py-django-compressor: updated to 4.7.0
v4.7 (2025-11-12)
- Drop Python 3.10 (EOL), Add Python 3.15
- Add support for Django 6.1.
- Drop support for Django versions before 5.2.
- Replace deprecated codecs.open with builtin open
- Discover compress blocks inside Jinja2 elif branches
- Update BrotliCompressorFileStorage to compress each file in one go
- Add Subresource Integrity (SRI) support for compressed assets
py-publicsuffixlist: updated to 1.1.2.20261112
1.1.1, 1.1.2 (2026-10-21)
No code changes. This release only refreshes CI and development tooling.
Update astral-sh/setup-uv to v10.3.0 in the GitHub Actions workflows.
Refresh uv.lock, updating certifi to pick up the bundled CA certificate changes.
Fix the auto-release workflow so that it no longer bundles a stale PSL file.
1.1.0 (2026-10-10)
This version drops support for Python 3.5, 3.6 and 3.7, and now requires Python 3.8 or later.
Packaging has been migrated to PEP 621 metadata in pyproject.toml using hatchling, replacing setup.py, setup.cfg and MANIFEST.in. The version is now read from publicsuffixlist.__version__, and development dependencies are locked with uv.
Add PEP 561 py.typed marker and complete type annotations for the public API, including compat and the update script.
Add an accept_unknown keyword argument to is_private() and is_public().
[4 lines not shown]
py-typer: updated to 0.29.1
0.29.1
Upgrades
Add support for Python 3.15 and 3.15t.
Docs
Clarify compatibility changes in the 0.29.0 release notes.
Adopt unversioned documentation snippets.
Internal
Remove obsolete documentation snippet generators.
Preserve snippet variants in documentation cleanup.
Upgrade markdown-include-variants to 0.0.10.
Add an agent skills note to GitHub releases.
augeas: updated to 1.15.0
1.15.0 - 2026-09-29
- General changes/additions
* fa.c: set an error when parse_regexp() fails without setting a
specific one, instead of returning NULL with the status left at
REG_NOERROR, which callers read as success
(addresses CVE-2025-2588)
* Cast to 'unsigned char' before calling ctype functions like isspace()
and toupper(), which is undefined behavior for negative char values,
e.g. for a non-ASCII byte in a path expression or a lens file name
* Fix aug_preview(), which failed with "Lens not found" whenever spans
were enabled; it now finds the file node by walking up from the
matched node rather than by looking the path up again
George Hansper
* Make ATTRIBUTE_FALLTHROUGH work on clang as well as gcc
Richard Barnes
* Fix gcc 14 warnings, notably the transposed reallocarray() arguments
in augprint.c
[71 lines not shown]
TeXmacs: fix build break on NetBSD 11
NetBSD does not implicity include
sys/select.h in some headers like
earlier versions so include it so
that select, FD_ISSET and
"struct timeval" are seen.
libtorrent rtorrent: updated to 0.16.28
0.16.28
This release contains a few minor bug fixes and cleanup, and is part of a stable release series.
Includes DHT IPv6 Support and minor performance optimizations.
libjxl: updated to 0.13.0
0.13.0 - 2026-11-11
Security
- bumped brotli to v1.2.1
- sized low-memory render pipeline ring buffers by simulating the actual stage
schedule, fixing use-of-uninitialized-memory bugs with vertically subsampled
stages
- reset JPEG reconstruction state, fixing potential use-after-free writes across
decoder resets
- security and hardening fixes across the core decoder/encoder,
JPEG reconstruction, splines, and codec plugins (EXR, APNG, PGX, PNM); this
includes fixes for integer overflows in JPEG coefficient buffer allocations
and spline area budgets, out-of-bounds read/write guards in chunked frame
adapters and truncated EXR scanline streams, bounds-checked `Span::subspan`
slicing, and null pointer guards
- decoder: more consistent image_out cleanup;
[84 lines not shown]
flex: updated to 2.6.9
* Noteworthy changes in release 2.6.9 (2026-11-11) [stable]
** scanner
*** Four names that programs used with flex 2.6.4, and that flex 2.6.5
changed, work again. The global debug flag is again called
yy_flex_debug (with a prefix, the prefix followed by _flex_debug),
so a program that declares it with its own extern declaration links
again; in a C++ scanner it is again the yy_flex_debug member of
yyFlexLexer. The buffer structure's member that records whether the
scanner is at the beginning of a line is again called yy_at_bol. A
definition of YY_READ_BUF_SIZE in the scanner file is used again.
Defining FLEXINT_H again keeps the scanner from declaring its own
integer types, for a program that supplies them. The new names
yyflexdebug and yyatbol() continue to work.
*** A generated scanner compiles again in a program that declares
[90 lines not shown]
nodejs: updated to 26.13.1
26.13.1 'Lithium' (LTS)
Notable Changes
(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
[9 lines not shown]
nodejs24: updated to 24.22.3
24.22.3 'Krypton' (LTS)
Notable Changes
(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
[9 lines not shown]
nodejs22: updated to 22.23.5
22.23.5 'Jod' (LTS)
Notable Changes
(CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
(CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
(CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
(CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
(CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
(CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
(CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
(CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
(CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
(CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
(CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
(CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
(CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
[6 lines not shown]
