rump: Copy struct proc::p_pgrp explicitly
Now that it's not in p_startcopy/endcopy, the memcpy isn't enough.
Should fix the thousands of test failures I caused by moving p_pgrp
out of the p_startcopy/endcopy range!
PR kern/60962: fork and spawn read p_pgrp without proc_lock
p5-HTTP-Body: update to 1.25.
TOOL_DEPENDS -> TEST_DEPENDS for a test dependency.
1.25 2026-11-05 18:47:08+01:00 Europe/Berlin
- SECURITY, CVE-2026-117500: the suffix of an upload's filename is
worked out from its last 255 bytes only, only when $file_temp_suffix
is unset, and for the default $basename_regexp by a string search
instead of the regexp; a filename of many dots ending in a backslash
made the default $basename_regexp take time quadratic in its length
(7 s per part at the 32 KiB header limit, once per part) in the
default configuration
- SECURITY, CVE-2026-117501: a chunked body is framed line by line with
a limit on the chunk-size line ($HTTP::Body::max_chunk_line_size,
1024 bytes), chunk data is passed on as it arrives instead of being
held until the chunk is complete, malformed framing (a line that is
no chunk-size line, a size that does not fit an integer, chunk data
not followed by CRLF) croaks instead of buffering forever, and
nothing after the trailer or after the body parser is done is kept
[21 lines not shown]
Update to version 2.46
- fix downloads of wrong audio for some words that give multiple
search results in 'pthai-url-lingopolo
- add consonant names to 'pthai-consonants
- allow audio play of individual consonants in 'pthai-highlight-say-bounds
- return full thai name and class in 'pthai-lookup-consonant
- for 'pthai-show-* functions, unify display formatting
- clean up comments in a few places
routinator: Update to version 0.16.0
Breaking changes
Enabled ASPA and BGPsec by default. The command line options --enable-aspa and --enable-bgpsec have been replaced with --disable-aspa and --disable-bgpsec, respectively. (#1112)
Enabled strict validataion mode is by default. The command line option --strict has been replaced with --relaxed. (#1112)
Added the ability to separately configure if and where repository issues get logged via the new repository-log-level, repository-log and friends. The previous log-repository-issues was removed in favour of this new scheme.
This also slightly changes the JSON produced by the /status endpoint. (#1088)
Limited the value of the refresh option to a week to avoid integer overflows. (#1144)
New
Added support for Resource Signed Checklists (RSC, RFC 9323). (#1077)
Added support for SLURM v2 which adds filtering and adding ASPA assertions. (#1106)
Improvements
Reject any rsync argument starting with --rsh. (#1150)
Reject a history-size of 0. (#1151)
Bug fixes
Correctly merge ASPAs with an AS0-only provider list. (#1143)
[11 lines not shown]
basilisk: Update to 2026.11.01
This brings basilisk up to the most recent version of UXP (Pale Moon's
engine), with associated web compatibility and security fixes.
tooi: Update to 0.28.0
Changes:
0.28.0 (2026-10-28)
* Fix cropped links in cards
* Fix image loading in some cases
* Don't attempt to render video thumbnails
* Use a code editor to show status source as JSON instead of Python
* Fix showing thread on boosted statuses (127, thanks Taylor-Finch)
* Display better error messages when loading or rendering of an image fails
0.27.0 (2026-07-04)
* Add reply indicator to timeline (thanks Taylor-Finch)
* Allow passing options to external image viewer (thanks Taylor-Finch)
* Add pageup/pagedown/home/end shortcuts to timeline (thanks Taylor-Finch)
* Add option to pass URLs to external image viewer instead caching files locally
(thanks Taylor-Finch)
0.26.0 (2026-06-05)
[93 lines not shown]
geography/qgis: Update comment about LTR status
3.44 remains LTR, and a 4.x blessed as LTR is expected in Spring 2027
at the earliest. (And just this week, 4.4.0, was delayed due to
unresolved blockers.) Point out wip/qgis for people looking for qgis4
in the meantime.
py-cachetools: updated to 7.3.0
v7.3.0 (2026-11-05)
- Use ``OrderedDict`` for defined and faster ``LFUCache`` eviction.
- Various unit test improvements.
- Minor type stub improvements.
- Minor documentation improvements.
py-authlib: updated to 1.9.5
1.9.5
Security
authlib.jose refuses as an HMAC secret every OpenSSH public key or certificate that it can load as an RSA, EC or OKP key. It used to accept a key with a tab after the key type, and certificates. These keys verify RS256 and EdDSA tokens, so anyone who knew the public key could forge an HS256 token for an application that did not restrict the algorithms. This completes the fix for CVE-2026-114615. GHSA-f7j6-p4qx-gq99
translate-toolkit: updated to 3.20.4
3.20.4
This release improves translation key validation and fixes Nextcloud
JSON fallbacks for untranslated strings.
