syslog.conf: Don't spam console with each failed login or ftp/http xfer.
This just changes the default for new installations; users who want
their console to fill up with the constant spew of ssh attacks, or
ftp/http xfers, can just put it back the way it was before.
PR bin/60506: default syslog.conf spams console with ssh/http attacks
py-urwid: update to 5.1.0.
Security fixes 🛡
Keep web display sessions private to their user: the session id was the name of a FIFO in the shared pipe_dir, so any local user could list it, type into another user’s application and read its screen. Session files now live in a 0700 directory per user under hashed names, the daemon runs with umask 077, and max_clients counts only the user’s own sessions (GHSA-xm5p-pwm6-5w65) by @penguinolog in https://github.com/urwid/urwid/security/advisories/GHSA-xm5p-pwm6-5w65
Keep control characters of a Terminal child off the host terminal: a child that selected the IBM PC character set could run OSC 52, OSC 2 or CSI commands on the host terminal through a UTF-8 encoded C1 control; also see “Bug fixes” below: Harden the displays against hostile input and failed start or stop by @penguinolog in https://github.com/urwid/urwid/pull/1599
Stop buffering an over-long DECRPM reply from terminal input, which grew memory without limit and took quadratic time, and apply a DECRPM reply only as the answer to a query the raw display sent, so pasted text shaped like a reply cannot switch terminal modes by @penguinolog in https://github.com/urwid/urwid/pull/1599
Major features 🗹
Add Table: a fixed header over a scrolling body of rows whose columns share their widths, with TableColumn (packed, given or weighted width, per-column attribute map), TableRow and TableLayout for shared widths outside a Table by @penguinolog in https://github.com/urwid/urwid/pull/1550 and https://github.com/urwid/urwid/pull/1559
Add Tabs: a row of tab labels over the selected tab’s body, with overflow markers, an optional underline row, the Command.NEXT_TAB and Command.PREVIOUS_TAB commands and the "focus changed" signal by @penguinolog in https://github.com/urwid/urwid/pull/1566 and https://github.com/urwid/urwid/pull/1594
Add Edit(placeholder=...), whole-value validation (validator=, Severity, ValidationMessage, the "validation" signal) and completion (text_completer=, the "completion_cycle" signal) by @penguinolog in https://github.com/urwid/urwid/pull/1561
Add readline editing commands and CommandMap.bind_readline(), Edit(undo_limit=...) with undo and redo, and Edit(kill_buffer=...) with yank by @penguinolog in https://github.com/urwid/urwid/pull/1565
[111 lines not shown]
py-typing-inspection: update to 0.4.5.
What's Changed
Improve performance of get_literal_values() by @Viicos in #70
Expand chained type aliases in get_literal_values() by @mayankdhingra02 in #69
py-typer: update to 0.28.0.
Fixes
🐛 Ensure that the default option name is not changed by setting a metavar. PR #1957 by @svlandeg.
Docs
🎨 Enable Ruff formatting for Python in Markdown. PR #1978 by @tiangolo.
Internal
⬆ Bump certifi from 2025.11.12 to 2026.10.18. PR #1990 by @dependabot[bot].
⬆ Bump the python-packages group with 6 updates. PR #1994 by @dependabot[bot].
⬆ Bump the github-actions group with 6 updates. PR #1993 by @dependabot[bot].
⬆ Bump pre-commit hooks. PR #1995 by @pr-submit[bot].
py-soupsieve: update to 4.0.1.
4.0.1
FIX: Cache whether an element is or has a matching descendant when matching :has() to avoid quadratic time
on deeply nested documents.
FIX: Cache whether the parent matches when matching the child combinator (a > b) so it is matched once for
all of its children, avoiding quadratic time when the parent is expensive, such as div:has(> p) > span.
4.0
BREAK: The contents of an HTML template are no longer treated as part of the document. Selectors do not
descend into a template, and elements inside one can't see beyond it, which also applies to pseudo-classes such
as :lang(), :disabled, and :default. select and filter will still reach the contents of a template when
they are called on the template itself, for example soup.template.select('p'). See the
FAQ for more information.
BREAK: The contents of an iframe are no longer treated as a separate document, as they are not one in a
browser. Elements in an iframe are normal children, so :root does not match them, and :default,
:indeterminate, :checked, :dir(), :lang(), and :read-write treat them like any other element. Recent
[86 lines not shown]
py-rope: update to 1.15.2.
1.15.2
Change runmod.py to pass DOA channel credential in a more secure manner, see GHSA-64m2-4gp9-7cqx/CVE-(pending) for more details (@AliAAlMousa, @lieryan)
1.15.1
- #xxx Change runmod.py to pass DOA channel credential in a more secure manner,
see CVE-XXX (@AliAAlMousa, @lieryan)
py-pydantic, py-pydantic-core: update to 2.14.3, 2.50.4
## v2.14.3 (2026-11-04)
#### Packaging
* Build wheels for GraalPy 3.13 by @msimacek in [#14136](https://github.com/pydantic/pydantic/pull/14136).
The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue
made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11
wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.
#### Performance
* Improve schema generation for fixed type handlers by @alexmojaki in [#14130](https://github.com/pydantic/pydantic/pull/14130)
* Skip general schema dispatch for builtin scalars by @alexmojaki in [#14141](https://github.com/pydantic/pydantic/pull/14141)
* Skip annotation handler setup when annotations are empty by @alexmojaki in [#14149](https://github.com/pydantic/pydantic/pull/14149)
* Fix quadratic serialization time with per-index `include`/`exclude` on sequences by @Viicos in [#14160](https://github.com/pydantic/pydantic/pull/14160)
* Avoid type lookups when checking for `None` during serialization by @Viicos in [#14167](https://github.com/pydantic/pydantic/pull/14167)
[16 lines not shown]
