GraphicsMagick p5-GraphicsMagick: updated to 1.3.48
1.3.48
Security Fixes:
Address ImageMagick CVE CVE-2026-42050, ImageMagick security advisory GHSA-7mxf-ff4f-jj7p, which is related to an X11 display buffer overflow. This is really a minor issue since it requires X11 keyboard input and causes no harm.
DCM: In RLE decoder, detect and report end of input. Reported-by: Tristan Madani.
DCM: Convert from ASCII numeric value to unsigned value, with error detection. Avoid problems caused by negative values. Reported-by: Tristan Madani.
display: Correct bounds checking for 'filename' length. Thanks to Petr Gajdos for a heads-up regarding the disparity.
GradientImage(): Fix 'pixel_packets' and 'indexes' addressing logic for NorthGravity. Addresses "[security] GraphicsMagick GradientImage: heap-buffer-overflow READ in NorthGravity branch reached from gm convert (magick/gradient.c:284)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
ImageToBlob(): Fix memory leak which may occur if WriteImage() fails.
LOCALE: Bound the length passed to strncpy() and string terminator. Addresses "[security] GraphicsMagick LOCALE coder: stack-buffer-overflow WRITE in ReadConfigureFile reached from gm convert (coders/locale.c:257)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
META/IPTC: Prevent reading past the end of a truncated/short IPTC profile.
MIFF: Correct scope of 'values' reallocation error handling. Addresses "[security] GraphicsMagick MIFF reader: heap-use-after-free WRITE via stale cursor on values-buffer realloc failure (coders/miff.c:1048)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
MSL: Properly log warnings and errors using LogMagickEventList() given a va_list. Reported-by: Tristan Madani.
PCD: Over-provision the per-channel Huffman decode buffers and detect any attempt to overflow them. Discovered and reported by Cipher - Causal Security (https://causalsecurity.com/).
PCX: If image has more than 256 colors, save as a DirectClass type. Addresses "[security] GraphicsMagick PCX writer: heap-buffer-overflow WRITE in WritePCXImage colormap fill (coders/pcx.c:1186)" from David Korczynski. Credit to Anthropic Claude and Ada Logics.
PNG: Use only values from GetImageCharacteristics() since IsMonochromeImage() and IsGrayImage() may produce different answers. Addresses "[security] GraphicsMagick MNG re-encode: heap-buffer-overflow WRITE in ExportGrayAlphaQuantumType reached from gm convert (magick/export.c:1105)" as reported by David Korczynski via email on May 28, 2026. Credit to Anthropic Claude and Ada Logics.
[11 lines not shown]
cmake cmake-gui: updated to 4.4.1
CMake 4.4.1
* gitlab-ci: make `needs` explicitly empty where possible
* gitlab-ci: move macOS arm64 jobs to `tart` runners
* gitlab-ci: extend Xcode CI job timeout to 3 hours
* ci: do not limit testing based on load in a `tart` runner
* Tests: Update RunCMake.Framework expected output for macOS 26.4
* try_compile: Restore toleration of toolchain file setting internal variable
* GNUInstallDirs: Document cross-compiling behavior w.r.t. lib directories
* Style: Replace some UTF-8 characters with ASCII equivalents
* CPackIFW: Add recent release versions to search list
* FASTBuild: Prefer first compiler in PATH on Windows
* CTest: Restore support for dashboard client build targets
* Help: target_sources: Align descriptions with signatures
* Presets: Forward presets-file to workflow steps
* FindPython: fix SABIModule detection failure
* FindPython: Add support for pydebug ABI flag on Windows
* CMAKE_TEST_BUILD_DEPENDS: Use config when evaluating test dependency targets
[17 lines not shown]
haproxy: updated to 3.4.3
3.4.3
- BUG/MEDIUM: h3: fix parser desync on error with multiple frames
- BUG/MINOR: mux_quic: prevent multiple STOP_SENDING emission per stream
- BUILD: quic: workaround a gcc bug saying "maybe used uninitialized" when USE_TRACE=0
- CLEANUP: traces: get rid of a few rare empty args in TRACE calls
- MINOR: compiler: add a macro to ignore all arguments
- MINOR: trace: always pretend to use args when disabled
- BUG/MINOR: trace/quic_frame: use buf, not trace_buf in chunk_frm_appendf()
- BUG/MEDIUM: mux_quic: do not free QCS if STOP_SENDING to sent
- MINOR: mux_quic: use separate error code for STOP_SENDING
- BUG/MEDIUM: mux_quic: complete stream shutdown for read channel
- BUG/MINOR: quic: ignore STREAM after MUX closure on BE side
- BUG/MEDIUM: fd: Fix a deadlock when closing other tgroups fds
- BUG/MEDIUM: tcpcheck: Add proxy used for healthcheck sections in proxies list
- BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
- MINOR: chunks: Add function to get a large/regular chunk depending on a buffer
- BUG/MEDIUM: chunk: Review chunks usage to not retrieve a large buffer by error
[80 lines not shown]
sqlite3: updated to 3.53.4
3.53.4 (2026-07-24):
Fixes for problems in 3.53.0 (and 3.53.1, 3.53.2, and 3.53.3) mostly coming from AIs. See the check-in timeline for details.
build.sh: consider tools/make/configure and tools/make/*.in
When deciding if nbmake is out-of-date the files in tools/make
should be considered too.
Reviewed by: riastradh
news/eilmeldung: update to 1.7.1
1.7.1 - 2026-07-27
This is a minor release with mainly bugfixes. However, there is a kind of breaking change:
breaking change for scoop users: eilmeldung is now in scoop main.
bugfix in article content display
no content is shown if now article is selected
tags are now updated correctly
an error on command clear now leads to an error message instead of a crash
undo tagging now bevaves correctly if an article already had the tag before
bump dependencies
1.7.0 - 2026-07-20
🙈 Ever thought, it is a shame that life has no undo function? 🙈 At least, eilmeldung has one now!
[16 lines not shown]
devel/feluda: update to 1.15.0
What's Changed
build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.16.1 to 2.22.0 in /examples/java-example/maven-example in the maven group across 1 directory by @dependabot[bot] in #228
feat(licenses): detect licenses from SPDX source file headers by @anistark in #229
fix(licenses): offline license text and copyleft restrictiveness by @anistark in #230
refactor: tidy string-argument ergonomics with impl Into<String> by @anistark in #231
docs: surface the github action and open community channels by @anistark in #232
feat(scan): flag foreign license headers in own source files by @anistark in #233
fix(java): resolve maven pom property placeholders in parent coords by @anistark in #234
feat(go): migrate license resolution to the official pkg.go.dev API by @anistark in #235
feat(tui): overhaul the --gui table layout, theme, and interactions by @anistark in #236
feat(cli): update --help and --version output by @anistark in #237
build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1 in /examples/java-example/maven-example in the maven group across 1 directory by @dependabot[bot] in #239
fix(node): strip YAML quotes from scoped dep names in pnpm-lock.yaml by @01luyicheng in #238
feat(scan): detect vendored and unmanaged dependencies by @anistark in #240
docs: redesign the site styling and add host serve by @anistark in #242
Update vim to version 9.2.0859
Changes:
- patch 9.2.0859: GTK2: Link error
- runtime(python): highlight the 'lazy' soft keyword
- patch 9.2.0858: MS-Windows GUI: white flash when VimEnter is slow
- patch 9.2.0857: popup: opacity popup over a terminal is not cleared when closed
- runtime(python): Fix indenting for brackets within python byte strings
- runtime(sh): fix Bash/Ksh array highlighting after an escaped paren
- patch 9.2.0856: GTK4: undercurl rendering is inefficient
- CI: Bump the github-actions group across 1 directory with 3 updates
- patch 9.2.0855: 'showcmd' not redrawn with empty mapping triggered on timeout
- runtime(osc52): don't use osc52 provider if gui is running
- runtime(doc): clarify expandcmd() and "~" behaviour
- runtime(doc): Tweak documentation style a bit
- runtime(doc): remove incorrect note about spellcapcheck and the first word
- runtime(doc): document &t_8u as &t_8f and &t_8b
