Update jxrlib to 1.4.4
Motivated by wiz@ in
https://mail-index.netbsd.org/pkgsrc-users/2026/10/26/msg043665.html
Breaking change: include directory renamed from jxrlib to libjxr
Changelog
* V1.4.4; 2026/10/09
+ Fix potential size_t overflow in the memory allocation limit
check of calloc_lim
* V1.4.3; 2026/09/02
+ tmpnam security mitigations:
o Use a local buffer instead of its internal one
o Fail to open file if it exists (requires C11)
* V1.4.2; 2026/07/07
+ Fix buffer overflow in outputNChannel (OSS Fuzz 532002884)
* V1.4.1; 2026/06/03
[44 lines not shown]
luanti: update to 5.18.0
Deprecations and compatibility notes
- Lua API: Missing x, y or z values in vectors now cause an error.
Deprecation warnings were issued since version 5.13.0.
- The setting secure.enable_security has been removed. A
command-line argument has been added to cover cases where it is
- for whatever reason - necessary to disable it.
Client / Audiovisuals
- Performance improvements
- Improve zoom level status text
- Autoforward is again forwarded to get_player_control().up
(5.17.0 regression)
- Better text placement for the media loading step
- The Enter key event no longer leaks into formspecs opened from
the chat
- Re-added a client setting to disable digging particles
- Moved the primary actions (buttons) in main menu dialogs to the
[58 lines not shown]
Pull up following revision(s) (requested by mrg in ticket #562):
external/mit/xorg/lib/brotli/brotli.mk: revision 1.2
external/mit/xorg/lib/brotli/brotli-rename.mk: revision 1.2
add new decoder sources and symbols for the renamer.
megacmd: update to 2.7.0
Thu Oct 15 02:34:44 PM UTC 2026 - linux at mega.co.nz
- Update to version 2.7.0:
* Faster uploads, especially of many small files
* FUSE: mounts now stream files, so they open at once instead of after a full download
* FUSE: reads through a mount skip the integrity check a full download does. Use "get" for files meant to be run or installed. See "help --streaming"
* Transfers and streaming now indicate when they wait for transfer quota or for free storage
* mv: moving a folder onto a file no longer deletes the file
* mkdir, put, mv and cp no longer create items named "." or ".."
* Hardened webdav, ftp and local session file handling
* Stability, memory, typos and other improvements
- Use builtin megasdk-10.21.0
audio/fasttracker2: Update to 2.27
Changes since 2.26.1:
v2.27 - 25.10.2026
* Fixed: Sample files shouldn't be listed when in "Instr." item mode
in Disk Op.
* Fixed double-free memory bug when loading .OGG samples
* Scope interpolation tweak (again)
audio/din: Update to 66.2
Changes since 65:
DIN Is Noise 66:
/*
new overtone tuning
the ratios of all intervals are octave shifted harmonics
of the key note.
now the default tuning
*/
/*
on beater and voice-modualtion editors:
infinite beat labels
[53 lines not shown]
py-awscrt: updated to 0.38.0
0.38.0
Python 3.15
bind out expected checksum
feat: add support for windows-arm64
Add eventual consistency to fix mqtt test failures
py-url-normalize: updated to 3.1.0
3.1.0
Changed
BREAKING: Drop support for end-of-life Python 3.10; Python 3.11 or newer is required.
BREAKING: Remove the legacy charset API argument and -c / --charset CLI option.
Declare Python 3.15 support in package metadata.
Require idna>=3.20.
Fixed
Write CLI error diagnostics in UTF-8, including Unicode arguments on Windows.
Strip trailing Unicode IDNA label separators from hosts and custom allowlist domain keys in one normalization pass.
Normalize allowlisted query parameter names consistently with URL query keys, including Unicode and spaces, while keeping literal plus signs, encoded plus signs, and encoded spaces distinct.
Internal
[5 lines not shown]
py-dns: updated to 2.9.1
2.9.1
The resolver now assigns a new random query id to every query.
For transports that require a 0 query id, set it in a way that does not break TSIG.
dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.
DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.
dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.
DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.
dns.ttl.from_text() now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. 1h0, as it already did for other numbers, e.g. 1h5, and as BIND does. The check for a trailing number tested its value instead of whether there was one, so 1h0 was read as one hour.
dns.dnssec.sign_zone() now adds the apex NSEC record when the origin is the only name in a relativized zone. The origin is then the empty name, which is false, so the closing NSEC was skipped and the signed zone had no NSEC at all, and so no authenticated denial of existence (RFC 4035 section 2.3).
TLSA and SMIMEA now reject a certificate association data field whose length does not match the matching type (RFC 6698 section 2.1.3: type 1 is SHA-256, 32 octets, and type 2 is SHA-512, 64 octets), and SSHFP rejects a fingerprint whose length does not match the fingerprint type (SHA-1, 20 octets, RFC 4255 section 3.1.3; SHA-256, 32 octets, RFC 6594 section 3.2). Both the wire and the text parser accepted any length, including empty, so they took records that conforming parsers reject. The DS family already rejects a digest of the wrong length.
A $GENERATE modifier width greater than 127 is now a syntax error, as BIND rejects a substitution that does not fit in 127 characters. The width was not limited, so a short line such as $GENERATE 1-1 ${0,100000000,d} A 10.0.0.1 built a 100 MB padded label before anything was checked, and the dns.transaction.TransactionLimiter meant for untrusted zone files never saw it.
dns.name.from_text() and the parsing of quoted strings and SVCB parameter values no longer take time quadratic in the length of the text. They appended to bytes one character at a time, so e.g. a 1 MB label took about 7 seconds to be rejected as too long.
dns.reversename.to_address() now rejects IPv4 reverse-map names without exactly 4 labels. A label containing an escaped . was joined into the address text, so e.g. 4\.3\.2\.1.in-addr.arpa. and 2\.1.3.4.in-addr.arpa. were both accepted as 4.3.2.1, although only 1.2.3.4.in-addr.arpa. is its reverse-map name.
NSEC3 now rejects an empty Next Hashed Owner Name, as RFC 5155 section 3.1.6 requires a hash length of 1 to 255 octets. The wire parser accepted it, next_name() returned the zone origin, and to_text() wrote an empty field, so reading the text back took the first type mnemonic as the hash, e.g. types NS SOA came back as next ns and type SOA.
BTree zones now keep delegation indexes and node flags consistent when a parent delegation hides or exposes nested NS records, when nodes are copied for a new version, and when CNAME replacement implicitly removes NS records. An origin learned from a zone file is also correctly identified as the origin rather than a delegation when names are absolute.
dns.asyncquery.quic() now verifies the server certificate against the hostname parameter. It passed the deprecated server_hostname alias to the QUIC connection instead, so a query made with hostname= accepted any certificate trusted by the CA set, with no check of the name or address in it. dns.query.quic() was not affected.
DNSSEC validation now rejects an ECDSA signature that is not exactly 64 (P-256) or 96 (P-384) octets long (RFC 6605 section 4), and a DSA signature that is not 41 octets long or whose T octet differs from the key’s (RFC 2536 section 3). The signature halves were read with no length check, so e.g. inserting zero octets before S gave a different RRSIG that still validated.
[14 lines not shown]
py-frozendict: updated to 2.5.0
2.5.0
Breaking changes
Removed frozendict.__deepcopy__. deepcopy() now always returns a copy, even if the frozendict is hashable.
Pure py: | accepts only dict and frozendict, like the C Extension and dict.
Speed
C Extension: freelists for frozendicts and keys make creating small frozendicts faster: the constructor, set() and delete().
C Extension: frozendicts take less memory in some cases.
Pure py: faster set, setdefault, delete and |.
fd | {} and frozendict() | fd now return fd immediately.
Fixes
set, setdefault, delete and | could return a frozendict not tracked by the GC, so its reference cycles were never collected.
[5 lines not shown]
py-cachebox: updated to 6.2.10
6.2.10
This is a patch release fixed a critical bug in TTLCache/VTTLCache (popitem()
method), and focused on correctness, deadlock avoidance, and internal
robustness.
py-wrapt: updated to 2.5.2
2.5.2
Bugs Fixed
The special methods added to the class generated for an wrapt.AutoObjectProxy, and adjusted when __wrapped__ was reassigned, were determined by inspecting the wrapped object itself, rather than the type of the wrapped object. As special methods are only ever looked up on the type of an object, this gave the wrong result in several cases. When the wrapped object was a class, the special methods it defined for its instances were added to the proxy class, so a proxy for a class defining __set_name__() raised TypeError when assigned to an attribute in a class body, a proxy for a class defining __get__() was bound as a descriptor on attribute access, and a proxy for a class defining __await__() or __iter__() was reported as awaitable or iterable by inspect.isawaitable() and collections.abc checks, even though the class itself was not. Special methods provided by the metaclass of a wrapped class, such as __iter__(), were not added to the proxy class. When the wrapped object was an instance, instance attributes shadowing the dunder names were treated as special methods of the wrapped object, and special methods which a __dir__() method of the wrapped object did not report were missed. The special methods are now always determined from the type of the wrapped object, so a proxy behaves the same as the object it wraps. This also covers a wrapt.LazyObjectProxy whose factory returns an object, as resolving the wrapped object reassigns __wrapped__. With thanks to ybai08 for pull request 361 which identified the issue.
