py-authlib: updated to 1.9.4
1.9.4 — 2026-11-04
Security
IDJAGGrant stores the verified claims of the ID-JAG in request.id_jag_claims. authenticate_user can use them to resolve the user with the iss and sub claims, and tenant for a multi-tenant IdP. The documentation used to resolve the user with sub alone. An IdP, or a tenant of an IdP, could then get access tokens for the users of another one. Update authenticate_user if your server trusts several IdPs or a multi-tenant IdP. GHSA-9qr6-8289-9j56
harfbuzz: updated to 15.1.0
15.1.0
- Add buffer deserialization APIs that report progress as a byte offset, for
use from introspection bindings.
- Fix Indic shaping of the Unicode 18 Devanagari and Bengali additions.
- Fix Arabic fallback shaping: wrong ligatures when a component is missing from
the font, and disappearing marks in legacy fonts.
- Fix `COLR` glyph extents and mark positioning in fonts with empty layers.
- Fix AAT shaping: wrong `kerx` kerning (formats 1 and 2) and mark positioning
(format 4, a 14.3.0 regression), and ignored `kern` and `mort` tables with a
non-first initial state.
- Various fixes to the Graphite2 shaper.
- Report HarfRust shaping failures through `hb_buffer_allocation_successful()`.
- Fix wrong outlines in `gvar` fonts with intermediate tuples.
- Fix `hb_face_create_or_fail()` rejecting face indices with named-instance
bits set.
- Fix wrong fallback metrics: the vertical descender in fonts without `vhea`,
and the hanging baseline for some scripts.
[30 lines not shown]
sparc: Stop exposing default KERNBASE to modules
Otherwise, on kernels with non-standard KERNBASE, modules reference
illegal addresses when using curcpu(), curlwp, and so on.
Unfortunately, this cannot be pulled-up to release branches, as
this changes module ABI.
Ride on 11.99.10 version bump.
nodejs: bump libuv BUILDLINK_API_DEPENDS minimum to 1.52
Recent releases expect the following feature in libuv, or builds will
fail due to the missing field.
* unix,win: add f_frsize field to uv_statfs_t (Ben Noordhuis)
struct proc: Move p_pgrp out of p_startcopy/endcopy region.
It cannot be safely copied with the current memcpy logic that logic
uses happens without holding proc_lock, so we have to copy it
separately anyway. Leave a comment emphasizing this aspect of the
locking rules so we don't have this bug again.
Looks like p_mqueue_cnt may need similar treatment.
As a result of this kernel ABI change, welcome to 11.99.10!
PR kern/60962: fork and spawn read p_pgrp without proc_lock
shader-slang: update to 2026.21
- Document how to install Metal Developer Tools
- Return the parse result from
IGlobalSession::parseCommandLineArguments
- Allow global constant inlining with shader debug information
- Keep a global-scope call whose callee needs a local variable out of
force inlining
- Add optional slang-standard-modules embedding library
- git-worktree-add.sh: add --force to replace an existing branch and
worktree
- Fix MSVC 2019 internal compiler error in unit-test-string.cpp
- SPIR-V: emit pointer-to-signed-int casts through an unsigned
integer
- Fix CUDA Gather on combined samplers and reject GatherCmp on CUDA
- Make abs of an unsigned integer the identity on SPIR-V, LLVM and
GLSL
- render-test: create an untyped object input in the program's
session
[133 lines not shown]
security/pkcs11-provider: Do revbump after all with base openssl fix.
Previously it would build _by default_ with pkgsrc openssl; revbump
is needed because this default changes.
victorialogs*: Update to 1.53.0
Breaking changes:
Update note 1: the /internal/force_merge, /internal/force_flush,
/internal/log_new_streams and /internal/partition/* HTTP endpoints now
require the POST method for security reasons, in order to prevent
GET-based SSRF attacks. Update any scripts or automation calling
these endpoints via GET to use POST. See #1635.
Update note 2: requests to /select/vmalert/-/reload and other
/select/vmalert/* paths ending with /config or /reload now require the
-httpAuth.* credentials for security reasons. Previously, such requests
were proxied to vmalert without checking the credentials. Add the
credentials to any scripts calling these paths. See #11548.
Rest of changes, see full release notes at:
https://github.com/VictoriaMetrics/VictoriaLogs/releases/tag/v1.53.0
ggml: update to 0.29.0.
ggml v0.29.0 adds an OCP FP8 E4M3 tensor type, a new
ggml_flash_attn_ext_rows op where each query slice attends to its
own list of K/V rows, a batched tensor copy API, and initial support
for multi-node tensor parallelism through a new multi-process
communicator interface. Core improvements include bounding tensor
views by the bytes their strides reach, zero-copy GGUF export of
host-buffer tensors, and vm_allocate-based allocations on Apple
platforms. Performance work spans all major backends: new SVE
kernels in the CPU backend, DPAS flash attention for quantized KV
in SYCL, fused MoE MMQ in CUDA, faster MXFP4 mat-vec in Metal,
split-K tuning in Vulkan, and a large expansion of quantized
GEMM/GEMV coverage in OpenCL. The Hexagon backend gains support
for several new ops, including the lightning indexer, top-k mask,
conv2d and upscale.
fd-find: update to 10.5.1.
Bugfixes
Fix --absolute-path turning verbatim (\\?\) search paths into relative paths on Windows: \\?\UNC\server\share is now reported as \\server\share, and \\?\Volume{...} paths are kept intact, see #2207 (@Duo-ee)
Make --ignore and --no-hidden after -u override only their half of -u, see #2192 (@NavpreetSSidhu)
Fix inline case-insensitive regex flags incorrectly making other --and patterns case-sensitive, see #2184 (@mabunemeh)
Accept --format templates that start with - when passed as a separate argument, see #2126 (@vulragrag-star)
Don't incorrectly escape newlines in error messages, see #2104
Restore jemalloc as default allocator on supported systems
Fix the cargo binstall release URL, which named the crate (fd-find) instead of the binary (fd) and fell back to a third-party mirror
Fix integer overflow when parsing size constraints, rejecting values that exceed u64::MAX instead of panicking, see #2196 (@parneetsingh022).
Various fixes and updates to zsh completion
Fix --glob patterns when using --full-path on windows. See #2067.
