fix some minor issues
1. the DISTFILE is stored as v1.8.1.tar.gz which is prone to conflict, use
the github framework to ensure it is stored as uacme-1.8.1.tar.gz
2. the manpage uacme.1 claims a default CONFDIR which is wrong, fix that
3. a ctype error in crypto.c
use upstream e230f474b87134e8c6c85b630084c612057f253e and fix ia64 builds.
upstream commit message:
disable BROTLI_MODEL macro for some targets
PiperOrigin-RevId: 827486322
py-music21: updated to 10.5.2
10.5.2
Security release. These problems affect v10.5.1 and every earlier version of music21; only v10 gets the fix, so everyone should upgrade to 10.5.2 (pip install --upgrade music21, Python 3.11 or newer) or the latest v11 master branch (which is g
On shared Unix machines, another user could plant files in music21's temp/cache folder or settings file and run code as you. music21 now uses only a temp folder you own that no one else can write to. (Linux and other Unixes have never been officially supported, and problems like these are exactly why, but many, many users run music21 on them.)
Titles and lyrics written to LilyPond are now fully escaped, and LilyPond is run without a shell.
Clercq-Temperley text passed to parseData() is no longer opened as a file path.
converter.parse() no longer reads a file from data such as 'tinyNotation: ...' that contains /.. segments (#2109).
Behavior changes:
On Unix accounts without a writable home folder (common for web servers), settings are kept in the private music21 temp folder. Settings saved earlier to /tmp/.music21rc are no longer read. Check your existing file for vulnerabilities and recreate it at the path shown by music21.environment.Environment().getSettingsPath() (normally /tmp/music21/.music21rc or /tmp/music21-userid-<uid>/.music21rc).
common.cleanpath() no longer collapses .. after a folder that does not exist.
ConverterClercqTemperley.parseData() raises on strings that are not Clercq-Temperley data; use converter.parse(path) for files.
py-xlsxwriter: updated to 3.3.1
3.3.1 - October 28 2026
* Fixed performance issue where positioning objects such as images and comments
on a worksheet with a custom default row height.
* Fixed a (different) performance issue where positioning a large number of
objects such as comments on a worksheet with custom row heights or column
widths.
* Fixed off by one error in the worksheet :func:`set_first_sheet()` method.
* Fixed issue where :func:`autofit()` hid a column that had a user defined
width narrower than the autofit width.
* Fixed issue where :func:`add_table()` didn't detect a duplicate header name
when a user defined header matched a default ``ColumnN`` header.
[16 lines not shown]
nmap ndiff zenmap: updated to 7.993
Nmap 7.993 [2026-10-23]
o [NSE] Fixed a regression which prevented most scripts in the version
category from running.
o [Windows] Upgraded the included version of Npcap from 1.89 to 1.90, resolving
an issue that prevented most installations on Windows older than Windows 10.
See https://npcap.com/changelog
o [Ncat] Updated Ncat's ca-bundle.crt.
o [Zenmap] Fix Zenmap's handling of multiple osclass elements in Nmap
XML. Previously, each subsequent osclass in a host would overwrite the
previous osclass. [Derek Martin]
py-draftjs_exporter: updated to 7.3.1
7.3.0
Added
Add md_line_break as a reusable line break component. Markdown output now converts newlines in block text to CommonMark hard line breaks (\ + newline), degrading to a space in headings, via a default composite decorator in MARKDOWN_CONFIG and build_markdown_config.
Export md_code_block_fence from the package root, to allow customizing the code block fence character in Markdown output.
Changed
The Markdown importer now parses backslash line-end hard breaks (\ + newline) as newlines, matching the exporter's md_line_break output.
tor: updated to 0.4.9.15
Changes in version 0.4.9.15 - 2026-10-28
This is another security release that includes new DoS defenses against large
volumes of directory requests received by relays. Another significant change
is that the HSDir flag is now sticky, meaning it persists across restarts.
This release primarily affects relays so please upgrade as soon as possible.
py-flakes: updated to 4.1.0
4.1.0 (2026-10-28)
- Drop support for EOL python 3.10
- Significant performance improvements
- Fix handling of ``Literal`` and ``Annotated`` for lazy imports
appstream: updated to 1.2.2
1.2.2
Features:
* content-rating: Add attribute titles and group descriptions
* pool: Allow adding extra data locations with explicit scope and origin
* ascli: sysinfo: Print some more information about the OS, like its support period
* bundle: Drop Limba, add Manifold
Bugfixes:
* cli: Fail YAML validation for missing input
* compose: Fix build on a newer kernel with an old glibc
* pool: Work around all Flatpak origins having the same name
* pool: Include scope in metadata cache keys for Flatpak
* apt: Don't hang when tar emits lots of stderr output
* its: Support MetaInfo files that use the specification's namespace
* system-info: Don't prefix an OS ID that already is rDNS
* sysinfo: Also replace `-` with `_` at `dns_to_rdns` function
gperftools: updated to 2.19.2
gperftools 2.19.2 is out!
This is another quick bug-fix release on top of 2.19.1. It updates
the vendored aw-backtrace.
Updated aw-backtrace expands x86-64 DRAP support. With -march=x86-64-v3
(e.g. Ubuntu 26.04's amd64v3 variant) gcc realigns the stack for AVX
much more often, and a realigned function that also passes arguments
on the stack uses a DRAP frame. The layout of those frames turned out
to be more general than we previously assumed, so backtraces through
them were truncated (this affected CPU and heap profiles as well as
debugallocation's stack traces). This fixes the test failures seen on
github's Ubuntu 26.04 builders.
gperftools 2.19.1 is out!
[19 lines not shown]
PR lib/60885 - fix wscanf(3) conversion of multi-byte decimal point
This alters the way that the decimal point character in the locale
data is converted before processing float (all sizes) data fields.
This is a much simpler change to that for scanf(3), as the decimal
point (radix character) remains a single (wchar_t) character, and is
processed as such. All that is needed for wscanf() is to properly
convert the value from the locale data to a wchar_t.
No pullups planned, no NetBSD release contains any locales with
multi-byte LC_NUMERIC decimal points (or LC_MONETARY either, though
that would be irrelevant to scanf) so there is no point adding the
code to deal with something that doesn't exist there.
PR lib/60885 - fix scanf(3) handling of multi-byte decimal point
This alters the way that the decimal point character is scanned
when processing float (all sizes) data fields.
A new state is added to the state machine to handle moving through
the bytes that make up the decimal point - entered only when there
is more than one such byte.
No pullups planned, no NetBSD release contains any locales with
multi-byte LC_NUMERIC decimal points (or LC_MONETARY either, though
that would be irrelevant to scanf) so there is no point adding the
code to deal with something that doesn't exist there.
PR lib/60886 - fix weird printf(3) grouping for specific integer values
See the PR for the details - the bug is so bizarre, and impossible to
trigger with any real locale, that new ones needed to be invented to
expose it. This fixes that bug.
Since this issue cannot be observed with any real world locale, and
no locale in any released version of NetBSD has settings which would
allow the bug to manifest, no pullups for this are planned.
grafana: add some go modules manually to fix the build
show-go-modules doesn't pick these up consistently,
presumably due to our go.mod patch.
This is an annoying issue and needs to be revisited later.
tailscale: update 1.104.4
- Tailscale SSH performs Unix socket forwarding on behalf of the
authenticated user rather than as root, preventing authorized peers
from using local and remote forwarding to reach root-only Unix
sockets such as the Docker socket or the tailscaled local API. This
fix addresses a security vulnerability described in TS-2026-014.
- Tailscale SSH bounds the memory used for session handling and
releases it when the peer disconnects, preventing denial of service
through unbounded memory growth in tailscaled from continuous
window-change messages and environment variable appends. This fix
addresses a security vulnerability described in TS-2026-015.
- Tailscale Serve restricts TCP forwards to Unix socket backends and
revalidates backend paths on each connection, preventing access to
privileged Unix sockets such as the tailscaled local API socket.
This fix addresses a security vulnerability described in
TS-2026-016.
[6 lines not shown]
