diff --git a/.github/workflows/haskell.yml b/.github/workflows/haskell.yml
--- a/.github/workflows/haskell.yml
+++ b/.github/workflows/haskell.yml
@@ -12,13 +12,13 @@
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        cabal: ["3.2"]
-        ghc: ["8.0", "8.2", "8.4", "8.6", "8.8", "8.10"]
+        cabal: ["3.4.1.0"]
+        ghc: ["8.6", "8.8", "8.10", "9.0"]
     steps:
     - uses: actions/checkout@v2
       with:
         submodules: 'recursive'  
-    - uses: actions/setup-haskell@v1
+    - uses: haskell/actions/setup@v1
       with:
         ghc-version: ${{ matrix.ghc }}
         cabal-version: ${{ matrix.cabal }}
diff --git a/HACKING.rst b/HACKING.rst
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -157,7 +157,7 @@
 ----------------------------
 
 There will usually be a ``HackPort`` developer hanging about in
-``#gentoo-haskell`` on FreeNode. Join the channel and ask away!
+``#gentoo-haskell`` on Libera.Chat. Join the channel and ask away!
 
 TODO
 ----
diff --git a/Merge/Dependencies.hs b/Merge/Dependencies.hs
--- a/Merge/Dependencies.hs
+++ b/Merge/Dependencies.hs
@@ -364,7 +364,7 @@
       , ("Xss",    any_c_p "x11-libs" "libXScrnSaver")
       , ("tag_c",  any_c_p "media-libs" "taglib")
       , ("magic",  any_c_p "sys-apps" "file")
-      , ("crypt",  any_c_p "virtual" "libc")
+      , ("crypt",  any_c_p_s_u "virtual" "libcrypt" Portage.AnyBuildTimeSlot [])
       , ("Xrender", any_c_p "x11-libs" "libXrender")
       , ("Xcursor", any_c_p "x11-libs" "libXcursor")
       , ("Xinerama", any_c_p "x11-libs" "libXinerama")
diff --git a/Portage/EBuild.hs b/Portage/EBuild.hs
--- a/Portage/EBuild.hs
+++ b/Portage/EBuild.hs
@@ -183,6 +183,7 @@
     -- add to this list with any non https-aware websites
     httpOnlyHomepages = Just <$> [ "leksah.org"
                                  , "darcs.net"
+                                 , "khumba.net"
                                  ]
 
 -- | Sort IUSE alphabetically
diff --git a/Portage/GHCCore.hs b/Portage/GHCCore.hs
--- a/Portage/GHCCore.hs
+++ b/Portage/GHCCore.hs
@@ -40,7 +40,7 @@
 -- The first @GHC@ version in this list is a minimum default.
 ghcs :: [(DC.CompilerInfo, InstalledPackageIndex)]
 ghcs = modern_ghcs
-    where modern_ghcs  = [ghc843, ghc863, ghc865, ghc881, ghc883, ghc884, ghc8101, ghc8104]
+    where modern_ghcs  = [ghc843, ghc863, ghc865, ghc881, ghc883, ghc884, ghc8101, ghc8104, ghc902]
 
 -- | Maybe determine the appropriate 'Cabal.Version' of the @Cabal@ package
 -- from a given @GHC@ version.
@@ -60,6 +60,7 @@
           , ([8,8,4],  Cabal.mkVersion [3,0,1,0])
           , ([8,10,1], Cabal.mkVersion [3,2,0,0])
           , ([8,10,4], Cabal.mkVersion [3,2,1,0])
+          , ([9,0,2], Cabal.mkVersion [3,4,1,0])          
           ]
 
 platform :: Platform
@@ -141,6 +142,9 @@
 ghc nrs = DC.unknownCompilerInfo c_id DC.NoAbiTag
     where c_id = CompilerId GHC (mkVersion nrs)
 
+ghc902 :: (DC.CompilerInfo, InstalledPackageIndex)
+ghc902 = (ghc [9,0,2], mkIndex ghc902_pkgs)
+
 ghc8104 :: (DC.CompilerInfo, InstalledPackageIndex)
 ghc8104 = (ghc [8,10,4], mkIndex ghc8104_pkgs)
 
@@ -171,6 +175,42 @@
 --      example: https://downloads.haskell.org/~ghc/8.6.5/docs/html/users_guide/8.6.5-notes.html
 --  * our binary tarballs (package.conf.d.initial subdir)
 --  * ancient: http://haskell.org/haskellwiki/Libraries_released_with_GHC
+ghc902_pkgs :: [Cabal.PackageIdentifier]
+ghc902_pkgs =
+  [ p "array" [0,5,4,0]
+  , p "base" [4,15,1,0]
+  , p "binary" [0,8,8,0] -- used by libghc
+  , p "bytestring" [0,10,12,1]
+--  , p "Cabal" [3,4,1,0]  package is upgradeable
+  , p "containers" [0,6,4,1]
+  , p "deepseq" [1,4,5,0] -- used by time
+  , p "directory" [1,3,6,2]
+  , p "filepath" [1,4,2,1]
+  , p "exceptions" [0,10,4] -- used by libghc
+  , p "ghc-bignum" [1,1]
+  , p "ghc-boot" [9,0,2]
+  , p "ghc-boot-th" [9,0,2]
+  , p "ghc-compact" [0,1,0,0]
+  , p "ghc-prim" [0,7,0]
+  , p "ghc-heap" [9,0,2]
+  , p "ghci" [9,0,2]
+--  , p "haskeline" [0,8,2]  package is upgradeable
+  , p "hpc" [0,6,1,0] -- used by libghc
+  , p "integer-gmp" [1,1]
+  , p "mtl" [2,2,2]  -- used by exceptions
+  , p "parsec" [3,1,14,0]  -- used by exceptions
+  , p "pretty" [1,1,3,6]
+  , p "process" [1,6,13,2]
+  --  , p "stm" [2,5,0,0]  package is upgradeable(?)
+  , p "template-haskell" [2,17,0,0] -- used by libghc
+  , p "terminfo" [0,4,1,5] -- used by libghc
+  , p "text" [1,2,5,0] -- used by libghc
+  , p "time" [1,9,3,0] -- used by unix, directory, hpc, ghc. unsafe to upgrade
+  , p "transformers" [0,5,6,2] -- used by libghc
+  , p "unix" [2,7,2,2]
+--  , p "xhtml" [3000,2,2,1]
+  ]
+
 ghc8104_pkgs :: [Cabal.PackageIdentifier]
 ghc8104_pkgs =
   [ p "array" [0,5,4,0]
@@ -182,7 +222,7 @@
   , p "deepseq" [1,4,4,0] -- used by time
   , p "directory" [1,3,6,0]
   , p "filepath" [1,4,2,1]
---  , p "exceptions [0,10,4] -- used by haskeline, package is upgradeable 
+  , p "exceptions" [0,10,4] -- used by libghc in ghc-9.0.2
   , p "ghc-boot" [8,10,4]
   , p "ghc-boot-th" [8,10,4]
   , p "ghc-compact" [0,1,0,0]
@@ -192,14 +232,14 @@
 --  , p "haskeline" [0,8,0,1]  package is upgradeable
   , p "hpc" [0,6,1,0] -- used by libghc
   , p "integer-gmp" [1,0,3,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,14,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2]  -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,14,0]  -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,9,0]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,16,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,4]
-  -- , p "text" [1,2,4,1] dependency of Cabal library
+  , p "terminfo" [0,4,1,4] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,4,1] -- used by libghc in ghc-9.0.2
   , p "time" [1,9,3,0] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,6,2] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -217,7 +257,7 @@
   , p "deepseq" [1,4,4,0] -- used by time
   , p "directory" [1,3,6,0]
   , p "filepath" [1,4,2,1]
---  , p "exceptions [0,10,4] -- used by haskeline, package is upgradeable 
+  , p "exceptions" [0,10,4] -- used by libghc in ghc-9.0.2
   , p "ghc-boot" [8,10,1]
   , p "ghc-boot-th" [8,10,1]
   , p "ghc-compact" [0,1,0,0]
@@ -227,14 +267,14 @@
 --  , p "haskeline" [0,8,0,0]  package is upgradeable
   , p "hpc" [0,6,1,0] -- used by libghc
   , p "integer-gmp" [1,0,3,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,14,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2]  -- used by libghc in ghc-9.0.2 
+  , p "parsec" [3,1,14,0]  -- used by libghc in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,8,2]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,16,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,4]
-  -- , p "text" [1,2,3,2] dependency of Cabal library
+  , p "terminfo" [0,4,1,4]  -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,3,2]  -- used by libghc in ghc-9.0.2
   , p "time" [1,9,3,0] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,6,2] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -260,14 +300,14 @@
 --  , p "haskeline" [0,7,5,0]  package is upgradeable
   , p "hpc" [0,6,0,3] -- used by libghc
   , p "integer-gmp" [1,0,2,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,14,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2]  -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,14,0] -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,9,0]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,15,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,4]
-  -- , p "text" [1,2,4,0] dependency of Cabal library
+  , p "terminfo" [0,4,1,4] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,4,0] -- used by libghc in ghc-9.0.2
   , p "time" [1,9,3,0] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,6,2] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -293,14 +333,14 @@
 --  , p "haskeline" [0,7,5,0]  package is upgradeable
   , p "hpc" [0,6,0,3] -- used by libghc
   , p "integer-gmp" [1,0,2,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,14,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2] -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,14,0] -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,8,0]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,15,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,4]
-  -- , p "text" [1,2,4,0] dependency of Cabal library
+  , p "terminfo" [0,4,1,4] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,4,0] -- used by libghc in ghc-9.0.2 
   , p "time" [1,9,3,0] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,6,2] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -326,14 +366,14 @@
 --  , p "haskeline" [0,7,4,3]  package is upgradeable
   , p "hpc" [0,6,0,3] -- used by libghc
   , p "integer-gmp" [1,0,2,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,14,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2] -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,14,0] -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,5,1]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,15,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,4]
-  -- , p "text" [1,2,4,0] dependency of Cabal library
+  , p "terminfo" [0,4,1,4] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,4,0] -- used by libghc in ghc-9.0.2
   , p "time" [1,9,3,0] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,6,2] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -359,14 +399,14 @@
 --  , p "haskeline" [0,7,4,3]  package is upgradeable
   , p "hpc" [0,6,0,3] -- used by libghc
   , p "integer-gmp" [1,0,2,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,13,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2] -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,13,0] -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,5,0]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,14,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,2]
-  -- , p "text" [1,2,3,1] dependency of Cabal library
+  , p "terminfo" [0,4,1,2] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,3,1] -- used by libghc in ghc-9.0.2
   , p "time" [1,8,0,2] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,6,2] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -392,14 +432,14 @@
 --  , p "haskeline" [0,7,4,3]  package is upgradeable
   , p "hpc" [0,6,0,3] -- used by libghc
   , p "integer-gmp" [1,0,2,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,13,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2] -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,13,0] -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,3,0]
   --  , p "stm" [2,5,0,0]  package is upgradeable(?)
   , p "template-haskell" [2,14,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,2]
-  -- , p "text" [1,2,3,1] dependency of Cabal library
+  , p "terminfo" [0,4,1,2] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,3,1] -- used by libghc in ghc-9.0.2
   , p "time" [1,8,0,2] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,5,0] -- used by libghc
   , p "unix" [2,7,2,2]
@@ -425,14 +465,14 @@
 --  , p "haskeline" [0,7,4,2]  package is upgradeable
   , p "hpc" [0,6,0,3] -- used by libghc
   , p "integer-gmp" [1,0,2,0]
-  --  , p "mtl" [2,2,2]  package is upgradeable(?)
-  --  , p "parsec" [3,1,13,0]  package is upgradeable(?)
+  , p "mtl" [2,2,2] -- used by exceptions in ghc-9.0.2
+  , p "parsec" [3,1,13,0] -- used by exceptions in ghc-9.0.2
   , p "pretty" [1,1,3,6]
   , p "process" [1,6,3,0]
   --  , p "stm" [2,4,5,0]  package is upgradeable(?)
   , p "template-haskell" [2,13,0,0] -- used by libghc
-  -- , p "terminfo" [0,4,1,1]
-  -- , p "text" [1,2,3,0]
+  , p "terminfo" [0,4,1,1] -- used by libghc in ghc-9.0.2
+  , p "text" [1,2,3,0] -- used by libghc in ghc-9.0.2
   , p "time" [1,8,0,2] -- used by unix, directory, hpc, ghc. unsafe to upgrade
   , p "transformers" [0,5,5,0] -- used by libghc
   , p "unix" [2,7,2,2]
diff --git a/cabal/cabal-install/Distribution/Client/HashValue.hs b/cabal/cabal-install/Distribution/Client/HashValue.hs
--- a/cabal/cabal-install/Distribution/Client/HashValue.hs
+++ b/cabal/cabal-install/Distribution/Client/HashValue.hs
@@ -1,5 +1,6 @@
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE CPP                #-}
 module Distribution.Client.HashValue (
     HashValue,
     hashValue,
@@ -71,10 +72,14 @@
     --TODO: [code cleanup] either we should get TUF to use raw bytestrings or
     -- perhaps we should also just use a base16 string as the internal rep.
     case Base16.decode (BS.pack hashstr) of
+#if MIN_VERSION_base16_bytestring(1,0,0)
+      Right hash -> HashValue hash
+      Left _ -> error "hashFromTUF: cannot decode base16"
+#else
       (hash, trailing) | not (BS.null hash) && BS.null trailing
         -> HashValue hash
       _ -> error "hashFromTUF: cannot decode base16 hash"
-
+#endif
 
 -- | Truncate a 32 byte SHA256 hash to
 --
diff --git a/cabal/cabal-install/Distribution/Client/HttpUtils.hs b/cabal/cabal-install/Distribution/Client/HttpUtils.hs
--- a/cabal/cabal-install/Distribution/Client/HttpUtils.hs
+++ b/cabal/cabal-install/Distribution/Client/HttpUtils.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE BangPatterns #-}
+{-# LANGUAGE CPP          #-}
 -----------------------------------------------------------------------------
 -- | Separate module for HTTP actions, using a proxy server if one exists.
 -----------------------------------------------------------------------------
@@ -182,7 +183,11 @@
     fragmentParser = do
         _ <- P.string "#sha256="
         str <- some P.hexDigit
+#if MIN_VERSION_base16_bytestring(1,0,0)
+        return  (Base16.decodeLenient (BS8.pack str))
+#else
         return (fst (Base16.decode (BS8.pack str)))
+#endif
 
 ------------------------------------------------------------------------------
 -- Utilities for repo url management
diff --git a/cabal/cabal-install/cabal-install.cabal b/cabal/cabal-install/cabal-install.cabal
--- a/cabal/cabal-install/cabal-install.cabal
+++ b/cabal/cabal-install/cabal-install.cabal
@@ -334,7 +334,7 @@
         async      >= 2.0      && < 2.3,
         array      >= 0.4      && < 0.6,
         base       >= 4.8      && < 4.15,
-        base16-bytestring >= 0.1.1 && < 0.2,
+        base16-bytestring >= 0.1.1 && < 1.1,
         binary     >= 0.7.3    && < 0.9,
         bytestring >= 0.10.6.0 && < 0.11,
         Cabal      == 3.3.*,
diff --git a/hackage-security/.github/workflows/haskell.yml b/hackage-security/.github/workflows/haskell.yml
new file mode 100644
--- /dev/null
+++ b/hackage-security/.github/workflows/haskell.yml
@@ -0,0 +1,41 @@
+name: Haskell CI
+
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ghc: ['8.10.6', '8.8.4', '8.6.5']
+        os: [ubuntu-latest, macOS-latest, windows-latest]
+    steps:
+    - uses: actions/checkout@v2
+    - uses: haskell/actions/setup@v1
+      with:
+        ghc-version: ${{ matrix.ghc }}
+        cabal-version: '3.6.2.0'
+
+    - name: Cache
+      uses: actions/cache@v1
+      env:
+        cache-name: cache-cabal
+      with:
+        path: ~/.cabal
+        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/*.cabal') }}-${{ hashFiles('**/cabal.project') }}
+        restore-keys: |
+          ${{ runner.os }}-build-${{ env.cache-name }}-
+          ${{ runner.os }}-build-
+          ${{ runner.os }}-
+
+    - name: Install dependencies
+      run: |
+        cabal update
+        cabal build --only-dependencies --enable-tests --enable-benchmarks -vnormal+nowrap all
+    - name: Build
+      run: cabal build --enable-tests --enable-benchmarks -j1 -vnormal+nowrap all
+    - name: Run tests
+      run: cabal test -j1 -vnormal+nowrap all
diff --git a/hackage-security/README.md b/hackage-security/README.md
--- a/hackage-security/README.md
+++ b/hackage-security/README.md
@@ -676,7 +676,7 @@
     `/package/<package-id>/<package-id>.tar.gz`).
 
 The most important observation however is the following: **It is not possible to
-serve a local repository as a remote repository** (by poining a webserver at a
+serve a local repository as a remote repository** (by pointing a web server at a
 local repository) because the layouts are completely different. (Note that the
 location of packages on Hackage-1 _did_ match the layout of local repositories,
 but that doesn't help because the _only_ repository that `cabal-install` will
diff --git a/hackage-security/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs b/hackage-security/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs
--- a/hackage-security/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs
+++ b/hackage-security/hackage-security-HTTP/src/Hackage/Security/Client/Repository/HttpLib/HTTP.hs
@@ -62,7 +62,7 @@
     -> IO a
 get browser reqHeaders uri callback = wrapCustomEx $ do
     response <- request browser
-      $ setRequestHeaders reqHeaders
+      $ addRequestHeaders reqHeaders
       -- avoid silly `Content-Length: 0` header inserted by `mkRequest`
       $ removeHeader HTTP.HdrContentLength
       $ HTTP.mkRequest HTTP.GET uri
@@ -78,7 +78,7 @@
 getRange browser reqHeaders uri (from, to) callback = wrapCustomEx $ do
     response <- request browser
       $ setRange from to
-      $ setRequestHeaders reqHeaders
+      $ addRequestHeaders reqHeaders
       -- avoid silly `Content-Length: 0` header inserted by `mkRequest`
       $ removeHeader HTTP.HdrContentLength
       $ HTTP.mkRequest HTTP.GET uri
@@ -234,8 +234,8 @@
     -- See <http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html>
     rangeHeader = "bytes=" ++ show from ++ "-" ++ show (to - 1)
 
-setRequestHeaders :: HTTP.HasHeaders a => [HttpRequestHeader] -> a -> a
-setRequestHeaders =
+addRequestHeaders :: HTTP.HasHeaders a => [HttpRequestHeader] -> a -> a
+addRequestHeaders =
     foldr (.) id . map (uncurry HTTP.insertHeader) . trOpt []
   where
     trOpt :: [(HTTP.HeaderName, [String])]
diff --git a/hackage-security/hackage-security-http-client/hackage-security-http-client.cabal b/hackage-security/hackage-security-http-client/hackage-security-http-client.cabal
--- a/hackage-security/hackage-security-http-client/hackage-security-http-client.cabal
+++ b/hackage-security/hackage-security-http-client/hackage-security-http-client.cabal
@@ -24,7 +24,6 @@
   exposed-modules:     Hackage.Security.Client.Repository.HttpLib.HttpClient
   build-depends:       base               >= 4.5 && < 4.15,
                        bytestring         >= 0.9,
-                       data-default-class >= 0.0,
                        http-client        >= 0.4 && < 0.7,
                        http-types         >= 0.8,
                        hackage-security   >= 0.5 && < 0.7
diff --git a/hackage-security/hackage-security-http-client/src/Hackage/Security/Client/Repository/HttpLib/HttpClient.hs b/hackage-security/hackage-security-http-client/src/Hackage/Security/Client/Repository/HttpLib/HttpClient.hs
--- a/hackage-security/hackage-security-http-client/src/Hackage/Security/Client/Repository/HttpLib/HttpClient.hs
+++ b/hackage-security/hackage-security-http-client/src/Hackage/Security/Client/Repository/HttpLib/HttpClient.hs
@@ -61,8 +61,7 @@
     -- TODO: setUri fails under certain circumstances; in particular, when
     -- the URI contains URL auth. Not sure if this is a concern.
     request' <- HttpClient.setUri HttpClient.defaultRequest uri
-    let request = setRequestHeaders reqHeaders
-                $ request'
+    let request = addRequestHeaders reqHeaders request'
     checkHttpException $ HttpClient.withResponse request manager $ \response -> do
       let br = wrapCustomEx $ HttpClient.responseBody response
       callback (getResponseHeaders response) br
@@ -73,7 +72,7 @@
          -> (HttpStatus -> [HttpResponseHeader] -> BodyReader -> IO a)
          -> IO a
 getRange manager reqHeaders uri (from, to) callback = wrapCustomEx $ do
-    request <- (setRange from to . setRequestHeaders reqHeaders)
+    request <- (setRange from to . addRequestHeaders reqHeaders)
             `fmap` HttpClient.setUri HttpClient.defaultRequest uri
     checkHttpException $ HttpClient.withResponse request manager $ \response -> do
       let br = wrapCustomEx $ HttpClient.responseBody response
@@ -130,11 +129,11 @@
     -- See <http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html>
     rangeHeader = BS.C8.pack $ "bytes=" ++ show from ++ "-" ++ show (to - 1)
 
--- | Set request headers
-setRequestHeaders :: [HttpRequestHeader]
+-- | Add the given request headers
+addRequestHeaders :: [HttpRequestHeader]
                   -> HttpClient.Request -> HttpClient.Request
-setRequestHeaders opts req = req {
-      HttpClient.requestHeaders = trOpt disallowCompressionByDefault opts
+addRequestHeaders opts req = req {
+      HttpClient.requestHeaders = HttpClient.requestHeaders req ++ trOpt disallowCompressionByDefault opts
     }
   where
     trOpt :: [(HttpClient.HeaderName, [ByteString])]
diff --git a/hackage-security/hackage-security/ChangeLog.md b/hackage-security/hackage-security/ChangeLog.md
--- a/hackage-security/hackage-security/ChangeLog.md
+++ b/hackage-security/hackage-security/ChangeLog.md
@@ -1,5 +1,12 @@
 See also http://pvp.haskell.org/faq
 
+0.6.1.0
+-------
+
+* Support basic auth in package-indices (#252)
+* Fix tests due to new aeson handling of unescaped control sequences (#256)
+* Bump a lot of bounds on packages we depend on
+
 0.6.0.1
 -------
 
diff --git a/hackage-security/hackage-security/hackage-security.cabal b/hackage-security/hackage-security/hackage-security.cabal
--- a/hackage-security/hackage-security/hackage-security.cabal
+++ b/hackage-security/hackage-security/hackage-security.cabal
@@ -1,6 +1,6 @@
 cabal-version:       1.12
 name:                hackage-security
-version:             0.6.0.1
+version:             0.6.1.0
 
 synopsis:            Hackage security library
 description:         The hackage security library provides both server and
@@ -24,7 +24,7 @@
 license-file:        LICENSE
 author:              Edsko de Vries
 maintainer:          cabal-devel@haskell.org
-copyright:           Copyright 2015-2016 Well-Typed LLP
+copyright:           Copyright 2015-2022 Well-Typed LLP
 category:            Distribution
 homepage:            https://github.com/haskell/hackage-security
 bug-reports:         https://github.com/haskell/hackage-security/issues
@@ -110,13 +110,13 @@
                        Hackage.Security.Util.TypedEmbedded
                        Prelude
   -- We support ghc 7.4 (bundled with Cabal 1.14) and up
-  build-depends:       base              >= 4.5     && < 4.15,
+  build-depends:       base              >= 4.5     && < 4.17,
                        base16-bytestring >= 0.1.1   && < 1.1,
                        base64-bytestring >= 1.0     && < 1.3,
                        bytestring        >= 0.9     && < 0.12,
                        Cabal             >= 1.14    && < 1.26
                                       || >= 2.0     && < 2.6
-                                      || >= 3.0     && < 3.4,
+                                      || >= 3.0     && < 3.8,
                        containers        >= 0.4     && < 0.7,
                        ed25519           >= 0.0     && < 0.1,
                        filepath          >= 1.2     && < 1.5,
@@ -126,8 +126,8 @@
                        -- 0.4.2 introduces TarIndex, 0.4.4 introduces more
                        -- functionality, 0.5.0 changes type of serialise
                        tar               >= 0.5     && < 0.6,
-                       template-haskell  >= 2.7     && < 2.17,
-                       time              >= 1.2     && < 1.10,
+                       template-haskell  >= 2.7     && < 2.19,
+                       time              >= 1.2     && < 1.13,
                        transformers      >= 0.3     && < 0.6,
                        zlib              >= 0.5     && < 0.7,
                        -- whatever versions are bundled with ghc:
@@ -252,21 +252,18 @@
                        Cabal,
                        containers,
                        bytestring,
+                       network-uri,
                        tar,
+                       text,
                        time,
                        zlib
 
-  if flag(use-network-uri)
-    build-depends: network-uri
-  else
-    build-depends: network
-
   -- dependencies exclusive to test-suite
-  build-depends:       tasty            == 1.2.*,
+  build-depends:       tasty            >= 1.2 && < 1.5,
                        tasty-hunit      == 0.10.*,
                        tasty-quickcheck == 0.10.*,
-                       QuickCheck       >= 2.11 && <2.14,
-                       aeson            == 1.4.*,
+                       QuickCheck       >= 2.11 && <2.15,
+                       aeson            == 1.4.* || == 1.5.* || == 2.0.*,
                        vector           == 0.12.*,
                        unordered-containers >=0.2.8.0 && <0.3,
                        temporary        >= 1.2 && < 1.4
diff --git a/hackage-security/hackage-security/tests/TestSuite/JSON.hs b/hackage-security/hackage-security/tests/TestSuite/JSON.hs
--- a/hackage-security/hackage-security/tests/TestSuite/JSON.hs
+++ b/hackage-security/hackage-security/tests/TestSuite/JSON.hs
@@ -1,3 +1,4 @@
+{-# LANGUAGE CPP #-}
 {-# OPTIONS_GHC -fno-warn-orphans #-}
 module TestSuite.JSON (
     prop_roundtrip_canonical,
@@ -21,23 +22,30 @@
 import Data.Aeson (Value (..), eitherDecode)
 import Data.String (fromString)
 import qualified Data.Vector as V
+#if MIN_VERSION_aeson(2,0,0)
+import qualified Data.Aeson.KeyMap as KM
+#else
 import qualified Data.HashMap.Strict as HM
+#endif
 
+-- text
+import qualified Data.Text as Text
+
 prop_aeson_canonical, prop_roundtrip_canonical, prop_roundtrip_pretty, prop_canonical_pretty
-  :: JSValue -> Bool
+  :: JSValue -> Property
 
 prop_roundtrip_canonical jsval =
-    parseCanonicalJSON (renderCanonicalJSON jsval) == Right (canonicalise jsval)
+    parseCanonicalJSON (renderCanonicalJSON jsval) === Right (canonicalise jsval)
 
 prop_roundtrip_pretty jsval =
-    parseCanonicalJSON (BS.pack (prettyCanonicalJSON jsval)) == Right jsval
+    parseCanonicalJSON (BS.pack (prettyCanonicalJSON jsval)) === Right jsval
 
 prop_canonical_pretty jsval =
-    parseCanonicalJSON (renderCanonicalJSON jsval) ==
+    parseCanonicalJSON (renderCanonicalJSON jsval) ===
     fmap canonicalise (parseCanonicalJSON (BS.pack (prettyCanonicalJSON jsval)))
 
 prop_aeson_canonical jsval =
-    eitherDecode (renderCanonicalJSON jsval) == Right (toAeson (canonicalise jsval))
+    eitherDecode (renderCanonicalJSON jsval) === Right (toAeson (canonicalise jsval))
 
 canonicalise :: JSValue -> JSValue
 canonicalise v@JSNull        = v
@@ -48,6 +56,9 @@
 canonicalise   (JSObject vs) = JSObject [ (k, canonicalise v)
                                         | (k,v) <- sortBy (compare `on` fst) vs ]
 
+sanitizeString :: String -> String
+sanitizeString s = Text.unpack (Text.replace (Text.pack "\\") (Text.pack "\\\\") (Text.pack (show s)))
+
 instance Arbitrary JSValue where
   arbitrary =
     sized $ \sz ->
@@ -55,9 +66,9 @@
       [ (1, pure JSNull)
       , (1, JSBool   <$> arbitrary)
       , (2, JSNum    <$> arbitrary)
-      , (2, JSString . getASCIIString <$> arbitrary)
+      , (2, JSString . sanitizeString . getASCIIString <$> arbitrary)
       , (3, JSArray                <$> resize (sz `div` 2) arbitrary)
-      , (3, JSObject . mapFirst getASCIIString .  noDupFields <$> resize (sz `div` 2) arbitrary)
+      , (3, JSObject . mapFirst (sanitizeString . getASCIIString) .  noDupFields <$> resize (sz `div` 2) arbitrary)
       ]
     where
       noDupFields = nubBy (\(x,_) (y,_) -> x==y)
@@ -78,7 +89,11 @@
 toAeson (JSNum n)     = Number (fromIntegral n)
 toAeson (JSString s)  = String (fromString s)
 toAeson (JSArray xs)  = Array $ V.fromList [ toAeson x | x <- xs ]
+#if MIN_VERSION_aeson(2,0,0)
+toAeson (JSObject xs) = Object $ KM.fromList [ (fromString k, toAeson v) | (k, v) <- xs ]
+#else
 toAeson (JSObject xs) = Object $ HM.fromList [ (fromString k, toAeson v) | (k, v) <- xs ]
+#endif
 
 instance Arbitrary Int54 where
   arbitrary = fromIntegral <$>
diff --git a/hackport.cabal b/hackport.cabal
--- a/hackport.cabal
+++ b/hackport.cabal
@@ -1,6 +1,7 @@
+Cabal-Version:  2.2
 Name:           hackport
-Version:        0.7
-License:        GPL
+Version:        0.7.1.1
+License:        GPL-3.0-or-later
 License-file:   LICENSE
 Author:         Henning Günther, Duncan Coutts, Lennart Kolmodin
 Maintainer:     Gentoo Haskell team <haskell@gentoo.org>
@@ -9,7 +10,6 @@
 Description:    A command line tool to manage an overlay of Gentoo ebuilds
                 that are generated from a hackage repo of Cabal packages.
 Build-Type:     Simple
-Cabal-Version:  >=1.10
 
 source-repository head
   type: git
@@ -58,7 +58,7 @@
     random >= 1.0,
     stm >= 2.0,
     --  hackage-security depends
-    base16-bytestring >= 0.1.1 && < 1,
+    base16-bytestring >= 0.1.1 && < 1.1,
     base64-bytestring >= 1.0,
     cryptohash-sha256 >= 0.11,
     ed25519,
@@ -465,6 +465,10 @@
     Hackage.Security.Util.TypedEmbedded
     Prelude
     Text.JSON.Canonical
+
+  autogen-modules:
+    Paths_cabal_install
+    Paths_hackport
 
 Test-Suite test-resolve-category
   -- requires a local Portage overlay, thus fails in a sandboxed test.
diff --git a/tests/Portage/EBuildSpec.hs b/tests/Portage/EBuildSpec.hs
--- a/tests/Portage/EBuildSpec.hs
+++ b/tests/Portage/EBuildSpec.hs
@@ -33,6 +33,7 @@
     it "should not convert whitelisted http-only homepages into https homepages" $ do
       toHttps "http://leksah.org" `shouldBe` "http://leksah.org"
       toHttps "http://darcs.net/" `shouldBe` "http://darcs.net/"
+      toHttps "http://khumba.net/" `shouldBe` "http://khumba.net/"
     it "should otherwise convert all homepages into https-aware homepages" $ do
       toHttps "http://pandoc.org" `shouldBe` "https://pandoc.org"
       toHttps "http://www.yesodweb.com/" `shouldBe` "https://www.yesodweb.com/"
diff --git a/tests/Portage/GHCCoreSpec.hs b/tests/Portage/GHCCoreSpec.hs
--- a/tests/Portage/GHCCoreSpec.hs
+++ b/tests/Portage/GHCCoreSpec.hs
@@ -17,7 +17,7 @@
   describe "packageIsCoreInAnyGHC" $ do
     it "returns True for the binary package" $ do
       packageIsCoreInAnyGHC (Cabal.mkPackageName "binary") `shouldBe` True
-    it "returns False for the exceptions package (because it is upgradeable)" $ do
-      packageIsCoreInAnyGHC (Cabal.mkPackageName "exceptions") `shouldBe` False
+    it "returns False for the haskeline package (because it is upgradeable)" $ do
+      packageIsCoreInAnyGHC (Cabal.mkPackageName "haskeline") `shouldBe` False
     it "returns False for the yesod package" $ do
       packageIsCoreInAnyGHC (Cabal.mkPackageName "yesod") `shouldBe` False
