diff --git a/.gitignore b/.gitignore
index 09778b2..900e5e2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,7 @@
 /R-4.0.0.tar.gz
 /R-4.0.1.tar.gz
 /R-4.0.2.tar.gz
+/xz-5.2.5.tar.bz2
+/R-4.0.3.tar.gz
+/pcre-8.44.tar.bz2
+/curl-7.72.0.tar.bz2
diff --git a/R.spec b/R.spec
index cae457c..9e4b6fc 100644
--- a/R.spec
+++ b/R.spec
@@ -155,11 +155,11 @@
 
 %global major_version 4
 %global minor_version 0
-%global patch_version 2
+%global patch_version 3
 
 Name: R
 Version: %{major_version}.%{minor_version}.%{patch_version}
-Release: 5%{?dist}
+Release: 1%{?dist}
 Summary: A language for data analysis and graphics
 URL: http://www.r-project.org
 Source0: https://cran.r-project.org/src/base/R-4/R-%{version}.tar.gz
@@ -180,9 +180,9 @@ Source106: https://cran.r-project.org/doc/FAQ/R-FAQ.html
 %if %{zlibhack}
 %global zlibv 1.2.11
 %global bzipv 1.0.8
-%global xzv 5.2.4
-%global pcrev 8.43
-%global curlv 7.67.0
+%global xzv 5.2.5
+%global pcrev 8.44
+%global curlv 7.72.0
 Source1000: http://zlib.net/zlib-%{zlibv}.tar.gz
 Source1001: https://www.sourceware.org/pub/bzip2/bzip2-%{bzipv}.tar.gz
 Source1002: http://tukaani.org/xz/xz-%{xzv}.tar.bz2
@@ -364,12 +364,12 @@ Provides: R(ABI) = %{major_version}.%{minor_version}
 %add_submodule grid %{version}
 %add_submodule KernSmooth 2.23-17
 %add_submodule lattice 0.20-41
-%add_submodule MASS 7.3-51.6
+%add_submodule MASS 7.3-53
 %add_submodule Matrix 1.2-18
 Obsoletes: R-Matrix < 0.999375-7
 %add_submodule methods %{version}
-%add_submodule mgcv 1.8-31
-%add_submodule nlme 3.1-148
+%add_submodule mgcv 1.8-33
+%add_submodule nlme 3.1-149
 %add_submodule nnet 7.3-14
 %add_submodule parallel %{version}
 %add_submodule rpart 4.1-15
@@ -377,7 +377,7 @@ Obsoletes: R-Matrix < 0.999375-7
 %add_submodule splines %{version}
 %add_submodule stats %{version}
 %add_submodule stats4 %{version}
-%add_submodule survival 3.1-12
+%add_submodule survival 3.2-7
 %add_submodule tcltk %{version}
 %add_submodule tools %{version}
 %add_submodule translations %{version}
@@ -1280,6 +1280,9 @@ R CMD javareconf \
 %{_libdir}/libRmath.a
 
 %changelog
+* Mon Oct 12 2020 Tom Callaway <spot@fedoraproject.org> - 4.0.3-1
+- update to 4.0.3
+
 * Tue Sep  8 2020 Tom Callaway <spot@fedoraproject.org> - 4.0.2-5
 - make cups a "Recommends" instead of a "Requires" (bz1875165)
 - even though f31 uses a forked spec file, reflect the systemlapack change there here
diff --git a/sources b/sources
index a7a0c94..4607293 100644
--- a/sources
+++ b/sources
@@ -1,6 +1,6 @@
 SHA512 (zlib-1.2.11.tar.gz) = 73fd3fff4adeccd4894084c15ddac89890cd10ef105dd5e1835e1e9bbb6a49ff229713bd197d203edfa17c2727700fce65a2a235f07568212d820dca88b528ae
-SHA512 (xz-5.2.4.tar.bz2) = 25a548c34a304ba51cdaa63813df0fa4ac2f3cf0ec6dc2d181ec5b62fe586090cd0f1c866ee7ba19e9b264ecabf9ca9f2f1dda7f95313546da4152f3cfaa7e6e
 SHA512 (bzip2-1.0.8.tar.gz) = 083f5e675d73f3233c7930ebe20425a533feedeaaa9d8cc86831312a6581cefbe6ed0d08d2fa89be81082f2a5abdabca8b3c080bf97218a1bd59dc118a30b9f3
-SHA512 (pcre-8.43.tar.bz2) = 3b4ac2c7ccd77c9575d07a33c3456f40b50731029e62d01fb8f2f5871d7118e12bc9e6bc7a8079769c765e38da5ecf98c4b261b10ff0a2f14f0881b434f67af7
-SHA512 (curl-7.67.0.tar.bz2) = 096e12be86bca1c19ba9e1d98b8342ec0d76b2e00cab322a7109d1e3559343ff7702b993c772f221fa073d2b8b6ffe6535d15411819fb245d3fa2c18e110b0a5
-SHA512 (R-4.0.2.tar.gz) = b7330613ee9795f54cde3dd9f7509be83d9156fb8577c17179727ee01450db27704249f68bd48e0331e2df09c2d9833d8bb019c4f9ce9ba669df74650ff2e842
+SHA512 (xz-5.2.5.tar.bz2) = 89e25ddf72427ee9608cbf2e9dbc24d592cb67a27f44ccf7d47e4d9405774444e9cfcd02ac4bcb92064860371ed31d3cfbecd5fe063f296ead607714c0a664a1
+SHA512 (R-4.0.3.tar.gz) = 2493295f3052d077a4820c0f84ca1c37df262b8b357f62f2ea99dbfffea065861735a08fa2098421078e58e917c540e680a668546d450af734722b421669e058
+SHA512 (pcre-8.44.tar.bz2) = f26d850aab5228799e58ac8c2306fb313889332c39e29b118ef1de57677c5c90f970d68d3f475cabc64f8b982a77f04eca990ff1057f3ccf5e19bd137997c4ac
+SHA512 (curl-7.72.0.tar.bz2) = ca787b8890c485f3176b9d51b024d217d69f28c34ab84c4091a2fcbbe5f13346efd559e9bb507971aec0ecb6ec4ed5975d2722773015728b72d3f26a3574c312