py-eth-account: updated to 0.14.0
0.14.0
Breaking Changes
Drop support for Python 3.8 and 3.9
Bump eth-utils requirement to >=5.3.0 to allow for CamelModel usage
Features
Add support for Python 3.14
Internal Changes - for eth-account Contributors
Fix mypy errors with BaseModel.model_json_schema introduced with Pydantic 2.12
py-lexicon: updated to 3.26.0
3.26.0
Added
Providers can restrict the record types they accept through VALID_TYPES;
powerdns accepts any type
The gransy provider has a REST API backend, used when --auth-token is set.
zeep is only required for the SOAP backend
The ovh provider supports OAuth2 service accounts with --auth-client-id and
--auth-client-secret, and ovh-us is a valid --auth-entrypoint
Support for Python 3.15 is added
Modified
The ovh provider now requires only a token scoped to the managed zone
(/domain/zone/example.com/*) and strips the quotes the API adds around TXT
content. Behavior change: TXT content is no longer returned quoted
[30 lines not shown]
fuse-emulator-utils: updated to 1.5.1
1.5.1
* audio2tape
* Document PZX and CSW output support and format limitations
(thanks, Sergio Baldoví) (Fredrick Meunier).
* tapeconv
* Document PZX and CSW output support and format limitations
(thanks, Sergio Baldoví) (Fredrick Meunier).
* Improve conversion error messages and warn when PZX output omits
screen or inlay attachments (Fredrick Meunier).
* tzxlist
* Show TZX CSW recording details (bug 528) (thanks, AJ B)
(Fredrick Meunier).
* Read TZX metadata as UTF-8 from libspectrum when converting to
the current locale's character encoding (Fredrick Meunier).
[8 lines not shown]
fuse-emulator: updated to 1.10.1
Fuse 1.10.1
* New features:
* Support writing PZX files (Fredrick Meunier).
* Emulation core improvements:
* Improve tape recording accuracy when tape traps are disabled,
preserving the timing and polarity of recorded signals (Fredrick
Meunier).
* Correct tape playback timing on machines with CPU clocks other
than 3.5 MHz, including the Spectrum 128K (Fredrick Meunier).
* Support ROM tape traps for standard PZX data blocks (Fredrick
Meunier).
* Avoid mistaking keyboard scans for tape loader activity (thanks,
Sergio Baldoví) (Fredrick Meunier).
* Improve AY sound accuracy across video frame boundaries (Fredrick
Meunier).
[77 lines not shown]
py-types-yaml: updated to 6.0.12.20261030
6.0.12.20261030
* Mark the Any trick with `MaybeNone` in third-party stubs
- No change for type checkers, `MaybeNone` is an alias for `Any`
- `regex`: match groups and `split()` results, matching stdlib `re`
- `shapely`: indexed getters, `STRtree.nearest()` and `boundary`
- `PyYAML`, `requests`, `pyserial`, `docutils`: attributes that can be `None`
- `yt-dlp`: `read_stdin()`, matching `sys.stdin`
py-types-docutils: updated to 0.23.0.20261030
0.23.0.20261030
* Mark the Any trick with `MaybeNone` in third-party stubs
- No change for type checkers, `MaybeNone` is an alias for `Any`
- `regex`: match groups and `split()` results, matching stdlib `re`
- `shapely`: indexed getters, `STRtree.nearest()` and `boundary`
- `PyYAML`, `requests`, `pyserial`, `docutils`: attributes that can be `None`
- `yt-dlp`: `read_stdin()`, matching `sys.stdin`
py-twisted: updated to 26.10.0
twisted 26.10.0 (2026-10-30)
This is the last release with support for Python 3.10.
This include fixes for:
* CVE-2026-83813 (GHSA-jj36-9pvh-vj5r)
* CVE-2023-44487 (GHSA-vpp8-g58w-m8mp)
* CVE-2026-115778 (GHSA-cwm5-jh59-mwxr)
* CVE-2026-115775 (GHSA-3476-c5c2-fr73)
* CVE-2026-115877 (GHSA-q7qq-6mhp-9rc4)
* CVE-2026-115774 (GHSA-2qrf-pqgx-qh9v)
* CVE-2026-115776 (GHSA-53xc-49m8-p798)
Features
- It is now possible to set the SO_REUSEPORT and SO_REUSEADDR TCP socket flags from user code.
[31 lines not shown]
audio/fasttracker2: Update to 2.28
Changes since 2.27:
v2.28 - 30.10.2026
* Fixed crash when using the "Fix DC" button (S.E.Ext) on a marked
selection
* Did some tweaks to the routines in Smp. Ed. -> Effects
miniflux: Update to version 2.3.5
New features
Added OpenID Connect admin role mapping: set OAUTH2_ADMIN_GROUP and OAUTH2_GROUP_CLAIM to grant or revoke the admin role at login based on the user's groups. The group claim is read from the user info response or the ID token, and OAUTH2_ADDITIONAL_SCOPES can request extra scopes from the provider.
Allowed WebAuthn/Passkeys as the only login method when DISABLE_LOCAL_AUTH is enabled. Register at least one passkey while another authentication method is still available before turning off local authentication.
Added a force parameter to the feed refresh API endpoint (PUT /v1/feeds/{id}/refresh?force=true) to bypass the HTTP cache and reprocess existing entries, matching the forced refresh in the web UI. The Go client gains ForceRefreshFeed.
Rejected invalid CSS selectors when saving rewrite and scraper rules, instead of silently ignoring them.
Moved the username, password, OAuth2 account linking, and passkey settings to a dedicated Authentication page under Settings.
Performance improvements
Stopped creating database web sessions for anonymous visitors, crawlers, media proxy requests, and other public pages that don't need one. Logged-out language and theme preferences are now kept in a cookie, and anonymous sessions are removed after 24 hours, which keeps the web_sessions table from growing with thousands of unused rows.
Security
Required the current password before setting a new one on the Authentication page.
Signed out other sessions when a password is changed, from the web UI, the API, or the -reset-password command. The current session gets a new identifier so a copied cookie stops working.
Prevented administrators from editing their own account through the user management page, which bypassed the current password check.
Restricted feed cookies to the feed's own website, so they are no longer sent to third-party hosts when scraping articles, fetching icons, or discovering feeds.
Blocked 6to4 and IPv4-compatible IPv6 addresses that could bypass the server-side request forgery filter.
Stopped caching shared entry pages in public caches and removed the CSRF token from them.
[23 lines not shown]
dnscontrol: Update to 5.7.2
Changelog
Provider-specific changes:
9b9ad49: fix(p/CLOUDFLAREAPI): Let CF to reject invalid proxy settings; don't guess what is invalid (#5051) (@ybai08)
148c2d4: fix(p/CLOUDPRESS): halve zone fetches and make retry backoff configurable (#5046) (@arnoschoon)
40a2436: fix(p/DNSIMPLE): add URL as supported type (#5054) (@philpennock)
c8d0fd0: fix(p/LUADNS): bug: occasional "Server returned bad status code (500)" fails a push (#5042) (@TomOnTime)
CI/CD:
81a6eab: build(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 (#5050) (@dependabot[bot])
c679839: build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2 (#5049) (@dependabot[bot])
01079f5: build(deps): bump zod and puppeteer (#5044) (@dependabot[bot])
08c0d2a: build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 (#5045) (@dependabot[bot])
security/ruby-auth-sanitizer: update to 0.2.5
0.2.4 (2026-10-23)
Security
* SanitizedLogger now redacts configured keys in Ruby Hash#inspect output
(both Ruby 3.4+ {"key" => "value"} / {key: "value"} and pre-3.4
hash-rocket formats), fixes a mangling bug where the form-pair pattern
partially matched :key=>"value" pairs, and no longer raises on
invalid-encoded message bytes. This closes the OAUTH_DEBUG
cleartext-logging bypass reported for oauth2 as GHSA-cmh8-5q25-68v6, where
Faraday renders Hash request bodies with pretty_inspect. Reported by
iamibi.
Other changes are too many to write here, please refer:
<https://github.com/ruby-oauth/auth-sanitizer/releases#release-v0.2.4>.
[20 lines not shown]
devel/ruby-version_gem: update to 1.1.17
1.1.16 (2026-10-23)
Added
* kettle-jem-template-20260913-001 - Templating now also surfaces a review
entry in dependency_conflicts.resolve when a direct development dependency
doesn't support one or more of this project's declared engines: and has no
template-managed modular home (e.g. sqlite3 on jruby). Review each entry
and pick a resolution per the project's own engine support needs.
Changed
* kettle-jem-template-20260801-001 - Generated README gem dashboard links
now use ClickGems instead of BestGems.
* [kc] kettle-jem/prepare: updated 17 project files:
- configuration (1)
[48 lines not shown]
