The Guix team urges users to upgrade after vulnerabilities were found in its substitute handling and channel update mechanisms.