py-urllib3: update to 2.6.0.
2.6.0 (2025-12-05)
==================
Security
--------
- Fixed a security issue where streaming API could improperly handle highly
compressed HTTP content ("decompression bombs") leading to excessive resource
consumption even when a small amount of data was requested. Reading small
chunks of compressed data is safer and much more efficient now.
(`GHSA-2xpw-w6gg-jr37 <https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37>`__)
- Fixed a security issue where an attacker could compose an HTTP response with
virtually unlimited links in the ``Content-Encoding`` header, potentially
leading to a denial of service (DoS) attack by exhausting system resources
during decoding. The number of allowed chained encodings is now limited to 5.
(`GHSA-gm62-xv2j-4w53 <https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53>`__)
[42 lines not shown]
www/py-quart-trio: import py-quart-trio-0.12.0
Quart-Trio is an extension for Quart to support the Trio event
loop. This is an alternative to using the asyncio event loop present
in the Python standard library and supported by default in Quart.
www/py-quart: import py-quart-0.20.0
Quart is an async Python web application framework. Using Quart
you can,
- render and serve HTML templates,
- write (RESTful) JSON APIs,
- serve WebSockets,
- stream request and response data,
- do pretty much anything over the HTTP or WebSocket protocols.
www/py-hypercorn: import py-hypercorn-0.18.0
Hypercorn is an ASGI and WSGI web server based on the sans-io hyper,
h11, h2, and wsproto libraries and inspired by Gunicorn. Hypercorn
supports HTTP/1, HTTP/2, WebSockets (over HTTP/1 and HTTP/2), ASGI,
and WSGI specifications. Hypercorn can utilise asyncio, uvloop, or
trio worker types.
Hypercorn can optionally serve the current draft of the HTTP/3
specification using the aioquic library.
Track individual inodes between the time that their accounting is
subtracted from one segment before it is added to the new segment.
Counting duplicates is not sufficient. Addresses a "negative bytes"
panic.
textproc/xleak: import package
Expose Excel files in your terminal - no Microsoft Excel required!
Inspired by doxx, xleak brings Excel spreadsheets to your command line with
beautiful rendering, powerful export capabilities, and a feature-rich
interactive TUI.
xleak features full-text search, formula display, lazy loading for large files,
clipboard support, and export to CSV/JSON.
textproc/doxx: import package
Packaged in wip by wiz@ and myself.
A fast, terminal-native document viewer for Word files. View,
search, and export '.docx' documents without leaving your command
line.
mips: Fix R5000SC cache page macro typo that broke boot.
A change in rev 1.5 to mips_r5k_round_page() and mips_r5k_trunc_page()
in cache_r5k.h (for PR/55139) had a fatal typo in the mask, so the
R5000SC cache flush code ended up operating on unintended addresses
and at least R5000SC Indy would no longer boot.
(not sure how my Qube 2700 worked at that time..)
Fix the macros to use the intended mask so that the secondary cache
flushes are done on the correct range again.
Sorry for the long breakage.
Analyzed and reported by Adrian Chadd on port-mips@.
https://mail-index.netbsd.org/port-mips/2025/12/thread1.html#001536
Should be pulled up to netbsd-9, netbsd-10, and netbsd-11.
sys/arch/amd64: support ramdisks when booting in GENPVH mode
This adds support for booting NetBSD/amd64 with QEMU’s -kernel/-initrd
combination, in generic PVH mode (GENPVH). This includes the MICROVM
kernel, which now defaults to supporting modules and root on memory
disks.
This patch probes the first few bytes loaded in memory for
differentiating between modules, splash screens (PNG or JPEG), or
assumes filesystem images otherwise. It works with plain filesystem
images, but not with modules yet. Supporting any combination of
filesystem, modules or splash screen images should be possible in the
future.
Tested on NetBSD/amd64 by iMil and myself; measured to gain another 1~3
ms of boot time with the MICROVM kernel on the reference hardware.
As posted on tech-kern@ on 26/11/2025, with no objections.
XXX pull-up to -11 and adapt for -10
devel/act_runner: import act_runner-0.2.13 as devel/act_runner
act_runner is a runner for Gitea actions, compatible with GitHub's
actions. It is based on act.
