p5-Sereal*: update to 7.002
7.002
* Add an opt-in paranoid preset for authenticated input, bounded
decompression and container sizes, UTF-8 validation, restricted
object blessing and THAW, and a recursion limit of 2048. Explicit
constructor options can override each default.
* Add allow_classes for ordinary and frozen objects and
track_classes for per-class object counts. Permit genuine Regexp
objects through refuse_objects unless an allowlist excludes them.
* Add allow_unsigned as an explicit checksum-policy opt-out. Lower
the normal recursion limit from 10000 to 8192, or 4096 on Cygwin.
Clarify the trust assumptions and limits of paranoid mode.
* Balance custom-op argument and result references on Perl builds
with PERL_RC_STACK.
* Fix native floating-point declaration tests on older FreeBSD and
macOS Perls. Remove hobodecoder's od dependency and make child
tests portable on Windows. Bound randomized test runtime and TAP
memory use, and adapt deep-recursion tests to Cygwin's stack.
p5-Cpanel-JSON-XS: update to 4.81.
4.81 2026-11-09 (rurban)
- Fix memory leak when croak is called while encoding a tied hash
in canonical mode (PR #261, Nikolay Shaplov, ISP RAS)
p5-JSON-XS: update to 4.05.
4.05 Fri 13 Nov 2026 05:21:06 CET
- the incremental parser would not properly reset parsing offset
after removing a top-level number json number, causing memory
corruption. this is potentially a very serious vulnerability.
(reported by Albert Gierlach).
- the ignore initial whitespace optimisation in the incremental
parser could result in the parser reading beyond the end of string,
potentially leading to parsing errors or skipping json texts.
- FREEZE method calls could move the stack and cause a use-after-free.
requires allow_tags and a suitable FREEZE method to be exploited
(reported by Albert Gierlach).
- json_sv_grow would not allocate space for the trailing 0 byte.
possibly exploitable. (reported by Albert Gierlach).
- the incremental parser did not properly detect embedded NUL
characters as an error (reported by Peter Juhasz and his LLM).
- string and object decoding failures could leak a partially
constructed perl scalar (reported by Peter Juhasz).
[2 lines not shown]
xmag: update to 1.0.9.
Alan Coopersmith (6):
Improve man page formatting
man page: fix warnings from `mandoc -T lint` and `groff -rCHECKSTYLE=10`
gitlab CI: drop the ci-fairy check-mr job
Strip trailing whitespace from source files
meson: Add option to build with meson
xmag 1.0.9
lxqt-runner: update to 2.5.0
lxqt-runner-2.5.0 / 2026-11-05
===============================
* Silenced layershell's warnings by updating its code.
* CMake maintenance.
* Fixed compilation without math support.
* Updated the address of Free Software Foundation.
lxqt-qtplugin: update to 2.5.0
lxqt-qtplugin-2.5.0 / 2026-11-05
=================================
* Fixed a case where SVG tray icons would not appear if they did not
belong to the icon theme (because `QIcon::availableSizes` is empty for
them).
lxqt-panel: update to 2.5.1
lxqt-panel-2.5.1 / 2026-11-09
==============================
* Workaround for a bad behavior of `wlroots` that prevented an auto-hiding panel from being shown after VT switching.
lxqt-panel-2.5.0 / 2026-11-05
==============================
* Fixed Network Monitor Plugin not respecting lxqt-panel's icon size.
* Added new option to Network Monitor Plugin's config to 'Prefer system icons'.
* Change tooltip in Status Notifier if an app sets title instead of tooltip (some GTK apps can't set the tooltip but may change the title).
* Fixed volume wheel scroll dropping steps with fast mice, and added touchpad support to Volume Control plugin.
* Improved widget removal and height adjustment in Volume Control plugin.
* Do not close Task Manager's group popup on showing its context menu.
* Added minimum width config option to Custom Command plugin.
* Save the icon path when selected via file picker in Custom Command plugin's config dialog.
* Made the D-Bus task command work with auto-hiding panels.
* Removed Wayfire from the list of compositors that support an unfocusable panel (because its latest stable version would make popup windows unfocusable too).
* Made the Close button the default button for config dialogs of relevant plugins.
[8 lines not shown]
lxqt-globalkeys: update to 2.5.0
lxqt-globalkeys-2.5.0 / 2026-11-05
===================================
* Used `std::pair` instead of `QPair`.
* Used US English in a string.
* Updated the address of Free Software Foundation.
