Pull up following revision(s) (requested by riastradh in ticket #539):
sys/arch/amd64/amd64/machdep.c: revision 1.381
amd64: Make XSAVE area overlap mcontext_t on signal delivery.
Additionally, if the stack pointer is already such that pushing a
struct sigframe_siginfo would make it congruent to -8 modulo the
stack alignment, as the signal handler expects (-8 for the return
address on an aligned stack frame), don't re-align it again -- it's
just fine as is.
Previously, for NetBSD 11.0, we would copy out an XSAVE area
separately from ucontext_t, and copy out the FXSAVE content twice in
two different places on the stack -- one in the ucontext_t for
compatibility so older applications can still read x87/SSE registers,
and one in the XSAVE area:
+-----------------------+ | (other XSAVE stuff) | |
[88 lines not shown]
py-django-treebeard: updated to 7.0.3
Treebeard 7.0.3 is a bugfix release.
Fixed some instances of nodes holding stale data after a move operation.
Fixed admin tree filters not showing all possible filter options.
Made delete() operations for MP_Node and NS_Node atomic to avoid inconsistent state if an exception was raised during deletion.
py-django-import-export: updated to 4.4.3
v4.4.3
* This release patches a denial-of-service vulnerability in :class:`~import_export.widgets.IntegerWidget`.
``IntegerWidget.clean()`` converted imported values using ``int(Decimal(value))`` with no bound on the
value's magnitude. A value written in exponent notation, such as ``1e1000000``, is cheap to parse as a
``Decimal`` but forces Python to expand every digit when converted to ``int``, a cost that grows
superlinearly with the digit count. A single such value could stall the importing process for several
seconds while pinning a CPU core, and a file containing many such rows multiplied the cost.
``IntegerWidget`` is the default widget for all integer model fields, including the ``id`` column used by
every resource that does not override ``import_id_fields``, so almost every import was affected. The stall
occurred during the initial dry run, before the confirmation step. Python's
``sys.set_int_max_str_digits()`` limit did not protect this path, as it only guards conversions between
``int`` and ``str``, not ``Decimal.__int__``.
This was an availability issue only. The resulting integers exceed the range of any standard database
[22 lines not shown]
py-django-bootstrap5: updated to 26.4
26.4 (2026-10-11)
- **Breaking:** Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.
- **Breaking:** Remove `django_bootstrap5.text.text_concat`. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines
- Remove `BaseRenderer.get_size_class`, which nothing called. The module-level `get_size_class` in `django_bootstrap5.size` is the one in use, and the method shadowed its name inside the class body.
- Fix a `template_name` set on a `RadioSelect`, `CheckboxSelectMultiple` or `ClearableFileInput` subclass being overwritten by this package's own widget template
- Accept a non-string URL value in `css_url`, `javascript_url` and `theme_url`, so a lazy `static()` value can be used directly instead of only inside the dict form
- Recognize `week`, `search` and `color` input-type widgets as form-control widgets, so `addon_before`/`addon_after` work on them, and warn instead of silently dropping addons on a widget that cannot have them
- Add the documented `inline_field_class` setting to `BOOTSTRAP5_DEFAULTS`, where it was missing. Its effective default is unchanged.
- Store `src/django_bootstrap5/widgets.py` with LF line endings, like every other file and as `.editorconfig` requires. It was the only file in the repository with CRLF.
- Support `addon_before`/`addon_after` on fields with `layout="floating"`
- Add a system check that warns about keys in the `BOOTSTRAP5` setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (`django_bootstrap5.W001`). Silence it with `SILENCED_SYSTEM_CHECKS` if you keep extra keys deliberately.
- Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on `github.actor`, which is spoofable in a `pull_request_target` context, and now gates on the pull request author, with `fetch-metadata` as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries `timeout-minutes`, and `ci.yml` declares `permissions: contents: read`.
- Fail `just lint` on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).
- Cover every statement and branch in the test suite, and hold it there with `fail_under = 100`, checked by a `coverage report` step in CI. Until that step existed the floor was set but never run.
- Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.
- Test on Python 3.15 against Django 6.1 and `main`. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.
[10 lines not shown]
py-asgiref: updated to 3.13.0
3.13.0 (2026-10-23)
* It is now possible to nest ``ThreadSensitiveContext`` by providing an
explicit ``executor`` for thread-sensitive tasks. This enables moving a block
of such work away from the parent context's shared worker.
The provided executor must run work sequentially and on a single thread, as
per ``ThreadPoolExecutor(max_workers=1)``, and the calling code is
responsible for managing the executor's lifecycle.
See the README for more details.
* ``Local`` attribute access is now 2-3x faster. ``Local(...)`` now uses one
of two internal specialisations, selected by ``thread_critical``, instead of
checking the mode on every access.
As a result ``Local`` is now marked ``@final`` and raises ``TypeError`` if
[9 lines not shown]
py-pyvcd: updated to 0.5.1
pyvcd-0.5.1 (2026-10-19)
* fix: declare the total bit width for aliases of compound vector variables
* fix: write `realtime`, `shortreal`, and `real_parameter` variable values as
real numbers. `realtime` values were previously written in binary, e.g.
``b1`` instead of ``r1``, and fractional values were rejected
* feat: default sizes for `shortreal` (32) and `real_parameter` (64)
variables
py-evalidate: updated to 2.1.6
2.1.5
Few more checks added to EvalModel.security_check(), including .format() and .format_map(), Thanks to Nagizaaz Shaik
.security_check() and .expr() now methods of EvalModel (backward-compatible).
README.md updated
py-websockets: updated to 17.3
17.3
Improvements
Tested compatibility with uvloop in the :mod:`asyncio` implementation.
Used non-blocking reads in the :mod:`threading` implementation. Depending on platforms, this can make connection termination more reliable.
Bug fixes
Fixed a crash when authenticating client connections with HTTP Basic Authentication using non-ASCII credentials.
Fixed a race condition between receiving the next frame of a fragmented message and canceling :meth:`~asyncio.connection.Connection.recv`.
py-utils: updated to 4.1.4
4.1.4
Build from the source distribution with uv_build 0.13 and later. The build
requirement was uv_build>=0.11,<0.13, so a frontend other than uv, such as
python -m build or a distribution package build, refused to build 4.1.3 once
uv_build 0.13 was the installed version.
py-xlsxwriter: updated to 3.3.0
3.3.0 - October 22 2026
* Added the :func:`set_zoom_to_fit()` method for chartsheets. It ensures that a
chartsheet is zoomed automatically by Excel to fit the screen even when the
window is resized.
* Added alt text ``description`` and ``title`` options to worksheet Tables.
* Added the :func:`use_custom_theme()` method to change the default workbook
theme to a user supplied ``.thmx``, ``.xlsx`` or ``theme1.xml`` file, along
with the ``default_format_properties``, ``default_row_height`` and
``default_column_width`` constructor options to change the default font and
cell size to match the theme.
* Changed the exception raised for an unsupported ``source`` type in
``Image()`` and an unsupported ``theme`` type in ``use_custom_theme()`` from
``ValueError`` to ``TypeError``.
[17 lines not shown]
py-tzlocal: updated to 5.4.5
5.4.5 (2026-10-22)
- Recognize timezone file names with multiple slashes in the TZ environment variable.
- Use HTTPS in place of FTP to retrieve tzdata archive.
py-ruff: updated to 0.17.2
0.17.2
Preview features
[complexity] Add unnecessary-regular-expression-compile
Bug fixes
Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053)
[pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417)
[pylint] Avoid false positive on starred elements (PLE0643)
[pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120)
[pyupgrade] Mark fix unsafe when deleting comments (UP035)
Performance
Avoid intermediate names in lint name resolution
[11 lines not shown]
py-dulwich: updated to 1.2.19
1.2.19 2026-10-22
* Keep the assume-unchanged flag (and other index flags) on entries
whose content does not change, rather than clearing it when ``status``
refreshes the stat cache or on reset, checkout, restore, stash pop and
add. (Jelmer Vernooij)
* Split the interactive rebase todo list only on newlines, so a carriage
return or other line separator in a commit subject can no longer add an
instruction such as ``exec`` to the rebase. (Kartik Kenchi)
* In ``update_working_tree``, leave a path alone when one of its leading
directories has been replaced by a symlink, rather than following the
symlink and removing a file outside the work tree. (Kartik Kenchi)
* Walk the commit graph with a ``deque`` in ``_collect_ancestors`` so
enumerating reachable commits (during ``upload-pack`` negotiation and
[6 lines not shown]
py-svglib: updated to 2.3.2
2.3.2 (2026-10-23)
Security
- A long run of digits in the arguments of a path arc command (`A` or `a`)
could make parsing take exponential time, so a tiny SVG could block a
process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h).
Arc arguments are now read one token at a time, without regex backtracking.
Parsing of a malformed arc stops at the first argument that does not fit.
Fixed
- Accept explicit plus signs on arc rotation and endpoints, and tab, carriage
return and line feed separators in transform arguments, as allowed by SVG
- `svg2rlg()` no longer unpacks a `.svgz` file to a sibling `.svg` file, which
overwrote an existing file of that name and then deleted it. The compressed
data is now read as a stream
[16 lines not shown]
Be more conservative with pool and freelist sizes and address potential deadlocks discovered while working on PR kern/60396.
Note that with this change we track the total amount of memory allocated to
both reserved buffers and pools on a per-array basis, and constrain
"openings" to keep it under control on small-memory machines.
1) Per suggestion from oster@, rename the "emergency" freelists that are now
used before dynamic allocation to "reserved" freelists.
2) Eliminate static pool sizes and compute dynamically instead. For now,
most are larger to avoid potential deadlocks discussed below. With
some restructuring of the I/O dispatch model they can probably get smaller.
3) Address an M_WAITOK allocation with PSS_MUTEX held in "forced"
reconstruction. It appears this could deadlock rf_RaidIOThread
and the recon thread. Added another small set of emergency
buffers to cover this case.
4) Reorganize rf_Configure to initialize pools _after_ disk,
[35 lines not shown]
Add devel/ocaml-parmap version 1.2.5.
Parmap is a minimalistic library allowing to exploit multicore architecture
for OCaml programs with minimal modifications: if you want to use your many
cores to accelerate an operation which happens to be a map, fold or map/fold
(map-reduce), just use Parmap's parmap, parfold and parmapfold primitives
in place of the standard List.map and friends, and specify the number of
subprocesses to use by the optional parameter ~ncores.
