luanti: update to 5.17.0
Client / Audiovisuals
- Dropdowns now accept selection by (Mouse) Down -> Drag -> Release
- Formspecs no longer close when focusing the window
- Fix: Formspec model[] elements are again animated
- Implement basic gamepad support for in-game actions (not formspecs)
- Support multi-track animations (glTF models)
- Fixed an case where the held item stack (e.g. when dragging) size
was no longer displayed correctly
- The mouse cursor is no longer clamped to window bounds
- Shaders: Fix plants flickering when visual_scale > 1
- Chat: Pressing the Tab key now autocompletes to the next common
part of the player name
- The (main menu) progress bar now shows more media download details
- Formspec: Inventory slots and buttons now stay hovered on update
- Main menu: Mods are now sorted by their technical name (before:
directory name)
- Mostly fix the appearance of waving liquids (shader) below solid
[38 lines not shown]
chromium: update to 151.0.7922.173
* 151.0.7922.173
This update includes 7 security fixes. Please see the Chrome Security Page for more information.
[N/A][522819252] Critical CVE-2026-76017: Use after free in Chromoting. Reported by Google on 2026-06-11
[N/A][513757918] High CVE-2026-76018: Privilege elevation in Import. Reported by Google on 2026-05-16
[TBD][539032888] High CVE-2026-76019: Incorrect authorization in Workers. Reported by Anonymous on 2026-07-26
[TBD][541837151] High CVE-2026-76020: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-03
[N/A][541854084] High CVE-2026-76021: Use after free in DOM. Reported by Google BigSleep at Grape on 2026-08-02
[TBD][543798025] High CVE-2026-76022: Buffer overflow in Network. Reported by 0xAlessandro on 2026-08-07
[TBD][545124048] High CVE-2026-76023: Improper resource control in Linux Toolkit Theming. Reported by Keita Sode and Daisuke Hatakeyama of SYZD Research on 2026-08-11
* 151.0.7922.169
This update includes 15 security fixes. Please see the Chrome Security Page for more information.
[N/A][534923522] Critical CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15
[N/A][540087398] Critical CVE-2026-76036: Buffer overflow in Dawn. Reported by Google on 2026-07-28
[N/A][516715010] High CVE-2026-76033: Inappropriate implementation in CORS. Reported by Google on 2026-05-26
[12 lines not shown]
lang/nodejs: revert fix
After a discussion with wiz@ and some extended testing, it turns out
that the build fix for {macOS,NetBSD}/amd64 related to c-ares appears to
no longer be necessary. The pull-up request #7242 issued for lang/nodejs
version 26.3.1 (as per pkgsrc-2026Q2) remains relevant and correct
though, per my analysis of the issue.
Tested on NetBSD/amd64 (11.0_RC6)
py-ruff: updated to 0.16.4
0.16.4
Preview features
[flake8-use-pathlib] Add autofix for PTH116
[refurb] Restrict delete-full-slice to lists (FURB131)
[refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor
Bug fixes
Fix InvalidInstruction on Windows CPUs that do not support POPCNT
[pyflakes] Emit semantic syntax errors in string type definitions as F722
[pylint] Allow os._exit imports in import-private-name (PLC2701)
Rule changes
[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14
[13 lines not shown]
py-zmq: updated to 27.2.0
27.2 is a small release, mostly updating the build process and typing.
Lots of new type coverage.
- Add `python3 -m zmq.curve_keygen` entrypoint for creating curve key pairs
- Require Python 3.9 (drops Python 3.8)
- Stop building wheels for free-threaded CPython 3.13 (cp313t)
- Add wheels for free-threaded CPython 3.15 (cp315t)
- Fix builds on Windows with Visual Studio 2026
- Fix builds with upcoming Cython release
- Add more type coverage, fix some typing, typing compatibility with mypy 2.1
py-mcomix: update to 3.2.0.
### Bug fixes
- Adapt keybinding handling to changed API of Gtk.accelerator_parse
in newer versions of Gtk. This fixes broken keybindings.
- The pytest package needed for running MComix' unit tests is now
installed when installing the `dev` dependency group.
### Features
- MComix now respects the XDG Thumbnail Directory specification (again),
and will store thumbnails relative to XDG_CACHE_HOME instead of
relative to the home directory on UNIX systems. Nothing changes
on Windows. Note: Existing thumbnails in the former cache directory
($HOME/.thumbnails) are not moved automatically by this update.
- Added new sort order option (GLib order) that uses GTK collate keys
when computing file order.
filezilla: update to 3.71.0.
3.71.0 (2026-08-19)
+ FTP(S), SFTP: Entering an empty path in the remote path edit field now returns back to the initial home directory
- FTP(S): Fix parsing of permissions for chmod dialog on servers that include both perms and unix.mode facts in MLSD output
- SFTP: Updated fzssh to 1.4.0 to support additional algorithms and key file formats
- Official binaries are now linked against wxWidgets 3.2.11
- FTP(S): Fixed parsing of paths on servers with the server type set to DOS. Some malformed paths were wrongly accepted, confusing the engine; such paths are now rejected early.
- Refactored engine internals to remove influences from FTP-specific concepts that were permeating into other protocols
fzssh: update to 1.4.0.
1.4.0 (2026-08-18)
+ Added auth_password_change_request_event
+ Added support for ssh-ed448 keys
+ Added support for umac-128-etm at openssh.com and umac-64-etm at openssh.com MAC algorithms
+ Added support for aes128-gcm at openssh.com encryption algorithm
+ Support additional algorithms for encrypted private key files
+ Support loading of private keys from pkcs#7 (.pfx) files
- Fix building fzssh with Nettle >= 4.0
- Fixed an issue where the channel input buffer could grow without bounds
- Added compatibility flag to suppress agent connection error message due to sandboxing on macOS
libfilezilla: update to 0.57.0.
0.57.0 (2026-08-18)
+ Added support for creating impersonation_token from either user names or user ids
+ Added APIs to check whether impersonation is available before trying to create a token
+ Added fz::get_user_id() and fz::get_user_name()
+ MSW: Added passwordless impersonation tokens
+ MSW: Added desktop selection for processes spawned under impersonation
+ MSW: Process spawning under impersonation can now report setup failures through a logger
+ Improved the impersonation demo with user id, passwordless, desktop and custom command support
+ Added fz::secure_buffer that wipes memory on deallocation
+ Added fz::pbkd2 function taking hmac algorithm as argument
- MSW: Loading impersonated user profiles no longer changes caller process privileges
- MSW: Fixed EOF handling when reading redirected process output after the child process exits
coccinelle: update to 1.3.2.
* 1.3.2
** Language:
- Minor tweaks to improve accuracy
** Features:
- Add --c-internals and --cocci-internals flags for debugging
- Use pcre2 instead of pcre
** Bugfixes:
- Fix performance regression introduced in 1.2 resulting in >2x improvement
