py-wagtailmenus: updated to 4.1
4.1.0
* Added LOCALIZE_MENU_ITEMS setting for i18n locale-aware menus
* Added testing for Wagtail 7.4 (LTS).
* Removed support for Wagtail 6.3 LTS, 7.1 and 7.2 (end of life).
* Removed support for Django 5.1 (end of life).
* Raised minimum Wagtail version to 7.0.
* Removed dead Django <4.1 compatibility shim in `models/menus.py`.
py-wagtail: updated to 7.4.2
7.4.2
CVE-2026-54259: Improper restriction handling on Documents and Images chosen endpoints
CVE-2026-54260: Denial of service via unbounded filter specs in the image preview
CVE-2026-54261: Improper permission handling in image preview
CVE-2026-54262: Pages translations can be created without page permissions when using simple_translation
CVE-2026-54263: Reflected XSS in dynamic image URL generator view
Fix: Prevent spurious migrations when there are missing child blocks in StructBlock.Meta.form_layout (Matthias Brück, Sage Abdullah)
Fix: Prevent error in usage views when using gettext_lazy for a model's verbose_name (James Biggs)
Fix: Prevent development markdown files from being added to virtual environment root upon installation (Dan Braghis)
Fix: Prevent StreamField blocks referenced multiple times from losing their required state after deferred validation (Sage Abdullah)
Docs: Add missing return in example views for template components (Tibor Leupold)
py-django-filter: updated to 26.1
Version 26.1 (2026-07-11)
* Added testing for Django 6.1.
DRF integration will require the upcoming DRF v3.18.
See https://github.com/encode/django-rest-framework/pull/9978
* Added testing against Python 3.14.
opencv: updated to 4.14.0
4.14.0
Core module:
Fixed copyTo on empty fixed-type matrices
Improved precision of RotatedRect::points
Fixed UB in cv::error when breakOnError set to true
Fixed cv::mul overflow for U16 type
Revert "Disable IPP with AVX512 in cv::compare because of performance regression"
Fixed UBSan function pointer type mismatch in countNonZero
Fixed heap-buffer-overflow in YAML parseKey for empty keys
Optimized flip Horizontal
Added AVX VNNI support
Fixed meanStdDev on Windows for ARM
Added NEON implementation for rotate function
Fixed inplace transpose race by enforcing LLSS ordering via local barrier in OpenCL
Fixed incorrect results for in-place flip on strict OpenCL implementations
[32 lines not shown]
rumdl: update to 0.2.40.
0.2.40
Fixed
md003: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so rumdl fmt added a horizontal rule the document never had (7363c34)
md077: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged (58fb25b)
reflow: keep wiki links, shortcodes and math whole inside a wrapped span (db12c2c)
config: honor the documented MD033 table_allowed alias, which silently dropped the configured value (db2c204)
config: stop reporting MD013's documented semantic-link-understanding alias as an unknown option (1539a64)
parity: make the markdownlint comparison harness actually run (182763c)
Documentation
md013: document that ignore-link-urls affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat (c4f8bad)
0.2.39
[9 lines not shown]
libssh: update to 0.11.5.
Follow upstream version numbering again.
version 0.11.5 (released 2026-07-21)
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59843: Denial of service via zero advertised channel packet size
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Bugfixes:
[9 lines not shown]
py-pillow_heif: update to 1.5.0.
## [1.5.0 - 2026-07-22]
### Added
- Grid(tiled) image encoding: `options.GRID_TILE_SIZE` option, `tile_size` parameter for `save` and `grid_tile_size` parameter for `register_*_opener`. #317
- `info["tiling"]` dictionary with the grid info for tiled images. #317
- `PH_LIBHEIF_CMAKE_ARGS` environment variable for `build_libs.py` to pass extra `cmake` arguments to the libheif build.
- Windows ARM64 wheels.
### Changed
- Minimum required `libheif` version is `1.23.1`.
- Releases are now tag-triggered and published to PyPI with attestations via Trusted Publishing. #432
- `libheif` was updated from the `1.23.0` to `1.23.1` version. #445
- `libde265` was updated from the `1.1.0` to `1.1.1` version. #434
### Removed
[3 lines not shown]
py-utils: updated to 4.0.0
Version 4.0 is a modernization release: the public helpers you already rely on
are unchanged, but the package underneath is faster to import, stricter about
types, and built with a modern toolchain.
py-scrapy: updated to 2.17.0
Scrapy 2.17.0 (2026-07-07)
Highlights:
- Security bug fixes
- HTTP/2 and SOCKS proxy support for ``HttpxDownloadHandler``
- Improved settings for changing allowed TLS versions
Security bug fixes
- ``s3://`` requests now use HTTPS by default, instead of plaintext HTTP.
Previously, :class:`~scrapy.core.downloader.handlers.s3.S3DownloadHandler`
sent signed S3 requests over plaintext HTTP unless
``request.meta["is_secure"]`` was set to a true value, exposing the request
path, the AWS ``Authorization`` header, the ``X-Amz-Security-Token`` header
(when using temporary credentials), and the response contents to network
[160 lines not shown]
py-rarfile: updated to 4.4
4.4
Security fixes:
* Skip CRC check for some old subblocks. Previously
`rarfile` tried to calculate header CRC by reading
data payload for those, but that could cause excessive
allocations.
Fixes:
* RAR5: Reattempt passwords after trying wrong password
when header encryption is used.
* Restore fd position in file type detection functions.
nushell: updated to 0.114.1
0.114.1
This patch release fixes issues found after enforce-runtime-annotations became
opt-out in the last version, improving runtime type checks and error reporting.
gflags: updated to 2.3.1
2.3.1
ci: Point test.yml at main instead of master
ci: Add GitHub Actions workflow to build with Bazel
bazel: Support QNX in Bazel and more Bazel 9 fixes
appstream: updated to 1.1.4
1.1.4
Features:
* sysinfo: Assume a more modern display for the handset chassis template
* sysinfo: Assume a more modern display for the tablet chassis template
* sysinfo: Initial code to autodetect the display size on Wayland
* sysinfo: Handle fractional display scaling via xdg-output
* Implement support for GCVE as vulnerability database provider
* qt: Sync enum mirrors with the C library
* qt: Add Artifact, Checksum, Reference, Review and Agreement wrappers
* qt: Wrap missing C API on existing classes
* reviews: Add simple interface to fetch ODRS reviews for a component
* reviews: Implement support for submitting reviews
Specification:
* docs: Suggest using the longest display side for maximum size constraints
[12 lines not shown]
