py-zeroconf: updated to 0.151.3
v0.151.3 (2026-08-30)
Bug Fixes
- Correct the recursion available header flag to the rfc 1035 value
Refactoring
- Compute probe pacing from fresh clock reads
- Compute service info request pacing from fresh clock reads
Testing
- Fix flaky test_service_browser_expire_callbacks
- Make test_qu_response deterministic by injecting the announcement
v0.151.2 (2026-08-29)
[4 lines not shown]
ccid: updated to 1.8.3
1.8.3
- Add support of
- Broadcom Corp 58200 0x5884
- Broadcom Corp 58200 0x5885
- Broadcom Corp 58200 0x5886
- Broadcom Corp 58200 0x5887
- Circle CIR135 ICC
- DigiFlow LLP. KAZTOKEN
- HID Global Crescendo NFC Reader
- HID Global OMNIKEY Plug
- HID Global OMNIKEY SE Plug
- Neowave LinkeoC-PRO
- Swissbit iShield Key 2 Pro
- macOS: provide a sample script to build the driver with meson
- fix some minor issues found by an AI tool
- Some other minor improvements
defguard-gateway: updated to 2.0.5
2.0.5
It changes the default OPNsense plugin configuration which controls the placement of Defguard-related firewall rules.
This configuration is now also available in advanced plugin options.
py-pillow_heif: updated to 1.6.0
1.6.0 - 2026-08-31
Added
- Reading and writing HDR metadata: `content_light_level`, `mastering_display_colour_volume`, `ambient_viewing_environment` keys in `info` dictionary.
- Python `3.15` and `3.15t` wheels added.
Changed
- `libheif` was updated from the `1.23.1` to `1.23.2` version.
Fixed
- Use-after-free when a numpy array or the `data` memoryview outlived the `HeifFile` it was created from.
- Conflicting license metadata: removed the `GPLv2` classifier, the package license is `BSD-3-Clause`; bundled library licenses in wheels are described in `LICENSES_bundled.txt`, which was updated to match the current libraries.
protobuf py-protobuf: updated to [7.]36.1
36.1
Rust
Update README files for each crate. (e64a176)
Include runtime version details in assertion error messages. (fecb404)
Drop special treatment of rust versions below 4.33. (1312f3b)
Invert the relationship between rust crates (fbf3069)
Python
Optimize pure Python parse path for custom JSON enum names. (333846a)
Additional unit tests for Python handling of custom JSON enum names.
pcre2: updated to 10.48
10.48 31-August-2026
This is a regular release, incorporating security fixes along with small
improvements and fixes to library behaviour.
Only changes to behaviour, changes to the API, and other significant changes
are described here. Please see the ChangeLog and Git log for further details.
As well as the tarball and Git tag for this release, there are detailed
instructions for backporting security and correctness fixes, for the last
five years of releases.
* (Git change) Renamed the default development branch from master to main.
* (Maintenance change) Added a five-year support lifecycle policy and
publication of backport patches for security and high-severity fixes in older
releases.
[46 lines not shown]
*tcsh: Sanitise path settings.
Avoids constant rebuilds when using bulk build tools. While here apply
some minor pkglint. I tested all packages on NetBSD 11/amd64 apart from
the install of the standalone-tcsh binary package due to read-only / in
my build sandboxes.
forgejo-runner: register missing dependencies
devel/git-base is necessary to clone the code of the actions, and
lang/nodejs is required to perform them.
Remove multimedia/sickgear for catastrophic security issues (backdoor?)
It is doing the equivalent of downloading code from a wiki page and
executing it. But even if this would not be editable by everybody by
leaking the deploy token, it would still be a potential backdoor for the
developers.
See https://github.com/SickGear/SickGear/issues/1517 for details.
The patches in pkgsrc neutered this a bit, but I still urge everybody
who has this installed to *immediately* uninstall it.
expat: update to 2.8.4.
Release 2.8.4 Mon August 31 2026
Security fixes:
#1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service
attacks through moderately sized crafted XML input
(CWE-407).
The vulnerability is closely related to past CVE-2026-45186
that was fixed with Expat 2.8.1.
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote.)
#1322 CVE-2026-76957 -- Protect custom encoding callbacks from
parser re-entry. The vulnerability is closely related to
past issues CVE-2026-50219, CVE-2026-56131 and
CVE-2026-56412 that were all fixed with Expat 2.8.2.
[47 lines not shown]
