nodejs: updated to 26.8.2
26.8.2 (Current)
Notable Changes
- doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel)
- meta: refine the security vuln posture for experimental features (James M Snell)
- deps: update Undici to 8.10.2 (Node.js GitHub Bot)
- deps: update OpenSSL to 3.5.8
py-checkdmarc: updated to 6.0.1
6.0.1
Fixed
SPF: the RFC 6652 reporting modifiers ra=, rp=, and rr=, added in 5.8.0 and removed later, are recognized again; their values are validated against RFC 6652 §3 (rp= per erratum 6579) and surfaced in the parsed result as ra, rp, and rr next to exp, and a malformed value is warned about and ignored instead of failing the record. Warnings also cover the two RFC 6652 §3 semantic rules — rp= and rr= do nothing without ra=, and ra= is ignored in a record reached through an include — and exp= and these modifiers are now honored after all in any order
6.0.0
An RFC conformance audit compared every module line-by-line against its governing specification (SPF: RFC 7208; DMARC: RFC 9989/9990; TLSRPT: RFC 8460; MTA-STS: RFC 8461; SMTP/MX: RFC 5321/7505/2181; DNSSEC: RFC 4033-4035; SOA: RFC 1035/2181; BIMI: draft-brand-indicators-14) and found 81 discrepancies, most confirmed by executing the old code. This release fixes all of them. Many fixes change validation verdicts — records the specs call valid are no longer rejected, and records they call invalid are no longer accepted — hence the major version. This release also contains everything staged for 5.18.0, which was never released.
Breaking changes
MX STARTTLS/TLS testing is now opt-in: pass --check-mx-tls on the CLI or check_mx_tls=True to check_domains(), check_mx(), or get_mx_hosts(). The --skip-tls flag and skip_tls parameter are still accepted but do nothing, and passing skip_tls emits a DeprecationWarning. As a result, MX host results no longer carry the tls and starttls keys, and the CSV tls/starttls columns are empty, unless TLS testing is turned on
check_dnssec() performs a real chain-of-trust check anchored at the parent zone's DS record instead of verifying a zone's DNSKEY against itself. A zone with no DS at its parent (including "island of security" zones) is insecure per RFC 4033 §4.3 and returns False; a broken zone such as dnssec-failed.org returns False through any resolver, where it previously returned True through non-validating resolvers. Bogus (SERVFAIL with DS present) is now warned about distinctly from unsigned
Unknown and extension tags/fields now parse with a warning instead of failing validation, as each spec requires: SPF unknown modifiers (RFC 7208 §6), DMARC unknown tags (RFC 9989 §4.7), TLSRPT extension fields (RFC 8460 §3), MTA-STS extension fields and policy keys (RFC 8461 §3.2), and BIMI unknown tags (draft §4.3). An unknown field is ignored only when it fits the spec's own extension grammar; a malformed extension name or value still fails the record or policy
A TXT record unrelated to the record type being queried is now discarded instead of failing validation, per each spec's discard rule: TLSRPT (RFC 8460 §3.1), MTA-STS (RFC 8461 §3.1), BIMI (draft §7.2), and DMARC report authorization records (RFC 9990 §4). Each query also now returns the record carrying the version tag rather than whichever TXT record the resolver listed first. When a real record sits beside the unrelated one, the unrelated record is reported as a warning; when it is the only record present, the check reports that no record exists. DMARC authorization records are discarded silently, and a wildcard authorization record that is unrelated is still an error. Callers catching UnrelatedTXTRecordFoundAtTLSRPT or UnrelatedTXTRecordFoundAtBIMI should note that those queries now raise SMTPTLSReportingRecordNotFound and BIMIRecordNotFound instead
Records the old code wrongly accepted are now invalid: SPF records exceeding the 10-DNS-lookup limit through a, ptr, or macro-valued terms (RFC 7208 §4.6.4 — the limit was previously only enforced for some mechanism types), SPF include of a domain with no SPF record (permerror per RFC 7208 §5.2), MTA-STS policies missing a required key (RFC 8461 §3.2 — the check was dead code), BIMI records missing the required l= tag (draft §4.3), lowercase v=dmarc1 (RFC 9989 §4.8), and an SPF qualifier on a modifier or a value on the all mechanism (RFC 7208 §12)
[54 lines not shown]
py-aiostream: updated to 0.7.2
0.7.2
Change return type of return Callable annotation in async_ to Coroutine[Any, Any, T], which is narrower than Awaitable[T]
Replace asyncio.iscoroutinefunction with inspect.iscoroutinefunction
Allow concatmap, flatmap and switchmap to receive an async function
py-platformdirs: updated to 4.11.8
4.11.8
fix: ignore relative XDG base directory paths
fix: return one user path for root under multipath
fix: preserve literal percent signs in user-dirs paths
fix: retain Homebrew site directories inside virtual environments
py-regex: updated to 2026.9.10
2026.9.10
Fixed version.
2026.9.9
Fix Python API error propagation in match helpers
Preserve Python Exceptions in Input Decoding and String Detachment
Prevent Invalid Pointer Use and Exception State Corruption in Byte String Joining
Propagate Allocation and Internal Errors During Pattern Compilation and Scanner Execution
xz: updated to 5.8.4
5.8.4 (2026-09-09)
IMPORTANT: This includes a fix for a security issue that affects all
XZ Utils versions since 5.0.0. This and a few other fixes have also
been committed to the old stable branches (v5.2, v5.4, and v5.6) in
the xz Git repository. Those fixes are marked below. No new 5.2.x,
5.4.x, or 5.6.x releases will be made.
* liblzma:
- lzma_alone_decoder(), lzma_lzip_decoder(),
lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
invalid memory access after memory allocation has failed and
the application reinitializes the existing decoder to decode
a different file. This bug could at least result in a crash.
This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
(Also in v5.2, v5.4, and v5.6.)
[120 lines not shown]
bigloo: update to 4.7a
* gmtoff: adjust variable type
* Generic bignum fix again (bootstrap)
* Fix typo in ude-autoload.el
* Silence gcc buffer overflow warning
* Make the test suite fail if individual tests fail
* Fix bignum tests
* Removal of pkgcomp and lib and generic bignum implementation fix (bootstrap)
* Fixnum bignum generic implementation (bootstrap)
* add support for periods in xml attribute names
* Doc typo
* Backport fixes for SawC (bootstrap)
* backport jvm fix
* Bug fixes backported from 5.0a (bootstrap)
* _index.md: Fix a double sentence
* Complete the renaming of flt into fst (bootstrap)
* Renaming flt into fst (bootstrap)
* Rename *saw-register-allocation?* variable to get rid of the ? character (bootstrap)
[24 lines not shown]
knot: Update to 3.6.0
Knot DNS 3.6.0 (2026-09-08)
Features:
knotd: DELEG-aware answering (see 'zone.deleg-aware')
knotd: DELEG-aware zone signing (see 'policy.deleg-adt')
knotd: configurable storage for the last signed serial (see 'zone.dnssec-metadata-db')
knotd: optional jitter for DNSSEC events (see 'policy.dnssec-jitter')
knotd: optional jitter for SOA refresh events (see 'zone.refresh-jitter')
knotd: implemented a "trash bin" for deleted DNSSEC keys (see 'DNSSEC key delete and recovery')
knotc: zone retransfer with automatic IXFR fix-up (see '+fixfr')
kdig: per zone DNSSEC answer validation (see '+validate')
utils: automatic LMDB migration from version 0.9 using embedded LMDB 0.9.35
libknot: support for DELEG and DELEGPARAM record types
Improvements:
knotd: millisecond-precision prefix timestamps in non-syslog logging
knotd: enforced serial policy during initial zone file load if 'difference-no-serial' is enabled
[34 lines not shown]
www/php-concrete-cms: update to 9.5.4
9.5.4 (2026-09-08)
Behavioral Improvements
* Test mail settings: show email sender, add links to configuration pages
(#13078) (thanks mlocati)
* SEO bulk report no longer rescans paths needlessly for every page it
lists. (#13071)
* Improve sanitization checking of SVG on upload
Bug Fixes
* Fix issue with composer attribute control not saving
* When dragging / dropping page in sitemap an "invalid token"-error occurs
(#13077)
* Rescan Locale strips every content-block page link and crashes on stack
pages (#13082) (thanks janscarton)
[22 lines not shown]
www/ruby-css-parser: update to 3.1.0
3.1.0 (2026-09-09)
* Parser#load_uri! accepts an integrity: option (Subresource Integrity,
https://www.w3.org/TR/SRI/) to verify a fetched remote stylesheet before
it is parsed
www/ruby-aws-sdk-s3: update to 1.230.0
1.230.0 (2026-09-08)
* Feature - Adds support for Amazon S3 Object Lock variable retention.
Existing S3 APIs that support S3 Object Lock parameters now support two
new parameters EventHold and EventHoldDuration at the object level, and
DefaultEventHoldDuration at the bucket level.
