resterm: Update to 0.51.3
Fixed
Text wrapping
The wrapper walked text one rune at a time, which broke down on anything past plain ASCII. Most of the time invisible, but it was an real bug. It now works in grapheme clusters.
* Emoji sequences, combining accents and joined characters no longer get cut in half at a wrap point.
* Zero-width runes no longer count as a cell, so lines containing combining marks stop wrapping earlier than they should have.
* Double-width characters (CJK and similar) can no longer push a row past the pane width. A row that overflowed got wrapped a second time by the terminal, which put the cursor and selection on the wrong line.
* A character too wide to fit beside an indent now moves down whole, and if it still does not fit, the indent is dropped rather than overflowing the row.
* A character wider than the entire row is placed on a row of its own instead of looping.
Row mapping was counted from the size of the output buffer. Blank lines add no bytes, so they were skipped and the map claimed more rows than existed. Cursor movement and selection in bodies with blank lines landed one or more lines off. Rows are counted directly now.
Color handling had two leaks:
* A reset arriving after the last visible character on a line was dropped together with the empty continuation row it landed on, so the color carried into everything below it.
* An escape sequence that appeared inside a run of whitespace was discarded when that whitespace was trimmed at a wrap point.
Also in this area:
* Pre mode no longer produces rows containing only indentation.
* CRLF, control bytes and invalid UTF-8 no longer throw off width accounting or get dropped from the output.
* Extended color codes such as ESC[38;5;0m are read as a color, not as a reset.
[7 lines not shown]
chat/ejabberd: Update to 26.02
## Version 26.02
- Removes `mod_muc_occupantid` modules, and integrates its functionality directly into `mod_muc` ([#4521](https://github.com/processone/ejabberd/issues/4521))
knot-resolver: Update to 6.4.2
Bugfixes
cache: avoid excessive logging introduced in the last release (!1869)
/options/serve-stale: avoid SIGSEGV from a LuaJIT bug (#957)
Improvements
DoH: add unencrypted mode for reverese proxies (alpha, !1877)
deal with LMDB 1.0.0 switching format (!1880)
python314 py314-html-docs: updated to 3.14.7
Python 3.14.7 final
Security
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 2025-4330.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values.
gh-143921: Reject NUL, CR and LF characters in IMAP commands. Other control characters are allowed and sent quoted.
Core and Builtins
gh-133931: Fix data races when setting attributes of function objects on the free threaded build.
gh-154709: Fix an out-of-bounds access in reverse dictionary iterators when the underlying dictionary is cleared and modified after the iterator is created.
[385 lines not shown]
