diff --git a/gnu/local.mk b/gnu/local.mk
index cbc741ac57..16b63bc951 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -809,7 +809,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/findutils-localstatedir.patch		\
   %D%/packages/patches/findutils-makedev.patch			\
   %D%/packages/patches/findutils-test-xargs.patch		\
-  %D%/packages/patches/flac-CVE-2017-6888.patch		\
   %D%/packages/patches/flann-cmake-3.11.patch			\
   %D%/packages/patches/flint-ldconfig.patch			\
   %D%/packages/patches/foomatic-filters-CVE-2015-8327.patch	\
@@ -1124,6 +1123,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/nfs-utils-missing-headers.patch		\
   %D%/packages/patches/ngircd-handle-zombies.patch		\
   %D%/packages/patches/nm-plugin-path.patch			\
+  %D%/packages/patches/nss-freebl-stubs.patch			\
   %D%/packages/patches/nss-increase-test-timeout.patch		\
   %D%/packages/patches/nss-pkgconfig.patch			\
   %D%/packages/patches/ntfs-3g-CVE-2019-9755.patch		\
diff --git a/gnu/packages/certs.scm b/gnu/packages/certs.scm
index c41870332c..7e0071ecf9 100644
--- a/gnu/packages/certs.scm
+++ b/gnu/packages/certs.scm
@@ -76,7 +76,7 @@
 (define-public nss-certs
   (package
     (name "nss-certs")
-    (version "3.44.1")
+    (version "3.45")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -87,7 +87,7 @@
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "1y0jvva4s3j7cjz22kqw2lsml0an1295bgpc2raf7kc9r60cpr7w"))))
+                "12sfq9xvpwpc22qnjsg1if1lmchiy33byrh92wn91phz7li0abqi"))))
     (build-system gnu-build-system)
     (outputs '("out"))
     (native-inputs
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index b87203cab6..467aa5d84c 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -57,7 +57,7 @@
 (define-public cups-filters
   (package
     (name "cups-filters")
-    (version "1.25.0")
+    (version "1.25.1")
     (source(origin
               (method url-fetch)
               (uri
@@ -65,7 +65,7 @@
                               "cups-filters-" version ".tar.xz"))
               (sha256
                (base32
-                "1laiscq8yvynw862calkgbz9irrdkmd5l821q6a6wik1ifd186c1"))
+                "0nlq44jnjcnrbdv0dv5myg5kaycmk6a4klynpvj65xvn3l9cq28s"))
               (modules '((guix build utils)))
               (snippet
                ;; install backends, banners and filters to cups-filters output
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index ea3b3eb0ef..6ced8ac184 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -611,15 +611,15 @@ Language.")
 (define-public mariadb
   (package
     (name "mariadb")
-    (version "10.1.40")
+    (version "10.1.41")
     (source (origin
               (method url-fetch)
-              (uri (string-append "https://downloads.mariadb.org/f/"
-                                  name "-" version "/source/"
-                                  name "-" version ".tar.gz"))
+              (uri (string-append "https://downloads.mariadb.com/MariaDB"
+                                  "/mariadb-" version "/source/mariadb-"
+                                  version ".tar.gz"))
               (sha256
                (base32
-                "19375bnq0yg52kqh6cy00s5rglcxdrs5bb2hy7dqv2xqa9z7lxci"))
+                "1wh0073lqw3d9xs150bf2q3qvjwa6886mfi9khmsn7p8vapw6irb"))
               (patches (search-patches "mariadb-client-test-32bit.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -654,6 +654,10 @@ Language.")
          ;; For now, disable the features that that use libarchive (xtrabackup).
          "-DWITH_LIBARCHIVE=OFF"
 
+         ;; Disable the TokuDB engine, because its test suite frequently fails,
+         ;; and loading it crashes the server: <https://bugs.gnu.org/35521>.
+         "-DTOKUDB_OK=OFF"
+
          ;; Ensure the system libraries are used.
          "-DWITH_JEMALLOC=yes"
          "-DWITH_PCRE=system"
@@ -701,9 +705,6 @@ Language.")
                       ;; 2030-12-31.  See <https://bugs.gnu.org/34351> for details.
                       "main.mysqldump"
 
-                      ;; XXX: Fails sporadically.
-                      "innodb_fts.crash_recovery"
-
                       ;; FIXME: This test fails on i686:
                       ;; -myisampack: Can't create/write to file (Errcode: 17 "File exists")
                       ;; +myisampack: Can't create/write to file (Errcode: 17 "File exists)
@@ -781,7 +782,6 @@ Language.")
        ("libxml2" ,libxml2)
        ("ncurses" ,ncurses)
        ("pcre" ,pcre)
-       ("snappy" ,snappy)
        ("xz" ,xz)
        ("zlib" ,zlib)))
     (propagated-inputs
@@ -801,14 +801,14 @@ as a drop-in replacement of MySQL.")
 (define-public postgresql
   (package
     (name "postgresql")
-    (version "10.9")
+    (version "10.10")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://ftp.postgresql.org/pub/source/v"
                                   version "/postgresql-" version ".tar.bz2"))
               (sha256
                (base32
-                "0m0gbf7nwgag6a1z5f9xszwzgf2xhx0ncakyxwxlzs87n1zk32wm"))
+                "0lzj46dwd9cw94gnqm36bxd7jlhfdyqjrfzr3c4xd3prfn2rnkxd"))
               (patches (search-patches "postgresql-disable-resolve_symlinks.patch"))))
     (build-system gnu-build-system)
     (arguments
diff --git a/gnu/packages/gl.scm b/gnu/packages/gl.scm
index 9ed043c7ae..a2658a6789 100644
--- a/gnu/packages/gl.scm
+++ b/gnu/packages/gl.scm
@@ -64,14 +64,14 @@
 (define-public glu
   (package
     (name "glu")
-    (version "9.0.0")
+    (version "9.0.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "ftp://ftp.freedesktop.org/pub/mesa/glu/glu-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0r72yyhj09x3krn3kn629jqbwyq50ji8w5ri2pn6zwrk35m4g1s3"))))
+                "1xqhk9bn10nbvffw3r4p4rjslwz1l7gaycc0x2pqkr2irp7q9x7n"))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("mesa" ,mesa))) ; according to glu.pc
@@ -224,7 +224,7 @@ also known as DXTn or DXTC) for Mesa.")
 (define-public mesa
   (package
     (name "mesa")
-    (version "19.1.1")
+    (version "19.1.4")
     (source
       (origin
         (method url-fetch)
@@ -236,7 +236,7 @@ also known as DXTn or DXTC) for Mesa.")
                                   version "/mesa-" version ".tar.xz")))
         (sha256
          (base32
-          "10amy5sdmpjbskr3xazgk0jyli8xpgi0y1nsmjr76hx8nhb4n4bj"))
+          "1yvb7ja09i36zjifpyrf8jmbm9z0wqs2w3x8dlmxkkzdv6knilm6"))
         (patches
          (search-patches "mesa-skip-disk-cache-test.patch"))))
     (build-system meson-build-system)
@@ -288,7 +288,7 @@ also known as DXTn or DXTC) for Mesa.")
               ;; TODO: Fix svga driver for aarch64 and armhf.
               '("-Dgallium-drivers=etnaviv,freedreno,nouveau,r300,r600,swrast,tegra,v3d,vc4,virgl"))
              (_
-              '("-Dgallium-drivers=nouveau,r300,r600,radeonsi,svga,swrast,virgl")))
+              '("-Dgallium-drivers=iris,nouveau,r300,r600,radeonsi,svga,swrast,virgl")))
          ;; Enable various optional features.  TODO: opencl requires libclc,
          ;; omx requires libomxil-bellagio
          "-Dplatforms=x11,drm,surfaceless,wayland"
@@ -305,11 +305,8 @@ also known as DXTn or DXTC) for Mesa.")
 
          ;; Enable Vulkan on i686-linux and x86-64-linux.
          ,@(match (%current-system)
-             ("x86_64-linux"
+             ((or "i686-linux" "x86_64-linux")
               '("-Dvulkan-drivers=intel,amd"))
-             ;; TODO: Fix intel driver on i686-linux.
-             ("i686-linux"
-              '("-Dvulkan-drivers=amd"))
              (_
               '("-Dvulkan-drivers=auto")))
 
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 6f37e5e8ca..61d3e45a05 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -730,9 +730,7 @@ application suites.")
 (define-public gtk+
   (package (inherit gtk+-2)
    (name "gtk+")
-   ;; NOTE: When updating the version of 'gtk+', the hash of 'mate-themes' in
-   ;;       mate.scm will also need to be updated.
-   (version "3.24.9")
+   (version "3.24.10")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -740,7 +738,7 @@ application suites.")
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "0dg6jf2763sp740ls6b5y86b5b9zhz3zj0sbmar2xpws1lkv0zjp"))
+              "00qvq1r96ikdalv7xzgng1kad9i0rcahqk01gwhxl3xrw83z3a1m"))
             (patches (search-patches "gtk3-respect-GUIX_GTK3_PATH.patch"
                                      "gtk3-respect-GUIX_GTK3_IM_MODULE_FILE.patch"))))
    (outputs '("out" "bin" "doc"))
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 6928246509..5f3cf0ac2c 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1035,7 +1035,7 @@ language bindings to VIGRA.")
 (define-public libwebp
   (package
     (name "libwebp")
-    (version "1.0.2")
+    (version "1.0.3")
     (source
      (origin
        ;; No tarballs are provided for >0.6.1.
@@ -1046,7 +1046,7 @@ language bindings to VIGRA.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1ay0sai7f74dyk2gi975qfllmq534vnsx456npf16583mqb6ib2q"))))
+         "1l8h9d3z3kla567ilmymrgg8vc2n763g8qss1hah8dg832hbqkxf"))))
     (build-system gnu-build-system)
     (inputs
      `(("freeglut" ,freeglut)
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index 39fcf61a12..807fd43b9b 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -48,14 +48,14 @@
     ;; The 7 release series has an incompatible API, while the 6 series is still
     ;; maintained. Don't update to 7 until we've made sure that the ImageMagick
     ;; users are ready for the 7-series API.
-    (version "6.9.10-51")
+    (version "6.9.10-58")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "03c5r14ycp7mmlk6pryfcnpvjjnghk3z7dbjd1b7m1bgzmw21jhj"))))
+               "1hrd408lqgwg70aaif8g60lipwsplsg61722kpmx7a08pygs46hf"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--with-frozenpaths" "--without-gcc-arch")
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index e3c7d9ce91..ab3b4458b2 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -325,7 +325,7 @@ enough to be used effectively as a scientific calculator.")
 (define-public double-conversion
   (package
     (name "double-conversion")
-    (version "3.1.4")
+    (version "3.1.5")
     (home-page "https://github.com/google/double-conversion")
     (source (origin
               (method git-fetch)
@@ -334,7 +334,7 @@ enough to be used effectively as a scientific calculator.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "13xwcqk2c0q8c1siw566clxcpvp0xrxvb72mra42wa3nvq9wlsv6"))))
+                "0csy4pjw1p8rp6g5qxi2h0ychhhp1fldv7gb761627fs2mclw9gv"))))
     (build-system cmake-build-system)
     (arguments
      '(#:test-target "test"
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index 40a8002954..b6df366a77 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -70,7 +70,7 @@ in the Mozilla clients.")
 (define-public nss
   (package
     (name "nss")
-    (version "3.44.1")
+    (version "3.45")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -81,9 +81,10 @@ in the Mozilla clients.")
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "1y0jvva4s3j7cjz22kqw2lsml0an1295bgpc2raf7kc9r60cpr7w"))
+                "12sfq9xvpwpc22qnjsg1if1lmchiy33byrh92wn91phz7li0abqi"))
               ;; Create nss.pc and nss-config.
               (patches (search-patches "nss-pkgconfig.patch"
+                                       "nss-freebl-stubs.patch"
                                        "nss-increase-test-timeout.patch"))))
     (build-system gnu-build-system)
     (outputs '("out" "bin"))
diff --git a/gnu/packages/patches/flac-CVE-2017-6888.patch b/gnu/packages/patches/flac-CVE-2017-6888.patch
deleted file mode 100644
index d2583201b4..0000000000
--- a/gnu/packages/patches/flac-CVE-2017-6888.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-https://git.xiph.org/?p=flac.git;a=patch;h=4f47b63e9c971e6391590caf00a0f2a5ed612e67
-
-From 4f47b63e9c971e6391590caf00a0f2a5ed612e67 Mon Sep 17 00:00:00 2001
-From: Erik de Castro Lopo <erikd@mega-nerd.com>
-Date: Sat, 8 Apr 2017 18:34:49 +1000
-Subject: [PATCH] stream_decoder.c: Fix a memory leak
-
-Leak reported by Secunia Research.
----
- src/libFLAC/stream_decoder.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
-index 14d5fe7f..a5527511 100644
---- a/src/libFLAC/stream_decoder.c
-+++ b/src/libFLAC/stream_decoder.c
-@@ -1753,6 +1753,9 @@ FLAC__bool read_metadata_vorbiscomment_(FLAC__StreamDecoder *decoder, FLAC__Stre
- 					}
- 					memset (obj->comments[i].entry, 0, obj->comments[i].length) ;
- 					if (!FLAC__bitreader_read_byte_block_aligned_no_crc(decoder->private_->input, obj->comments[i].entry, obj->comments[i].length)) {
-+						/* Current i-th entry is bad, so we delete it. */
-+						free (obj->comments[i].entry) ;
-+						obj->comments[i].entry = NULL ;
- 						obj->num_comments = i;
- 						goto skip;
- 					}
--- 
-2.11.0
-
diff --git a/gnu/packages/patches/nss-freebl-stubs.patch b/gnu/packages/patches/nss-freebl-stubs.patch
new file mode 100644
index 0000000000..3f7b47b029
--- /dev/null
+++ b/gnu/packages/patches/nss-freebl-stubs.patch
@@ -0,0 +1,20 @@
+This patch is required for Makefile-based builds of NSS 3.45 on armhf-linux.
+
+Taken from upstream bug tracker:
+https://bugzilla.mozilla.org/show_bug.cgi?id=1571316
+
+diff --git a/nss/lib/freebl/ecl/curve25519_32.c b/nss/lib/freebl/ecl/curve25519_32.c
+--- a/nss/lib/freebl/ecl/curve25519_32.c
++++ b/nss/lib/freebl/ecl/curve25519_32.c
+@@ -29,6 +29,10 @@
+  *  1. Convert custom integer types to stdint.h types
+  */
+ 
++#ifdef FREEBL_NO_DEPEND
++#include "../stubs.h"
++#endif
++
+ #include "ecl-priv.h"
+ 
+ /* fe means field element. Here the field is \Z/(2^255-19). An element t,
+
diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 7385c78b9f..7ab8174ffa 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -89,13 +89,12 @@ POSIX regular expression API.")
 (define-public pcre2
   (package
     (name "pcre2")
-    (replacement pcre2/fixed)
     (version "10.33")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/pcre/pcre2/"
                                   version "/pcre2-" version ".tar.bz2"))
-
+              (patches (search-patches "pcre2-fix-jit_match-crash.patch"))
               (sha256
                (base32
                 "1anqi7vpbfzag7imccrc6di1zl5rl63ab7rfpmajpw6d1kzlsl9m"))))
@@ -126,14 +125,3 @@ own native API, as well as a set of wrapper functions that correspond to the
 POSIX regular expression API.")
    (license license:bsd-3)
    (home-page "https://www.pcre.org/")))
-
-(define-public pcre2/fixed
-  ;; PHP >= 7.3.8 requires a fixed version at build time, so make it public
-  ;; and hide it in the UI.
-  (package
-    (inherit pcre2)
-    (source
-     (origin
-       (inherit (package-source pcre2))
-       (patches (search-patches "pcre2-fix-jit_match-crash.patch"))))
-    (properties '((hidden? . #t)))))
diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm
index 5628a4b93f..55d88d07e8 100644
--- a/gnu/packages/perl.scm
+++ b/gnu/packages/perl.scm
@@ -9010,15 +9010,15 @@ Tree::Simple::Visitor::* objects.")
 (define-public perl-try-tiny
   (package
     (name "perl-try-tiny")
-    (version "0.22")
+    (version "0.30")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "mirror://cpan/authors/id/D/DO/DOY/"
+       (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/"
                            "Try-Tiny-" version ".tar.gz"))
        (sha256
         (base32
-         "068vdbpacfawc3lkfs0b82xxl27h3l0gj14iada3vlwk8rps9yv0"))))
+         "0szgvlz19yz3mq1lbzmwh8w5dh6agg5s16xv22zrnl83r7ax0nys"))))
     (build-system perl-build-system)
     (home-page "https://metacpan.org/release/Try-Tiny")
     (synopsis "Minimal try/catch with proper preservation of $@@")
diff --git a/gnu/packages/php.scm b/gnu/packages/php.scm
index 2411de55c9..497989b781 100644
--- a/gnu/packages/php.scm
+++ b/gnu/packages/php.scm
@@ -367,7 +367,7 @@
        ("oniguruma" ,oniguruma-5)
        ("openldap" ,openldap)
        ("openssl" ,openssl)
-       ("pcre" ,pcre2/fixed)            ; must be /fixed for tests
+       ("pcre" ,pcre2)
        ("postgresql" ,postgresql)
        ("readline" ,readline)
        ("sqlite" ,sqlite)
diff --git a/gnu/packages/python-xyz.scm b/gnu/packages/python-xyz.scm
index b937eef63a..459d5d44e1 100644
--- a/gnu/packages/python-xyz.scm
+++ b/gnu/packages/python-xyz.scm
@@ -3191,14 +3191,14 @@ provides additional functionality on the produced Mallard documents.")
 (define-public python-cython
   (package
     (name "python-cython")
-    (version "0.29.11")
+    (version "0.29.13")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Cython" version))
        (sha256
         (base32
-         "1866m01ggl2h3rky4hac3m5p048gg4a0jb09ljkknryiqln54fkn"))))
+         "13k37lrcgagwwnzr5bzririsscb793vndj234d475x1h9ad0d7f2"))))
     (build-system python-build-system)
     ;; we need the full python package and not just the python-wrapper
     ;; because we need libpython3.3m.so
@@ -3230,7 +3230,12 @@ provides additional functionality on the produced Mallard documents.")
 
          (replace 'check
            (lambda _
-             (invoke "python" "runtests.py" "-vv"))))))
+             ;; Disable compiler optimizations to greatly reduce the running
+             ;; time of the test suite.
+             (setenv "CFLAGS" "-O0")
+
+             (invoke "python" "runtests.py" "-vv"
+                     "-j" (number->string (parallel-job-count))))))))
     (home-page "https://cython.org/")
     (synopsis "C extensions for Python")
     (description "Cython is an optimising static compiler for both the Python
@@ -8782,20 +8787,24 @@ python-xdo for newer bindings.)")
 (define-public python-mako
   (package
     (name "python-mako")
-    (version "1.0.13")
+    (version "1.1.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Mako" version))
        (sha256
         (base32
-         "0h95n0g0k1jwxiqarr09navpfajarvbmpm8mhmw66c25qc675vlm"))))
+         "0jqa3qfpykyn4fmkn0kh6043sfls7br8i2bsdbccazcvk9cijsd3"))))
     (build-system python-build-system)
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda _
+                      (invoke "pytest" "-vv"))))))
     (propagated-inputs
      `(("python-markupsafe" ,python-markupsafe)))
     (native-inputs
      `(("python-mock" ,python-mock)
-       ("python-nose" ,python-nose)
        ("python-pytest" ,python-pytest)))
     (home-page "https://www.makotemplates.org/")
     (synopsis "Templating language for Python")
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 850bb82296..e05a4928f4 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -1301,7 +1301,7 @@ following features:
 (define-public subversion
   (package
     (name "subversion")
-    (version "1.10.4")
+    (version "1.10.6")
     (source (origin
              (method url-fetch)
              (uri
@@ -1312,7 +1312,7 @@ following features:
                                 "subversion-" version ".tar.bz2")))
              (sha256
               (base32
-               "18c1vdq32nil76w678lxmp73jsbqha3dmzgmfrj76nc0xjmywql2"))))
+               "19zc215mhpnm92mlyl5jbv57r5zqp6cavr3s2g9yglp6j4kfgj0q"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index ac1fe46726..9b809d007f 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -702,7 +702,7 @@ libebml is a C++ library to read and write EBML files.")
 (define-public libva
   (package
     (name "libva")
-    (version "2.4.1")
+    (version "2.5.0")
     (source
      (origin
        (method url-fetch)
@@ -714,7 +714,7 @@ libebml is a C++ library to read and write EBML files.")
              (string-append "https://www.freedesktop.org/software/vaapi/releases/"
                             "libva/libva-" version "/libva-" version ".tar.bz2")))
        (sha256
-        (base32 "0w7fkkrnfizzglviybxiyhxcvd3mfsiqlpda7rwj3ccihn857q79"))))
+        (base32 "0y38mw1ggxm15zq06r4qpwhd5wx4bppw1rsxpr6sq1m5d79rra1s"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/vulkan.scm b/gnu/packages/vulkan.scm
index 9fb780de77..0b3d476fa2 100644
--- a/gnu/packages/vulkan.scm
+++ b/gnu/packages/vulkan.scm
@@ -159,7 +159,7 @@ interpretation of the specifications for these languages.")
 (define-public vulkan-headers
   (package
     (name "vulkan-headers")
-    (version "1.1.112")
+    (version "1.1.114")
     (source
      (origin
        (method git-fetch)
@@ -169,7 +169,7 @@ interpretation of the specifications for these languages.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "0iia2wlq38hvxwip6r3k5946ylrlk42fw50mhf0pdjxjh02p8zn5"))))
+         "0fdvh26nxibylh32lj8b62d9nf9j25xa0il9zg362wmr2zgm8gka"))))
     (build-system cmake-build-system)
     (arguments
      `(#:tests? #f))                    ; No tests.
@@ -193,7 +193,7 @@ interpretation of the specifications for these languages.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1819bgmpjlikcc25bkmwwb7mp1rlyrq2v74wybg1g40ix70v0m0d"))))
+         "1rkm6dzdzxva62shscipz3kpp66x4kgmwvp1ski2fvf4jzzcbv7h"))))
     (build-system cmake-build-system)
     (arguments
      `(#:tests? #f ;FIXME: 23/39 tests fail.  Try "tests/run_all_tests.sh".
@@ -266,7 +266,7 @@ and the ICD.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "0an9hqvvpfmfld2pkszzwi7ccb9g2ijjqqzlj24dqg9kqnmcr3x4"))))
+         "1lz06mpni8ghf1xcxi4g6ck306lfaqwfi6f1w64kp9hczmvapfhf"))))
     (build-system cmake-build-system)
     (inputs
      `(("glslang" ,glslang)
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index f2d1f316d4..2294e77a9f 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -2228,7 +2228,7 @@ development server with Starman.")
 (define-public perl-cgi
   (package
     (name "perl-cgi")
-    (version "4.38")
+    (version "4.44")
     (source
      (origin
        (method url-fetch)
@@ -2236,7 +2236,7 @@ development server with Starman.")
                            "CGI-" version ".tar.gz"))
        (sha256
         (base32
-         "1m779315rzj4mpgscw209a2wk18iwg2n8zibn8aak4mv56jz8n4c"))))
+         "020jrygslqixrxd2nzc2l8ac39ynqzsy83nnnr3mqn6kxfvmyhqj"))))
     (build-system perl-build-system)
     (native-inputs
      `(("perl-test-deep" ,perl-test-deep)
@@ -2871,7 +2871,7 @@ used by the HTTP protocol (and then some more).")
 (define-public perl-http-message
   (package
     (name "perl-http-message")
-    (version "6.15")
+    (version "6.18")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -2879,7 +2879,7 @@ used by the HTTP protocol (and then some more).")
                    version ".tar.gz"))
              (sha256
               (base32
-               "11fbvisyvi6bw8z9iq9fm9mraf69qyds09fblhl9gyvg7ccll93v"))))
+               "04lih0fn89jpyk74c4aq1rzq18h8v4zd3x0lik2r9dl8sdqd2q6h"))))
     (build-system perl-build-system)
     (native-inputs
      `(("perl-try-tiny" ,perl-try-tiny)))
diff --git a/gnu/packages/wine.scm b/gnu/packages/wine.scm
index fd7277a7af..43dae3cf7c 100644
--- a/gnu/packages/wine.scm
+++ b/gnu/packages/wine.scm
@@ -164,10 +164,14 @@
                       (copy-file (string-append (assoc-ref inputs "mesa")
                                  "/share/vulkan/icd.d/radeon_icd.i686.json")
                                  (string-append icd "/radeon_icd.i686.json"))
+                      (copy-file (string-append (assoc-ref inputs "mesa")
+                                 "/share/vulkan/icd.d/intel_icd.i686.json")
+                                 (string-append icd "/intel_icd.i686.json"))
                       (wrap-program (string-append out "/bin/wine-preloader")
                                     `("VK_ICD_FILENAMES" ":" =
                                       (,(string-append icd
-                                        "/radeon_icd.i686.json"))))
+                                        "/radeon_icd.i686.json" ":"
+                                        icd "/intel_icd.i686.json"))))
                       #t)))))
              (_
               `())
@@ -224,7 +228,9 @@ integrate Windows applications into your desktop.")
                                      (assoc-ref inputs "mesa")
                                      "/share/vulkan/icd.d/intel_icd.x86_64.json" ":"
                                      (assoc-ref inputs "wine")
-                                     "/share/vulkan/icd.d/radeon_icd.i686.json"))))
+                                     "/share/vulkan/icd.d/radeon_icd.i686.json" ":"
+                                     (assoc-ref inputs "wine")
+                                     "/share/vulkan/icd.d/intel_icd.i686.json"))))
                    (wrap-program (string-append out "/bin/wine64-preloader")
                                  `("VK_ICD_FILENAMES" ":" =
                                    (,(string-append (assoc-ref inputs "mesa")
@@ -232,7 +238,9 @@ integrate Windows applications into your desktop.")
                                      ":" (assoc-ref inputs "mesa")
                                      "/share/vulkan/icd.d/intel_icd.x86_64.json"
                                      ":" (assoc-ref inputs "wine")
-                                     "/share/vulkan/icd.d/radeon_icd.i686.json"))))
+                                     "/share/vulkan/icd.d/radeon_icd.i686.json"
+                                     ":" (assoc-ref inputs "wine")
+                                     "/share/vulkan/icd.d/intel_icd.i686.json"))))
                    #t)))))
            (_
             `())
@@ -393,10 +401,14 @@ integrate Windows applications into your desktop.")
                       (copy-file (string-append (assoc-ref inputs "mesa")
                                  "/share/vulkan/icd.d/radeon_icd.i686.json")
                                  (string-append icd "/radeon_icd.i686.json"))
+                      (copy-file (string-append (assoc-ref inputs "mesa")
+                                 "/share/vulkan/icd.d/intel_icd.i686.json")
+                                 (string-append icd "/intel_icd.i686.json"))
                       (wrap-program (string-append out "/bin/wine-preloader")
                                     `("VK_ICD_FILENAMES" ":" =
                                       (,(string-append icd
-                                        "/radeon_icd.i686.json"))))
+                                        "/radeon_icd.i686.json" ":"
+                                        icd "/intel_icd.i686.json"))))
                       #t)))))
              (_
               `())
@@ -464,7 +476,9 @@ integrated into the main branch.")
                                      (assoc-ref inputs "mesa")
                                      "/share/vulkan/icd.d/intel_icd.x86_64.json" ":"
                                      (assoc-ref inputs "wine-staging")
-                                     "/share/vulkan/icd.d/radeon_icd.i686.json"))))
+                                     "/share/vulkan/icd.d/radeon_icd.i686.json" ":"
+                                     (assoc-ref inputs "wine-staging")
+                                     "/share/vulkan/icd.d/intel_icd.i686.json"))))
                    (wrap-program (string-append out "/bin/wine64-preloader")
                                  `("VK_ICD_FILENAMES" ":" =
                                    (,(string-append (assoc-ref inputs "mesa")
@@ -472,7 +486,9 @@ integrated into the main branch.")
                                      ":" (assoc-ref inputs "mesa")
                                      "/share/vulkan/icd.d/intel_icd.x86_64.json"
                                      ":" (assoc-ref inputs "wine-staging")
-                                     "/share/vulkan/icd.d/radeon_icd.i686.json"))))
+                                     "/share/vulkan/icd.d/radeon_icd.i686.json"
+                                     ":" (assoc-ref inputs "wine-staging")
+                                     "/share/vulkan/icd.d/intel_icd.i686.json"))))
                    #t)))))
            (_
             `())
diff --git a/gnu/packages/xiph.scm b/gnu/packages/xiph.scm
index 804cfd39a7..bac6ac0d4d 100644
--- a/gnu/packages/xiph.scm
+++ b/gnu/packages/xiph.scm
@@ -235,15 +235,14 @@ It currently supports:
 (define flac
   (package
    (name "flac")
-   (version "1.3.2")
+   (version "1.3.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://downloads.xiph.org/releases/flac/flac-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "0gymm2j3276kr9nz6vmgfwsdfrq6c449n40a0mzz8h6wc7nw7kwi"))
-            (patches (search-patches "flac-CVE-2017-6888.patch"))))
+              "0j0p9sf56a2fm2hkjnf7x3py5ir49jyavg4q5zdyd7bcf6yq4gi1"))))
    (build-system gnu-build-system)
    (arguments
     `(#:parallel-tests? #f))
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 2074163f24..926fb746b0 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -1136,7 +1136,7 @@ themselves.")
 (define-public libpciaccess
   (package
     (name "libpciaccess")
-    (version "0.14")
+    (version "0.16")
     (source
       (origin
         (method url-fetch)
@@ -1146,7 +1146,7 @@ themselves.")
                ".tar.bz2"))
         (sha256
           (base32
-            "197jbcpvp4z4x6j705mq2y4fsnnypy6f85y8xalgwhgx5bhl7x9x"))))
+            "12glp4w1kgvmqn89lk19cgr6jccd3awxra4dxisp7pagi06rsk11"))))
     (build-system gnu-build-system)
     (arguments
      '(;; Make sure libpciaccess can read compressed 'pci.ids' files as
diff --git a/guix/build/ant-build-system.scm b/guix/build/ant-build-system.scm
index d79a2d55ed..49549c1b4b 100644
--- a/guix/build/ant-build-system.scm
+++ b/guix/build/ant-build-system.scm
@@ -43,7 +43,8 @@
   (call-with-output-file "build.xml"
     (lambda (port)
       (sxml->xml
-       `(project (@ (basedir "."))
+       `(project (@ (basedir ".")
+                    (name ,jar-name))
                  (property (@ (name "classes.dir")
                               (value "${basedir}/build/classes")))
                  (property (@ (name "manifest.dir")
@@ -118,10 +119,9 @@
                  (target (@ (name "jar")
                             (depends "compile, manifest"))
                          (mkdir (@ (dir "${jar.dir}")))
-                         (exec (@ (executable "jar"))
-                               (arg (@ (line ,(string-append "-cmf ${manifest.file} "
-                                                             "${jar.dir}/" jar-name
-                                                             " -C ${classes.dir} ."))))))
+                         (jar (@ (destfile ,(string-append "${jar.dir}/" jar-name))
+                                 (manifest "${manifest.file}")
+                                 (basedir "${classes.dir}"))))
 
                  (target (@ (name "install"))
                          (copy (@ (todir "${dist.dir}"))