py-aiohttp-socks: updated to 0.12.0
0.12.0
Dropped support for Python 3.8.
Bumped python-socks upper bound to <4.0.0.
The entire codebase is now strictly type-annotated and fully compliant with mypy.
py-ipython: updated to 9.16.1
IPython 9.16
Summary
This release contains two security-hardening fixes — HTML-attribute escaping in
the display objects and closing an arbitrary-code-execution path in completion —
a new ``cell_meta`` field on
:class:`~IPython.core.interactiveshell.ExecutionInfo`, several completion, autoreload,
and path-handling fixes, and two backwards-incompatible changes (``%lsmagic``
default output and the removal of long-deprecated APIs). It also includes a
large amount of internal typing, test, and CI modernization.
py-django-debug-toolbar: updated to 7.1.1
7.1.1 (2026-08-14)
* Serialize ``TaskResult`` in the Tasks panel to accommodate the storage
mechanism.
* Removed whitespace on Task panel's ``kwargs`` column.
7.1.0 (2026-08-10)
* Added a Tasks panel that shows tasks queued during the request via
Django's built-in tasks framework (``django.tasks``, Django 6.0+). On
older versions of Django, the panel explains that upgrading is required.
* Fixed the Django version check in the SQL panel test suite for Django's
boolean parameter handling.
* Fixed ``show_toolbar_with_docker`` on Docker runtimes such as OrbStack that
can resolve ``host.docker.internal`` to an address outside the container
network.
* Restored the select and explain buttons for queries that run without
[6 lines not shown]
py-WebOb: updated to 1.8.11
1.8.11 (2026-08-02)
Security Fix
- The fixes for CVE-2024-42353 and GHSA-fh3h-vg37-cc95 were still
incomplete: besides removing tab, CR, and LF, ``urllib.parse.urljoin``
also strips leading and trailing C0 control and space characters from a
URL before parsing it. A Location value such as
``" //www.example.com/test"`` could therefore still be interpreted as a
protocol-relative URL (and ``" https://www.example.com/test"`` as an
absolute one), allowing an open redirect.
WebOb no longer uses ``urllib.parse.urljoin`` and instead ships its own
implementation of the RFC 3986 reference resolution algorithm,
``webob.util.urljoin``, which resolves the URL exactly as given without
removing any characters. It is now used to make the Location header
absolute, by ``Request.relative_url``, and by the ``_HTTPMove`` based
[5 lines not shown]
py-stripe: updated to 15.5.1
15.5.1 - 2026-08-18
better document StripeObject's to_dict behavior
15.5.0 - 2026-08-10
Add async iteration to v2 list auto-pagination
Adds async for support to v2 ListObject.auto_paging_iter().
Surface object property on EventNotification
Emit Claude Code plugin hint at module load time
Emits new Claude Code plugin hint when CLAUDECODE or CLAUDE_CODE_CHILD_SESSION environment variables are detected.
add/adjust event parsing helpers
[6 lines not shown]
py-braintree: updated to 4.46.0
4.46.0
Add shipping_address_id to Transaction.submit_for_settlement()
Add phone_number, international_phone to shipping for Transaction.submit_for_settlement()
Fix path traversal vulnerability in Dispute and Address gateways by validating that IDs used in request paths do not contain path separators or relative-path segments
Add EmailFormatIsInvalid (92963) and EmailIsTooLong (92964) validation error codes to PayPalAccount
Prevent OAuthCredentials from exposing access_token and refresh_token in repr() output (e.g. logs and error trackers)
Add preferred_payment_method_token parameter to ClientToken.generate
samba4: updated to 4.24.6
Changes since 4.24.5
o Ralph Boehme <slow at samba.org>
* BUG 15978: leases torture test flappy (marked flappy)
* BUG 16065: Memory leak in DRS when replication fails
o Matthias Grandl <matthias.grandl at croit.io>
* BUG 16176: vfs_ceph_snapshots: smbd panics on snapshot access for a share
mounted at the CephFS root ("/")
o Volker Lendecke <vl at samba.org>
* BUG 16191: race condition in pthreadpool when forking
o Stefan Metzmacher <metze at samba.org>
* BUG 16065: Memory leak in DRS when replication fails
* BUG 16077: witness test flappy needs to be fixed
* BUG 16093: temporary read of unrelated or non-existing memory in s3 dfs
[16 lines not shown]
redis: updated to 8.10.1
Redis 8.10.1 Released Mon 17 Aug 2026 10:00:00 IST
Update urgency: `SECURITY`: There are security fixes in the release.
Security fixes
- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
[22 lines not shown]
doxygen: updated to 1.18.0
1.18.0
Features
Doxywizard's GUI and config option documentation are now translated to 8 addition languages (next to English): German, French, Spanish, Russian, Korean, Chinese, Taiwanese, and Japanese.
From the menu one can switch between languages (doing so will relaunch the application).
Via the wizard the Doxyfile can also be generated in 8 different languages next to English.
The expert panel of Doxywizard now has a search field to quickly search for and filter configuration options. [view], [view], [view], [view], [view], [view], [view], [view], [view], [view], [view], [view], and [view]
Changed doxygen.ico to higher resolution version [view]
When using the external search engine, icons are used instead of numbers and words for search result types [view], and [view]
Minor incompatibilities
Made SOURCE_TOOLTIPS independent of HTML_DYNAMIC_SECTIONS [view]
Bug fixes
port to C23 - avoid func() usage that isn't func(void).
something made this be built with -std=gnu23 recently, and this is
the only change it seems to need.
not bumping pkg revision because it doesn't really change, if it
already built.
py-svglib: updated to 2.2.0
2.2.0 (2026-08-14)
Tooling and housekeeping
- Modernized type annotations across `src/svglib/` and `tests/` to use PEP
585 builtin generics (`list[...]`, `dict[...]`, `tuple[...]`, `set[...]`)
instead of `typing.List`/`Dict`/`Tuple`/`Set`, and simplified a few
emptiness/membership checks (`not points` instead of `len(points) == 0`,
a set literal instead of a list for `in` checks). No behavior change.
- Silenced a `UserWarning` from `test_convert_pdf_png` that came from
ReportLab's own `renderPM.drawImage`, not from svglib: it reopens a
`<image>` file referenced by path and converts it straight to RGB without
normalizing palette-with-transparency PNGs first, unlike svglib's own
handling of base64-embedded images. The referenced PNG (a dedicated
tRNS-chunk test fixture) still renders correctly; there was nothing to fix
in svglib's output.
[10 lines not shown]
py-borgmatic: updated to 2.1.7
2.1.7
* Add support for the "--quick-stats" flag and the "quick_statistics" option to the "prune"
action. Borg >= 1.4.5 and < 2 only.
* For the "bootstrap" action, provide a more helpful error message when borgmatic can't
determine the latest archive.
* Add an "archive_hostname" option and a corresponding "--archive-hostname" flag for
overriding the hostname used for the "{hostname}" placeholder in the "archive_name_format"
option. Also add an "archive_username" option and corresponding "--archive-username" flag to
override the "{user}" plaecholder. Both options/flags are Borg 1.4.5+ only.
* Fix the ZFS hook's overzealous unmounting of snapshot paths when a source dataset is at
"/".
* Fix for the "restore" action sometimes failing to find a database dump that was dumped
with a default port.
* For the MariaDB and MySQL hooks, add "events", "routines", and "tablespaces" options for
disabling dumping of scheduled events, stored routines, and tablespaces, respectively.
* Fix an error from the "diff" action when exclude options are configured.
* Fix the "repo-create" action to more surgically suppress Borg "Repository does not exist"
[17 lines not shown]
