*cups*: update to 2.4.20
v2.4.20 - 2026-10-05
--------------------
- SECURITY-5.7: The scheduler did not open temporary PPD files in exclusive
mode (CVE-2026-55480)
- SECURITY-5.5: The scheduler did not remove all job status attributes from a
job creation request (GHSA-7j85-5r23-xhvh)
- SECURITY-5.3: The scheduler did not validate the request language value
(CVE-2026-61702)
- SECURITY-4.6: Attribute names were not validated as proper keyword values
(GHSA-w9hj-hq9p-m7f6)
- SECURITY-4.3: The `cupsUTF32toUTF8` function incorrectly treated UTF-32
values as 64-bit (CVE-2026-87875)
- SECURITY-4.1: Held jobs for temporary print queues could crash the scheduler
(GHSA-qqm8-4q5h-jg55)
- SECURITY-3.3: The backend did not sanitize IPP attribute strings
(CVE-2026-55453)
[58 lines not shown]
dnsdist: Update to 2.1.3
Released: 12th of October 2026
Improvements
Tighten access to metrics when the dashboard is passwordless
References: pull request 18151
Bug Fixes
Stop Closing TLS connections too early (DNSBunker)
References: pull request 18150
Correct stat name lookup in udpErrorStats()
References: pull request 18154
Fix possible use-after-free in add*Action
References: pull request 18062
Skip timeout entries for DynBlock NMT rules
[7 lines not shown]
py-uv*: update to 0.13.0:
uv 0.13.0 makes Python 3.15 the default stable Python version. We've
also included several breaking changes to improve correctness,
performance, and compatibility.
py-cssselect: updated to 1.6.0
1.6.0
* Dropped support for Python 3.10.
* Added support for Python 3.15.
* **Backward-incompatible change**: ``Relation``, which represents
``:has()``, now takes and exposes a list of ``(combinator, selector)``
pairs as ``arguments``, replacing its ``combinator`` and ``subselector``
arguments and attributes.
* **Backward-incompatible change**: the
``GenericTranslator.xpath_relation_*_combinator()`` methods now take only
the XPath expression of the ``:has()`` argument and return an XPath
condition string. Translator subclasses that override them need to be
updated.
[52 lines not shown]
py-cryptodome: updated to 3.24.1
3.24.1 (11 October 2026)
Resolved issues
* Security: the time to create an ECDSA, EdDSA or DSA signature depended
on the secret nonce, enough to recover the private key with a lattice attack.
DSA signing is now about 40% slower with GMP. Thanks to Daniel Bleichenbacher.
libadwaita: updated to 1.10.0
1.10.0
- AdwAnimation
- Fix AdwCallbackAnimationTarget annotations
- AdwActionRow
- Ensure :use-markup property is set in constructed()
- AdwStatusPage
- Stop using :last-child in styles
- AdwSidebar/AdwViewSwitcherSidbar
- Document how to display suffix at the bottom
- AdwTabBar/AdwTabGrid
- Clear a dangling idle callback in dispose
- Build
- Fix release builds requiring sassc
- Depend on glib 2.89.3
- Stylesheet
- Support .flat and .raised for GtkDropDown
[23 lines not shown]
py-zensical: update to 0.0.69.
0.0.69
This version adds MkDocs plugin replacements for nav-weight and
markdownextradata, improves symlink watching, fixes minification
crashes with Unicode, and preserves emojis in llmstxt exports.
The user interface is updated to v0.0.36, improving navigation
spacing and fixing instant navigation.
0.0.68
This version adds native replacements for the audio and video MkDocs
plugins and improves compatibility with the macros plugin. The user
interface is updated to v0.0.35, bringing instant navigation to
search results, consistent skip links, and corrected accessibility
labels for overlays and progress indicators.
[2 lines not shown]
py-tenacity: update to 9.2.1.
9.2.1
9.2.0 was tagged but never reached PyPI: the upload rejected its
package description (#714). 9.2.1 is the first release on PyPI with
everything in 9.2.0, plus the changes below.
What's Changed
chore(mypy): drop vestigial tornado ignore_missing_imports override by @jd in #676
fix: annotate wait_base.radd as taking the int seed from sum() by @jd in #677
chore(mypy): enable the strictness options strict leaves off by @jd in #678
refactor: drop always-true truthiness checks and enable truthy-bool by @jd in #679
refactor: declare BaseAction's REPR_FIELDS and NAME as ClassVar by @jd in #680
test: fix possibly-undefined and deprecated call sites by @jd in #681
refactor: mark overridden methods with @OverRide by @jd in #682
fix: restore support for falsy wait values and callable + strategy by @jd in #694
fix: read the tornado global live instead of an import-time snapshot by @jd in #696
[71 lines not shown]
py-soupsieve: update to 3.0.3.
3.0.3
FIX: When matching with >, the BeautifulSoup object should not count as a parent.
FIX: Fix case where relative sibling matching under :has(~) would incorrectly match a sibling that came before
the target element.
3.0.2
FIX: Python versions less than 3.11.5 have broken possessive quantifiers, so require at least 3.11.5 for Soup
Sieve 3.0+. 3.0 and 3.0.1 will be yanked from PyPI to avoid having the 3.0 series installed on Python < 3.11.5
which will cause the library to be broken.
3.0.1
FIX: Fix regression related to [attribute!=value] where previously it would match if the attribute was not
present and recent changes broke that. Essentially, [attribute!=value] should be the same as
:not([attribute=value]).
[17 lines not shown]
py-pymdown-extensions: update to 12.2.
NEW: Add official support for Python 3.15.
NEW: Tilde, Caret: For backwards compatibility, disable CommonMark punctuation rules by default. If subscript or
superscript is disabled in the respective extension, CommonMark rules will be honored again. A new punctuation
rule has been added to force CommonMark rules. When done, people will need to be aware of punctuation when subscript
or superscript is enabled and escape any that violates CommonMark rules.
NEW: Highlight: Highlight now allows in the auto_title_map specifying the title as a simple string or a
dictionary containing the title and the title mode: either text or html, with text being the default. This
allows a title to be specified and treated as HTML when the mode is html.
NEW: SuperFences: Add new title_mode option for Pygments fenced blocks that allows a user to specify a title
to be treated as HTML via title_mode="html".
py-pillow_heif: update to 1.8.1.
## [1.8.1 - 2026-10-11]
This is the last version that supports `Python 3.10` and `Pillow` `11`/`12`: version `1.9.0` will require `Pillow 13`, which needs `Python 3.11` or newer.
### Changed
- `libheif` was updated from the `1.23.4` to `1.23.6` version. #491 #499
- Saving `;10`/`;12` data with sample values above its bit depth now raises `ValueError`. #499
- `libx265` was updated from the `4.2` to `4.3` version. #503
py-pdf: update to 6.20.0.
Security (SEC)
Limit work per stream (filter count, accumulated decoding work) (#4173) by @stefan6419846
New Features (ENH)
Add support for BrotliDecode filter (PDF 2.0) (#4168) by @stefan6419846
Performance Improvements (PI)
Parse an embedded CFF font program once per stream (#4164) by @marshalltech81
Parse numbers, indirect references, names and nulls faster (#4148) by @MartinThoma
Do not inherit PdfObject from a Protocol (#4149) by @MartinThoma
Speed up cloning direct objects (#4152) by @MartinThoma
Bug Fixes (BUG)
[17 lines not shown]
