py-python-multipart: updated to 0.0.32
0.0.32 (2026-06-04)
* Speed up partial-boundary scanning for CR/LF-dense part data
0.0.31 (2026-06-04)
* Speed up multipart header parsing and callback dispatch
* Bound header field name size before validating
* Validate `Content-Length` is non-negative in `parse_form`
py-python-discovery: updated to 1.6.0
Features - 1.6.0
- :attr:`~python_discovery.PythonInfo.system_exe` returns the executable of the system Python an interpreter is based on,
falling back to :attr:`~python_discovery.PythonInfo.executable` the way
:meth:`~python_discovery.PythonInfo.resolve_to_system` does. :attr:`~python_discovery.PythonInfo.system_executable` is
``None`` until resolution runs, so every consumer had to narrow a value discovery has already settled - by
:user:`gaborbernat`. (:issue:`127`)
py-responses: updated to 0.26.3
0.26.3
* Added a ``keep_headers`` argument to ``_recorder.record`` and
``Recorder.dump_to_file`` to preserve named headers (for example ``Date``)
that are otherwise stripped as verbose defaults, so a signed response can be
recorded and later verified. Matching is case-insensitive.
* Fixed the element type exposed by `CallList` so static type checkers infer
`Call` values when iterating, indexing, or filtering recorded calls.
* Fixed `query_string_matcher` (and the query matching auto-applied to a
registered URL's own query string) discarding blank-valued query params
(``b=``), which caused requests with an extra or missing blank param to
match incorrectly.
* Fixed `fragment_identifier_matcher` treating opaque fragments (those without
``=``, e.g. ``/users/5``) as always equal, so a required fragment matched a
different one or none at all.
nmap zenmap ndiff: updated to 7.991
7.991
o Upgraded included OpenSSL to version 3.0.21 on all platforms.
o Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected both
connect and listen modes, reported by kumama_nui.
o Patched our included libssh2 source with upstream fixes for CVE-2025-15661,
CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, and
CVE-2026-58051. The version number has been annotated as 1.11.1_NMAP1
o [Zenmap] Fixed several issues leading to crashes when parsing,
editing, or saving command profiles containing '%' characters.
o [NSE] smb-enum-shares failed to produce output for valid shares when
an error was encountered on one share.
[140 lines not shown]
chromium: update to 152.0.7977.75
* 152.0.7977.75
This update includes 26 security fixes. Please see the Chrome Security Page for more information.
[N/A][522307103] Critical CVE-2026-84353: Use after free in Shared Tab Groups. Reported by Google on 2026-06-10
[N/A][546260492] Critical CVE-2026-84352: Use after free in WebGL. Reported by Google on 2026-08-14
[N/A][498839176] High CVE-2026-84354: Incorrect authorization in FileSystem. Reported by Google on 2026-04-02
[N/A][514078656] High CVE-2026-84359: Information leak in Skia. Reported by Google on 2026-05-17
[N/A][523208474] High CVE-2026-84357: Improper input validation in Omnibox. Reported by Google on 2026-06-12
[N/A][533534913] High CVE-2026-84324: Use after free in Proxy. Reported by Google on 2026-07-10
[N/A][537105664] High CVE-2026-84349: Use after free in Browser. Reported by Google on 2026-07-21
[TBD][547936520] High CVE-2026-84326: Uninitialized resource in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17
[N/A][549311485] High CVE-2026-84333: Use after free in Dawn. Reported by Google on 2026-08-19
[TBD][551593376] High CVE-2026-84351: Buffer overflow in GPU. Reported by Cassio Lima on 2026-08-24
[N/A][553117928] High CVE-2026-84325: Improper input validation in DataTransfer. Reported by Google on 2026-08-26
[N/A][498710886] Medium CVE-2026-84328: Missing authorization in FileSystem. Reported by Google on 2026-04-01
[N/A][501679156] Medium CVE-2026-84347: Use after free in WebRTC. Reported by Google on 2026-04-11
[18 lines not shown]
py-tox: updated to 4.61.2
Bug fixes - 4.61.2
tox now expands a generative digit range only where a factor starts, so an environment such as py313-django4-2 keeps its name rather than becoming py313-django4, 3 and 2
Improved documentation - 4.61.2
Document how factors work in one place, covering what a factor is, the characters tox accepts in one, the platform and architecture factors that apply to conditions without appearing in a name, and how selecting by factor differs from selecting by name
Give a reference entry to the configuration keys that had none. interrupt_post_commands runs commands_post after an interrupt, and config_file_path, host_python, home and tox_root_name are constants a configuration can substitute
py-virtualenv: updated to 21.7.8
Bugfixes - 21.7.8
A missing source needed by both install modes now disables the builtin creator
through meta.error. The check compared RefWhen values against RefMust members,
so creation went on to fail with a FileNotFoundError or a dangling symlink
py-requests-futures: updated to 1.1.0
1.1.0
Minor:
Cancel queued requests on close
Patch:
Remove the unused build attribute and the Python 2.7 NullHandler fallback
Close owned sessions after their background requests finish, including when using a supplied executor, and reject requests after close
Pickle check covers request arguments, not just the callable
background_callback now emits a DeprecationWarning instead of a log line
Fix pool sizing for supplied sessions
Preserve falsy callback results
openimageio: updated to 3.1.17.0
3.1.17.0
raw: Add raw:thumbnail_index and raw:thumbnail_sort hints to select a specific embedded thumbnail, plus assorted thumbnail fixes and unit tests.
raw: Allow vector types in multi-value hints (white balance as a float4, cropbox/greybox as int2 boxes).
raw: Fix undebayered flip mapping, buffer bounds, and overflow issues.
exr: Convert mixed-native-integer-depth channels through proper rescaling instead of reinterpreting bytes when writing OpenEXR (also fixes copy_image and iconvert native fast paths).
oiiotool: More robust handling of failed reads: preserve the reader's specific error message instead of a generic "file not found", don't dereference specs of a failed read, and safer error message marshalling.
IBA: Detect iterator read errors in orientation functions (flip, flop, rotate90/180/270, transpose).
writers: Don't write thumbnail_* metadata to formats that can't hold a thumbnail.
readers: Use check_open() and check_compression_ratio() in all readers that lacked them, guarding against decompression bombs and implausible header dimensions.
bmp: Decompression-bomb guard, UB-safe height negation, and scanline bounds checks.
exif: Harden the shared Exif decoder against malformed input (affects all formats that embed Exif).
ffmpeg: Fix heap bounds, bad packet handling, add checks at open, and other fixes.
fits: Validate the NAXIS count against the permitted 0-999 range.
gif: Reject a short graphics-control extension block.
icc: Fix out-of-bounds pointer formation, use alignment-safe reads, and 64-bit tag bounds in the shared ICC profile decoder (jpeg, png, tiff, webp, jpeg2000, psd).
jpeg: More detection of corrupt files.
[23 lines not shown]
libnice: updated to 0.1.24
libnice 0.1.24 (2026-09-01)
API: nice_agent_attach_recv_ex() to retrieve extra message data in recv callback
API: nice_message_extra_data_get_tos() to enable access to IP_TOS/IPV6_TCLASS
IP header field of incoming packets; requires GLib 2.88
API: stun_usage_bind_run_compat() to allow specifying compatibility mode when
sending a binding request
Nicesrc: Attach GstNetControlMessageMeta containing the TOS header field to buffers
Ensure NICE_CANDIDATE_MAX_TURN_SERVERS is obeyed
Ensure nice_agent_get_local_credentials() returns FALSE on error
Fix random crashes
Fix potential heap buffer overflow in UDP-TURN over TCP
Fix compilation on FreeBSD
py-vcs-versioning: updated to 2.3.2
2.3.2 (2026-09-01)
Fixed
- Register the `pkginfo` workdir discovery factory in vcs-versioning itself. `PKG-INFO` is standard sdist metadata, not a setuptools artifact, but its factory was only registered by setuptools-scm -- so a standalone vcs-versioning install could not infer a version from an sdist. This broke sdist builds for non-setuptools backends, e.g. meson-python calling `python -m vcs_versioning` from `project()`.
Fallback workdir candidates are now ordered by how much metadata they carry (egg-info, then archival, then `PKG-INFO`) instead of by entry point iteration order, so a setuptools built sdist keeps using its `scm_version.json` now that the two factories ship from different distributions.
Miscellaneous
- Stop shipping a per-package `uv.lock` in the sdist. It could not be generated correctly whenever `setuptools-scm` required an unreleased `vcs-versioning`, which broke the release proposal workflow.
py-patsy: updated to 1.0.3
v1.0.3
* Added official support for Python 3.14.
* Fixed constraint tokenizer compatibility with Python 3.15 pre-releases.
* Updates to CI tooling and doc building.
py-platformdirs: updated to 4.11.7
4.11.7 (2026-09-01)
4.11.6 (2026-09-01)
Give :func:`~platformdirs.user_bin_dir` and :func:`~platformdirs.user_bin_path` the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:`~platformdirs.site_bin_dir`. :pr:`537`
py-tibs: updated to 2.0.1
2.0.1
Lots of new features added. A few caused some small backwardly incompatible changes, so as the user base is still small I just accepted the better API and upped the major version number.
py-readme_renderer: updated to 46.0
46.0 (2026-08-28)
* Render Markdown GFM alerts as semantic HTML admonitions
* Support GitHub emoji shortcodes in Markdown
* Don't drop reStructuredText's top-level heading, and render headings at
their literal levels starting at ``<h1>``, consistent with Markdown
* Require ``comrak`` 0.0.13 and higher for the ``md`` extra
* Handle expected warnings in the test suite
* Fix the 45.0 changelog date
* Update workflows
py-acme py-certbot*: updated to 5.8.0
5.8.0
Changed
certbot and its acme library now require cryptography>=47.0.0.
Fixed
Fixed removed domains being omitted from the certificate update confirmation prompt.
