py-markdown: update to 3.11.2.
Sanitize attribute names in the fenced_code and legacy_attrs extensions so an
attribute name cannot break out of its tag and inject markup (#1663).
For backwards compatibility, revert the enforcement of CommonMark style
punctuation rules (#1657).
py-importlib-metadata: update to 10.1.0.
v10.1.0
=======
Features
--------
- Detecting whether a distribution supplies metadata no longer reads or parses
that metadata where the metadata directory can be inspected instead, so
retrieving a distribution by name, which prefers the valid candidates, is
substantially faster.
- Reverted the preference for the greater metadata directory added in v9.1.0.
The ordering was lexicographic on the directory name and not on the parsed
version, so it only approximated a preference for the newer version. Where a
path supplies more than one metadata directory for a distribution, discovery
once again reports them in the order the path supplies
(python/cpython#100666).
[37 lines not shown]
py-filelock: update to 4.2.4.
4.2.4
Keep GitHub Release notes free of extra blank lines while retaining
the PyPI and version comparison links. #863
4.2.3
Creating a lock on a Python 3.15 interpreter without types.LazyImportType
no longer triggers AttributeError at exit. #860
Handle EFTYPE when a no-follow open refuses a symlink in a soft
reader/writer lock's protocol tree, so heartbeat reports lost
ownership rather than a transient refresh error.
tree-sitter-markdown: update to 0.5.4.
What's Changed
Allow make test to run via the top-level Makefile by @mavit in #244
ci: bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #253
fix(scanner): prevent serialization buffer overflow on deep nesting by @WillLillis in #279
fix(scanner): end and comment blocks on their opening line by @hasansezertasan in #272
Avoid quadratic parse time on long * / _ / ` / ~ runs by @brandon-arrendondo in #278
fix: recognize a closing code fence at the end of input by @hasansezertasan in #271
fix(python): make setup.py work again by @WOnder93 in #249
Remove junk Requires: @TS_REQUIRES@ in tree-sitter-markdown*.pc by @mavit in #246
Fix python bindings by @atupone in #264
fix: regenerate parser with tree-sitter 0.27.1 by @clason in #281
Add a field for info_string nodes in code fences by @the-mikedavis in #201
fix(rust): build for wasm32 with tree-sitter 0.27 by @lexoliu in #265
fix(scanner): drop the MSVC pragma from UNUSED by @WillLillis in #282
release v0.5.4 by @clason in #283
grafana-prometheus-datasource: update to 13.2.4.
Update Go to 1.27.3. (#380)
Fix security vulnerability CVE-2026-102990 by overriding basic-ftp
to ^6.2.1 (#386)
Fix security vulnerabilities (CVE-2026-93749, CVE-2026-17495)
Keep the error source of failed resource and Search API requests.
Timeouts, cancellations, connection errors and other downstream
errors from these requests are now reported as downstream, not as
plugin errors. (#388)
Update contributing docs (#380)
Update MonacoQueryField to respect the theme.components.height.md
variable (#378)
dmarc-report-viewer: update to 2.6.2.
## [2.6.2] - 2026-10-21
* Fix: Recognize more types of zipped XML attachments with DMARC reports (see issue #101).
* Updated Cargo dependencies.
## [2.6.1] - 2026-10-18
* Fix: Flag DKIM auth only when no signature passes (fix for issue #85 by @FrauJulian).
* Removed XML and JSON count from dashboard and added next update time.
* Updated Cargo dependencies.
harfbuzz: update to 15.0.0.
Overview of changes leading to 15.0.0
Thursday, October 22, 2026
=====================================
- Support for the new tables and formats in the ISO Open Font Format (OFF) 5th
edition is now enabled by default:
* New tables and formats for 24-bit glyph indices (a.k.a. beyond-64k): the
`GLYF`, `LOCA`, `GVAR`, `MAXP`, `HHEA`, `HMTX`, `VHEA`, and `VMTX` tables,
`cmap` format 15, `VORG` version 2, `COLR` `PaintGlyph2`, the 24-bit
`GSUB`, `GPOS`, `GDEF`, `BASE`, and `JSTF` formats, and extended TrueType
Collection directories.
A test font, `NotoSans-beyond64k.ttf`, which merges the Noto Sans fonts
into a single font, can be found at:
https://drive.google.com/file/d/1vMQI9mZMzfKIMHD96Iie40Oyo9NnnweH/view
* Cubic curves in `GLYF` outlines.
* The `DMAP` table, supported since 14.6.0.
- Support instancing axes not referenced by retained `VARC` data. The latest
`VARC` test fonts can be found at:
[30 lines not shown]
powerdns-recursor: Update to 5.4.9
Released: 26th of October 2026
Bug Fixes
Do not depend on specific order of thread local object destruction.
References: #18216, pull request 18231
patch: update to 2.8.1.
Changes in version 2.8.1:
* Prevent creation of out-of-tree files (CVE-2026-115207).
Changes in version 2.8:
* The --follow-symlinks option now applies to output files as well as input.
* 'patch' now supports file timestamps after 2038 even on traditional
GNU/Linux platforms where time_t defaults to 32 bits.
* 'patch' no longer creates files with names containing newlines,
as encouraged by POSIX.1-2024.
* Patches can no longer contain NUL ('\0') bytes in diff directive lines.
These bytes would otherwise cause unpredictable behavior.
* Patches can now contain sequences of spaces and tabs around line numbers
and in other places where POSIX requires support for these sequences.
* --enable-gcc-warnings no longer uses expensive static checking.
Use --enable-gcc-warnings=expensive if you still want it.
[6 lines not shown]
