p5-Text-CSV_XS: update to 1.65.
1.65 - 2026-10-15, H.Merijn Brand
* CPAN.org does not forward email anymore
* parse (): report trailing lone CR, do not store EOF as 0xFF (CVE-2026-110759)
* Under allow_whitespace, do not strip beyond field start (CVE-2026-110758)
* combine (): decide quoting from the bytes, not the NV flags (CVE-2026-110757)
* Flush saved bytes in Combine () (CVE-2026-110756)
* Re-use AHEAD with \r instead of copying (CVE-2026-110755)
* getline (): free the result array when the parse fails (CVE-2026-110754)
* Do not free the bound column scalar in skip_empty_rows (CVE-2026-110753)
* fragment (): do not size memory by the selector integers (CVE-2026-110752)
p5-Cpanel-JSON-XS: update to 4.80.
4.80 2026-09-?? (rurban)
- Security fixes, reported by Stig Palmquist (CPANSec):
* CVE-2026-110672 decode: free the hash key on "Duplicate keys not
allowed" and on a missing ':' (leak).
* CVE-2026-110673 decode: charge allow_tags "(" nesting against
max_depth (stack overflow).
* CVE-2026-110674 decode: look bare keys up as UTF-8, so the
duplicate check no longer misses or crashes on non-ASCII keys.
* CVE-2026-110675 decode: validate bare hash keys as UTF-8 like
quoted keys (malformed keys).
* CVE-2026-110676 encode: compact allow_bignum Math::BigFloat
values with huge exponents (30MB from 12 bytes).
* CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference
counts (leaked every array).
* CVE-2026-110678 incr_parse: apply max_size to the buffered text
in every context.
* CVE-2026-110680 encode: bound the canonical key snapshot for
[49 lines not shown]
Update to 9.50
Upstream changes:
9.50 2026-10-16
- Added SECURITY.md policy for reporting security issues.
- Fixed a security issue in Mojo::DOM where the content of title and textarea elements was not escaped during
rendering, allowing escaped end tags to break out and turn sanitized HTML into live markup.
9.49 2026-08-10
- Added EXPERIMENTAL support for partitioned cookies. (rawleyfowler)
- Added EXPERIMENTAL partitioned attributes to Mojo::Cookie::Response and Mojolicious::Sessions
devel/libagcre and textproc/agcre: Update to version 20261015
Changes since previous version:
Bring over changes from the development branch:
+ unicode escapes can be set with \xNNNN as well as \uNNNN
+ tighten up bounds checking when looking ahead while compiling
+ make sure illegal utf8 sequences are handled as single bytes
+ fill out the unicode sequences recognised by unicode_isprint
and unicode_isgraph
+ update unicode_isspace to not recognise 0x200e and 0x200f (they're
directional markers for BiDi text, not whitespace)
+ tighten up the way hex numbers are calculated in unicode escapes
+ bump version number to 20261015
lean4: update to 4.35.0.
The main new feature of Lean 4.35.0 is vcgen, a faster and more
general successor of mvcgen. It also adds lake check and lake
comparator, which check a project with Lean's kernel and, if
requested, with several independent kernels that now come with the
toolchain. On the tactic side, rwa has been redesigned, constructor
now warns when it has to choose between constructors, and grind
proves more goals about BitVec and fixed-width integers by translating
them into Nat and Int arithmetic. Decidable has a new definition
based on Bool, which makes many more equations hold by rfl.
Import math/HiGHS from wip, update to version 1.15.1.
HiGHS is a high performance serial and parallel solver for large
scale sparse linear programming (LP) problems of the form:
Minimize c^Tx subject to L <= Ax <= U; l <= x <= u
rumdl: update to 0.3.0.
Changed
2.4–4.7× faster rumdl fmt than 0.2.79 on frozen documentation
snapshots: Cargo (99 files) 4.7×, MkDocs Material (85 files) 2.6×, and
Ruff (16 files) 2.4×. Reusing parsed Markdown and shared source analysis
reduces repeated work. Speedups compare median elapsed times from 31 paired
runs after five warmups on Apple M6: ordinary Rust 1.96.0 release builds,
default threads, warm filesystem cache, and --no-config --no-cache --silent
(--flavor=standard for Cargo/Ruff, --flavor=mkdocs for MkDocs Material).
Output includes the correctness fixes listed below and can differ from 0.2.79.
Code block tools are supported and remain opt-in. Missing tags, missing
active-mode tools and invocations with no tools checked are ignored by default.
An omitted unknown-tag policy inherits on-missing-language-definition,
preserving existing strict configurations. Valid internal cached checks count
as checked; applicable external tools rerun to reflect changes in their own
configuration and environment.
on-missing-language-definition = "warn" now reports uncovered languages;
[134 lines not shown]
