go: update to 1.27.4 and 1.26.11 (security)
These releases include 12 security fixes following the security policy <https://go.dev/doc/security/policy>:
- net/http: HTTP/1 server crash due to MaxBytesReader header race
For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
"Connection: close" header is automatically set without synchronization,
which might race with another header being set explicitly in the server
handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
MaxBytesHandler can crash due to runtime panic if its handler reads the
request body concurrently with writing the response header.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.
- cmd/go: unexpected code execution via --sysroot, -target, -isysroot,
-Wl,-syslibroot, and -x cgo flags
[279 lines not shown]
mail/thunderbird: Disable debug symbols for non-debug builds
Turns out debug symbols are enabled by default even when --disable-debug is
given, which are thrown away at installation time due to
--enable-install-strip. We must pass a separate option
--disable-debug-symbols to ${WRKSRC}/configure. This massively reduces the
memory requirements from >32 GiB to ~3 GiB, as well as disk usage from
several tens of GiB to just 9.8 GiB.
textproc/groff-pdfmark
Adding groff-pdfmark package to make available the pdfmark macros and supporting scripts that were removed from the main groff distribution in recent versions.
libmatheval: update to 1.1.12.
Version 1.1.12
* Updated build system to work with current GNU autotools. Guile is
needed for test suite only, which now works with Guile 2.0 and later.
* Fixed buffer overflows in the Fortran interface and in handling of
very long strings (reported by Hongduo Zhao).
* Fixed memory leaks on parsing error, and in Flex generated scanner.
* Characters not part of the notation are now reported as error,
instead of being echoed to standard output.
* Fixed wrong simplification of 0^x.
* Fixed wrong derivatives of asinh() and acoth() functions.
* Inverse hyperbolic functions are calculated by C library, fixing
inaccurate results for very small or very large arguments.
* Added min(), max() and select() functions. Note that min, max and
select therefore can not be used as variable names any more.
* Library exports its interface only, so that its internal symbols
(including these of Lex and Yacc generated code) do not clash with
[3 lines not shown]
lang/rust/cargo.mk: Make cargo-vendor-crates recipe more robust.
1. Fail if digest command fails for any reason.
2. Don't leave each final .json file around if interrupted.
No functional change intended in the success case.
firefox153: update to 153.7.0
Mozilla Foundation Security Advisory 2026-127
Security Vulnerabilities fixed in Firefox ESR 153.7
Announced
November 10, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.7
#CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
Reporter
Mozilla
[886 lines not shown]
lang/rust/cargo.mk: Set CARGO_BUILD_JOBS=${_MAKE_JOBS_N} in MAKE_ENV.
This fixes excessive parallelism in py-maturin, anything that uses
Python setuptools-rust, and generally anything that assembles its own
cargo(1) command line instead of using ${CARGO_ARGS}.
py-pdf: updated to 7.0.1
7.0.1, 2026-11-10
Security (SEC)
- Determine image buffer sizes using the actual bytes per pixel
Performance Improvements (PI)
- Don't parse content streams without text operators in extract_text()
Bug Fixes (BUG)
- Decode UTF-8 text strings
- Fix page reference lookup for hierarchical page trees in PdfWriter
- Copy the operations in ContentStream.replicate()
- Deal with more rendering intents for inline images
py-pipx: updated to 1.18.16
1.18.16 - 2026-11-07
Changes
pipx ensurepath no longer claims it added the binary directories to PATH when they were already there; the summary now says so and points at --force for adding them again
Fixed
Rebuild shared pip environments created with Python older than 3.10, and refresh existing applications’ references to the rebuilt environment before running their installers
py-sqlparse: updated to 0.6.1
End of Maintenance
Version 0.6.1 marks the final release of sqlparse.
After many years of maintaining this project, I have decided to end its
active development and maintenance. The increasing volume of security reports,
particularly those generated through automated vulnerability research, has made
the workload unsustainable for me as a sole volunteer maintainer.
No further releases, including security fixes, are planned.
The source code and existing releases will remain available.
I would like to thank everyone who has contributed to sqlparse over the years.
Notable Changes
[27 lines not shown]
py-alembic: updated to 1.20.1
1.20.1
bug
[bug] [autogenerate]
Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don’t store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.
[bug] [autogenerate] [postgresql]
Fixed rendering of the PostgreSQL DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.
[bug] [autogenerate] [postgresql]
Fixed false-positive “Computed default cannot be modified” warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.
[bug] [autogenerate] [postgresql]
Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.
[bug] [postgresql]
[13 lines not shown]
py-aioquic: updated to 1.7.2
1.7.2
* Fix data written to a stream returned by
:meth:`~aioquic.asyncio.QuicConnectionProtocol.create_stream` being
truncated when it was a :class:`memoryview` whose items are wider than one
byte.
* Improve type annotations: all functions in the library are now annotated.
* Fix the demo application with Starlette 1.0.
* Remove the SiDUCK example, as the draft it implemented expired without being
adopted.
lz4: updated to 1.11.1
1.11.1
LZ4 v1.11.1 is a point release, whose main purpose is to fix LZ4_resetStreamHC(), an obsolete symbol, on dirty memory. While reset functions are expected to reset valid states, LZ4_resetStreamHC() has been working fine on dirty memory, which made it possible to employ it as an initializer instead. Hence, some (hopefully rare) applications may have developed a dependency on this property. v1.11.0 did not respect this undocumented behavior: on a dirty state, compression at levels >= 10 could result in a write out of bounds. Thus v1.11.1 is released to restore the previous behavior.
This is mostly of importance for distributions and package managers, as liblz4 may be paired with older binaries that are no longer updated. LZ4_resetStreamHC() was replaced by LZ4_initStreamHC() in v1.9.0 (2019). Applications still employing this symbol are invited to migrate.
This release also restores the (deprecated) unprefixed lz4frame enums, for applications that still need them. They now generate a deprecation warning: once again, actively maintained applications should move to the prefixed names. Build configurations accidentally broken in v1.11.0 work again: make with BUILD_STATIC=no or BUILD_SHARED=no, and MinGW with clang and lld.
mit-krb5: updated to 1.22.3
Major changes in 1.22.3 (2026-11-09)
Fix a logic error when checking PAC server checksums [CVE-2026-111423].
Check for unkeyed checksums when validating CAMMAC verifiers [CVE-2026-71199].
Fix a loophole in the KDC's client authdata filtering which could allow clients to include fake PAC and CAMMAC authdata values when requesting service tickets. These fake values would be rejected by application servers, were it not for the two bugs noted above.
Check for the lockdown_keys attribute when processing password change protocol requests in kadmind [CVE-2026-107884].
In libgssrpc, when processing RPC messages using the RPCSEC_GSS flavor, use the verified service type included in the RPC request to determine how to unwrap arguments and wrap return values, instead of the unverified service type included during authentication [CVE-2026-118380].
In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI is only needed for very old (pre-1.4) clients [CVE-2026-112322] [CVE-2026-112323].
Fix numerous null pointer deferences, read overruns, unbounded memory allocations, and memory leaks that could be used as denial of service attacks against the KDC, kadmind, application servers, or client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200] [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778] [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316] [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319] [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323] [CVE-2026-119079].
Fix a client crash when a KKDCP proxy daemon closes the TLS session without supplying any response data.
Shut down kpropd gracefully when a termination signal is received, when operating in incremental propagation mode.
Detect when an incremental propagation update is applied to a nonexistent principal; when this happens, force a full resync instead of crashing.
Fix a KDC crash when the LDAP KDB module loses its connection to the LDAP server.
Avoid a crash on macOS when the native API ccache type is used before and after forking a process.
When an application accepts a GSS context without asking for delegated credentials, discard any credentials sent by the initiator without parsing them first.
On Windows, prevent buffer overflows when the KDC sends an unexpectedly long prompt string via OTP preauthentication.
On Windows, move the default per-machine krb5.ini location from C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as the former location could be pre-created by an unutrusted user before KfW installation.
[3 lines not shown]
