py-coverage: updated to 7.15.4
7.15.4 — 2026-08-06
- Fix: in the HTML report, a source file name containing a double quote (legal
on POSIX) wasn't escaped where it's dropped into the ``href`` of the index
and prev/next links, so it could close the attribute early and inject markup.
Page URLs are now escaped. Thanks, `Rajath Mohare <pull 2227_>`_.
- Fix: the LCOV report wrote file names and other fields into its
line-oriented records without neutralizing control characters. A measured
file whose name contained a newline (legal on POSIX) could forge extra
records, inflating the coverage seen by tools that read the report. Control
characters in a field are now replaced. Thanks, `Rajath Mohare <pull
2226_>`_.
- Wheels are now provided for Python 3.15.
py-argcomplete: updated to 3.7.2
Changes for v3.7.2 (2026-08-05)
Require Python 3.10+
Changes for v3.7.1 (2026-08-04)
- Fix for kislyuk-544 => TestZshGlobalExplicit tests are failing after
upgrade to zsh 5.9.0.1
- Expand ~ in \_FilteredFilesCompleter (DirectoriesCompleter)
libiscsi: updated to 1.20.3
1.20.3
When queueing the first PDU to an idle socket, immediately try to write
it to the socket instead of waiting for the event-loop to
timeout/notice there is work to do.
Various other small bugfixes.
(cad/klayout) Updated 0.29.12 to 0.30.10, based on wip/klayout by Atsushi Toyokura
(pkgsrc)
- Add two experimental patches for Timer::memory_size () at:
src/tl/tl/tlTimer.cc
src/klayout.pri
- To test the code inserted above, we have to know when the function is called.
By asking chatGPT,
**KLayout 0.30.10**, `tl::Timer::memory_size()` is called automatically when an **enabled `tl::SelfTimer` is destroyed and writes its performance report**
--------------------------------------
SelfTimer goes out of scope / is deleted
v
SelfTimer::~SelfTimer()
v
stop()
v
report()
[419 lines not shown]
arti: update to 2.5.1.
# Arti 2.5.1 - 3 August 2026
Arti 2.5.1 continues development on relays and directory authorities.
It also adds some performance, security, and convenience features for
onion services.
# Arti 2.5.0 — 30 June 2026
Arti 2.5.0 comes with lots of progress in the relay and directory authority
space, including ntor handshake handling, as well as encoding/decoding support
for router- and micro descriptors.
This release also includes a number of important bug fixes, as well as two security
fixes for medium-severity security issues, [TROVE-2026-24] and [TROVE-2026-27].
apr-util: update to 1.6.4.
Changes with APR-util 1.6.4
*) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
avoid producing an empty bucket. PR 64273
[Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
*) apr_brigade: Metadata buckets are now ignored in
apr_brigade_split_line, apr_brigade_flatten and
apr_brigade_to_iovec, fixing possible undefined behaviour. PR 68278
[Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
*) apr_crypto_openssl: Compatibility with OpenSSL 3. [Yann Ylavic]
*) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
on versions 1.1+. [Graham Leggett]
*) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
[5 lines not shown]
SDL3: updated to 3.4.14
3.4.14
This is a stable bugfix release, with the following changes:
GPU buffers and textures can have multiple read usages
Fixed X11 crash if the IME service was shutdown in the background
Fixed hang when hiding an X11 window on some window managers
Fixed being unable to get clipboard text on older versions of macOS
Fixed the 8BitDo Pro 3 controller showing up twice on macOS
Fixed Xbox controllers not being detected if SDL is built with GameInput support
Fixed pen creating phantom mouse events in relative mode on Android
openvpn: updated to 2.7.6
2.7.6
Enable TCP_NODELAY by default and push it to clients
options: make 'tun' the default for '--dev'
Correctly calculate packet id size when epoch packet format is in use
test_tls_crypt: Fix issue with temp file name on big endian systems
ssl_pkt: Fix doxygen warning about read_control_auth
t_client.sh.in: Do not run resolvectl if systemd is not running
test_tls_crypt: Fix test failure on Windows
ssl: Ignore hard reset packets with a non-zero packet id
mingw: avoid C99 "hh" scanf length modifier
interactive: forbid "--setenv opt" in startup data
CMake: detect cmocka_version.h via include path, not by linking
options: limit ping and keepalive values to one day
Make --x509-username-field work with Mbed TLS
Remove --providers from --help output for Mbed TLS
gstreamer1: updated to 1.28.6
1.28.6
Highlighted bugfixes:
Various security fixes and playback fixes
playbin3, playbin: fix stalls after re-enabling previously disabled subtitles
Fix regression in core if a pad is re-linked while changed sticky events are being pushed
dtls/webrtc: fix some issues with OpenSSL 4.0.0
RTP retransmission bitrate estimation fixes
Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets
Add H.266 muxing support to the Rust (f)mp4 muxers
Better handling of input buffers without timestamps in Rust (f)mp4 muxers
webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder
SMPTE ST2038 ancillary metadata and closed caption combiner improvements
Fix SEI insertion into H.265/HEVC streams with alpha
Windows D3D11 WinRT screen capture element fixes
Improved coded buffer size handling for VA encoders
[5 lines not shown]
firefox: remove target_arch=x86_64 cfg attr in patch
Fixes aarch64 build.
(target_pointer_width=64 should suffice here, NetBSD does not have x32
ABI for x86_64.)
chat/ejabberd: Update to 26.07
## Version 26.07
#### Security fixes
This release contains fixes for those issues:
- It's possible to craft PLAIN auth request and authenticate as one user, but then open
session for different one.
- mod_caps persistent cache can be poisoned by using legacy version requests.
This cache was only used to determine list of nodes that should trigger notifications
in PubSub presence-based delivery.
- SQL injection in mod_pubsub handling of paging requests.
- Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
- It was possible to make ejabberd send redirect response for OAuth requests to unvetted url.
This required enabling ejabberd to act as OAuth provider (by adding request handler for
ejabberd_oauth in http listener). As part of this fix we changed `oauth_client_id_check`
default value to `db` - using ejabberd as OAuth provider will be only allowed by clients
[20 lines not shown]
chat/ejabberd: Partially address pkglin and improve comments
- Improve version pattern for coreutils (textual change, NFCI)
- Reorder CONFIGURE_ARGS after DEPENDS
- Clarify and regularize description of build tools
- Reorder erlang bl3 depends.
Except for coreutils version, this is a comment-only/reordering
change.
