NetBSD/pkgsrc kZphIY0doc CHANGES-2026

   Updated www/py-wagtailmenus, www/py-django-stubs-ext, devel/py-proto-plus
VersionDeltaFile
1.4690+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc dtDfKQHdevel/py-proto-plus distinfo Makefile

   py-proto-plus: updated to 1.28.2

   1.28.2

   Bug Fixes

   proto-plus: make Marshal thread-safe and handle race conditions
VersionDeltaFile
1.14+4-4devel/py-proto-plus/distinfo
1.16+2-2devel/py-proto-plus/Makefile
+6-62 files

NetBSD/pkgsrc VssUtxbwww/py-django-stubs-ext distinfo Makefile

   py-django-stubs-ext: updated to 6.0.7

   6.0.7
   Fix manager resolution when QuerySet overrides as_manager
   Fix order_by false positives with JSONField key transforms
   typing: improve CaptureQueriesContext and test decorators in django.t…
   Drop README version rows targeting unsupported Django versions
   Update mypy to 2.2
   Fix lookup false positive for unions containing combinable expressions
   Fully annotate Field.formfield keyword args
   Preserve values() aliases through annotate() for order_by
   Annotate unparameterized Field references
   Update mypy to 2.3.0, release 6.0.7
VersionDeltaFile
1.9+4-4www/py-django-stubs-ext/distinfo
1.10+2-2www/py-django-stubs-ext/Makefile
+6-62 files

NetBSD/pkgsrc yCPoZuKwww/py-wagtailmenus distinfo Makefile

   py-wagtailmenus: updated to 4.1

   4.1.0

   * Added LOCALIZE_MENU_ITEMS setting for i18n locale-aware menus
   * Added testing for Wagtail 7.4 (LTS).
   * Removed support for Wagtail 6.3 LTS, 7.1 and 7.2 (end of life).
   * Removed support for Django 5.1 (end of life).
   * Raised minimum Wagtail version to 7.0.
   * Removed dead Django <4.1 compatibility shim in `models/menus.py`.
VersionDeltaFile
1.7+4-4www/py-wagtailmenus/distinfo
1.15+3-3www/py-wagtailmenus/Makefile
1.5+4-1www/py-wagtailmenus/PLIST
+11-83 files

NetBSD/pkgsrc I72BU9Hdoc CHANGES-2026

   Updated www/py-django-filter, www/py-wagtail
VersionDeltaFile
1.4689+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc pTU5cZ2www/py-wagtail PLIST Makefile

   py-wagtail: updated to 7.4.2

   7.4.2

   CVE-2026-54259: Improper restriction handling on Documents and Images chosen endpoints
   CVE-2026-54260: Denial of service via unbounded filter specs in the image preview
   CVE-2026-54261: Improper permission handling in image preview
   CVE-2026-54262: Pages translations can be created without page permissions when using simple_translation
   CVE-2026-54263: Reflected XSS in dynamic image URL generator view
   Fix: Prevent spurious migrations when there are missing child blocks in StructBlock.Meta.form_layout (Matthias Brück, Sage Abdullah)
   Fix: Prevent error in usage views when using gettext_lazy for a model's verbose_name (James Biggs)
   Fix: Prevent development markdown files from being added to virtual environment root upon installation (Dan Braghis)
   Fix: Prevent StreamField blocks referenced multiple times from losing their required state after deferred validation (Sage Abdullah)
   Docs: Add missing return in example views for template components (Tibor Leupold)
VersionDeltaFile
1.10+116-8www/py-wagtail/PLIST
1.33+8-9www/py-wagtail/Makefile
1.16+4-4www/py-wagtail/distinfo
+128-213 files

NetBSD/pkgsrc TfLOa3Swww/py-django-filter distinfo Makefile

   py-django-filter: updated to 26.1

   Version 26.1 (2026-07-11)

   * Added testing for Django 6.1.

     DRF integration will require the upcoming DRF v3.18.
     See https://github.com/encode/django-rest-framework/pull/9978

   * Added testing against Python 3.14.
VersionDeltaFile
1.16+4-4www/py-django-filter/distinfo
1.21+2-2www/py-django-filter/Makefile
+6-62 files

NetBSD/pkgsrc QEDTTsidoc CHANGES-2026

   Updated graphics/opencv[-opencv-contrib-face]
VersionDeltaFile
1.4688+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc heMMvrigraphics/opencv PLIST options.mk, graphics/opencv-contrib-face distinfo PLIST

   opencv: updated to 4.14.0

   4.14.0

   Core module:

   Fixed copyTo on empty fixed-type matrices
   Improved precision of RotatedRect::points
   Fixed UB in cv::error when breakOnError set to true
   Fixed cv::mul overflow for U16 type
   Revert "Disable IPP with AVX512 in cv::compare because of performance regression"
   Fixed UBSan function pointer type mismatch in countNonZero
   Fixed heap-buffer-overflow in YAML parseKey for empty keys
   Optimized flip Horizontal
   Added AVX VNNI support
   Fixed meanStdDev on Windows for ARM
   Added NEON implementation for rotate function
   Fixed inplace transpose race by enforcing LLSS ordering via local barrier in OpenCL
   Fixed incorrect results for in-place flip on strict OpenCL implementations

    [32 lines not shown]
VersionDeltaFile
1.30+17-15graphics/opencv/PLIST
1.1+29-0graphics/opencv-contrib-face/patches/patch-.._opencv__contrib-4.14.0_modules_face_CMakeLists.txt
1.36+11-11graphics/opencv-contrib-face/distinfo
1.10+4-4graphics/opencv-contrib-face/PLIST
1.17+4-4graphics/opencv/options.mk
1.67+4-4graphics/opencv/distinfo
+69-384 files not shown
+75-4610 files

NetBSD/pkgsrc kIFq69Wdoc CHANGES-2026 TODO

   doc: Updated textproc/rumdl to 0.2.40
VersionDeltaFile
1.4687+2-1doc/CHANGES-2026
1.27633+1-2doc/TODO
+3-32 files

NetBSD/pkgsrc 4XWCy6otextproc/rumdl distinfo Makefile

   rumdl: update to 0.2.40.

   0.2.40

   Fixed

       md003: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so rumdl fmt added a horizontal rule the document never had (7363c34)
       md077: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged (58fb25b)
       reflow: keep wiki links, shortcodes and math whole inside a wrapped span (db12c2c)
       config: honor the documented MD033 table_allowed alias, which silently dropped the configured value (db2c204)
       config: stop reporting MD013's documented semantic-link-understanding alias as an unknown option (1539a64)
       parity: make the markdownlint comparison harness actually run (182763c)

   Documentation

       md013: document that ignore-link-urls affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat (c4f8bad)

   0.2.39


    [9 lines not shown]
VersionDeltaFile
1.45+4-4textproc/rumdl/distinfo
1.47+2-2textproc/rumdl/Makefile
+6-62 files

NetBSD/pkgsrc qoXKer3emulators/qemu Makefile, misc/tmate Makefile

   *: recursive bump for libssh version number change back to upstream
VersionDeltaFile
1.410+2-2emulators/qemu/Makefile
1.12+2-2misc/tmate/Makefile
1.93+2-2net/krdc/Makefile
1.44+2-2net/ocsync/Makefile
1.39+2-2net/ocsync/buildlink3.mk
1.127+2-2net/remmina/Makefile
+12-1212 files not shown
+36-3418 files

NetBSD/pkgsrc KYhpmlKdoc TODO CHANGES-2026

   doc: Updated security/libssh to 0.11.5
VersionDeltaFile
1.27632+2-2doc/TODO
1.4686+2-1doc/CHANGES-2026
+4-32 files

NetBSD/pkgsrc KumTuq1security/libssh Makefile distinfo, security/libssh/patches patch-tests_torture.c

   libssh: update to 0.11.5.

   Follow upstream version numbering again.

   version 0.11.5 (released 2026-07-21)
    * Security:
      * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
      * CVE-2026-59843: Denial of service via zero advertised channel packet size
      * CVE-2026-59844: Denial of service via oversized SFTP read length
      * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
      * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
      * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
      * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
      * CVE-2026-59849: Denial of service via automatic certificate authentication loop
      * CVE-2026-59850: Use-after-free via data callbacks on closed channels
      * Zero-initialize every ssh_string
    * Compatibility:
      * Fix compatibility with C23 / gcc16
    * Bugfixes:

    [9 lines not shown]
VersionDeltaFile
1.59+4-10security/libssh/Makefile
1.36+5-5security/libssh/distinfo
1.27+2-3security/libssh/buildlink3.mk
1.24+2-2security/libssh/PLIST
1.2+2-2security/libssh/patches/patch-tests_torture.c
+15-225 files

NetBSD/pkgsrc RnLqaVCdoc TODO CHANGES-2026

   doc: Updated graphics/py-pillow_heif to 1.5.0
VersionDeltaFile
1.27631+2-2doc/TODO
1.4685+2-1doc/CHANGES-2026
+4-32 files

NetBSD/pkgsrc m5c54uNgraphics/py-pillow_heif distinfo Makefile

   py-pillow_heif: update to 1.5.0.

   ## [1.5.0 - 2026-07-22]

   ### Added

   - Grid(tiled) image encoding: `options.GRID_TILE_SIZE` option, `tile_size` parameter for `save` and `grid_tile_size` parameter for `register_*_opener`. #317
   - `info["tiling"]` dictionary with the grid info for tiled images. #317
   - `PH_LIBHEIF_CMAKE_ARGS` environment variable for `build_libs.py` to pass extra `cmake` arguments to the libheif build.
   - Windows ARM64 wheels.

   ### Changed

   - Minimum required `libheif` version is `1.23.1`.
   - Releases are now tag-triggered and published to PyPI with attestations via Trusted Publishing. #432
   - `libheif` was updated from the `1.23.0` to `1.23.1` version. #445
   - `libde265` was updated from the `1.1.0` to `1.1.1` version. #434

   ### Removed

    [3 lines not shown]
VersionDeltaFile
1.25+4-4graphics/py-pillow_heif/distinfo
1.35+2-2graphics/py-pillow_heif/Makefile
+6-62 files

NetBSD/pkgsrc fnNc6B3doc CHANGES-2026

   Updated time/py-tempora, devel/py-utils
VersionDeltaFile
1.4684+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc bZJC41cdevel/py-utils distinfo Makefile

   py-utils: updated to 4.0.0

   Version 4.0 is a modernization release: the public helpers you already rely on
   are unchanged, but the package underneath is faster to import, stricter about
   types, and built with a modern toolchain.
VersionDeltaFile
1.16+4-4devel/py-utils/distinfo
1.18+3-4devel/py-utils/Makefile
1.10+4-2devel/py-utils/PLIST
+11-103 files

NetBSD/pkgsrc 25E68Hxtime/py-tempora distinfo Makefile

   py-tempora: updated to 5.12.0

   5.12.0
   Unknown changes
VersionDeltaFile
1.20+4-4time/py-tempora/distinfo
1.31+3-4time/py-tempora/Makefile
1.12+1-2time/py-tempora/PLIST
+8-103 files

NetBSD/pkgsrc 8UY7cOmdoc CHANGES-2026

   Updated archivers/py-rarfile, www/py-scrapy
VersionDeltaFile
1.4683+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc VFJ4rI4www/py-scrapy distinfo Makefile

   py-scrapy: updated to 2.17.0

   Scrapy 2.17.0 (2026-07-07)

   Highlights:

   -   Security bug fixes
   -   HTTP/2 and SOCKS proxy support for ``HttpxDownloadHandler``
   -   Improved settings for changing allowed TLS versions

   Security bug fixes

   -   ``s3://`` requests now use HTTPS by default, instead of plaintext HTTP.

       Previously, :class:`~scrapy.core.downloader.handlers.s3.S3DownloadHandler`
       sent signed S3 requests over plaintext HTTP unless
       ``request.meta["is_secure"]`` was set to a true value, exposing the request
       path, the AWS ``Authorization`` header, the ``X-Amz-Security-Token`` header
       (when using temporary credentials), and the response contents to network

    [160 lines not shown]
VersionDeltaFile
1.31+4-4www/py-scrapy/distinfo
1.42+2-2www/py-scrapy/Makefile
+6-62 files

NetBSD/pkgsrc Q2mnQ18archivers/py-rarfile distinfo Makefile

   py-rarfile: updated to 4.4

   4.4
   Security fixes:

   * Skip CRC check for some old subblocks.  Previously
     `rarfile` tried to calculate header CRC by reading
     data payload for those, but that could cause excessive
     allocations.

   Fixes:

   * RAR5: Reattempt passwords after trying wrong password
     when header encryption is used.

   * Restore fd position in file type detection functions.
VersionDeltaFile
1.10+4-4archivers/py-rarfile/distinfo
1.11+2-2archivers/py-rarfile/Makefile
+6-62 files

NetBSD/pkgsrc 4KdfRetdoc CHANGES-2026

   Updated devel/gflags, shells/nushell
VersionDeltaFile
1.4682+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc 76l9q6Ishells/nushell distinfo cargo-depends.mk

   nushell: updated to 0.114.1

   0.114.1
   This patch release fixes issues found after enforce-runtime-annotations became
   opt-out in the last version, improving runtime type checks and error reporting.
VersionDeltaFile
1.75+19-19shells/nushell/distinfo
1.65+5-5shells/nushell/cargo-depends.mk
1.91+2-2shells/nushell/Makefile
+26-263 files

NetBSD/pkgsrc 64TkfWwdevel/gflags distinfo PLIST

   gflags: updated to 2.3.1

   2.3.1

   ci: Point test.yml at main instead of master
   ci: Add GitHub Actions workflow to build with Bazel
   bazel: Support QNX in Bazel and more Bazel 9 fixes
VersionDeltaFile
1.7+4-4devel/gflags/distinfo
1.5+3-3devel/gflags/PLIST
1.8+2-3devel/gflags/Makefile
+9-103 files

NetBSD/pkgsrc NwNMCVxdoc TODO

   doc/TODO: + grafana-13.1.1, pandoc-3.10.1, py-pillow_heif-1.5.0, rumdl-0.2.40.
VersionDeltaFile
1.27630+5-3doc/TODO
+5-31 files

NetBSD/pkgsrc mBX7XDBdoc CHANGES-2026

   Updated mail/exim[-html], devel/appstream
VersionDeltaFile
1.4681+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc N5bQZnAdevel/appstream Makefile distinfo

   appstream: updated to 1.1.4

   1.1.4

   Features:
    * sysinfo: Assume a more modern display for the handset chassis template
    * sysinfo: Assume a more modern display for the tablet chassis template
    * sysinfo: Initial code to autodetect the display size on Wayland
    * sysinfo: Handle fractional display scaling via xdg-output
    * Implement support for GCVE as vulnerability database provider
    * qt: Sync enum mirrors with the C library
    * qt: Add Artifact, Checksum, Reference, Review and Agreement wrappers
    * qt: Wrap missing C API on existing classes
    * reviews: Add simple interface to fetch ODRS reviews for a component
    * reviews: Implement support for submitting reviews

   Specification:
    * docs: Suggest using the longest display side for maximum size constraints


    [12 lines not shown]
VersionDeltaFile
1.32+9-2devel/appstream/Makefile
1.13+4-4devel/appstream/distinfo
1.9+2-1devel/appstream/PLIST
+15-73 files

NetBSD/pkgsrc yyVsPBQmail/exim distinfo Makefile, mail/exim-html distinfo Makefile

   exim exim-html: updated to 4.99.5

   4.99.5
   This is a security release. It addresses GCVE-25-2026-07-45-1 and GCVE-25-2026-07-45-3.
VersionDeltaFile
1.97+4-4mail/exim/distinfo
1.47+4-4mail/exim-html/distinfo
1.54+2-2mail/exim-html/Makefile
1.220+2-2mail/exim/Makefile
1.30+3-1mail/exim-html/PLIST
+15-135 files

NetBSD/pkgsrc 6ksr9dBmail/py-mailman-hyperkitty Makefile

   py-mailman-hyperkitty: restrict like py-mailman
VersionDeltaFile
1.9+2-4mail/py-mailman-hyperkitty/Makefile
+2-41 files