net/py-paho-mqtt: Update to 2.2.0
v2.2.0
- **Possible breaking change**: Change some exceptions from `ValueError` to `TypeError`
(in `max_queued_messages_set` and Client `callback_api_version` parameter) (Closes #972)
The breaking change is unlikely however, both exceptions are expected to only be
raised with broken code (e.g. need to pass wrong type - not just wrong value).
- Add `drop_out_messages` to discard outgoing message queue. This could be needed if broker lost
the session (Closes #935)
*: revbump for mpv-0.42.0
(At least according a code skim moviebox-tui should DEPENDS on mpv because it is
not actually linked to libmpv and so probably it does not really need a
revbump... but let's do that to be on the safer side.)
mpv: Update to 0.42.0
pkgsrc changes:
- Bump BUILDLINK_ABI_DEPENDS.mpv due .so bump
Changes:
0.42.0
==============
We are excited to announce the release of mpv 0.42.0.
Key highlights:
* libcurl based network backend with HTTP/2, HTTP/3 and connection reuse
* DVD-Video, Blu-ray HDMV and BD-J menu navigation
* DVD-Audio playback
* Direct playback of .iso images of DVD-Video, DVD-Audio and Blu-ray discs
* Dolby Vision Profile 7 enhancement layer support in `gpu-next`
* MPEG-TS programs and HLS variants are exposed as editions
* DSD-over-PCM (DoP) passthrough with `--audio-spdif=dsd`
[15 lines not shown]
libplacebo: Update to 7.387.0
pkgsrc changes:
- Bump BUILDLINK_ABI_DEPENDS.libplacebo given the .so bump, no revbump will be
needed because multimedia/mpv is the only dependency and it will be updated
shortly, this update was driven by mpv-0.42.0.
Changes:
7.387.0
This release introduces a new compositor API with support for multiple
video inputs, JSON-based scene descriptions and animation, alongside
support for Dolby Vision Profile 7 FEL. It also includes significant
improvements to color management, HDR tone mapping, frame interpolation,
deinterlacing and GPU backends, as well as numerous bug fixes.
openssh: update to 10.6p2.
Changes since OpenSSH 10.6p1
============================
This release contains a critical security workaround that affects
Linux systems that use the musl libc and PAM disabled.
This release also includes a number of bugfixes that had already
been committed on the portable OpenSSH V_10_6 stable branch.
Security
========
* sshd(8): avoid password authentication bypass that is exploitable
through sshd(8) that affects some Linux systems when built and run
with PAM support disabled. We consider the root cause of this bug
to be outside sshd, but it is exploitable via sshd and can be
avoided there.
[27 lines not shown]
multimedia/moviebox-tui: update to 0.1.29
Fixed
Providers & Stream Resolution:
Restored MovieBox TV series streaming by generating and attaching the official X-Client-Build APK certificate stamp with signed requests.
Preserved multi colon and namespaced media identifiers (such as Kitsu anime IDs) in Stremio addon stream aggregation.
Replaced hard assertions on HTTP client builders with safe fallbacks in MovieBox, CircleFTP, and DhakaFlix clients.
Networking & DNS:
Added runtime fallback to public DNS (Cloudflare, Google, Quad9) in FallbackResolver when primary system DNS lookup fails or is blocked by an ISP.
Media Playback & Sidecar Proxy:
Handled poisoned watchdog activity locks gracefully in the stream proxy sidecar loop to prevent unwrap crashes.
Standardized cross-platform temporary subtitle cleanup path joins to eliminate forward-slash path issues on Windows.
Test Infrastructure:
Synchronized environment dependent player tests with ENV_MUTEX and probed Android intent openers dynamically to eliminate parallel test race conditions.
Changed
Dependencies & Build Infrastructure:
Upgraded unicode-width to 0.2.3, log to 0.4.35, and zip to 9.2.1 (#234).
audio/spotify-player: update to 0.25.2
What's Changed
fix selected item handling in filtered lists by @aome510 in #1084
fix playback not transferred correctly upon re-connection in d7978f6
Add TLS backend features (rustls-tls / native-tls) — fixes auth panic on Termux by @Aypex in #1060
fix: use /nscpot_login redirect URI for ncspot client by @geetarOS in #1108
Fix broken NPF BPFJIT tests.
when compiling BPF byte code, bpf_jit_generate_code called by npf_bpf_compile
expects the size in array count not the raw byte size of the bpf instruction struct.
also, use npf's kernel prepare function to initialize the byte code args.
security/ruby-net-sftp: update to 4.1.1
4.0.1 (2026-10-22)
* Allow net-ssh 8 [#181]
4.0.2 (2026-10-25)
* Security: Recursive downloads refuse to follow an existing local symlink
at a server-named path instead of writing through it. The local path
passed by the caller may still be a symlink. Suggested in #162 by
srosenhamer [#186]
* Security: Recursive downloads reject file names from the server that are
not a single path component (such as `../x` or `a/b`) instead of writing
outside the target directory. Reported in #162 by srosenhamer [#185,
#162]
* Net::SFTP now works with frozen string literals enabled: `File` reads and
`Dir#glob` no longer mutate frozen strings, and `glob` no longer modifies
[114 lines not shown]
security/ruby-net-scp: update to 4.2.1
4.1.1 (2026-10-22)
* Allow net-ssh 8
* Fix frozen string literal compatibility [npezza93, mfazekas]
- Use mutable string for scp command construction
- Use mutable string for error_string initialization
* Add Ruby 3.4 and ruby-head to CI matrix
* Add Ruby 4.0+ compatibility (logger, rdoc gems)
* Drop EOL Ruby 2.3-2.5 from CI
4.1.2 (2026-10-25)
* Security: Downloads no longer apply setuid, setgid or sticky bits sent by
the server, check that a server-chosen local name matches the requested
remote basename (as OpenSSH does since CVE-2019-6111), and refuse to
follow an existing local symlink at a server-named path instead of writing
through it. The local path passed by the caller may still be a symlink.
[80 lines not shown]
