Update math/HiGHS to 1.16.0.
The highlights of v1.16 are the use of parallelism by default in the
MIP solver, a rewritten LP file reader, a Hessian oracle for QP,
support for AMD GPUs in HiPDLP, Windows ARM64 Python wheels and NuGet
packages, and a large number of correctness fixes in the MIP solver
and presolve.
Code changes
Model file I/O
The LP file reader has been rewritten as a parser for a formal
grammar of the LP file format (PR #3355). Invalid files are now
rejected, rather than being read silently as a different model,
and syntax errors are reported with the line and column of the
error. The reader is also faster and uses less memory (PR #3446).
The floating point precision when writing to an MPS file was increased
[215 lines not shown]
emulators/qemu: Set CC and CXX FEATURES
This package lacked USE_*_FEATURES, but unsurprisingly did not build
with FORCE_C_STD=c89 and FORCE_CXX_STD=c++03. Via test builds,
describe which standards fail, and add USE_*_FEATURES with the lowest
working standard, in lieu of clear documentation. That ends up with
gnu11 and c++17.
In theory, gcc 7 supports these standards. Explain that upstream
rejects gcc <10 without rationale, and that 10 pkgsrc-norms-rounded is
still 10.
py-kivy: updated to 2.3.2
2.3.2
Highlights
- [:repo:`9480`]: Add support for Python 3.14. Kivy supports Python 3.8–3.14
using standard CPython builds with the GIL enabled. Free-threaded Python
builds are not supported.
Core-providers
- [:repo:`9029`]: Preserve SDL2 window DPI defaults when `GetDpiForWindow`
returns zero on Windows.
Distribution
- [:repo:`8965`]: Bump the development version to `2.3.2.dev0`.
- [:repo:`9463`]: Use `kivy_deps.angle~=0.5.0` on Python 3.14 while retaining
[17 lines not shown]
vifm: Update to version 0.14.5
Security
Fixed unsafe IPC pipe reuse (CVE-2026-110237). Thanks to Andrew Savchenko and Salvatore Bonaccorso (a.k.a. carnil).
AppImage
Updated AppImage runtime to a recent version. Thanks to Alexander Gottweis (a.k.a. stablestud).
Documentation
Improved wording of documentation sections describing filters and patterns.
Improved wording of documentation covering :view. Thanks to CaptainFantastic.
Slightly improve documentation of columncount: in 'lsoptions'.
Fixed invocation form of :locate that passes parameters without escaping not being documented.
:set command and options
Fixed printing the value of 'previewoptions': remove trailing comma and fix maxtreedepth: and graphicsdelay: being mutually exclusive.
File list
Avoid views scrolling unnecessarily in response to file-system changes that add or remove files before the first visible line. Thanks to justpretending2.
[25 lines not shown]
ggml: update to 1.0.0.
ggml 1.0.0 prunes the deprecated public API and the legacy DIAG_MASK
ops, adds configurable YaRN truncation and FP8 support, and brings
broad performance work across backends: few-row quantized matmuls
and MoE fusion on CUDA/Metal, a Vulkan prefill FlashAttention path,
a device-side MoE scheduler on SYCL, decomposed Adreno FlashAttention
in OpenCL, new WebGPU kernels, expanded Hexagon op coverage, and
scheduler improvements that avoid uploading unused inputs.
bgpipe: Update to version 0.25.0
What's Changed
Bump bgpfix to v0.24.0 by @pforemski in #50
rov: use the memoizing Cache.ValidateOrigin by @pforemski in #44
Disable MPTCP (godebug multipathtcp=0) by @pforemski in #45
limit: --session N let through only N-1 prefixes by @pforemski in #47
http, websocket: set IdleTimeout by @pforemski in #48
Exit cleanly after streaming an MRT file (fixes #40); connect --tls; read -A by @pforemski in #42
Build with Go 1.27 (CI, release, Docker) by @pforemski in #49
test: fix GoBGP 4.11 and FRR replay races in integration tests by @pforemski in #52
core: do not close the pipe outputs under the pipe (go test -race) by @pforemski in #57
--as4 auto|on|off (guess 2-byte ASNs by default); fix write --create/--append, head exit, RIB sniffing by @pforemski in #51
rv-live: fix permanent stall on slow links, make --stale work by @pforemski in #53
rv-live: read with parallel consumers, to keep up with the whole feed by @pforemski in #54
ris-live: fix disconnects, backoff, and fatal connection errors by @pforemski in #55
Security audit fixes: tag --drop, grep -LR race, ASPA, limit memory, extio lines by @pforemski in #56
test: fully transparent proxy (GoBGP <-> bgpipe with TPROXY <-> FRR) by @pforemski in #60
rpki: --rpki reads the first .ccr of a .tgz (RPKIviews snapshots) by @pforemski in #59
bmp: new stage (BMP station and exporter over TCP); tests against Rotonda and Netom by @pforemski in #58
postgresql1[4-8]: updated to 18.7, 17.12, 16.16, 15.20, 14.25
18.7, 17.12, 16.16, 15.20, 14.25
Security Issues
The following security vulnerabilities are closed in this update release. You can find more details about the vulnerabilities and their affected versions in the links below:
CVE-2026-6460: Type confusion after ALTER ... SET DATA TYPE executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-6467: Extension script schema mishandling executes arbitrary SQL (CVSS v3.1: 7.2)
CVE-2026-14661: dblink and subscriptions can append to arbitrary files (CVSS v3.1: 8.1)
CVE-2026-16237: INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition (CVSS v3.1: 5.4)
CVE-2026-16240: pg_basebackup can use backup manifest content as a format string (CVSS v3.1: 3.7)
CVE-2026-18447: Output parameter type confusion executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116303: Foreign key and JSON conversions bypass EXECUTE privilege on cast functions (CVSS v3.1: 3.1)
CVE-2026-116304: Parallel RECORD typmod use-after-free executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116306: Composite-type change during field assignment executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116307: plperl prepared-query use-after-free executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116308: dict_int reads beyond zero-length tokens (CVSS v3.1: 4.3)
[68 lines not shown]
py-xdis: updated to 6.3.1
6.3.1 2026-09-11
Update minor versions released recent versions Python from 3.10 to 3.15
SakayanagiYuna:
For Python 2 interned strings Honor the per-read bytes_for_s flag for Python 2 TYPE_INTERNED and
TYPE_STRINGREF records. Previously, these records were always
decoded as UTF-8 with errors ignored, silently dropping non-UTF-8
bytes. Cache the original bytes alongside the existing text representation
so references can be read in either context without losing data,
preserving identity for repeated references within each
representation. Include both representations in code reference
metadata to preserve interned tags when re-marshalling. Keep existing text decoding and Python 3 Unicode behavior unchanged. Add synthetic regression tests for binary strings, mixed-context
references, interned bytecode in a Python 2.7 pyc, and marshal round
trips.
[7 lines not shown]
py-wcmatch: updated to 12.0.1
12.0.1
- **FIX**: Require `bracex` 3.2.2 for bug fixes.
- **FIX**: Fix a non-terminal globstar consuming the final filename when the following extended group can match
nothing, e.g. `**/?(a)` matching `b`. This also affects the implicit globstar used by `MATCHBASE` and
`pathlib.match`.
- **FIX**: Fix `globmatch` with `REALPATH` rejecting a symlinked file when it is matched by a trailing `**`
(e.g. `**` or `dir/**`), disagreeing with `glob` and Bash, which both return such files.
- **FIX**: Preserve directory symlink traversal when collapsing adjacent `**` and `***` components with
`GLOBSTARLONG`, regardless of their order.
12.0
- **BREAK**: Various fixes to `!(...)` patterns to more closely align to Bash. 100% Bash behavior is impossible with
regular expression, but behavior in many ways was improved, but there may be some surprising behavior changes.
- **FIX**: Fix an `EXTGLOB`/`EXTMATCH` inverse group, `!(...)`, inside another group ignoring the rest of its
[58 lines not shown]
