py-types-setuptools: updated to 83.0.0.20260716
83.0.0.20260716
Run ty on typeshed stubs in CI
Add a pinned ty check for the standard-library and third-party stubs across Python 3.10-3.14 and the supported target platforms. The runner honors stdlib/VERSIONS, resolves checked-in stub packages and their external dependencies, and avoids duplicate published stub packages that shadow local sources.
Match pyright's policy for non-actionable override and deprecation diagnostics, add narrowly scoped ignores beside existing checker exceptions, and exclude only the obsolete requests and legacy distutils stubs. Check geopandas, seaborn, and shapely on every target version, with two existing pandas-stubs type-bound exceptions mirrored for ty. Also fix the remaining Windows-only dateutil builtin-name collision discovered by the new check.
py-types-python-dateutil: updated to 2.9.0.20260716
2.9.0.20260716
Run ty on typeshed stubs in CI
Add a pinned ty check for the standard-library and third-party stubs across Python 3.10-3.14 and the supported target platforms. The runner honors stdlib/VERSIONS, resolves checked-in stub packages and their external dependencies, and avoids duplicate published stub packages that shadow local sources.
Match pyright's policy for non-actionable override and deprecation diagnostics, add narrowly scoped ignores beside existing checker exceptions, and exclude only the obsolete requests and legacy distutils stubs. Check geopandas, seaborn, and shapely on every target version, with two existing pandas-stubs type-bound exceptions mirrored for ty. Also fix the remaining Windows-only dateutil builtin-name collision discovered by the new check.
py-types-gdb: updated to 16.3.0.20260712
16.3.0.20260712
[gdb] Allow gdb.Value to take a Buffer plus a Type
If a type is passed that is not None, it always goes through the
buffer protocol, which interestingly means you can't pass
an existing gdb.Value together with a type. You have to use the
cast method for that purpose.
py-types-docutils: updated to 0.22.3.20260712
0.22.3.20260712
Avoid class-scope name collisions in stubs
Class members such as list, type, cursor, Model, and datetime shadow the builtins, classes, or modules referenced by nearby annotations. ty then resolves those annotations to Unknown, which can hide invalid calls in APIs including docker, sqlite3, psycopg2, Markdown, and requests.
Qualify shadowed builtins and use private aliases for colliding imports and classes. This removes 15 stdlib and 120 third-party collision diagnostics under ty 0.0.58, restores the affected public types, and fixes four existing psycopg2 type assertions.
lang/gcc10: pull over the changes to rs6000/netbsd.h from gcc12.
This is so that this builds and runs on powerpc/11.0*.
The most important fix is that on powerpc, -msecure-plt is enabled by
default, so that resulting executables can be run with PAX_MPROTECT active.
Otherwise, we end up with executables with sections which have both
"write" and "execute" turned on, which PAX_MPROTECT rejects.
Fixes PR#60439 for lang/gcc10.
Bump PKGREVISION for both gcc10 and gcc10-libs, to adhere to rules in comments.
py-numexpr: updated to 2.14.2
Changes from 2.14.1 to 2.14.2
* Added a ``disable_cache`` parameter to ``evaluate()`` to bypass the
internal expression cache. Thanks to 27rabbitlt.
* Added Windows ARM64 wheel builds.
* Dropped support for Python 3.10.
* No longer build free-threaded Python 3.13 wheels, matching NumPy's own
support.
* Avoid keeping arrays passed as ``out=`` alive in the ``re_evaluate`` cache
* Guarded out-of-range shift counts (shift amount >= bit width) in the
integer ``<<``/``>>`` opcodes, which was undefined behavior in C and could
return garbage results. Thanks to uwezkhan
* Fixed ``run_interpreter()`` unconditionally returning success even when
the VM engine failed, so execution errors are now correctly raised
instead of silently discarded
* Fixed a reference leak of ``constsig`` on the allocation-failure path in
``NumExpr_init()``
py-oath: updated to 1.4.5
1.4.5
* fix licensing metadata in setup.py, license is BSD 3-clause not MIT
* fix ci workflow
* fix typos (Tim Gates)
* fix dead declaration for test_suite in setup.py
ld.elf_so: Fix one more mistake in handling _rtld_load_object.
This can return NULL (meaning object not found or something went wrong
with the object) or OBJ_ERR (meaning the object has DF_1_NOOPEN set or
the caller passed RTLD_NOLOAD to dlopen() and the object was not
already loaded) or a valid object.
I reviewed all paths out of _rtld_load_object to make sure they
gracefully handle all three cases (NULL, OBJ_ERR, valid object), and
this assertion was the only path that didn't.
Fixes buggy assertion added for:
PR lib/59751: dlclose is not MT-safe depending on the libraries
unloaded
May fix:
PR bin/60472: ld.elf_so(1) changes cause a segmentation fault in
dlopen(3)
nginx: Update to 1.30.4
Changes with nginx 1.30.4 15 Jul 2026
*) Security: heap buffer overflow might occur in a worker process when
using the map directive with regex matching if the map variable was
included in a string expression after a capture affected by this map;
a similar issue might happen when using a non-cacheable variable in a
string expression (CVE-2026-42533).
Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
*) Security: uninitialized memory access might occur when using unnamed
regex captures with the "slice" directive or background cache update,
which could result in worker process memory disclosure or worker
process termination (CVE-2026-60005).
*) Security: use-after-free might occur when processing a specially
crafted proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434).
Thanks to P4P3R-HAK.
ld.elf_so: Mark new variables __debugused, not __diagused.
They are used in ld.elf_so builds with DEBUG, not with DIAGNOSTIC!
PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333
