firefox153: update to 153.3
Mozilla Foundation Security Advisory 2026-93
Security Vulnerabilities fixed in Firefox ESR 153.3
Announced
September 15, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.3
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component
Reporter
[689 lines not shown]
firefox140: update to 140.16
Mozilla Foundation Security Advisory 2026-92
Security Vulnerabilities fixed in Firefox ESR 140.16
Announced
September 15, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 140.16
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component
Reporter
[304 lines not shown]
R-xts: update to 0.14.3.
Fixes build with current R.
xts 0.14.3 (2026-09-26)
Fix deprecated special names in structure() calls. (#440)
Fix time-of-day subsetting (e.g. x["T18:00/"]) to create
fractional seconds as decimal fractions instead of raw integers.
The previous behavior could return incorrect results, and error
on R-devel (r90486). (#441)
xts 0.14.2 (2026-02-27)
Removed ATTRIB() and SET_ATTRIB() from C code, since they are
not part of the public R API. (#436)
Fixed crash when endpoints() was called on an xts object with
[10 lines not shown]
R-Rcpp: update to 1.1.2.
Committed during the freeze since it should help with the execinfo
problems on *BSD.
Changes in Rcpp release version 1.1.2 (2026-07-01)
Changes in Rcpp API:
Use of execinfo.h is again conditional to avoid build complexity (Dirk in #1445 addressing #1442)
An internal state component for Datetime is now int (Dirk in #1448 and #1449 fixing #1447)
Three new (in R 4.6.0) attribute accessors are used conditionally (Dirk in #1450 closing #1432)
An UBSAN error in the Sugar-based NA comparison has been corrected (Iñaki in #1453 fixing #1452)
Treatment of Inf outside of integer range in Sugar function has been corrected (Iñaki in #1458 fixing #1455)
[39 lines not shown]
simulavr: fix build with compilers defaulting to c++17
They have std::byte in the namespace (due to 'using namespace std),
which conflicts with the local byte typedef.
Bump PKGREVISION.