openssh: update to 10.5p1.
Changes since OpenSSH 10.4
==========================
This release contains a number of security fixes and small bugfixes.
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
Reported by sn0x-sharma
[72 lines not shown]
py-pylint: updated to 4.0.7
4.0.7
False Positives Fixed
Fix a false positive for invalid-name when a module-level variable is assigned
an instance of a TypedDict subclass. Such a name is a value, not a type
definition, so it is now checked against the constant or variable regex instead
of class-rgx.
Other Bug Fixes
Fix a crash in the bad-open-mode check when the mode argument of
open is the NotImplemented constant (Python >= 3.14).
Fix a crash in the not-context-manager and not-async-context-manager
checks when the context manager infers to a value without a name, such as the
slice returned by with slice(...) / async with slice(...).
[27 lines not shown]
py-fsspec: updated to 2026.7.0
2026.7.0
Enhancements
- Single-pass ``MemoryFileSystem.find()`` to avoid O(n_dirs * n_entries) listing
- Permit composite URL protocol schemes in infer_storage_options
- Implement topdown in async walk()
Fixes
- Fix incorrect glob docstring for '[!]'
- Propagate storage_options to all backends resolved by GenericFileSystem
- Handle end=None in FirstChunkCache._fetch like the other caches
- Clamp read end to file size in BlockCache and BackgroundBlockCache(#2081)
- Create the parent dir for "x" and "a" modes under auto_mkdir
- Expand paths for mode="x" when urlpath is a list
- fix: correctly pass 'start' and 'end' parameters to super().cat_file()
[16 lines not shown]
py-django-localflavor: updated to 5.1
5.1 (2026-08-01)
New flavors:
- Added local flavor for Qatar
- Added local flavor for Taiwan
- Added local flavor for United Arab Emirates
New fields for existing flavors:
- US: Added ``USIndividualTaxpayerIdentificationNumberField``,
``USAdoptionTaxpayerIdentificationNumberField``, and
``USTaxpayerIdentificationNumberField`` form and model fields for validating
ITINs, ATINs, and any valid U.S. taxpayer identification number (SSN, ITIN,
or ATIN).
Modifications to existing flavors:
[7 lines not shown]
py-drf-nested-routers: updated to 0.95.3
0.95.3
Removed support to EOLed Python 3.9. Still works for now, but no CI will validate it anymore.
Update flake8 to 7.1.1
Test against DRF 3.16 and Django 5.2
Test and advertise DRF 3.16 and Django 5.2 compatibility
Fix Error when request.data is a list. Fixes #349.
Update mypy to 1.13.0
Fix release pyc leakages
Add Python 3.14 & Update release flow
py-djangorestframework: updated to 3.18.0
3.18.0
Breaking changes
Drop support for Django 4.2, Django 5.0 and Django 5.1
Change errors for list serializers (many=True) to dict format
Features
Add support for Django 6.1
Add unaccent to SearchFilter
Add @throttle_scope function based view decorator
Add nulls_distinct support to UniqueTogetherValidator
Bug fixes
Replace cc_delim_re usage with split_header_value for Django 6.1+ compatibility
[9 lines not shown]
py-django-stubs-ext: updated to 6.0.9
6.0.9
6.0.8 was supposed to be the last 6.0.x release, but we found several regressions that we wanted to fix.
Now we are working on 6.1.0 release :)
Detect every generic stub class in the generic consistency test
Don't crash on a many-to-many through model that can't be resolved
py-django5: updated to 5.2.17
Django 5.2.17 fixes one security issue with severity “high”, two security
issues with severity “moderate”, and one security issue with severity “low” in
5.2.16.
py-django: updated to 6.1
The Django team is happy to announce the release of Django 6.1.
The release notes offer a harmonious mélange of new features and usability improvements. A few highlights are:
- Model field fetch modes for configuring on-demand fetching behavior
- Database-level delete options for ForeignKey.on_delete
- Dictionary-based email settings
py-elementpath: updated to 5.1.4
5.1.4
* Add *allow_environment* and *allow_external_resources* arguments to XPath30Parser
* some/every statements: revert to v4.8 implementation
* reverse axis position: workaround until next minor-version
py-greenlet: updated to 3.5.5
3.5.5 (2026-08-10)
- Link the C++ runtime statically into the Windows wheels again, as the
Appveyor builds did through 3.3.0. Since 3.3.1 ``_greenlet.pyd``
imported ``MSVCP140.dll``, which no Windows CPython distribution ships,
so importing greenlet failed on machines without the Visual C++
redistributable.
py-cbor2: updated to 6.1.4
6.1.4 (2026-08-01)
- Fixed :class:`frozendict` deriving its hash from its keys and its values as two independent
sets, so that frozendicts holding the same keys and the same values all collided regardless of
how the two were paired; since the decoder builds a frozendict for every map in an immutable
position, a payload keyed by such maps decoded in quadratic time
- Fixed the encoder not registering :class:`bytearray` values in the string reference namespace,
unlike :class:`bytes` and :class:`str`; since the decoder registers every byte string it reads, a
single ``bytearray`` desynchronised the namespace and made subsequent string references resolve
to the wrong value
- Fixed the decoder silently accepting an indefinite-length map whose break marker arrives after a
key with no value, dropping that trailing key and returning a truncated map instead of rejecting
the ill-formed input
- Fixed the decoder accepting a non-byte-string payload for a positive or negative bignum (tags 2
and 3). ``int.from_bytes()`` also accepts an array (or a map, whose keys it iterates), so a tag
wrapping one of those was coerced into an integer instead of being rejected as malformed
py-tortoise-orm: updated to 1.1.8
1.1.8
Added
QuerySet.union() — SQL UNION query support for combining results from multiple QuerySets, including support for union across different models, union(all=True) for duplicates, order_by(), limit(), and count().
feat: add postgresql:// scheme as alias for asyncpg
feat: add pre commit config and fix codespell issues
feat: django compatibility field name
feat: expose classmethod to build tortoise config
QuerySet.contains() method to check if an object exists in a queryset.
Added comprehensive EXPLAIN support for MySQL and PostgreSQL.
Built-in DomainNameValidator, URLValidator, and EmailValidator classes for common validation patterns.
Fixed
MigrationRecorder now uses parameterized queries; fixes MariaDB/MySQL rejecting ISO-8601 applied_at values.
fix(migrations): use parameterized queries in MigrationRecorder
[10 lines not shown]
py-asgiref: updated to 3.12.1
3.12.1 (2026-07-14)
* Restored the previous SyncToAsync.__call__ internal code shape, which was
relied on by some APM services.
Note, this change was available whilst maintaining the underlying fix.
It does not constitute an API stability promise. Ideally APMs are
*not* monkey patching internal APIs, and future changes will be made here if
needed.
3.12.0 (2026-07-14)
* ``AsyncToSync`` no longer captures the running event loop on
instantiation.
This resolves a series of deadlocks that users experienced after asgiref 3.9.0,
particularly with pytest-asyncio. pytest-asyncio stops the event loop between
[43 lines not shown]
py-apsw: updated to 3.53.4.0
3.53.4.0
Blob implements io.RawIOBase allowing use by other modules expecting file like
objects, such as compression. Several methods and attributes are added, and
Blob.write() now returns the size written (used to be None).
