gstreamer1: updated to 1.28.8
1.28.8
Highlighted bugfixes:
Various security fixes and playback fixes
Fix adaptivedemux2 HLS and DASH playback regression
Fix FLAC audio seeking regression
Various RTP depayloader and RTSP client SDP handling fixes
MXF demuxer: Added support for reading AAF AIFF-AIFC audio
VA-API compositor: Fix alpha blending with Intel driver
Windows media audio/video seeking improvements
AMD AMF AV1 video encoder force-keyframe fixes
Fix endless drain in some FFmpeg wrapper audio encoders and support dual mono
hlssink3 improvements
ISOBMFF dash/iso/fmp4 muxer fixes for timestamp rollover in 2036
cerbero: Rework checksum verification to allow mirror retries
Various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements
go: update to 1.27.2 and 1.26.9
These releases include 15 security fixes following the security policy:
- net/http: HTTP/2 server crash due to HPACK encoder race
HTTP/2 servers could end up crashing due to inadvertently modifying
its HPACK encoder concurrently. This happens because the server
modifies the HPACK encoder from two goroutines without
synchronization: one uses the encoder to encode a HEADERS frame as
part of a response sent to a client and the other modifies the
encoder's table size when handling a SETTINGS frame containing
SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can
repeatedly send a request while changing the header table size to
crash the server.
Fix this issue by not applying SETTINGS_HEADER_TABLE_SIZE immediately.
Instead, buffer any SETTINGS_HEADER_TABLE_SIZE received, and only
apply the new value prior to the next time the server writes a frame.
[237 lines not shown]
cad/geda: Remove as deprecated upstream and unused
Upstream is not only not maintaing this, but has said they aren't and
suggests switching to Ringdove. The distfile is from 2013. No one
spoke up in respone to a removal proposal on pkgsrc-users@.