libssh: update to 0.12.1.
version 0.12.1 (released 2026-07-21)
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
* CVE-2026-59843: Denial of service via zero advertised channel packet size
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Allow hybrid ML-KEM key exchange in FIPS mode
[53 lines not shown]
mame: update to 0.289.
After two long months, MAME 0.289 is ready, and it’s an undeniably
massive update! But before we talk about emulation, there are a
few more mundane things to mention. The sdljoy joystick input module
now supports game controllers with up to 128 buttons. Finally,
outputs have been overhauled, improving performance and fixing
issues, but you may need to update your configuration if you’ve
got external programs hooked up, and some artwork files may need
updating.
You’ll notice a number of systems and coprocessor cards based around
NS32000 family CPUs are now working. If you aren’t familiar with
it, the NS32000 architecture was one of the first single-chip CPU
families with a 32-bit ALU. It used a highly orthogonal instruction
set with clear influences from Digital Equipment Corporation’s
earlier work. In retrospect, it didn’t have enough registers, the
instruction encoding was too complex, it took them too long to
overtake Motorola’s 68k family’s performance, and bugs in the
[31 lines not shown]
moor: update to 2.16.2.
2.16.2
Before this release, a file that the syntax highlighter saw as one
single token -- a file holding nothing but a number, for example --
came out with every character in the same color.
With this release, highlighting that would look uniform is skipped and
the text is shown plain. Thanks @knirch for reporting #445!
Also in this release:
On Windows, arrow and function keys now work immediately after
returning from an editor opened with "v", instead of being ignored for
up to a tenth of a second
Faster .zst decompression on arm64 (Apple Silicon), and corrupt .zst
input now reports an error rather than decoding to garbage
Compressed files and streams are now properly closed, so moor no
[31 lines not shown]
OpenJPH: update to 0.31.0.
This release has a few fixes, new features, and many people contributed to it.
Importantly, this release adds Qfactor.
This release however breaks API and ABI.
rumdl: update to 0.2.49.
0.2.49 - 2026-08-02
Security
config: keep an extends target's path and contents out of messages about it (72bcb49)
An extends value is expanded from the environment before it is resolved, so naming the resolved path in an error or warning printed environment variable values wherever that message went, which under CI is the build log. extends also points at an arbitrary path, so a target that is not valid TOML had its offending line quoted back. A file reached through extends is now named by the reference as written, and its own text is never repeated. A config you name yourself is unchanged, and rumdl config, the language server's report to its editor, and RUST_LOG=debug still show resolved paths.
Reported privately by Shuvam Kumar.
Fixed
md072: keep every trailing newline when sorting frontmatter keys (a5e7c40)
fix-utils: measure fix ranges against the content the rule read (2ed4238)
md044: read a wikilink's display text, not the page name it hides (51d584e)
md039: keep wikilinks and nested images intact when trimming link text (aabd859)
md045,md057,md044: stop reporting wiki embeds as images (1147d17)
[85 lines not shown]
zxing-cpp: update to 3.1.1.
Patch release
QRCode: improve Version 1 detection rate
QRCode: fix detection regression in 3.1.0
python: fix use of 'None' keyword usage and wrong '**kwargs' tag
MicroPDF417: fix out of bounds access
MultiFormatWriter: fix BarcodeFormat::Aztec and QRCodeModel2 support
Android: make binary a little smaller (hidden symbols)
PDF417: match codewords using integer arithmetic by @nyluke in #1138
ReedSolomon: add missing header for GCC-16 by @parona-source in #1137
py-cryptography: update to 50.0.0.
50.0.0 - 2026-07-31
~~~~~~~~~~~~~~~~~~~
* **SECURITY ISSUE**:
:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
Credit to **@X1AOxiang** for reporting the issue
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
* Added ``xof()`` class methods to
:class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
[51 lines not shown]
py-beets: update to 2.13.1.
2.13.1
Bug fixes
Fixed source distributions not including the bundled man pages. 🐛 (#6882)
2.13.0
New features
Convert Plugin: Add new configuration option convert.refresh and command-line option --refresh, allowing to force Convert Plugin operation when original file is newer than existing converted file.
Edit Plugin: The interactive import editor now shows album-level fields (as configured by albumfields) as a YAML header section when editing an album import. Fields that appear in both itemfields and albumfields are shown only in the header, not per-track.
FetchArt Plugin: Add fetch_for_asis setting that enables fetching album art from online sources even when imported files are not modified by the auto-tagger. Default is no which means FetchArt Plugin looks for art only in the local filesystem when the user (or quiet_fallback) chooses asis.
FtInTitle Plugin: Apply featured-artist rewriting to fetched metadata before commands such as MBSync Plugin use it. 🐛 (#1153)
LastGenre Plugin: Add support for normalizing genre spellings and naming variants with a new configuration option aliases. The feature is enabled by default and ships with a built-in list of regex patterns. These patterns can be replaced via the user's configuration. The default whitelist and genre tree were audited against the top 1,000 Last.fm tags: canonical names are now consistent across both files, long-standing mismatches between them have been resolved, and entries align with the built-in alias patterns. 🐛 (#6466)
Lyrics Plugin: Add lrcmux backend, which aggregates lyrics from various other sources.
Lyrics Plugin: Added a --no-keep-synced command option to override keep_synced: yes for a single manual lyrics fetch.
[29 lines not shown]
