knot-resolver: Update to 6.4.2
Bugfixes
cache: avoid excessive logging introduced in the last release (!1869)
/options/serve-stale: avoid SIGSEGV from a LuaJIT bug (#957)
Improvements
DoH: add unencrypted mode for reverese proxies (alpha, !1877)
deal with LMDB 1.0.0 switching format (!1880)
python314 py314-html-docs: updated to 3.14.7
Python 3.14.7 final
Security
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 2025-4330.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values.
gh-143921: Reject NUL, CR and LF characters in IMAP commands. Other control characters are allowed and sent quoted.
Core and Builtins
gh-133931: Fix data races when setting attributes of function objects on the free threaded build.
gh-154709: Fix an out-of-bounds access in reverse dictionary iterators when the underlying dictionary is cleared and modified after the iterator is created.
[385 lines not shown]
net/coturn: Patch out use of ginstall
Upstream configure inexplicably searches for ginstall (which I view as
a pkgsrcism for layering of coreutils), and then uses it without mode
flags, resulting in man pages with executable bits.
dhcpcd: Update to v10.5.0 with the following changes:
* Add missing SPDX-License tags
* Format code with clang-format
* privsep: Change IPC to use SOCK_STREAM
* BPF: Split OS specific code out into own files and add libpcap support
* hooks: Escape interface names and use printf
* Delete DHCPv6 IA FD from the loop before closing it
* eloop: Use kqueue or epoll to wait for a fd to become ready
* Darwin: Add initial support for macOS
* Import latest pidfile from NetBSD
* route: Rework rt structure so sockaddrs are pointers
* dhcp-common: Escape ifname for lease file
* privsep: smaller buffer size without INET6
* script: add ifxname as the escaped string
* privsep: Test defines for all ioctls
* privsep: Add ps_root_gethostname
* DHCP: Don't really expire the lease when testing
* DHCP: Don't add a trailing : on vendor if no machine arch
[41 lines not shown]
net/coturn: Update to 4.17.0
Upstream NEWS content, less bugfixes and minor improvements:
Release 4.17.0
Changelist:
- Enable stateless nonce by default (#2036) (Pavel Punsky <eakraly at users.noreply.github.com>)
- Log format: ISO-8601 timestamp by default, no thread id, space delimiter (#2031) (Pavel Punsky <eakraly at users.noreply.github.com>)
- Start the DTLS listeners only when --dtls is given (#2026) (Pavel Punsky <eakraly at users.noreply.github.com>)
