devel/cargo-nextest: update to 0.9.149
Security
cargo nextest self update no longer trusts the eMudhra intermediate certificate authorities whose private keys were disclosed on 2026-10-20. Previously, an attacker able to intercept network traffic could have used these keys to make cargo nextest self update download and install a malicious binary.
Nextest's self-updater uses a bundled set of root certificates, so operating system and browser updates do not protect it. This release updates webpki-roots to 1.0.10 and rustls-webpki to 0.103.16, both of which distrust the compromised certificates.
Running tests does not involve network access and is not affected. Builds without the self-update feature, including most distribution packages, are also not affected.
Updating from an earlier version with cargo nextest self update would go through the affected code one last time. If you're concerned about your network being compromised, use one of the other installation methods instead.
Fixed
On riscv64 Linux, cargo nextest self update no longer panics. (#3649)
py-wcwidth: updated to 0.9.3
0.9.3
* **Bugfix** libwcwidth no longer has undefined behavior on NULL or empty input in the UTF-8 and
alignment functions
* **Changed** `HyperlinkParams.parse()`_ now rejects trailing text
* **Bugfix** `wrap()`_ should keep a link's own OSC 8 params across a line break
sysutils/gravityfile: update to 0.4.0
0.4.0 - 2026-10-13
A rewrite of the scanner, the explorer's internals and the command line, with release binaries for macOS, Linux and Windows. It is the first release on crates.io since 0.2.4: 0.3.0 was released on GitHub only, and 0.3.1 was never released, so its changes are listed here. Upgrading from 0.2.4, see also the 0.3.0 notes. Several changes are breaking: the gravityfile executable is gone (use grav), report options and JSON changed (schema_version 2), plugins are Lua only, and settings moved on macOS.
Security
Plugins cannot read past their read-size limit, even when they ask for a larger one, and cannot read special files such as FIFOs, which could block.
An archive cannot be created inside the directory being archived, and an interrupted archive leaves nothing behind.
zip is updated to 9.0, past RUSTSEC-2026-0367, -0368 and -0369. Those affect zip's own extraction helpers, which grav never used: its extraction already drops setuid and setgid bits and keeps symlinks inside the destination. Opening a ZIP still reads only its directory, not the whole archive, which zip 9 would otherwise scan.
Dependencies are updated past the vulnerable crossbeam-epoch 0.9.18 and the unsound git2 0.20 line; BLAKE3's unused memory-mapping feature, and with it memmap2, is gone.
Added
grav diff OLD [NEW] shows what grew, shrank, appeared or went between two scans, largest changes first per directory. Each side is a snapshot or a directory; with one snapshot it is compared with the same place today, scanned with the snapshot's scope. Text or JSON.
Plugins that work as documented. Hooks run in the background, so a slow plugin no longer freezes navigation; only on_delete_start (which can refuse the delete) and on_shutdown are awaited. gf.notify now shows its message in the status line, plugin failures are reported instead of only logged, and hooks receive the context (directory, theme, selected entry) as a third argument. Scan start and error, delete, copy, move and rename completion, and analysis hooks now fire. Hooks the explorer never fired and the unrendered ui namespace are removed, and the plugin guide and example are rewritten to match.
grav scan --top N lists the largest files anywhere below the root, and grav scan --by-type totals the space by file extension.
Scan history. Each full scan in the explorer, and grav scan --record, adds a summary to history.jsonl in the data directory. grav history [PATH] shows a directory's size over time and what changed most; --all lists every recorded directory. The explorer's header shows the change since the last scan of the same place. record_history = false turns it off.
Browse snapshots in the explorer. grav root.json.zst opens a saved scan or ncdu dump read-only, without touching the filesystem: navigation, search, the treemap, size toggling and age analysis work; file operations, rescans and duplicate detection are refused with an explanation.
[75 lines not shown]
python315 py315-html-docs: updated to 3.15.1
Python 3.15.1
Security
gh-159894: Bump the version of pip bundled in ensurepip to version 26.2.2.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
Core and Builtins
gh-159739: Avoid a crash if allocation fails while creating a string.templatelib.Template iterator.
gh-159739: Propagate errors during generic class construction and avoid a crash after failed generic alias substitution.
gh-159739: Raise OverflowError when the absolute value of a dynamic printf-style formatting width is too large.
gh-159739: Fix a reference leak in gc.get_objects() and gc.get_referrers() when an internal allocation fails in the free-threaded build.
gh-159739: Fix memory leaks during interpreter startup when a path configuration file is empty or too large, or when an audit hook rejects a command.
gh-159739: Avoid a crash when an interpreter configuration string cannot be encoded as UTF-8.
gh-159739: Preserve the original SyntaxError if allocating optional error metadata fails.
gh-159739: Avoid a crash if formatting an integer with the c presentation type runs out of memory.
gh-159739: Avoid a crash when a module filename cannot be encoded as UTF-8.
gh-159603: On FreeBSD, call pthread_attr_get_np() to get the stack size (and guard size) of the current thread. Patch by Victor Stinner.
[238 lines not shown]
python314 py314-html-docs: updated to 3.14.9
Python 3.14.9
Security
gh-159894: Bump the version of pip bundled in ensurepip to version 26.2.2.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Core and Builtins
gh-159739: Avoid a crash if allocation fails while creating a string.templatelib.Template iterator.
gh-159739: Propagate errors during generic class construction.
gh-159739: Raise OverflowError when the absolute value of a dynamic printf-style formatting width is too large.
gh-159739: Fix a reference leak in gc.get_objects() and gc.get_referrers() when an internal allocation fails in the free-threaded build.
gh-159739: Fix memory leaks during interpreter startup when a path configuration file is empty or too large, or when an audit hook rejects a command.
[116 lines not shown]
py-deepdiff: updated to 9.1.0
v9-1-0
- Added multiprocessing support for DeepDiff: parallel distance computation and parallel subtree diffing with aggregated worker stats, deterministic ordering, and automatic fallback to serial when unsafe (e.g. `custom_operators`, `*_obj_callback`, `ignore_order_func`)
- Added wildcard/glob pattern support for `exclude_paths` and `include_paths` thanks to [akshat62](https://github.com/akshat62)
- Reimplemented internal cache for improved performance
- Memoized `GlobPathMatcher` to remove exponential-time matching cliff
- Comprehensive type-hint corrections across `deephash.py`, `helper.py`, `delta.py`, `diff.py`, `distance.py`, `path.py`, and `serialization.py` (also fixed real bugs: misplaced paren in `path._guess_type` call, and `len(other.indexes > 1)` → `len(other.indexes) > 1` in `diff._compare_in_order`)
- Security: Delta dunder-attribute traversal in `check_elem()` now raises immediately instead of going through `_raise_or_log()`, with full-path preflight validation in `_get_elements_and_details()` so the `set_item_added` path cannot silently skip malicious dunder paths
- Fixed nested NamedTuple set/frozenset Delta updates dropping the outer container
- Fixed tuple Deltas using iterable opcodes silently doing nothing for insert/delete-only changes
- Fixed Delta with both moved and added iterable items mutating the Delta's own internal diff data
- Fixed crash during path sorting when removing multiple dictionary items with complex keys
- Packaging: added missing files to sdist and removed obsolete `MANIFEST.in` thanks to [mgorny](https://github.com/mgorny)
- Updated GitHub Actions workflows and dependencies
lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619
Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub.
Quote from security advisory announce on https://www.php.net:
Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.
Bump PKGREVISION.
archivers/libarchive: fix build on -10 / with older bmake
Avoid using $^ in the makefile. With bmake that doesn't support it,
which includes the one on -10 which is still supported, it expands to
empty and the result is that the build hangs trying to grep from
stdin.
Once -10 is EOL this change can be dropped.
Build fix, so no need to bump anything.
PR 60077
