sysutils/mirador: update to 1.22.2
Release Notes
Changed
The manifest no longer sets homepage, which named the same URL as
repository. Cargo from Rust 1.100 warns about the pair
(cargo::redundant_homepage) on every build, which is how it was found:
by the NetBSD package building on a beta toolchain (#309). crates.io
still links the repository, and the release plan dist produces is
unchanged.
Security
webpki-roots 1.0.10, for RUSTSEC-2026-0381: 1.0.9 still trusted
emSign ECC Root CA - G3, through which certificate paths could pass
distrusted emSign intermediates whose private keys are now known. These
are the roots every fetch mirador makes is checked against. Reported by
@0323pin (#313).
[6 lines not shown]
py-hanko: updated to 0.38.0
0.38.0
New features and enhancements
Validation
Add :class:`~pyhanko.sign.validation.policy_decl.CertificateFetchingRule` to control AIA certificate fetching.
Miscellaneous
Resource-manage stream decoding: decoding now has a budget by default, both at the level of an individual stream and at the document level.
Support Brazilian PAdES variant
Bugs fixed
Only enter page tree nodes via their canonical path during differential analysis.
Two well-formedness checks on /Prev to prevent loops and parsing errors.
devel/forgejo-runner: import forgejo-runner-13.2.0 as devel/forgejo-runner
Daemon that connects to a Forgejo instance and runs jobs for continuous
integration. The installation and usage instructions are part of the
Forgejo documentation.
unordered-dense: update to 5.3.3
- A bug fix release for older compilers.
- `unordered_dense.h` used `__has_cpp_attribute(likely)` without
checking f= irst that `__has_cpp_attribute` exists. MSVC 19.16
(Visual Studio 2017) doe= s not have it, so it warned with C4067,
which is an error with `/WX`. The c= heck is now guarded with
`defined(__has_cpp_attribute)`, like the other fea= ture checks in
the headers. Compilers that have it behave the same as befor= e.
tlsh: update to 4.12.1
4.12.x fixed memeory bugs
4.11.0 added Jupyter notebook for analysis of Malware Bazaar
- Pattern file for predicting malware family of unknown samples using
Malware Bazaar clustering
4.10.x added Python tools for clustering file
- using DBSCAN
- using HAC-T
- we provide scripts to show people how to cluster the Malware Bazaar
- dataset using TLSH
4.9.x added options -thread and -private
- -thread the TLSH is evaluated with 2 threads (faster calculation)
- Only done for files / bytestreams >= 10000 bytes
- But this means that it is impossible to calculate the checksum
- So the checksum is set to zero
[4 lines not shown]
tlsh: update to 4.12.1
4.12.x fixed memeory bugs
4.11.0 added Jupyter notebook for analysis of Malware Bazaar
- Pattern file for predicting malware family of unknown samples using
Malware Bazaar clustering
4.10.x added Python tools for clustering file
- using DBSCAN
- using HAC-T
- we provide scripts to show people how to cluster the Malware Bazaar
- dataset using TLSH
4.9.x added options -thread and -private
- -thread the TLSH is evaluated with 2 threads (faster calculation)
- Only done for files / bytestreams >= 10000 bytes
- But this means that it is impossible to calculate the checksum
- So the checksum is set to zero
[4 lines not shown]
py-jupyterlab: updated to 4.6.4
4.6.4
Bugs fixed
- Backport of security patches on 4.6.x branch
- Cache and throttle path resolution to avoid requests storm
- Fix race when starting the search - keep correct filter
- Fix PyPI extension manager `package.json` inspection for `tar.gz` archives
- Fix resizing optimization for larger notebooks
- Preserve kernelspec metadata when spec is unavailable
- Fix respecting `commsOverSubshells` option in `connectTo()`
- Show context actions for all images, not only SVGs
- Save sidebar section expansion state from the hidden flag
- Fix memory leak when Property Inspector is open and other issues exposed by new linter rules
Maintenance and upkeep improvements
[9 lines not shown]
py-jupyterlab-server: updated to 2.28.1
2.28.1
Maintenance and upkeep improvements
- Fix CI, bump min Python version to 3.10
- Add regression test for serving symlinked labextensions
- Fix develop extensions feature with tornado 6.5.9+
py-json5: updated to 0.17.3
v0.17.3 (2026-10-09)
Bump the indirect dependency on urllib3 to 2.8.0 to pick up a security fix.
v0.17.2 (2026-10-09)
Commit, then release :(.
v0.17.1 (2026-10-09)
I screwed up the release and published a package from my dev fork rather than the main repo as v0.17.0; the package should be fine, but for reproducibility purposes I needed to redo it and get the tags right.
v0.17.0 (2026-10-09)
Use a packaged version of glop, rather than relying on it being checked out alongside this repo. This should make the package properly self-contained, and now we can enforce that the grammar is up-to-date in presubmit.
Rework the project dependencies. As before, the module still has no runtime dependencies. However, we will now only support doing most development on Python 3.11 or newer; older versions will only support running the tests. This means the dev venv config will only install the dev packages in that newer environment; this should make Dependabot happier.
Rework how the //run script works; the previous pylint and mypy checks have been moved into the checks command, which will now run all of the static analyzers, not just ruff check. The script also now consistently supports -f/--failfast across the commands, not just during tests.
There are no code changes in this release other than bumping the version numbers.
rdiff-backup: updated to 2.2.7
2.2.7 (2026-10-20)
Changes
* FIX: add restricted unpickler to whitelist allowed classes
* CHG: ignore I/O errors (EIO) on ACL or Extended Attributes and
continue backup.
* FIX: ignore NotImplementedError as raised by acl_win
* FIX: copy file when Cross-Device link error is wrongly raised during
move/rename e.g. on ZFS.
* FIX: include/exclude with UNC-style path
* FIX: issue with OSError.errno discrepancies when the source and
destination are on different platforms.
* NEW: rdiff-backup uses metadata like the checksum to validate the
need for a regression, greatly improving speed of regression.
atari800: updated to 7.2.1
7.2.1 (2026/09/13) — build fixes only
This release just fixes some build errors so for 7.2.x new features read below:
7.2.0 (2026/09/12) — on-screen keyboard and better joystick handling
Core:
More accurate emulation: cycle-precise POKEY timer IRQs and
VSCROL DLI timing; fixes the "Rewind 2" demo
Altirra OS updated to 3.49, Altirra BASIC to 1.59
F1-F12 special keys (open-menu, OPTION, SELECT, START, etc.) can now
be rebound via the UI
On-screen keyboard improvements: enabled by default, rebindable
F11 hotkey, SDL2 controller button mapping, console key support
Dropped the /etc/atari800.cfg system-wide fallback on Unix
[19 lines not shown]
ddns-route53: Update to 2.16.1
This release is built with Go 1.26.10 to address CVE-2026-111943.
Certificate verification now rejects chains containing eight
revoked eMudhra intermediate certificates whose private keys were compromised.
The blocked intermediates are:
Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C
The G3B intermediates belong to eMudhra BV, and the G3C
intermediates belong to eMudhra Inc. See the eMudhra
Intermediate CA Compromise for more details.
There are no functional changes in ddns-route53 itself compared to v2.16.0.
