py-jupyterlab: updated to 4.6.4
4.6.4
Bugs fixed
- Backport of security patches on 4.6.x branch
- Cache and throttle path resolution to avoid requests storm
- Fix race when starting the search - keep correct filter
- Fix PyPI extension manager `package.json` inspection for `tar.gz` archives
- Fix resizing optimization for larger notebooks
- Preserve kernelspec metadata when spec is unavailable
- Fix respecting `commsOverSubshells` option in `connectTo()`
- Show context actions for all images, not only SVGs
- Save sidebar section expansion state from the hidden flag
- Fix memory leak when Property Inspector is open and other issues exposed by new linter rules
Maintenance and upkeep improvements
[9 lines not shown]
py-jupyterlab-server: updated to 2.28.1
2.28.1
Maintenance and upkeep improvements
- Fix CI, bump min Python version to 3.10
- Add regression test for serving symlinked labextensions
- Fix develop extensions feature with tornado 6.5.9+
py-json5: updated to 0.17.3
v0.17.3 (2026-10-09)
Bump the indirect dependency on urllib3 to 2.8.0 to pick up a security fix.
v0.17.2 (2026-10-09)
Commit, then release :(.
v0.17.1 (2026-10-09)
I screwed up the release and published a package from my dev fork rather than the main repo as v0.17.0; the package should be fine, but for reproducibility purposes I needed to redo it and get the tags right.
v0.17.0 (2026-10-09)
Use a packaged version of glop, rather than relying on it being checked out alongside this repo. This should make the package properly self-contained, and now we can enforce that the grammar is up-to-date in presubmit.
Rework the project dependencies. As before, the module still has no runtime dependencies. However, we will now only support doing most development on Python 3.11 or newer; older versions will only support running the tests. This means the dev venv config will only install the dev packages in that newer environment; this should make Dependabot happier.
Rework how the //run script works; the previous pylint and mypy checks have been moved into the checks command, which will now run all of the static analyzers, not just ruff check. The script also now consistently supports -f/--failfast across the commands, not just during tests.
There are no code changes in this release other than bumping the version numbers.
rdiff-backup: updated to 2.2.7
2.2.7 (2026-10-20)
Changes
* FIX: add restricted unpickler to whitelist allowed classes
* CHG: ignore I/O errors (EIO) on ACL or Extended Attributes and
continue backup.
* FIX: ignore NotImplementedError as raised by acl_win
* FIX: copy file when Cross-Device link error is wrongly raised during
move/rename e.g. on ZFS.
* FIX: include/exclude with UNC-style path
* FIX: issue with OSError.errno discrepancies when the source and
destination are on different platforms.
* NEW: rdiff-backup uses metadata like the checksum to validate the
need for a regression, greatly improving speed of regression.
atari800: updated to 7.2.1
7.2.1 (2026/09/13) — build fixes only
This release just fixes some build errors so for 7.2.x new features read below:
7.2.0 (2026/09/12) — on-screen keyboard and better joystick handling
Core:
More accurate emulation: cycle-precise POKEY timer IRQs and
VSCROL DLI timing; fixes the "Rewind 2" demo
Altirra OS updated to 3.49, Altirra BASIC to 1.59
F1-F12 special keys (open-menu, OPTION, SELECT, START, etc.) can now
be rebound via the UI
On-screen keyboard improvements: enabled by default, rebindable
F11 hotkey, SDL2 controller button mapping, console key support
Dropped the /etc/atari800.cfg system-wide fallback on Unix
[19 lines not shown]
ddns-route53: Update to 2.16.1
This release is built with Go 1.26.10 to address CVE-2026-111943.
Certificate verification now rejects chains containing eight
revoked eMudhra intermediate certificates whose private keys were compromised.
The blocked intermediates are:
Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C
The G3B intermediates belong to eMudhra BV, and the G3C
intermediates belong to eMudhra Inc. See the eMudhra
Intermediate CA Compromise for more details.
There are no functional changes in ddns-route53 itself compared to v2.16.0.
py-scikit-learn: updated to 1.9.1
1.9.1
Support for Array API
- |Fix| Fixed classification metrics to accept pandas labels when array API dispatch
is enabled and predictions are from a different array API namespace or
device.
By :user:`Olivier Grisel <ogrisel>`.
Metadata routing
Refer to the :ref:`Metadata Routing User Guide <metadata_routing>` for
more details.
- |Fix| Metadata is now correctly routed to the sub-estimator of meta-estimators such as
:class:`feature_selection.SelectFromModel`, :class:`feature_selection.RFE`,
:class:`feature_selection.RFECV`, :class:`feature_selection.SequentialFeatureSelector`,
[112 lines not shown]
compat_linux_test_project: update to 0.11 and take MAINTAINER role
Changes since 0.10:
Ensures that the output_file only has printable characters so that the
shar reference logs are valid.
knot-resolver: Update to 6.5.1
Thursday, October 22, 2026
Security
fix crash when forwarding - DoS via NULL deref Reporters: Yuqi Qiu and Xiang Li, Nankai University (AOSP Lab).
fix crash or loop - DoS Reporters: Joshua from AISLE
exhaustion of ports for outgoing TCP - DoS The attack only worked if /network/out-interface-* was configured. Reporters: Jonathan Horovitz, Yehuda Afek, and Anat Bremler-Barr from Tel Aviv University.
Bugfixes
python: fix logging level mapping bug, regressed in 6.5.0 (!1918)
fix build with musl libc, regressed in 6.5.0 (!1917)
DoH: the unencrypted mode opened also a UDP socket (!1921)
Improvements
performance of reloads with large cache on tmpfs (!1924)
git-lfs: updated to 3.8.1
3.8.1 (22 October 2026)
This release introduces security fixes for four vulnerabilities that
have been assigned the identifiers CVE-2026-69260, CVE-2026-69261,
CVE-2026-105802, and CVE-2026-105803. These vulnerabilities apply
to all of the operating systems supported by Git LFS.
* CVE-2026-69260:
When Git LFS sends a remote command via SSH, it does not properly
format the argument it derives from the remote SSH URL. Servers
which pass remote commands to a shell without sanitizing their
arguments may be induced to execute malicious programs.
Git LFS has resolved this problem by fully quoting the arguments
of the remote commands it sends via SSH.
[32 lines not shown]
buf: updated to 1.75.0
1.75.0
- Fix `buf build` dropping `message_set_wire_format`, `weak` field options, and MessageSet
extensions, and truncating MessageSet extension ranges, when a file has an unused import.
- Fix LSP crash when hovering on a CEL string literal containing a byte that is not valid UTF-8,
such as `'\x95'` in a protovalidate rule.
- Add `BUF_DEBUG`, `BUF_LOG_FORMAT`, and `BUF_TIMEOUT` environment variables as defaults for the
`--debug`, `--log-format`, and `--timeout` global flags. Flags take precedence when set.
- Add support to images for option dependencies declared with the `import option` syntax in
edition 2024 and later.
- Add support for Protobuf edition 2026.
- Update built-in Well-Known Types to Protobuf v36.2.
- Update managed mode to skip `cc_enable_arenas` for edition 2026 files, where the option was
removed.
- Fix `buf convert` and `buf curl` ignoring the `(pb.enumvalue.json).string` option for enum
value JSON names.
libansilove: updated to 1.4.3
libansilove 1.4.3 (2026-10-21)
- Update README to add a link to the Nix package
- Allow overriding the definition of ANSILOVE_EXTERN (Thanks Martin Fiedler)
- Provide a compatibility fallback implementation for strndup (Thanks Martin
Fiedler)
- Document support for PabloDraw 24-bit ANSI sequences
- Fix line wrapping when the cursor exceeds the column limit in ANSI and
PCBoard loaders
- Advance TAB to the next tab stop in ANSI and PCBoard loaders
(Both issues were reported by Aaron Myles Landwehr, thanks!)
- Fix black background with the blink bit in BinaryText files when iCE colors
are disabled (Thanks Joash Chee)
