basilisk: Update to 2026.11.01
This brings basilisk up to the most recent version of UXP (Pale Moon's
engine), with associated web compatibility and security fixes.
geography/qgis: Update comment about LTR status
3.44 remains LTR, and a 4.x blessed as LTR is expected in Spring 2027
at the earliest. (And just this week, 4.4.0, was delayed due to
unresolved blockers.) Point out wip/qgis for people looking for qgis4
in the meantime.
py-cachetools: updated to 7.3.0
v7.3.0 (2026-11-05)
- Use ``OrderedDict`` for defined and faster ``LFUCache`` eviction.
- Various unit test improvements.
- Minor type stub improvements.
- Minor documentation improvements.
py-authlib: updated to 1.9.5
1.9.5
Security
authlib.jose refuses as an HMAC secret every OpenSSH public key or certificate that it can load as an RSA, EC or OKP key. It used to accept a key with a tab after the key type, and certificates. These keys verify RS256 and EdDSA tokens, so anyone who knew the public key could forge an HS256 token for an application that did not restrict the algorithms. This completes the fix for CVE-2026-114615. GHSA-f7j6-p4qx-gq99
translate-toolkit: updated to 3.20.4
3.20.4
This release improves translation key validation and fixes Nextcloud
JSON fallbacks for untranslated strings.
openvpn: updated to 2.7.9
2.7.9
Security fixes
- win32: restrict loading plugin dependencies (DLLs) to plugin, app
and system directories.
- win32: run openvpn.exe from the interactive service at "high integrity
level", that is, process memory of openvpn.exe and all its threads are
protected from tampering. Signals/Events are still permitted.
- win32: openvpnserv: strictly filter user-defined environment variables
before passing to openvpn.exe (CVE-2026-121720)
- win32: openvpnserv: make validation of openvpn command line more robust
to invalid-quoting attacks (CVE-2026-115342)
[63 lines not shown]
multimedia/moviebox-tui: fix dependency
Spotted by leot@ during mpv revbump.
moviebox-tui only depends on the mpv executable.
While here remove duplicate line.
ansible-lint: updated to 26.11.0
26.11.0
fix: pin Python to 3.13 to avoid Ansible compatibility issues with…
Amazon Linux 2027 is in Preview
fix: resolve collection playbooks with extensions
fix: preserve explicit YAML tags like !!python/name during --fix
fix: do not color stderr output when stderr is redirected
Combine cache exclusion, YAML formatting, and event-query fixes
perf: avoid deepcopy in _sanitize_task
fix(security): update dependencies to resolve Dependabot alerts
ansible-core: updated to 2.21.6
2.21.6
Minor Changes
- ansible-test - Replace FreeBSD 14.4 remote with 14.5.
- ansible-test - Replace FreeBSD 15.0 remote with 15.1.
- ansible-test - Replace RHEL 10.1 remote with 10.2.
- ansible-test - Replace RHEL 9.7 remote with 9.8.
Security Fixes
- ``ansible-galaxy collection install`` - fix validating ``FILES.json`` entries are contained in the collection before creating them. (CVE-2026-89091)
- ``ansible-galaxy role install`` - fix validating the role name is contained to the configured role path. (CVE-2026-105929)
Bugfixes
- ansible_facts - initial facts from ``run_once`` tasks no longer reference the same object and can be updated for individual hosts
[4 lines not shown]
py-markdown: updated to 3.11.3
3.11.3 - 2026-11-05
Fixed
* Fix cases in new emphasis handling that did not handle long chains of tokens
like they should
* Fix quadratic-time parsing of many consecutive reference definitions, and of
many consecutive footnote definitions in the `footnotes` extension.
* Support automatic links with URL schemes other than HTTP and FTP, such as
`<ssh://example.org>`
* Fix quadratic-time id generation in the `toc` extension when many headers
share the same text.
* Ignore glossary abbreviations with empty definitions after inline elements,
consistently with abbreviations before inline elements.
* Strip complete HTML tags with quoted `>` characters from `toc` labels and
generated heading IDs.
* Fix quadratic-time regex backtracking in `attr_list` when a block ends with an
[13 lines not shown]
py-ruff: updated to 0.17.4
0.17.4
Preview features
[flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004)
[security] Implement tarfile-ignore-zeros-true
Bug fixes
Accept a bare raise before a semicolon
Allow match identifiers after a semicolon
Fix panic on BOM-prefixed files in diagnostic renderer
[flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102)
Rule changes
Show more nonprinting characters in diagnostic fix diffs
[28 lines not shown]
devel/cmake: Apply opt:-O2:-Os for GCC >= 14 on NetBSD/m68k
As a workaround for
PR toolchain/60970: GCC/m68k 14.4 miscompiles devel/cmake from pkgsrc-2026Q3
With this hack, generated package can build devel/re2c at least.
p5-Image-ExifTool: update to 13.61.
New version linked as main download on homepage.
Nov. 5, 2026 - Version 13.61
- Added a new Olympus CameraType (thanks Herb, github #502)
- Added arg_files/audio2itemlist.args to the distribution (github #497)
- Recognize the SlimHEIF mif3 file type (github #503
- Decode some more Canon tags (github #505, #506, #507)
- Changed DJI NRSetting tag name to NoiseReduction for consistency
- Patched issue where a corrupted FLIF file could cause a hang (github #500)
- Patched to avoid backward seek on empty QuickTime atom (github #482)
- Patched compatibility issue with Sony Imaging Edge applications when writing
ARW files (github #465)
- Patched a few places where corrupt metadata could result in excessive memory
usage
- Fixed performance issue when using -j on a file with large binary tag values
(github #496)
[106 lines not shown]
cloudflare-speed-cli: Update to version 1.0.12
Changes since 1.0.11:
- Optional clipboard support (PR #60):
- Ring-only TLS provider (PR #61):
- Removed unused AWS-LC related packages
Provided by Bartosz Kuzma on WIP, thanks!
PR pkg/60969
