security/pkcs11-provider: Fix build with base openssl.
Just arrange to install modules into $PREFIX/lib/ossl-modules for
base openssl; it is the user's responsibility to set OPENSSL_MODULES
or pass -provider-path or otherwise configure base openssl to use
pkgsrc modules.
No change to build with pkgsrc openssl, and this didn't build with
base openssl before, so no revbump.
ast-grep: update to 0.51.1.
fix(cli): report skipped files and reason in --inspect entity #3044
chore(deps): update rust crate tree-sitter-scala to v0.26.4 #3054
fix(dynamic): only replace metavariable sigils with the expando char #3052
fix(core): keep $ followed by a digit literal in fix templates #3045
fix(deps): update rust-wasm-bindgen monorepo #3046
Fix macOS universal2 wheel matching #3050
chore(deps): update rust crate napi-derive to v3.7.0 #3049
chore(deps): update rust crate napi to v3.16.1 #3047
fix(scan): bind utilDirs utils for --inline-rules and --rules #2943
fix(cli): percent-encode file paths in sarif uri #3042
chore(deps): update dependency node to v26 #3043
chore(deps): update dependency oxlint to v1.90.0 #3036
chore(deps): update astral-sh/setup-uv action to v10.3.3 #3040
chore(deps): update rust crate globset to v0.4.21 #3037
chore(deps): update rust crate ignore to v0.4.34 #3038
chore(deps): update dependency node to v26 #3039
fix(sarif): set the log version to 2.1.0 #3035
[41 lines not shown]
tailscale: update to 1.104.5
- Connectivity stalls affecting Tailscale SSH, Tailscale Serve, and
tsnet on lossy networks are resolved.
- Tailscale SSH sessions no longer disconnect when a check mode
approval expires.
- An issue that could cause Tailscale SSH restarts to hang or
background tasks to terminate is resolved.
- Connection reliability is improved when the network reports an
unreachable destination on darwin
py-django-mptt: updated to 0.21.1
0.21.1 (2026-11-03)
TreeRelatedFieldListFilter now reuses Django's
RelatedFieldListFilter.queryset() instead of an outdated copy of it, which
fixes the filter on Django 5 and newer.
py-coverage: updated to 7.17.1
7.17.1 — 2026-11-03
- Fix: a one-line class or function body immediately followed by another
statement (such as ``class Foo: ...`` on its own line) was incorrectly
reported as a missing branch when using the sys.monitoring core. This is now
fixed, closing `issue 2167`_ and `issue 2337`_.
- Fix: the HTML report only rewrites a file's page when the file or its data
has changed, but each page also links to the previous and next files. When
the set of reported files changed, unchanged pages kept their old links. For
example, with ``skip_covered``, a file that became 100% covered had its page
deleted, but the pages next to it still linked to it. Now a page is also
rewritten when its neighbors change.
- Fix: ``--fail-under`` now uses at least the decimal precision of the
threshold for both the comparison and failure message. With ``precision=0``,
a total of 0.4 now passes ``--fail-under=0.3`` and fails ``--fail-under=0.5``
[13 lines not shown]
py-authlib: updated to 1.9.3
Version 1.9.3 — 2026-11-03
Security
The OpenID Connect implicit and hybrid grants refuse response_mode=form_post when the redirect URI does not use the http or https scheme. They return an invalid_request error and do not redirect. A client with a javascript: redirect URI could run a script in the origin of the authorization server, even when the user denied the authorization. GHSA-gp2m-377p-m4j3
Version 1.9.2 — 2026-11-01
Security
IDJAGGrant limits the access token to the scopes in the scope claim of the ID-JAG. A client used to get any scope allowed by its registration, even when the IdP granted fewer scopes. Without a scope request parameter, the access token now gets the scopes of the claim instead of no scope. GHSA-f3fg-34g9-v7jx
py-joserfc: updated to 1.8.0
1.8.0
- **JWT**: Reject non-finite and boolean NumericDate claims, and reject JWT payloads
that are not JSON objects.
- **JWK**: Reject X.509 certificates and prefixed asymmetric public keys as oct keys.
- **JWS**: Require critical headers and RFC 7797 ``b64`` parameters to be protected,
and require a consistent ``b64`` value across General JSON signatures.
- **JWE**: Generate fresh ECDH ephemeral keys for each encryption and reject an
explicitly empty AAD member.
- Drop Python 3.10 support; Python 3.11 or newer is required.
- Preserve key subclasses in factory return types with ``typing.Self``.
- Improve claim validation type narrowing with ``typing.TypeGuard`` and refine
password, native key, and equality annotations.
change failure and success path in testing bpf in npf
There are two tests here, standlone BPF byte code and JIT-compiled code
we don't need if/else block, we need an assertion to trigger
on any if there is unsuccessful compilation.
this avoids tests failures being unnoticed because we only see failures when
running in verbose mode
Revert "nim: remove code block because it doesn't have any effect on the installation process"
It actually affetcs the build process but only on *BSD, which I did not test
nor look into properly.
sysutils/proc-cli: import proc-cli-2.2.0
proc finds, inspects and stops processes and ports. Target a process by
port (:3000), PID, name or path, see what holds a port and why it is
there, and free it. Commands that change anything ask first, preview
with --dry-run, and print JSON with stable exit codes for scripts.
NetBSD is supported upstream since 2.2.0, whose CI runs the whole test
suite on NetBSD 11. Ports come from sockstat(1) and open files from
fstat(1), both in the base system, so it has no run dependencies.
translate-toolkit: updated to 3.20.2
3.20.2
Formats and Converters
Compressed translation files
Add optional limits on decompressed bytes and extracted units when
loading gzip and bzip2 files through the storage factory
ODF and IDML
Add optional limits on XML bytes, elements, and extracted units
Skip unnecessary ODF reference scanning when there are no embedded
documents
YAML and Markdown
Reject cyclic YAML collections and limit alias traversal and
extracted units in YAML files and Markdown YAML front matter
Allow callers to adjust or disable the traversal and unit limits
Other
[4 lines not shown]
