py-yarl: updated to 1.25.1
v1.25.1
Contributor-facing changes
- Stopped running the test suite inside the riscv64 wheel builds; every wheel
for that architecture is built under emulation and the test run did not fit
in the job timeout.
v1.25.0
Bug fixes
- Made the C and pure Python quoting implementations reject ``%`` in ``safe``
or ``protected`` when requoting and a space in ``safe`` or ``protected`` for
query strings, since the two implementations disagreed on those
configurations.
[15 lines not shown]
py-wcwidth: updated to 0.9.1
0.9.1 *2026-09-23*
* **Bugfix** a regression in 0.9.0 Python and libwcwidth_ `width()`_ mis-measured CSI sequences
over 64 bytes
* **Performance** improvement of ~15% for 11 many Python API functions when using
default ``ambiguous_width`` and ``term_program`` arguments.
0.9.0 *2026-09-23*
* **New** Optional CPython extension using libwcwidth_, improving performance 10-58x
* **Drop Support** for Python 3.8
ansible-lint: updated to 26.9.0
26.9.0
Features
feat: support example section in file meta/argument_specs.yml
Fixes
fix: resolve short mock modules during syntax check
fix: propagate extra_vars to import_playbook syntax check
fix: resolve nested include_tasks relative paths
fix: resolve include_tasks paths from playbook dir
fix: apply profile-level skip list during linting
fix: honor warn_list after --fix rewrites task names
fix: mock_modules clobbering collections and args false positives
fix: inject plain-name mock roles path regardless of --offline
fix: warn users when directory expansion discovers new files
[13 lines not shown]
py-httpx2: updated to 2.13.1
2.13.1 (September 23rd, 2026)
Fixed
* Calculate `Content-Length` from the remaining bytes when a file is passed as `content=`, respecting its current position.
* Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown.
2.13.0 (September 14th, 2026)
Changed
* Require `brotlicffi` 1.2.0.2 or later for the `brotli` extra on non-CPython implementations.
py-httpcore2: updated to 2.13.1
2.13.1 (September 23rd, 2026)
Fixed
* Honor the `sni_hostname` extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection.
* Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled.
2.13.0 (September 14th, 2026)
Changed
* Require Trio 0.34.0 or later for the `trio` extra.
py-stone: updated to 3.5.5
3.5.5
Migrate PyPI publishing to Trusted Publishing
Update packaging requirement from >=26.2 to >=26.3
Update coverage requirement from >=7.15.2 to >=7.16.0
Update setuptools requirement from >=83.0.0 to >=84.0.0
Update pytest requirement from >=7.0.0 to >=9.1.1
gvproxy: updated to 0.8.9
0.8.9
fix(gvproxy): propagate --listen-stdio flag into config
Fix issue where udp_proxy enters a tight loop polling the socket if the read returns 0 with err = nil.
gvproxy: Fix --log-file having no effect
fix: apply ec2MetadataAccess bypass to UDP forwarder for link-local traffic
unixgram transport: build for all Unix(-like) platforms again - can be used by libkrun on Linux
gammu: updated to 1.45.0
1.45.0
[!] * Automatically split ordinary CLI text SMS into linked parts without
requiring -len (GitHub issue 413). Use -maxsms 1 to require one part.
[-] * Apply explicit SMS text length limits after decoding, including stdin
and text supplied after the length option. Honor -16bit regardless of
its position relative to length options.
[-] * Preserve Unicode surrogate pairs and special-message modes when
limiting SMS text. Reject oversized stdin instead of sending a prefix.
[+] * Bundle native MySQL support in the Windows installer.
[-] * Validate SMS PDU encoding inputs.
[-] * Respect AT modem SMS storage and notification capabilities, handle
Quectel and Alcatel notifications, and decode errors by manufacturer.
[-] * Enable USSD on Huawei E176 and disable bulk SMS listing on Samsung
GT-S3600i.
[-] * Encode AT clock timezones in quarter-hours and report missing command
echo during modem initialization.
[11 lines not shown]
tor: update to 0.4.9.13.
Changes in version 0.4.9.13 - 2026-09-23
This security release includes several high severity fixes, once again
originating from the LLM report firehose. The fixes affect all Tor
components: relays, clients, and onion services. We strongly recommend
upgrading as soon as possible.
o Major bugfixes (security):
- Avoid a set of possible memory corruption, double-free, and null
pointer dereference bugs that could occur with some reverse DNS
virtual address configurations. Fixes bug 41381; bugfix on
0.1.0.1-rc. Tracked as TROVE-2026-051.
- Avoid cacheing DNS PTR responses when DNS caching is disabled.
Previous code to prevent this caching parsed the response
addresses incorrectly, and defaulted to caching when the address
could not be parsed. Fixes bug 41380; bugfix on 0.2.4.7-alpha.
Tracked as TROVE-2026-050.
[100 lines not shown]
www/ruby-sass-embedded: update to 1.105.0
1.105.0 (2026-09-22)
* Refactor spec (#417)
* Refactor importer and logger (#416)
* Improve logger performance (#418)
* Bump sass from 1.104.1 to 1.105.0 in /ext/sass (#419)
* Add support for meta.load() and related features (#414)
* Refactor importer and logger (#420)
* Use argument forwarding (#421)
www/ruby-faraday1: update to 1.10.6
1.10.5 (2026-02-12)
What's Changed
* Backport CVE-2026-25765 by @iMacTia in #1665
1.10.6 (2026-06-24)
What's Changed
* See if tests pass against Ruby 3.3 by @jturel in #1677
* Backport GHSA-98m9-hrrm-r99r fix to 1.x: add param_depth_limit to
NestedParamsEncoder by @iMacTia with @Copilot in #1681
New Contributors
* @jturel made their first contribution in #1677
