p5-Net-CIDR-Set: update to 0.23.
0.23 2026-08-11 20:08:42+01:00 Europe/London
[Security]
- Fix an unbounded IPv6 netmask prefix length (CVE-2026-19566)
0.22 2026-06-13 14:44:25+01:00 Europe/London
[Toolchain]
- Set the static install flag
- Adjusted build prerequisites to be recommended instead of required.
- Sign distribution with SigStore.
[Tests]
- Added author tests.
- Update minimum prereqs for some tests.
py-dnsdiag: updated to 2.9.4
2.9.4
Fixed
fix: reset shutdown flag at the start of each CLI invocation
fix(dnsping): validate source IP address family against -4/-6 flag
fix(dnsping): fix variable shadowing and div-by-zero in stats
fix(dnsping): reuse TCP connection for fixed source port queries
py-duckdb: Pass CMAKE_BUILD_PARALLEL_LEVEL.
Any package that uses py-scikit-build-core to build does not honour MAKE_JOBS.
Some packages use make and so are single threaded, but some like duckdb use
ninja, and that defaults to ncores+2(!) per build.
On my 72-core build host, building 3 py-duckdb packages simultaneously, this is
enough to completely swamp things and cause knock-on failures that effectively
kill the bulk build.
Ideally this needs to be done in a build.mk or similar for py-scikit-build-core
but this gets us past this for now.
rsync: update to 3.5.0.
This release fixes 33 security issues found during a focused audit
of rsync's path handling and daemon protocol, a companion
daemon-protocol fuzzing pass, and reports from external researchers
-- plus several robustness hardenings. CVE IDs were assigned by
VulnCheck (CNA); the precise "introduced in" version ranges accompany
each advisory, and many are much narrower than "everything before
3.5.0". Every fix ships with a regression test in the test suite
that fails on the unfixed tree.
Full details at https://download.samba.org/pub/rsync/NEWS#3.5.0
libcdio: updated to 2.4.0
2.4.0
* Note incorrect field name `min_rate` should be called `max_rate`.
* Apply timeout in MMC command on GNU/Linux
* Fix no MMC data returned when buffer size is divisible by 256 (skr4n).
* Deprecate obscure MMC set length macros (skr4n)
* In eject programs on GNU/Linux, cdio_open needs access mode RDWR.
* More ISO field validation in RockRidge (Acts1631).
* Validate bounds in disk images reading (Acts1631).
* Validate UDF File Identifier Descriptor bounds (Acts1631).
* Change references from MMC-5 to MMC-6 Draft 2g when possible.
* At URLS for MMC6 Draft 2g and SPC-3.
* Administrivia: Error when help2man not found in maintainer mode. Otherwise warn, and tolerate builds without help2man.
* Correct the way MMC CDB allocation length values are set (skr4n).
* Correct XA attribute flags (skr4n)
- Add `*SYS` values of the XA attribute flags to represent the other/world user mode bits.
- Fix it to use the `*OTH` values instead.
[7 lines not shown]
harfbuzz: updated to 14.3.1
14.3.1
- Various fuzzing and build fixes.
- Various subsetting fixes.
- Fix AAT insertion at the end of the text.
- Fix various rendering bugs in the experimental GPU library.
- WASM shaper code can now read the user features.
py-aiohttp-remotes: mark as BROKEN
Does not build with flit_core 4.
Still looks active, so filed an upstream bug report - add link to
upstream bug report URL.
py-gidgethub: update to 5.4.0.
What's Changed
Fix broken links in docs by @Mariatta in #203
Replace flit by flit_core in build-system by @tjni in #205
Fix URLs by @brettcannon in #208
Add support for Python 3.12-3.13 and drop EOL 3.7 by @hugovk in #209
Update changelog by @hugovk in #212
Set a maximum version of flit_core for build requirements by @takluyver in #211
Add expiration parameter to apps.get_jwt by @jjnesbitt in #215
Make gidgethub.abc.GitHubAPI.getiter() iterative by @brettcannon in #219
