py-zope.testing: updated to 6.2
6.2 (2026-07-03)
- Add support for Python 3.15.
- Deprecate ``zope.testing.doctestcase`` in favour of plain ``doctest``
(e.g. ``doctest.DocTestSuite`` or ``doctest.DocFileSuite``).
- Move package metadata from setup.py to pyproject.toml.
libjwt: updated to 3.6.1
LibJWT 3.6.1 is a small test-portability patch release.
The in-process HTTP server used by the cached-JWKS test cast write() to (void) to ignore its result. glibc marks write() warn_unused_result, and the (void) cast does not suppress that warning on newer glibc, so the -Werror test build failed. The result is now asserted with ck_assert_int_gt(write(...), 0).
This is ABI-compatible with 3.6.0: no library source changed, so the exported symbol set is identical and per the libtool rules only the SONAME revision advances (18:0:4 → 18:1:4). The SONAME stays libjwt.so.14 and existing binaries keep working.
gnupg2: updated to 2.5.21
Noteworthy changes in version 2.5.21 (2026-07-02)
* New and extended features:
- gpg, gpgsm: Use partial file on decryption, remove on failure.
Disable with "--compatibility-flags=no-partial-file-guard".
- gpg: Use the INT_RCP_FPR subpacket in revocation signatures.
- Create a pkgversioninfo.txt file when building using the speedo
build system.
* Bug fixes:
- gpg: Fix potential use-after-free in batch key generation when
handling the keyserver URL option.
[18 lines not shown]
graphics/tiff: Update to 4.7.2
Upstream NEWS:
micro release
a very large number of bugfixes, including integer overflows
* Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer()
(:issue:`781`)
py-guessit: updated to 4.0.2
4.0.2 (2026-06-29)
Bug Fixes
- **title**: Keep languages instead of a language-only title
v4.0.1 (2026-06-29)
Bug Fixes
- **changelog**: Trim noise commit types from the changelog and PyPI page
- **packaging**: Balance changelog code fences in the PyPI long description
py-rebulk: updated to 6.0.1
6.0.1
Performance Improvements
Cache getfullargspec on the hot matching path
6.0.0
Bug Fixes
key: Skip private matches in declared-key value_type check
Documentation
Show declaring functional properties for check_keys
[7 lines not shown]
py-uv py-uv-build: updated to 0.11.26
0.11.26
Performance
Adapt uv to IDs-only PubGrub dependencies
Avoid allocations in ForkMap::contains
Reuse resolver work across PubGrub iterations
Speed up candidate selection for disjoint ranges
Bug fixes
Warn when the build cache is inside the source directory
suse_gcc12: support static linking
Allow creation of Linux binaries that do not need any of the suse_* packages installed.
Add glibc-devel-static.
Bump PKGREVISION.
Test:
# /emul/linux/usr/bin/gcc-12 -static -o hellolinux hello.c
# file hellolinux
hellolinux: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=89293d07b15722eb4b069afda0d48e6c62115e22, for GNU/Linux 3.2.0, with debug_info, not stripped
# pkg_delete suse_gcc12 suse_binutils suse_base
# rm -r /emul/linux
# ./hellolinux
hello, world
sox_ng: update to 14.8.0.1.
Enable compatibility symlinks so this can replace the unmaintained sox
package.
Enable test target.
sox_ng-14.8.0.1 2026-05-26
---------------
Changes since 14.8.0:
o Fix builds without FFTW giving all-black spectrograms, broken in 14.8.0
o Trivial fixes to the docs
sox_ng-14.8.0 2026-05-18
-------------
[258 lines not shown]
py-octoprint: updated to 1.11.8
1.11.8
Security fixes
XSS in Suppressed Command Notifications, severity Moderate (4.6): OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer.
An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance.
See also the GitHub Security Advisory and CVE-2026-35163.
File exfiltration possible via further parameter injection on upload endpoints, severity High (7.0): OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 but the fix provided in OctoPrint 1.11.2 turned out to be incomplete.
The primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.
See also the GitHub Security Advisory and CVE-2026-54134.
Bug fixes
[2 lines not shown]
py-autobahn: updated to 26.6.2
26.6.2
**WAMP Cryptosign**
* Fix ``import autobahn.wamp.cryptosign`` raising ``TypeError: unsupported operand type(s) for |: 'str' and 'NoneType'`` on CPython 3.11/3.12/3.13 when crypto support (``nacl``) is installed. A ``ruff`` ``UP007`` autofix in 26.6.1 had rewritten ``Optional["ISecurityModule"]`` to ``"ISecurityModule" | None`` in a module that lacks ``from __future__ import annotations``, so the string forward-reference union was evaluated eagerly at class-definition time (CPython 3.14 was unaffected because PEP 649 defers annotation evaluation). The regression broke WAMP-cryptosign and any importer with crypto dependencies present (e.g. ``xbr``, Crossbar.io) on CPython < 3.14. Added ``from __future__ import annotations`` to ``cryptosign.py`` to defer annotation evaluation
icinga2: updated to 2.16.3
2.16.3 (2026-07-01)
This is a hotfix release that fixes a regression with the `Json.decode()` DSL function that was introduced in v2.16.2:
The addition of a second argument to the internal `JsonDecode()` function unintentionally leaked into the DSL as a
required argument. This version restores the old and intended behavior of `Json.decode()`.
Changes
* Restore single-argument `Json.decode()` in the DSL
* Add the upgrading documentation for v2.15.1 again, which went missing with the v2.16.0 release
SDL3: updated to 3.4.12
3.4.12
This is a stable bugfix release, with the following changes:
Fixed an assert on Windows in SDL_SetWindowOpacity()
Improved support for external surfaces under Wayland
Fixed visual artifacts when switching render targets with the Vulkan renderer
Fixed crash rendering YUV textures on NVIDIA drivers with the Vulkan renderer
Added SDL_HINT_ENABLE_STEAM_SCREEN_KEYBOARD to customize behavior on Steam Deck and Steam Machine
Improved support for gamepads under Emscripten
Added hotplug detection support when using libusb for HIDAPI controllers
Fixed flipped Xbox 360 controller axes on macOS
Fixed truncated long text input sequences when using sdl2-compat
py-croniter: updated to 6.2.3
6.2.3 (2026-07-02)
Features and Improvements
- Fix quadratic expansion of comma-separated range lists for a large speed-up on expressions with many ranges.
Bugfixes
- Reject a zero step (e.g. ``5-5/0``) in equal and reversed cron ranges instead of silently accepting it.
- Fix ``expand_from_start_time`` month low-bound off-by-one so stepped month ranges start on the correct month.
