On Wed, Dec 12, 2018 at 12:03:34PM +0100, Rutger Helling wrote:
> From 8d82f31c8b4c7249b82314d4354e5973cb04c2c2 Mon Sep 17 00:00:00 2001
> From: Rutger Helling <rhelling@mykolab.com>
> Date: Wed, 12 Dec 2018 11:57:36 +0100
> Subject: [PATCH] gnu: qemu: Update to 3.1.0.
> 
> * gnu/local.mk: Remove qemu-CVE-2018-16847.patch and
> qemu-CVE-2018-16867.patch.
> * gnu/packages/patches/qemu-CVE-2018-16847.patch: Remove file.
> * gnu/packages/patches/qemu-CVE-2018-16867.patch: Remove file.
> * gnu/packages/virtualization.scm (qemu): Update to 3.1.0.
> [source]: Remove removed patches.

Thank you!

I tweaked the commit log and pushed as
6b34499dc62a55283dabd04c39f9b4d53fcf13c8

For the record, I tested it by building qemu and qemu-minimal, building
a bare-bones vm-image and gnu/system/install.scm, and booting the
vm-image with the new qemu package. This exercises both QEMU packages
and makes sure the new QEMU can still create the GuixSD installer.