Import unbound-1-26-2 (previous was 1-26-1)
Unbound 1.26.2
This release has a number of security fixes.
The release is signed with the OpenPGP software signing key that is
in use since Jan 1st 2026:
User ID: NLnet Labs releases signing key G2 <releases at nlnetlabs.nl>
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45
The key is available from https://nlnetlabs.nl/signing-keys .
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Bug Fixes:
[25 lines not shown]
use PR_ZERO on on pool allcoated memory and get rid of memset.
currently, xfer is zeroed using the wrong size.
remove it and simplify code.
reviewed by christos@
resterm: Update to 1.16.1
Compromised eMudhra certificates
The private keys of eight intermediate certificates from the
certificate authority eMudhra were so weak that anyone could
recover them from the public certificates. With those keys,
anyone can issue a valid HTTPS certificate for any website.
eMudhra has revoked the certificates, and browsers and
operating systems are blocking them.
(CVE-2026-111943, Mozilla's write-up)
resterm 1.16.1 rejects any certificate chain through these
intermediates on every platform. resterm 1.16.0 can
still accept them on systems whose certificate store
doesn't block them yet.
py-coverage: updated to 7.17.0
7.17.0 — 2026-10-22
- Dropped support for Python 3.10.
- Binary wheels are now provided for iOS and Android. This allows the use of
the optimized C tracer on mobile platforms.
- Fix: three or more levels of nested ``with`` statements could make a ``with``
line look like a branch with an exit that can never happen. Using the
sys.monitoring core, these phantom branches were reported as partial. Other
cores hid the problem but still counted the phantom branches in the total.
Closes `issue 1987`_.
- Fix: a comment or string that merely mentioned ``if True:`` or
``while True:`` could mark its line as a branch that is known to be partial,
so a branch that never ran was reported as taken. These built-in patterns
now only match at the start of the statement. Closes `issue 2314`_.
[64 lines not shown]
fix openjdk versions in patterns, it's e.g. 1.11.0.22 for a openjdk11.
Note that openjdk-bin doesn't carry the leading "1." about, but all
the native-built openjdks do
py-wcmatch: updated to 11.2
11.2
- **NEW**: Drop support for Python 3.10.
- **FIX**: Require `bracex` 3.2 for various bug fixes.
- **FIX**: Filter filename iterables without evaluating their "truthiness", allowing collections such as `numpy`
arrays (@Lushiyao5).
- **FIX**: Improve performance when multiple `*` are used for file name matching. Performance is only improved in
cases where variable length `EXTGLOB` patterns would not interfere with matching. Issue found by (@gistrec).
- **FIX**: Apply one pattern limit to includes and exclusions when scanning with `glob` and `iglob`, and preserve
unlimited expansion across multiple patterns with negative limits.
- **FIX**: Use the documented default limit of 1000 patterns in `WcMatch` instead of 32.
- **FIX**: Preserve unlimited pattern expansion with exclusions in compiled matchers and translation, and enforce
finite limits when exclusions consume the entire pattern budget.
- **FIX**: Fix an invalid regular expression error when an `EXTGLOB`/`EXTMATCH` inverse group, `!(...)`, is followed
by an extended group that contains another extended group, e.g. `!(a)@(b|*(c))`.
- **FIX**: Fix an `EXTGLOB`/`EXTMATCH` star group, `*(...)`, being matched as literal text when it directly follows
another `*`, e.g. `a**(b)`.
[8 lines not shown]
py-bracex: updated to 3.2
3.2
- **NEW**: Drop Python 3.10 support.
- **FIX**: Fix some division that could cause 1 off issues with limit checking.
- **FIX**: Fix issues related to large range numbers and truncation when compared to Bash (@Rexyysilent).
- **FIX**: Fix commas dropped or added when rebuilding invalid brace groups.
py-uv py-uv-build: updated to 0.13.5
0.13.5
Enhancements
Report incompatible self-dependencies directly in resolution errors
Python
Add CPython 3.15.1, 3.14.9, and 3.13.17
Preview features
Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants
Performance
Reduce peak memory use when resolving dependencies across multiple environments
[14 lines not shown]
net/xfr: update to 0.12.1
[0.12.1] - 2026-10-21
Security
Distrusted emSign intermediates are rejected — updated webpki-roots and webpki-root-certs to 1.0.10 and rustls-webpki to 0.103.16, closing RUSTSEC-2026-0381, RUSTSEC-2026-0383 and RUSTSEC-2026-0382. The private keys of several emSign intermediate CAs are now public. The bundled roots still included emSign ECC Root CA - G3, and certificate verification did not reject the compromised intermediates, so a network attacker holding one of those keys could impersonate an HTTPS server xfr talks to: the update check and the Prometheus push gateway. The new roots drop that CA and verification rejects paths through those intermediates. QUIC tests are unaffected, since xfr authenticates QUIC peers with the PSK channel binding, not the public CA set. Lockfile-only; no source or API changes.
[0.12.0] - 2026-10-17
Security
Updated rustls to 0.23.46 — closes RUSTSEC-2026-0346 (Debug impls could expose TLS session secrets), RUSTSEC-2026-0349 (a ServerHello could downgrade the handshake to classical key exchange), RUSTSEC-2026-0347 (data leak after an ECH rejection; xfr does not use ECH), and RUSTSEC-2026-0348 (brotli certificate decompression; xfr does not enable rustls's brotli feature). rustls backs xfr's QUIC transport and its HTTPS clients (update check, Prometheus push gateway). Lockfile-only; no source or API changes.
Added
xfr::persistence::atomic_write(path, bytes) — the library's crash-safe save routine (used for JSON and CSV results and preferences) is public, so other output paths can share it.
Changed
Behavior change: client options given with a subcommand are now a usage error — xfr --json -t 5 -P 4 diff a b or xfr -p 9000 serve used to run with those options silently dropped, so xfr -p 9000 serve listened on the default port instead of 9000. Top-level test, output and connection options typed alongside serve, diff or discover now fail with a usage error (exit 2) naming the option. When the subcommand takes the same option, the error's tip shows the corrected command (tip: put serve options after the subcommand: xfr serve --port 9000); otherwise it says the option only applies to client tests. Scripts and service units that put options before serve must move them after it (xfr serve -p 9000). --theme, --log-file, --log-level, --no-update-check and --completions still work with any subcommand, but as top-level options they go before it: xfr --no-update-check serve works, xfr serve --no-update-check is a usage error. Only --theme is also accepted after the subcommand, and serve has its own --log-file and --log-level, which go after it. Options set through environment variables (XFR_DURATION, XFR_PORT, XFR_PSK, ...) are not affected.
[42 lines not shown]
net/ttl: update to 0.24.1
[0.24.1] - 2026-10-21
Security
webpki-roots and webpki-root-certs 1.0.7 → 1.0.10 clear RUSTSEC-2026-0381 and RUSTSEC-2026-0383: the bundled Mozilla root set still trusted intermediates issued by the breached emSign CA. webpki-roots backs the update check (ureq); webpki-root-certs reaches ttl via reqwest's platform verifier (PeeringDB).
rustls-webpki 0.103.15 → 0.103.16 clears RUSTSEC-2026-0382 (certificate verification could accept distrusted intermediates). Reaches ttl via rustls in reqwest and ureq.
[0.24.0] - 2026-10-16
Added
Native Windows build (#141): the crate now compiles and its test suite runs on Windows, checked by a new build-windows CI job. Live tracing still needs WSL2: on native Windows ttl exits with a pointer to WSL2 instead of probing, while --replay and --diff work. No pre-built Windows binaries yet. Contributed by @athallajovian9-cyber.
MPLS and interface details in text reports (#146): --report (including --replay <file> --report) now prints indented lines under each hop with RFC 5837 interface data (role, name, address, ifIndex, MTU) and the MPLS label stack (label, traffic class, bottom-of-stack flag, TTL), tagged with the responding IP. Responders are sorted by address so ECMP output is deterministic, and interface names are sanitized before printing. Hops without extensions are unchanged.
--replay-size-limit <MiB> (#157): opens trusted --replay/--diff recordings larger than the default 10 MiB cap (range 1-1024). The limit is enforced while reading, and the error for an oversized file now says how to raise it.
Changed
Depend on pnet_packet (plus pnet_datalink on unix) instead of the pnet umbrella crate, dropping the unused pnet_transport. IP_HDRINCL is now set through socket2 instead of a hand-written setsockopt.
ICMP extension indicator (#145): hops whose responders sent RFC 5837 interface or MPLS data show a + beside the host in the main table. The marker checks every responder, and the hop detail view now includes extension data from secondary responders too.
[38 lines not shown]
