p5-MIME-tools: update to 5.522.
5.522 2026-10-27 Dianne Skoll <dianne at skoll.ca>
* VERSION 5.522 RELEASED
* Many security issues were addressed (see the following ten CVEs)
Issues were brought to my attention, and patches supplied, by the
CPANSec security group.
* parse_params: flag a parameter list that could not be parsed
Detect additional ambiguous parse situations when parameter
names contain illegal characters. Fixes:
CVE-2026-116264 invalid parameter hides boundary/filename
* parse_params: check the boundary after RFC 2231 reassembly
Another ambiguous-parse case was missed (trailing space after
boundary was not detected for RFC-2231-encoded boundaries.) Fixes:
CVE-2026-116265 RFC 2231 boundary skips ambiguity checks
[106 lines not shown]
p5-HTTP-Body: update to 1.24.
1.24 2026-10-26 18:28:01+01:00 Europe/Berlin
- SECURITY, CVE-2026-116131: urlencoded bodies are limited to
$HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
$HTTP::Body::MultiPart::max_parts parts (1000 each); reported and
patched by CPANSec
- SECURITY, CVE-2026-116132: the temporary file of an upload that is
still incomplete at DESTROY-time is now always deleted; reported and
patched by CPANSec (also fixes RT#84004)
- SECURITY, CVE-2026-116133: a multipart body without a boundary or with
a malformed delimiter line no longer takes quadratic time; a malformed
delimiter line now croaks, and padding or an epilogue after the close
delimiter is accepted; reported and patched by CPANSec
- SECURITY, CVE-2026-116134: a multipart part's header block is limited
to $HTTP::Body::MultiPart::max_header_size bytes (32768) and
$HTTP::Body::MultiPart::max_header_lines lines (100); reported and
patched by CPANSec
- SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in
[22 lines not shown]
Fix PR kern/60919 (mysterious new RAID sets after a component is spared out)
Note that this fix will only prevent _new_ kernels with the fix from creating
these "rogue" sets from spared out components of mirrors. It will not ignore
nor delete any sets that may have been created in this way by an old kernel
without the fix; to fix that, the user should raidctl -A no the rogue set and
then delete it. This is left as it is now from an abundance of caution; being
less conservative could cause a lot of trouble for any users who may have,
unfortunately, initialized multiple RAID sets with the same serial number.
Other related fixes:
1. Sparing out a component at runtime could leak its vnode and also
disappear it from raidctl -s output if another spare was subsequently
added.
2. Make raidctl -r, -a, -R work with components that have been spared out.
Fixes some leaks and zeroes existing labels.
[10 lines not shown]
Initial import of brotli 1.2.1, that fixes CVE 2026-111497.
also includes enhancements in dictionary handling, static init of
some data to reduce size, and minor other clean ups.
the new go and python code, as well as the ignored C encoder are
not included in this import as we don't use them, and they are
more than half the space.
gatus: Update to version 5.38.0
What's Changed
feat(alerting): add Resend alerting provider by @geffersonFerraz in #1830
fix(maintenance): validate maintenance windows for external, DNS and SSH endpoints by @anandghegde in #1804
fix(alerting): Redact telegram token from errors on send failure by @hippi345 in #1843
fix(websocket): apply the client timeout to reads and writes by @somaz94 in #1845
fix(ssh): support keyboard-interactive authentication for endpoints and tunnels by @peckto in #1863
fix(security): add comprehensive logging and diagnostics for OIDC (#1802) by @tech00exploere in #1862
fix(jsonpath): support object keys containing dots via quoted accessors by @leotemtem in #1864
fix: Honor minimum-reminder-interval for external endpoints by @yzxcj797 in #1773
chore(alerting): restyle matrix alerts with errors, safe links and escaping by @mazzz1y in #1875
upx: Updated to version 5.3.0
Changes in 5.3.0 (28 Oct 2026):
* new format win64/arm64; based on work by hoptodesk and Johannes Schindelin
* bug fixes - see https://github.com/upx/upx/milestone/25
postinstall(8): Do obsolete _then_ opensslcertsrehash.
Otherwise any certificates removed by an update will remain in
/etc/openssl/certs/ca-certificates.crt, which is very bad!
PR bin/60932: postinstall obsolete + opensslcertsrehash interact badly
news/brochure: update to 0.13.0
Full mouse support, notification cards, and a full-screen image viewer.
Highlights
Drag scrollbars and lists with the mouse
Notification cards with live refresh progress
Click an article image to view it full screen
Popups and dialogs work with the mouse
Text selection follows scrolling and copies fully
multimedia/moviebox-tui: update to 0.1.27
[0.1.27] - 2026-10-23
Fixed
Media Playback & Subtitle Engine:
Removed --play-and-exit from VLC player invocations so the player stays active across adaptive and HLS chunk transitions.
Reset legacy Android player defaults in graphical X11 and Wayland sessions so native Linux players take precedence over external Android intent dialogs.
Prioritized native Linux media player paths over foreign container fallbacks on Linux systems and preserved dynamic auto-player resolution for unconfigured sessions.
Providers & Stream Resolution:
Recovered playable signed MP4 streams via /resource-position/v2 when MovieBox returns deprecation notice clips, querying exact seasons and episodes and reporting accurate file sizes.
Stripped the DASH Referer header on direct MP4 streams to prevent CDN HTTP 429 throttling.
Bumped the MovieBox stream cache schema to v2_ to discard stale cached deprecation notices.
Filtered out unhosted MovieBox /hls/ signed cookie targets in manifest resolution, which stops unplayable H.264 stream entries from failing with HTTP 404 during downloads or media playback.
Download Engine & Batch Queue:
Fixed season batch downloads by arming is_waiting_for_download_stream during queue steps, eliminating immediate empty-list download calls that aborted multi-episode queues.
Reset the download resolution state lock on 4KHDHub resolver timeouts and errors so failed mirror resolutions do not block subsequent download attempts.
Added sequential single-connection fallback to the internal HTTP downloader when multi-worker segmented range requests receive HTTP 403, 429, or network disconnects.
[12 lines not shown]
