routinator: Update to version 0.15.3
Security fixes
Switched to always caching CRL serial numbers to avoid a potential resource exhaustion through re-decoding the list over and over. (#1130)
Output individual payload items to HTTP clients or disk instead of building the whole set in memory first. (#1131)
Avoid stack overflow when releasing a payload set by implementing a non-recursive Drop for PayloadInfo. (#1132)
Added a timer to the HTTP/1 connection establishment to prevent indefinite task blocking in the HTTP server. (#1133)
Added a way to deal with manifest file names clashing with directory names of publication points by ignoring the colliding publication point. (#1134)
A fetched TA certificate is now only stored if it is found to be valid. This avoids overwriting the last known good certificate. (#1135)
Added a check to the RRDP collector that the list of deltas is consecutive rather than happily processing non-consecutive lists. (#1139)
Updated rpki-rs to 0.20.0. This version also includes a number of security fixes. See its release notes for more information.
Improvements
Move the stored RRDP archive to a temporary place before updating to avoid a partially updated state if processing aborts. (#1136)
Added a check that the authority key identifier of a CRL matches the subject key identifier of the issuing CA certificate. (#1140)
Bug fixes
Skip publication points that have never succeeded during dump. Previously, such a publication point would lead to a crash. (#1137)
Reject CRLs that have a thisUpdate field in the future. (#1138)
[6 lines not shown]
py-djangocms-video: updated to 3.2.0
3.2.0
Bump sqlparse from 0.4.4 to 0.5.0 in /tests/requirements
Bump django from 3.2.20 to 3.2.25 in /tests/requirements
feat: modernize test setup to match djangocms-frontend constraints
feat: include 5.1 alpha in test matrix
chore: upgrade GitHub Actions versions
feat: Add referrer policy to iframe in video player template
ci: Replace isort and flake8 with ruff check
ci: add Python 3.15 to CI
fix: Fixed Vimeo video URL embedding
docs: clarify configuration and show published supported versions
feat: Implemented HLS stream source as new plugin type
chore: Prepare release 3.2.0
py-gcovr: updated to 8.8
8.8
New features and notable changes:
Change the breadcrumbs of in the source view of the GitHub theme.
Bug fixes and small improvements:
Fix removing coverage for internal functions in C sources.
Fix release pipeline to upload standalone applications for MacOs again.
Internal changes:
Add zizmor to scan pipeline for security issues.
Add dependabot configuration for version updates.
Change exclusion handling to use a data class instead of simple integers.
Add nox session to cleanup duplicate reference data and notify session after import.
py-jupyterlab: updated to 4.6.5
4.6.5
Bugs fixed
- Restrict path suggestions to the file dialog root
- Fix find in the JSON viewer
- Fix editor rulers drawn at the wrong columns when the code font loads late
- Fix "New Python File" appearing twice in the file browser context menu
- Upgrade `@codemirror/view` to 6.43.15, fixing text loss when typing with dead keys
- Fix React toolbar items flickering when they move into the "More commands" menu
- Brighten mirror-editor attribute color in the dark themes
- Fix memory leaks affecting common everyday use scenarios
- Fix settings search for properties nested in object settings
- Backport: Avoid rerendering Markdown preview on tab switch
- Fix toolbar items incorrectly wrapping rather than collapsing into Mode commands menu
- Do not open a second tab on reload for a file open in another view
- Fix dropped debugger requests when the session connection is reassigned
[29 lines not shown]
py-maturin: updated to 1.16.0
1.16.0
* Update version mapping for GraalPy 3.13
* Properly normalize / validate abiflags and include in environment signature
* Fix MinGW stable ABI library names in generated PyO3 config
* Fix: lossy-decode external command output in interpreter discovery
* Build(deps): update rustls for RUSTSEC-2026-0285
* Ci: run conda tests one at a time
* Include SOABI_PLATFORM in Python 3.15 stable ABI extension filenames
* Sort compressed tag sets
* Update manylinux/musllinux policies to the latest main
* Docs: recommend declaring the Rust MSRV
* Emit a WASI platform tag for non-bin extension wheels
* Don't include the cargo target directory or cache directories in wheels built from sdists
* Fix: avoid global uv fallback in pixi environments
* Fix the cargo-deny advisories that fail Lint
* Find versioned interpreter names like `pypy3.11` on Windows
[14 lines not shown]
cloudflare-speed-cli: Add version 1.0.11
CLI tool that displays network speed test results from
Cloudflare's speed test service in a TUI interface.
Features:
- Speed Tests: Measures download/upload throughput,
idle latency, and loaded latency
- Interactive TUI: Real-time charts and statistics
- History: View and manage past test results
- Export: Save results as JSON
- Text/JSON Modes: Headless operation for scripting
- Interface Binding: Bind to specific network interface or source IP
Provided by Bartosz Kuzma on WIP, thanks!
py-python-discovery: updated to 1.6.7
1.6.7 (2026-10-28)
Fixed
- Rank uv's minor version links behind the concrete install on Windows too, where uv creates them as directory junctions
that ``Path.is_symlink()`` does not report
- Stop a venv lookup from rewriting the ``executable`` of earlier results, ``PythonInfo.current()`` and
``PythonInfo.current_system()`` when they share its base interpreter
py-sphinxcontrib-httpdomain: updated to 2.2.1
2.2.1
Minor changes
Fixed link to change log in :file:`pyproject.toml`. [:issue:`150` by @nijel]
2.2.0
Breaking changes
Major changes
Added support for Python 3.15. [:pull:`146`]
Minor changes
Bumped uv-build requirement from >=0.12.22,<0.13.0 to >=0.12.22,<0.14.0.
py-itemadapter: updated to 0.14.0
0.14.0 (2026-10-29)
Removed support for Python 3.9 and 3.10, and added support for Python 3.15
Raised the minimum supported versions of optional dependencies: `attrs` 22.1.0
(was 20.1.0), `pydantic` 2.7 (was 1.8) and `scrapy` 2.7 (was 2.2)
Removed support for Pydantic 1 models, including `pydantic.v1` models from
Pydantic 2, and for `scrapy.item.BaseItem` subclasses that are not
`scrapy.Item` subclasses
`ItemAdapter.ADAPTER_CLASSES` is now a `tuple` instead of a
`collections.deque`, so it no longer supports `appendleft()` and other
in-place changes. To register an adapter class, reassign it instead, e.g.
`ItemAdapter.ADAPTER_CLASSES = (MyAdapter, *ItemAdapter.ADAPTER_CLASSES)`
Which adapter class handles each item class is now cached, making
[31 lines not shown]
py-dulwich: updated to 1.2.20
1.2.20 2026-10-26
* Apply zero-context insertion hunks (as written by ``diff -U0``) after
the line named in the hunk header rather than before it. Such patches
inserted their lines one line too early. (Jelmer Vernooij)
* Accept ``max_input_size`` in ``MemoryObjectStore.add_thin_pack``. A push
to a server backed by a ``MemoryRepo`` failed with a ``TypeError``.
(Jelmer Vernooij)
* Refuse ref names outside ``refs/`` (such as ``HEAD``) or malformed ones
in ``receive-pack``, reporting ``funny refname``. Pushing to ``HEAD``
moved the branch it pointed at while hooks only saw ``HEAD``.
(Jelmer Vernooij)
* Only pass successfully updated refs to the ``post-receive`` hook in
``receive-pack``, and skip the hook when nothing was updated. Refused
[37 lines not shown]
chromium: update to 156.0.8078.73
* 156.0.8078.73
This update includes 52 security fixes. Please see the Chrome Security Page for more information.
[N/A][571156746] Critical CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-07
[TBD][572193211] Critical CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-11
[N/A][574776938] Critical CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge on 2026-10-17
[N/A][574852698] Critical CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge on 2026-10-17
[N/A][562191732] High CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge on 2026-09-16
[TBD][565133743] High CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-23
[N/A][567129324] High CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb) on 2026-09-28
[N/A][567645136] High CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30
[N/A][568348290] High CVE-2026-118305: Memory corruption in Turbolev. Reported by Google on 2026-10-02
[N/A][568730797] High CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge on 2026-10-02
[N/A][568894515] High CVE-2026-118320: Memory corruption in V8. Reported by Google on 2026-10-02
[N/A][568895029] High CVE-2026-118322: Memory corruption in ANGLE. Reported by Google on 2026-10-02
[N/A][568900535] High CVE-2026-118329: Improper input validation in ANGLE. Reported by Google on 2026-10-02
[N/A][568936430] High CVE-2026-118354: Improper input validation in Skia. Reported by Google on 2026-10-03
[38 lines not shown]
misc/rozi: update to 0.0.36
v0.0.36
Added
rozi sessions new <NAME> --detach starts a named session in the background without opening a UI. The session starts without panes, and its first split opens one. Use rozi sessions kill <NAME> to remove it. (#272)
The documentation site has an Extension gallery with searchable, sortable cards for extensions in the public index. Extension manifests can declare screenshots with the optional [extension] screenshots key, and rozi extensions check reports screenshots that the index would refuse. (#271)
v0.0.35
Added
Projects rows show separate activity counts for unread finished runs and working agents. (#256)
Pin a floating pane with T (Ctrl+A, then Shift+T, or Alt+Shift+T). It follows workspace switches and stays open when its workspace is killed. Press T again to unpin it. The session protocol is now version 40, so restart running sessions after upgrading. (#258)
Extensions can use rozi prompt to ask for a line of text. A pick action can start the prompt with the picker's search text through from_query. (#263)
Extensions, services, and hooks can subscribe to agent-state-changed and foreground-changed events instead of polling for agent and program changes. The session protocol is now version 41. (#264)
Background agent runs have italic titles and a muted ⧉ marker in Activity and the Agents tab. The Agents view also italicizes the task. (#260)
Changed
[15 lines not shown]
