncryptUpdate).
-
-Copied from Debian, equivalent to upstream fix:
-<https://hg.mozilla.org/projects/nss/rev/1e22a0c93afe9f46545560c86caedef9dab6cfda>.
-
-# HG changeset patch
-# User Craig Disselkoen <cdisselk@cs.ucsd.edu>
-# Date 1574189697 25200
-# Node ID 60bca7c6dc6dc44579b9b3e0fb62ca3b82d92eec
-# Parent  64e55c9f658e2a75f0835d00a8a1cdc2f25c74d6
-Bug 1586176 - EncryptUpdate should use maxout not block size. r=franziskus
-
---- a/nss/lib/softoken/pkcs11c.c
-+++ b/nss/lib/softoken/pkcs11c.c
-@@ -1285,7 +1285,7 @@ NSC_EncryptUpdate(CK_SESSION_HANDLE hSes
-             }
-             /* encrypt the current padded data */
-             rv = (*context->update)(context->cipherInfo, pEncryptedPart,
--                                    &padoutlen, context->blockSize, context->padBuf,
-+                                    &padoutlen, maxout, context->padBuf,
-                                     context->blockSize);
-             if (rv != SECSuccess) {
-                 return sftk_MapCryptError(PORT_GetError());
diff --git a/gnu/packages/patches/orc-typedef-enum.patch b/gnu/packages/patches/orc-typedef-enum.patch
deleted file mode 100644
index 207bf32ba9..0000000000
--- a/gnu/packages/patches/orc-typedef-enum.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Orc 0.4.30 has a bug that causes duplicate symbols due to a missing typedef.
-
-Taken from upstream:
-https://gitlab.freedesktop.org/gstreamer/orc/merge_requests/32
-
-diff --git a/orc/orctarget.h b/orc/orctarget.h
---- a/orc/orctarget.h
-+++ b/orc/orctarget.h
-@@ -19,7 +19,7 @@ enum {
-   ORC_TARGET_FAST_DENORMAL = (1<<31)
- };
- 
--enum {
-+typedef enum {
-   ORC_TARGET_POWERPC_64BIT = (1<<0),
-   ORC_TARGET_POWERPC_LE = (1<<1),
-   ORC_TARGET_POWERPC_ALTIVEC = (1<<2),
diff --git a/gnu/packages/patches/pcre2-fix-jit_match-crash.patch b/gnu/packages/patches/pcre2-fix-jit_match-crash.patch
deleted file mode 100644
index 7543319ee9..0000000000
--- a/gnu/packages/patches/pcre2-fix-jit_match-crash.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From: Tobias Geerinckx-Rice <me@tobias.gr>
-Date: Thu, 01 Aug 2019 21:12:52 +0200
-Subject: [PATCH] gnu: pcre2: Fix jit_match crash.
-
-Fixes <https://bugs.exim.org/show_bug.cgi?id=2421>, reported as a ‘secrity
-problem’.
-
-Copied verbatim from upstream[0].
-
-[0]: https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_jit_compile.c?view=patch&r1=1089&r2=1092&pathrev=1092
-
---- trunk/src/pcre2_jit_compile.c	2019/05/10 13:15:20	1089
-+++ trunk/src/pcre2_jit_compile.c	2019/05/13 16:38:18	1092
-@@ -8571,7 +8571,10 @@
- PCRE2_SPTR bptr;
- uint32_t c;
- 
--GETCHARINC(c, cc);
-+/* Patch by PH */
-+/* GETCHARINC(c, cc); */
-+
-+c = *cc++;
- #if PCRE2_CODE_UNIT_WIDTH == 32
- if (c >= 0x110000)
-   return NULL;
diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 91c32d6e5d..ea45a3d06b 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -89,15 +89,14 @@ POSIX regular expression API.")
 (define-public pcre2
   (package
     (name "pcre2")
-    (version "10.33")
+    (version "10.34")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/pcre/pcre2/"
                                   version "/pcre2-" version ".tar.bz2"))
-              (patches (search-patches "pcre2-fix-jit_match-crash.patch"))
               (sha256
                (base32
-                "1anqi7vpbfzag7imccrc6di1zl5rl63ab7rfpmajpw6d1kzlsl9m"))))
+                "1jlqnzcz2yi70dm40wyfa9w8is9z2kh4dl8zjnv3vqd9mgzp7i3l"))))
    (build-system gnu-build-system)
    (inputs `(("bzip2" ,bzip2)
              ("readline" ,readline)
@@ -109,7 +108,8 @@ POSIX regular expression API.")
                           "--enable-pcre2test-libreadline"
                           "--enable-pcre2-16"
                           "--enable-pcre2-32"
-                          "--enable-jit")
+                          "--enable-jit"
+                          "--disable-static")
       #:phases
       (modify-phases %standard-phases
         (add-after 'unpack 'patch-paths
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index ebe0168ff2..3b6829c4bc 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -670,14 +670,14 @@ line tools for batch rendering @command{pdfdraw}, rewriting files
 (define-public qpdf
   (package
    (name "qpdf")
-   (version "9.0.1")
+   (version "9.1.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://sourceforge/qpdf/qpdf/" version
                                 "/qpdf-" version ".tar.gz"))
             (sha256
              (base32
-              "0lhgb82s2402ad2yiswkj227vjlw9zypphdfdivfkbril7dg6495"))
+              "0ygd80wxcmh613n04x2kmf8wlsl0drxyd5wwdcrm1rzj0xwvpfrs"))
             (modules '((guix build utils)))
             (snippet
              ;; Replace shebang with the bi-lingual shell/Perl trick to remove
diff --git a/gnu/packages/statistics.scm b/gnu/packages/statistics.scm
index 5dd69da2ca..536de0fd7b 100644
--- a/gnu/packages/statistics.scm
+++ b/gnu/packages/statistics.scm
@@ -183,7 +183,7 @@ This package also provides @command{xls2csv} to export Excel files to CSV.")
 (define r-with-tests
   (package
     (name "r-with-tests")
-    (version "3.6.1")
+    (version "3.6.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://cran/src/base/R-"
@@ -191,7 +191,7 @@ This package also provides @command{xls2csv} to export Excel files to CSV.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "128kifbq0w25y8aq77w289ddax5i5w2djcfsqgffrb3i7syrxajv"))))
+                "0m69pfi0nxyriyb2yz74xfzaxwfkinnf9kpvf1rz727vvmfa8rdx"))))
     (build-system gnu-build-system)
     (arguments
      `(#:disallowed-references (,tzdata-for-tests)
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index 1b671c15ac..a85e88a544 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -302,28 +302,31 @@ avoiding password prompts when X11 forwarding has already been setup.")
 (define-public libxkbcommon
   (package
     (name "libxkbcommon")
-    (version "0.8.4")
+    (version "0.9.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://xkbcommon.org/download/libxkbcommon-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "12vc91ydhphd5sddz15560r41l7k0i7mq6nma8kkbzdp6bwwzpb0"))))
-    (build-system gnu-build-system)
+               "1q4v378sr9ad8fy9znl7k8xpf0wch655r9m6z0bcc7sw1azsminl"))))
+    (build-system meson-build-system)
     (inputs
      `(("libx11" ,libx11)
        ("libxcb" ,libxcb)
+       ("wayland" ,wayland)
+       ("wayland-protocols" ,wayland-protocols)
        ("xkeyboard-config" ,xkeyboard-config)))
     (native-inputs
      `(("bison" ,bison)
+       ("doxygen" ,doxygen)
        ("pkg-config" ,pkg-config)))
     (arguments
      `(#:configure-flags
-       (list (string-append "--with-xkb-config-root="
+       (list (string-append "-Dxkb-config-root="
                             (assoc-ref %build-inputs "xkeyboard-config")
                             "/share/X11/xkb")
-             (string-append "--with-x-locale-root="
+             (string-append "-Dx-locale-root="
                             (assoc-ref %build-inputs "libx11")
                             "/share/X11/locale"))))
     (home-page "https://xkbcommon.org/")
@@ -462,7 +465,7 @@ rasterisation.")
 (define-public libdrm
   (package
     (name "libdrm")
-    (version "2.4.99")
+    (version "2.4.100")
     (source
       (origin
         (method url-fetch)
@@ -472,7 +475,7 @@ rasterisation.")
                ".tar.bz2"))
         (sha256
          (base32
-          "0pnsw4bmajzdbz8pk4wswdmw93shhympf2q9alhbnpfjgsf57gsd"))
+          "0p8a1l3a3s40i81mawm8nhrbk7p97ss05qkawp1yx73c30lchz67"))
         (patches (search-patches "libdrm-symbol-check.patch"))))
     (build-system meson-build-system)
     (arguments
diff --git a/gnu/packages/xiph.scm b/gnu/packages/xiph.scm
index d7530f0392..edb690b5ff 100644
--- a/gnu/packages/xiph.scm
+++ b/gnu/packages/xiph.scm
@@ -69,6 +69,8 @@
              (base32
               "1zlk33vxvxr0l9lhkbhkdwvylw96d2n0fnd3d8dl031hph9bqqy1"))))
    (build-system gnu-build-system)
+   (arguments
+    '(#:configure-flags '("--disable-static")))
    (synopsis "Library for manipulating the ogg multimedia format")
    (description
     "The libogg library allows to manipulate the ogg multimedia container
@@ -93,7 +95,8 @@ periodic timestamps for seeking.")
               "05dlzjkdpv46zb837wysxqyn8l636x3dw8v8ymlrwz2fg1dbn05g"))))
    (build-system gnu-build-system)
    (propagated-inputs `(("libogg" ,libogg)))
-   (arguments `(#:configure-flags '("LDFLAGS=-lm")
+   (arguments `(#:configure-flags '("LDFLAGS=-lm"
+                                    "--disable-static")
                 #:parallel-tests? #f))
    (synopsis "Library implementing the vorbis audio format")
    (description
@@ -119,6 +122,8 @@ polyphonic) audio and music at fixed and variable bitrates from 16 to
                "0q8wark9ribij57dciym5vdikg2464p8q2mgqvfb78ksjh4s8vgk"))
              (patches (search-patches "libtheora-config-guess.patch"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:configure-flags '("--disable-static")))
     (inputs `(("libvorbis" ,libvorbis)))
     ;; The .pc files refer to libogg.
     (propagated-inputs `(("libogg" ,libogg)))
@@ -174,7 +179,8 @@ stereo encoding, and voice activity detection.")
                 "0wa7sqpk3x61zz99m7lwkgr6yv62ml6lfgs5xja65vlvdzy44838"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:configure-flags '(,@(if (string=? "aarch64-linux"
+     `(#:configure-flags '("--disable-static"
+                           ,@(if (string=? "aarch64-linux"
                                            (%current-system))
                                '("--enable-neon=no") ; neon defaults to armv7-a
                                '()))))
@@ -352,6 +358,8 @@ ogginfo, to obtain information (tags, bitrate, length, etc.) about
                (base32
                 "17gz8kxs4i7icsc1gj713gadiapyklynlwqlf0ai98dj4lg8xdb5"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:configure-flags '("--disable-static")))
     (synopsis "Versatile audio codec")
     (description
      "Opus is a totally open, royalty-free, highly versatile audio codec.  Opus