python312 py312-html-docs: updated to 3.12.14
3.12.14
macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE 2026-72522.
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
[31 lines not shown]
python311 py311-html-docs: updated to 3.11.16
3.11.16
macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522.
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
[28 lines not shown]
python310 py310-html-docs: updated to 3.10.21
3.10.21
macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186.
gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
[23 lines not shown]
nginx-devel: updated to 1.31.3
1.31.3
fixes for buffer overflow vulnerability when using map with regex
(CVE-2026-42533), memory disclosure vulnerability when using
ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when
using ngx_http_ssi_module (CVE-2026-56434)
victorialogs-*: use PKGBASE
Factor out the name of the program by using PKGBASE.
More resistant to copypastos for packaging of other VictoriaLogs
components.
victorialogs-vlagent: Import vlagent-1.52.0
VictoriaLogs is open source user-friendly database for logs from
VictoriaMetrics.
This package contains vlagent, an agent for collecting logs from
various sources and storing them in VictoriaLogs.
unbound: updated to 1.26.0
1.26.0
Features
Update icannbundle.pem certificates in unbound-anchor. It has the public keys for 2009 to 2029 and for 2025 to 2045.
Fix to add `max-transfer-size` and `max-transfer-time` that limit auth-zone and rpz transfer amount and time taken. Default is disabled. This hardens against unbounded transfers. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Merge 1087: Overload `local_data_remove` to support removing specific records.
Merge 1433 from jisakiel: Add new static zone type block_aaaa to suppress AAAA queries.
Fix 1477: respip + dns64: dns64 uses A records modified by respip instead of original A records. Adds local-zone types block_a_wdata and block_aaaa_wdata, that are like block_a and block_aaaa, and uses local-data if present.
pnpm: import pnpm-12.0.0-rc.2 as wip/pnpm
This is a Rust port version of pnpm, called pacquet.
---
Fast, disk space efficient package manager:
* Fast. Up to 2x faster than the alternatives (see benchmark).
* Efficient. Files inside node_modules are linked from a single
content-addressable storage.
* Great for monorepos.
* Strict. A package can access only dependencies that are specified in its
package.json.
* Deterministic. Has a lockfile called pnpm-lock.yaml.
* Works as a Node.js version manager. See pnpm runtime.
* Works everywhere. Supports Windows, Linux, and macOS.
* Battle-tested. Used in production by teams of all sizes since 2016.
* Experimental Rust port. Includes pacquet, an experimental port of the CLI
written in Rust.
p5-Net-CIDR-Set: update to 0.23.
0.23 2026-08-11 20:08:42+01:00 Europe/London
[Security]
- Fix an unbounded IPv6 netmask prefix length (CVE-2026-19566)
0.22 2026-06-13 14:44:25+01:00 Europe/London
[Toolchain]
- Set the static install flag
- Adjusted build prerequisites to be recommended instead of required.
- Sign distribution with SigStore.
[Tests]
- Added author tests.
- Update minimum prereqs for some tests.
py-dnsdiag: updated to 2.9.4
2.9.4
Fixed
fix: reset shutdown flag at the start of each CLI invocation
fix(dnsping): validate source IP address family against -4/-6 flag
fix(dnsping): fix variable shadowing and div-by-zero in stats
fix(dnsping): reuse TCP connection for fixed source port queries
pciconf: Fix round-up logics for total sizes of bridge resources
The previous ones are valid only if alignments are 4K or 1M,
for I/O or memory, respectively.
pciconf: Fix alignments of device memory and I/O resources
Resources must be their-size-aligned. While here:
- Switch *align variable from int to more suitable integer types.
- Make some conditions clearer (NFC).
py-duckdb: Pass CMAKE_BUILD_PARALLEL_LEVEL.
Any package that uses py-scikit-build-core to build does not honour MAKE_JOBS.
Some packages use make and so are single threaded, but some like duckdb use
ninja, and that defaults to ncores+2(!) per build.
On my 72-core build host, building 3 py-duckdb packages simultaneously, this is
enough to completely swamp things and cause knock-on failures that effectively
kill the bulk build.
Ideally this needs to be done in a build.mk or similar for py-scikit-build-core
but this gets us past this for now.
