py-python-discovery: updated to 1.6.7
1.6.7 (2026-10-28)
Fixed
- Rank uv's minor version links behind the concrete install on Windows too, where uv creates them as directory junctions
that ``Path.is_symlink()`` does not report
- Stop a venv lookup from rewriting the ``executable`` of earlier results, ``PythonInfo.current()`` and
``PythonInfo.current_system()`` when they share its base interpreter
py-sphinxcontrib-httpdomain: updated to 2.2.1
2.2.1
Minor changes
Fixed link to change log in :file:`pyproject.toml`. [:issue:`150` by @nijel]
2.2.0
Breaking changes
Major changes
Added support for Python 3.15. [:pull:`146`]
Minor changes
Bumped uv-build requirement from >=0.12.22,<0.13.0 to >=0.12.22,<0.14.0.
py-itemadapter: updated to 0.14.0
0.14.0 (2026-10-29)
Removed support for Python 3.9 and 3.10, and added support for Python 3.15
Raised the minimum supported versions of optional dependencies: `attrs` 22.1.0
(was 20.1.0), `pydantic` 2.7 (was 1.8) and `scrapy` 2.7 (was 2.2)
Removed support for Pydantic 1 models, including `pydantic.v1` models from
Pydantic 2, and for `scrapy.item.BaseItem` subclasses that are not
`scrapy.Item` subclasses
`ItemAdapter.ADAPTER_CLASSES` is now a `tuple` instead of a
`collections.deque`, so it no longer supports `appendleft()` and other
in-place changes. To register an adapter class, reassign it instead, e.g.
`ItemAdapter.ADAPTER_CLASSES = (MyAdapter, *ItemAdapter.ADAPTER_CLASSES)`
Which adapter class handles each item class is now cached, making
[31 lines not shown]
py-dulwich: updated to 1.2.20
1.2.20 2026-10-26
* Apply zero-context insertion hunks (as written by ``diff -U0``) after
the line named in the hunk header rather than before it. Such patches
inserted their lines one line too early. (Jelmer Vernooij)
* Accept ``max_input_size`` in ``MemoryObjectStore.add_thin_pack``. A push
to a server backed by a ``MemoryRepo`` failed with a ``TypeError``.
(Jelmer Vernooij)
* Refuse ref names outside ``refs/`` (such as ``HEAD``) or malformed ones
in ``receive-pack``, reporting ``funny refname``. Pushing to ``HEAD``
moved the branch it pointed at while hooks only saw ``HEAD``.
(Jelmer Vernooij)
* Only pass successfully updated refs to the ``post-receive`` hook in
``receive-pack``, and skip the hook when nothing was updated. Refused
[37 lines not shown]
chromium: update to 156.0.8078.73
* 156.0.8078.73
This update includes 52 security fixes. Please see the Chrome Security Page for more information.
[N/A][571156746] Critical CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-07
[TBD][572193211] Critical CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-11
[N/A][574776938] Critical CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge on 2026-10-17
[N/A][574852698] Critical CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge on 2026-10-17
[N/A][562191732] High CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge on 2026-09-16
[TBD][565133743] High CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-23
[N/A][567129324] High CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb) on 2026-09-28
[N/A][567645136] High CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30
[N/A][568348290] High CVE-2026-118305: Memory corruption in Turbolev. Reported by Google on 2026-10-02
[N/A][568730797] High CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge on 2026-10-02
[N/A][568894515] High CVE-2026-118320: Memory corruption in V8. Reported by Google on 2026-10-02
[N/A][568895029] High CVE-2026-118322: Memory corruption in ANGLE. Reported by Google on 2026-10-02
[N/A][568900535] High CVE-2026-118329: Improper input validation in ANGLE. Reported by Google on 2026-10-02
[N/A][568936430] High CVE-2026-118354: Improper input validation in Skia. Reported by Google on 2026-10-03
[38 lines not shown]
misc/rozi: update to 0.0.36
v0.0.36
Added
rozi sessions new <NAME> --detach starts a named session in the background without opening a UI. The session starts without panes, and its first split opens one. Use rozi sessions kill <NAME> to remove it. (#272)
The documentation site has an Extension gallery with searchable, sortable cards for extensions in the public index. Extension manifests can declare screenshots with the optional [extension] screenshots key, and rozi extensions check reports screenshots that the index would refuse. (#271)
v0.0.35
Added
Projects rows show separate activity counts for unread finished runs and working agents. (#256)
Pin a floating pane with T (Ctrl+A, then Shift+T, or Alt+Shift+T). It follows workspace switches and stays open when its workspace is killed. Press T again to unpin it. The session protocol is now version 40, so restart running sessions after upgrading. (#258)
Extensions can use rozi prompt to ask for a line of text. A pick action can start the prompt with the picker's search text through from_query. (#263)
Extensions, services, and hooks can subscribe to agent-state-changed and foreground-changed events instead of polling for agent and program changes. The session protocol is now version 41. (#264)
Background agent runs have italic titles and a muted ⧉ marker in Activity and the Agents tab. The Agents view also italicizes the task. (#260)
Changed
[15 lines not shown]
py-cachebox: updated to 6.2.9
6.2.9
RRCache random eviction is now expected O(1). popitem() and random_key() no longer walk the whole table. They probe a few random buckets and fall back only on sparse tables. Benchmarks show 10x-500x faster evicts
Indexed binary heap for LFUCache/VTTLCache. Replaces the old “re-sort the whole VecDeque on every eviction” approach with an indexed min-heap. Filling a large VTTLCache is dramatically faster. Also fixes a bug where LFUCache.popitem() could evict a hot key after reads only
Better hash distribution for hashbrown. Mixes Python hashes once (fold-multiply) so the 7-bit SIMD control tags are well distributed. Small ints and many floats previously all landed in tag 0, causing extra equality checks. Benchmarks show time dropped from ~200 ms to ~6 ms and __eq__ calls fell from ~4.5 M to ~9 k
Iterator views now hold the cache lock while reading. Follow-up to the free-threaded iterator safety work. Every view method now takes the lock, checks the generation, and reads while still holding it
Iterator implementation optimization. Tighter checks, fewer clones.
Fix invalid DECREF on Py_None. This could panic on some builds/Python versions when the Bound was dropped
Bumped PyO3 from 0.29.3 to 0.30.1
py-asn1: updated to 0.6.5
0.6.5, released 26-10-2026
- GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time
instead of repeatedly shifting a growing integer and slicing the
remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf,
adriank31)
- GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments
in linear time while preserving their decoded bit values, including
intermediate fragment padding (thanks for reporting, manus-use)
- GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and
character-string fragments and indefinite-length ANY content in
linear time. Nested constructed OCTET STRING fragments now contribute
their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
- GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking
after two distinct tag sets to prevent quadratic CPU use from
colliding long tag IDs (thanks for reporting, droideck)
py-flit py-flit_core: updated to 4.2.0
Version 4.2
Flit now has a policy against using AI/LLMs for development.
Sdist include & exclude patterns are now matched regardless of Unicode normalisation form. This fixes a potential security issue, where a sensitive file may be published in an sdist even though it appears to match an exclusion rule. This may also depend on the filesystem, e.g. a rule that matches on Linux may not match on Mac, because Mac filesystems perform unicode normalisation.
If you have sensitive information in your project folder and you rely on include/exclude patterns to keep it out of sdists, it’s still a good idea to check them carefully. A malicious contributor could still use other tricks, such as Unicode lookalike characters, to make a pattern that doesn’t do what it appears to.
Flit will now refuse to build an sdist with symlinks that point outside of the project directory. This is a security issue for a consumer unpacking the sdist, and the consumer still needs to verify it, but this makes it harder to accidentally produce an sdist which consumers will reject.
Similarly, Flit will refuse to build wheels with symlinks pointing outside of the project directory, or using a README from outside the project directory. Either of these routes could previously have included files from the build machine into a wheel.
This change does not make it safe to build arbitrary untrusted packages with Flit; code from the package may still be executed. The aim is to make building more predictable, to reduce what needs to be manually verified. If you do not trust the source of a package, it is best to only attempt to build it in a secure sandbox with no access to sensitive information.
Allow environment markers to start with a parenthesised clause
Text in [] brackets in requirements should only be name normalised if it is the name of an extra group
Allow uploading to PyPI with a configured URL missing the trailing slash
Fix flit install --symlink installing into a directory with spaces in the path
Improved error messages for various cases, including hiding tracebacks in more cases where they are not informative
py-pdf: updated to 6.21.4
6.21.4, 2026-10-28
Security (SEC)
- Limit the number of copied page attributes during flattening
- Detect EOF when reading standard xref table trailer
- Fix loop detection when cloning DictionaryObject
Documentation (DOC)
- Exclude performance issues from security reports
py-mistune: updated to 3.4.0
3.4.0
* Add Python 3.15 support and include it in the CI test matrix.
* Require Python 3.10 or later.
* Parse inline links with an opening-bracket stack and replace per-syntax
failure caches with source-local delimiter scanning.
* Share one inline nesting budget across images, links, emphasis, and plugins.
Expose ``InlineParser.max_nested_level``; the older ``max_emphasis_depth``
and ``max_image_depth`` settings configure the same limit.
* Preserve later valid syntax when a candidate fails or reaches a nesting
limit, rather than treating the remaining input as unparsed text.
* Enforce CommonMark's 999-character reference label limit, balanced and
bounded destination parentheses, and link title constraints.
* Improve performance for unclosed inline HTML, unmatched code delimiters,
deeply nested images, and repeated text fragments.
* Recognize inline HTML comments permitted by CommonMark 0.31.2.
* Parse links containing full reference images without treating the image's
[24 lines not shown]
py-httplib2: updated to 0.32.1
0.32.1
cacerts: remove distrusted Comodo AAA Certificate Services root CA
due to eMudhra incident https://emudhra.we-have-a-problem.com/
