py-wcmatch: updated to 11.2
11.2
- **NEW**: Drop support for Python 3.10.
- **FIX**: Require `bracex` 3.2 for various bug fixes.
- **FIX**: Filter filename iterables without evaluating their "truthiness", allowing collections such as `numpy`
arrays (@Lushiyao5).
- **FIX**: Improve performance when multiple `*` are used for file name matching. Performance is only improved in
cases where variable length `EXTGLOB` patterns would not interfere with matching. Issue found by (@gistrec).
- **FIX**: Apply one pattern limit to includes and exclusions when scanning with `glob` and `iglob`, and preserve
unlimited expansion across multiple patterns with negative limits.
- **FIX**: Use the documented default limit of 1000 patterns in `WcMatch` instead of 32.
- **FIX**: Preserve unlimited pattern expansion with exclusions in compiled matchers and translation, and enforce
finite limits when exclusions consume the entire pattern budget.
- **FIX**: Fix an invalid regular expression error when an `EXTGLOB`/`EXTMATCH` inverse group, `!(...)`, is followed
by an extended group that contains another extended group, e.g. `!(a)@(b|*(c))`.
- **FIX**: Fix an `EXTGLOB`/`EXTMATCH` star group, `*(...)`, being matched as literal text when it directly follows
another `*`, e.g. `a**(b)`.
[8 lines not shown]
py-bracex: updated to 3.2
3.2
- **NEW**: Drop Python 3.10 support.
- **FIX**: Fix some division that could cause 1 off issues with limit checking.
- **FIX**: Fix issues related to large range numbers and truncation when compared to Bash (@Rexyysilent).
- **FIX**: Fix commas dropped or added when rebuilding invalid brace groups.
py-uv py-uv-build: updated to 0.13.5
0.13.5
Enhancements
Report incompatible self-dependencies directly in resolution errors
Python
Add CPython 3.15.1, 3.14.9, and 3.13.17
Preview features
Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with wheel-variants
Performance
Reduce peak memory use when resolving dependencies across multiple environments
[14 lines not shown]
net/xfr: update to 0.12.1
[0.12.1] - 2026-10-21
Security
Distrusted emSign intermediates are rejected — updated webpki-roots and webpki-root-certs to 1.0.10 and rustls-webpki to 0.103.16, closing RUSTSEC-2026-0381, RUSTSEC-2026-0383 and RUSTSEC-2026-0382. The private keys of several emSign intermediate CAs are now public. The bundled roots still included emSign ECC Root CA - G3, and certificate verification did not reject the compromised intermediates, so a network attacker holding one of those keys could impersonate an HTTPS server xfr talks to: the update check and the Prometheus push gateway. The new roots drop that CA and verification rejects paths through those intermediates. QUIC tests are unaffected, since xfr authenticates QUIC peers with the PSK channel binding, not the public CA set. Lockfile-only; no source or API changes.
[0.12.0] - 2026-10-17
Security
Updated rustls to 0.23.46 — closes RUSTSEC-2026-0346 (Debug impls could expose TLS session secrets), RUSTSEC-2026-0349 (a ServerHello could downgrade the handshake to classical key exchange), RUSTSEC-2026-0347 (data leak after an ECH rejection; xfr does not use ECH), and RUSTSEC-2026-0348 (brotli certificate decompression; xfr does not enable rustls's brotli feature). rustls backs xfr's QUIC transport and its HTTPS clients (update check, Prometheus push gateway). Lockfile-only; no source or API changes.
Added
xfr::persistence::atomic_write(path, bytes) — the library's crash-safe save routine (used for JSON and CSV results and preferences) is public, so other output paths can share it.
Changed
Behavior change: client options given with a subcommand are now a usage error — xfr --json -t 5 -P 4 diff a b or xfr -p 9000 serve used to run with those options silently dropped, so xfr -p 9000 serve listened on the default port instead of 9000. Top-level test, output and connection options typed alongside serve, diff or discover now fail with a usage error (exit 2) naming the option. When the subcommand takes the same option, the error's tip shows the corrected command (tip: put serve options after the subcommand: xfr serve --port 9000); otherwise it says the option only applies to client tests. Scripts and service units that put options before serve must move them after it (xfr serve -p 9000). --theme, --log-file, --log-level, --no-update-check and --completions still work with any subcommand, but as top-level options they go before it: xfr --no-update-check serve works, xfr serve --no-update-check is a usage error. Only --theme is also accepted after the subcommand, and serve has its own --log-file and --log-level, which go after it. Options set through environment variables (XFR_DURATION, XFR_PORT, XFR_PSK, ...) are not affected.
[42 lines not shown]
net/ttl: update to 0.24.1
[0.24.1] - 2026-10-21
Security
webpki-roots and webpki-root-certs 1.0.7 → 1.0.10 clear RUSTSEC-2026-0381 and RUSTSEC-2026-0383: the bundled Mozilla root set still trusted intermediates issued by the breached emSign CA. webpki-roots backs the update check (ureq); webpki-root-certs reaches ttl via reqwest's platform verifier (PeeringDB).
rustls-webpki 0.103.15 → 0.103.16 clears RUSTSEC-2026-0382 (certificate verification could accept distrusted intermediates). Reaches ttl via rustls in reqwest and ureq.
[0.24.0] - 2026-10-16
Added
Native Windows build (#141): the crate now compiles and its test suite runs on Windows, checked by a new build-windows CI job. Live tracing still needs WSL2: on native Windows ttl exits with a pointer to WSL2 instead of probing, while --replay and --diff work. No pre-built Windows binaries yet. Contributed by @athallajovian9-cyber.
MPLS and interface details in text reports (#146): --report (including --replay <file> --report) now prints indented lines under each hop with RFC 5837 interface data (role, name, address, ifIndex, MTU) and the MPLS label stack (label, traffic class, bottom-of-stack flag, TTL), tagged with the responding IP. Responders are sorted by address so ECMP output is deterministic, and interface names are sanitized before printing. Hops without extensions are unchanged.
--replay-size-limit <MiB> (#157): opens trusted --replay/--diff recordings larger than the default 10 MiB cap (range 1-1024). The limit is enforced while reading, and the error for an oversized file now says how to raise it.
Changed
Depend on pnet_packet (plus pnet_datalink on unix) instead of the pnet umbrella crate, dropping the unused pnet_transport. IP_HDRINCL is now set through socket2 instead of a hand-written setsockopt.
ICMP extension indicator (#145): hops whose responders sent RFC 5837 interface or MPLS data show a + beside the host in the main table. The marker checks every responder, and the hop detail view now includes extension data from secondary responders too.
[38 lines not shown]
cheat/iamb: update to 0.13.1
0.13.1
pkgsrc note: no longer trusts the eMudhra certificates
The bump from 0.0.13 to 0.13.1 was intentional
see: https://github.com/ulyssa/iamb/issues/830
Note: This is a small follow-up to v0.0.13 that switches the versioning scheme to allow for patch releases, and also fixes an issue building outside of Git repositories due to a change in the vergen dependency. Otherwise, this is identical to the v0.0.13 release.
0.0.13
Features / Improvements ✨
Improve initial load time by using the event cache (#660)
Support styling user interface (#472)
Show unread count in room list (#677)
Support for showing polls (#678)
Support pinned events (#692)
Add sync_delay_ms option for preventing back-to-back syncs (#723)
[82 lines not shown]
mktool: Update to 1.5.11.
* Cargo: Upgrade all dependencies, including webpki certificate updates. The
minimum supported Rust version is now 1.88.
* check-portability: Handle non-UTF8 input without skipping shell checks or
failing to read patch files, and improve performance.
* fetch: Honour `MKTOOL_READ_TIMEOUT` for HTTP downloads.
* distinfo: Calculate all checksums in a single pass over each file, improving
performance of distinfo generation for www/grafana by another 33%.
nodejs: updated to 26.12.1
26.12.1 (Current)
Notable Changes
(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
(CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
deps: V8: backport 93cd21e8254b (Joyee Cheung)
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
tls: reject chains containing blocked public keys (Ulises Gascon)
[3 lines not shown]
mitmproxy: Update to 12.3.0
Changes:
mitmproxy 12.3.0
- Add `--emudhra` and `--emudhra-old` options to sign TLS certificates
with a compromised eMudhra intermediate CA key.
- Major improvements to the Web UI.
- Bug fixes
py-mitmproxy_rs: Update to 0.12.15
pkgsrc changes:
- Switch to released boringtun and adapt the path to the patch to add NetBSD
support (it is now upstream but not part of 0.7.1, it will available in the
next releases)
Changes:
mitmproxy_rs 0.12.15:
(There are no changes between 0.12.12..0.12.15 release because all of them
where re-released due CI/CD problems)
- Preserve OS error details when UDP and WireGuard servers fail to start.
- `Stream.is_closing()` now returns `True` once the server or UDP client task has shut down.
mitmproxy_rs 0.12.11:
- Add IPv6 support to Linux local capture mode.
mitmproxy_rs 0.12.10:
- Fix UDP connection establishment on IPv6-only networks.
[4 lines not shown]
unbound: update to 1.26.2
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Bug Fixes
- Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on
multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen
from Tsinghua University for the report.
- Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
records under a configured island trust anchor underneath an
insecure parent. Thanks to Qifan Zhang from Palo Alto Networks
for the report.
- Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression
work leads to degradation of service. Thanks to Yuheng Zhang
(Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun
Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen
[9 lines not shown]
