samba4: updated to 4.24.7
Changes since 4.24.6
--------------------
o Ralph Boehme <slow at samba.org>
* BUG 16097: POSIX ACL backend silently discards erros when processing NT
ACLs with non-canonical ordering
o Volker Lendecke <vl at samba.org>
* BUG 16225: dns client problems related to EDNS usage
o AndrĂŠas Leroux <aleroux at tranquil.it>
* BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP
when packet is larger than 4k
o Stefan Metzmacher <metze at samba.org>
* BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP
when packet is larger than 4k
[19 lines not shown]
nodejs: updated to 26.8.2
26.8.2 (Current)
Notable Changes
- doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel)
- meta: refine the security vuln posture for experimental features (James M Snell)
- deps: update Undici to 8.10.2 (Node.js GitHub Bot)
- deps: update OpenSSL to 3.5.8
py-checkdmarc: updated to 6.0.1
6.0.1
Fixed
SPF: the RFC 6652 reporting modifiers ra=, rp=, and rr=, added in 5.8.0 and removed later, are recognized again; their values are validated against RFC 6652 §3 (rp= per erratum 6579) and surfaced in the parsed result as ra, rp, and rr next to exp, and a malformed value is warned about and ignored instead of failing the record. Warnings also cover the two RFC 6652 §3 semantic rules — rp= and rr= do nothing without ra=, and ra= is ignored in a record reached through an include — and exp= and these modifiers are now honored after all in any order
6.0.0
An RFC conformance audit compared every module line-by-line against its governing specification (SPF: RFC 7208; DMARC: RFC 9989/9990; TLSRPT: RFC 8460; MTA-STS: RFC 8461; SMTP/MX: RFC 5321/7505/2181; DNSSEC: RFC 4033-4035; SOA: RFC 1035/2181; BIMI: draft-brand-indicators-14) and found 81 discrepancies, most confirmed by executing the old code. This release fixes all of them. Many fixes change validation verdicts — records the specs call valid are no longer rejected, and records they call invalid are no longer accepted — hence the major version. This release also contains everything staged for 5.18.0, which was never released.
Breaking changes
MX STARTTLS/TLS testing is now opt-in: pass --check-mx-tls on the CLI or check_mx_tls=True to check_domains(), check_mx(), or get_mx_hosts(). The --skip-tls flag and skip_tls parameter are still accepted but do nothing, and passing skip_tls emits a DeprecationWarning. As a result, MX host results no longer carry the tls and starttls keys, and the CSV tls/starttls columns are empty, unless TLS testing is turned on
check_dnssec() performs a real chain-of-trust check anchored at the parent zone's DS record instead of verifying a zone's DNSKEY against itself. A zone with no DS at its parent (including "island of security" zones) is insecure per RFC 4033 §4.3 and returns False; a broken zone such as dnssec-failed.org returns False through any resolver, where it previously returned True through non-validating resolvers. Bogus (SERVFAIL with DS present) is now warned about distinctly from unsigned
Unknown and extension tags/fields now parse with a warning instead of failing validation, as each spec requires: SPF unknown modifiers (RFC 7208 §6), DMARC unknown tags (RFC 9989 §4.7), TLSRPT extension fields (RFC 8460 §3), MTA-STS extension fields and policy keys (RFC 8461 §3.2), and BIMI unknown tags (draft §4.3). An unknown field is ignored only when it fits the spec's own extension grammar; a malformed extension name or value still fails the record or policy
A TXT record unrelated to the record type being queried is now discarded instead of failing validation, per each spec's discard rule: TLSRPT (RFC 8460 §3.1), MTA-STS (RFC 8461 §3.1), BIMI (draft §7.2), and DMARC report authorization records (RFC 9990 §4). Each query also now returns the record carrying the version tag rather than whichever TXT record the resolver listed first. When a real record sits beside the unrelated one, the unrelated record is reported as a warning; when it is the only record present, the check reports that no record exists. DMARC authorization records are discarded silently, and a wildcard authorization record that is unrelated is still an error. Callers catching UnrelatedTXTRecordFoundAtTLSRPT or UnrelatedTXTRecordFoundAtBIMI should note that those queries now raise SMTPTLSReportingRecordNotFound and BIMIRecordNotFound instead
Records the old code wrongly accepted are now invalid: SPF records exceeding the 10-DNS-lookup limit through a, ptr, or macro-valued terms (RFC 7208 §4.6.4 — the limit was previously only enforced for some mechanism types), SPF include of a domain with no SPF record (permerror per RFC 7208 §5.2), MTA-STS policies missing a required key (RFC 8461 §3.2 — the check was dead code), BIMI records missing the required l= tag (draft §4.3), lowercase v=dmarc1 (RFC 9989 §4.8), and an SPF qualifier on a modifier or a value on the all mechanism (RFC 7208 §12)
[54 lines not shown]
py-aiostream: updated to 0.7.2
0.7.2
Change return type of return Callable annotation in async_ to Coroutine[Any, Any, T], which is narrower than Awaitable[T]
Replace asyncio.iscoroutinefunction with inspect.iscoroutinefunction
Allow concatmap, flatmap and switchmap to receive an async function
py-platformdirs: updated to 4.11.8
4.11.8
fix: ignore relative XDG base directory paths
fix: return one user path for root under multipath
fix: preserve literal percent signs in user-dirs paths
fix: retain Homebrew site directories inside virtual environments
py-regex: updated to 2026.9.10
2026.9.10
Fixed version.
2026.9.9
Fix Python API error propagation in match helpers
Preserve Python Exceptions in Input Decoding and String Detachment
Prevent Invalid Pointer Use and Exception State Corruption in Byte String Joining
Propagate Allocation and Internal Errors During Pattern Compilation and Scanner Execution
xz: updated to 5.8.4
5.8.4 (2026-09-09)
IMPORTANT: This includes a fix for a security issue that affects all
XZ Utils versions since 5.0.0. This and a few other fixes have also
been committed to the old stable branches (v5.2, v5.4, and v5.6) in
the xz Git repository. Those fixes are marked below. No new 5.2.x,
5.4.x, or 5.6.x releases will be made.
* liblzma:
- lzma_alone_decoder(), lzma_lzip_decoder(),
lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
invalid memory access after memory allocation has failed and
the application reinitializes the existing decoder to decode
a different file. This bug could at least result in a crash.
This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
(Also in v5.2, v5.4, and v5.6.)
[120 lines not shown]
Allow the user to decline roll forward by passing option "-o nolog" to
mount_lfs. Internally this is implemented by interpreting the MNT_LOG
flag to mean "do roll forward". Option "-o log" defaults on in mount_lfs(8).
