Release 2.8.0 Fri April 24 2026
Security fixes:
#47 #1183 CVE-2026-41080 -- The existing hash flooding protection
(based on SipHash) only used 4 to 8 bytes of entropy for
a salt, when 16 bytes of salt are supported by the
implementation of SipHash used by Expat. Now full 16 bytes
of entropy are used to improve protection against hash
flooding attacks.
Existing API function XML_SetHashSalt is now deprecated
because of its limitations, and its use should be
considered a vulnerability. Please either use the new API
function XML_SetHashSalt16Bytes (with known-high-quality
entropy input only!) instead, or leave the derivation of
a 16-bytes hash salt from high quality entropy to Expat's
internal machinery (by *not* calling either of the two
XML_SetHashSalt* functions).
Bug fixes:
#1188 Avoid propagating /dev/urandom file descriptor to child
[46 lines not shown]
textproc/docbook-xsl-ns: initial import
The DocBook XSL stylesheets provide a serie of ready-to-use templates to
process documents based on the DocBook XML DTD. They can generate different
types of output files, like XHTML, slides, manpages, JavaDoc...
These are namespace-aware XSLT stylesheets for the DocBook DTD and its
derivatives (Simplified DocBook, etc.).
graphics/colord: update to 1.4.8
# pkgsrc changes
* Switch to meson.
* Enable gusb and gudev support, among others.
* Install bash completions and man pages.
* Move some stuff to options.mk to make it optional.
* Patch to allow build on systems without libudev support.
* Use SUBST instead of patching to replace hard-coded paths.
# upstream changes (since 1.3.5)
Version 1.4.8
~~~~~~~~~~~~~
Released: 2025-06-23
New Features:
- Add AppStream metainfo XML with hardware provide info (Petter Reinholdtsen)
- Add support for -Dsystemd_root_prefix to make local building easier (Richard Hughes)
[138 lines not shown]
cups*: update to 2.4.18
Changes in CUPS v2.4.18 (2026-04-22)
------------------------------------
- Fixed cupsd crash if user does not exist (Issue #1555)
dasel: update to 3.8.0.
v3.8.0 - 2026-04-26
Added
dasel completion <shell> subcommand to generate shell completion scripts for bash, zsh, fish, and powershell (#497).
dasel man subcommand to generate a man page (#497).
Fixed
YAML string quote style (double, single, literal, folded) is now preserved on round-trip (#452).
v3.7.0 - 2026-04-25
Changed
merge function now performs deep merge, recursively merging nested maps (#133).
[51 lines not shown]