rspamd: update to 4.2.3.
4.2.3: 21 Oct 2026
** Incompatible changes **
* [Conf] phishing: Disable phishtank.rspamd.com by default (the zone no longer carries data)
* [Feature] rbl: Merge duplicate DNS queries from several checks into one request and one symbol insertion (a rule now scores once per matched value; set merge_checks = false to keep one insertion per check)
* [Fix] rbl: Fix the inverted dkim_domainonly test under dkim_match_from (eSLDs were compared when dkim_domainonly was off)
** Features **
* [Feature] force_actions: Promote rules that depend on composites to postfilters
* [Feature] force_actions: Add a priority setting to arbitrate between matching rules, shown as a priority:N symbol option
* [Feature] lua_task: Return the action name instead of its type from has_pre_result, plus its flags
* [Feature] metadata_exporter: Add unix_time to general metadata
** Bug fixes **
* [Fix] arc: Do not trust ARC forwarders whose seal failed verification (a whitelisted d= with a broken seal gave ARC_ALLOW_TRUSTED and its AAR could lower DMARC)
* [Fix] arc: Require exactly one ARC-Authentication-Results per instance and wait for all seal checks before publishing results
* [Fix] dkim: Report a key request that cannot be scheduled as a failure (ARC chains with such a seal published no result)
[26 lines not shown]
snmp_exporter: update to 0.31.0.
## 0.31.0 / 2026-10-25
BREAKING CHANGES:
Regenerating snmp.yml with the generator now maps enum lookup columns to
human-readable string labels (e.g. `"ioMemory"` instead of `"2"`) by default.
Dashboards, alerts, or recording rules that match on numeric enum label values
may need updating. Opt out per metric/lookup with `type: gauge`.
The generator now drops tables whose index type cannot be rendered as a label
(e.g. DateAndTime, Bits) with a warning, and fails when a chained lookup
promotes such a type to an index. Previously these produced configs that
crashed the exporter on scrape.
Building from source now requires Go 1.26 or newer.
* [FEATURE] Add DISPLAY-HINT support for SNMP OctetString formatting #1549
[49 lines not shown]
py-starlette: updated to 1.10.0
1.10.0 (October 24, 2026)
Changed
* Compare multidicts such as `FormData` and `QueryParams` by key while keeping the order of values under a repeated key, so `FormData` with repeated uploads no longer raises `TypeError`. `QueryParams("a=1&a=2")` and `QueryParams("a=2&a=1")` are no longer equal
* Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields
* Compare `Match` members by identity during routing
Deprecated
* Deprecate `starlette.formparsers.FormMessage`, which is no longer used
Fixed
* Parse the last URL-encoded form field when the request stream ends without an empty chunk
* Keep path parameter values that look like another placeholder in `url_path_for()`
* Default omitted `http.response.start` headers in `BaseHTTPMiddleware`, `GZipMiddleware` and `SessionMiddleware` instead of raising `KeyError`
[5 lines not shown]
py-pbs-installer: updated to 2026.10.25
2026.10.25
Version metadata is now stored in versions.json instead of a generated Python module.
New base_url parameter for get_download_link() / install() (and PBS_INSTALLER_BASE_URL env var) to download from a mirror.
Fix free-threaded builds shadowing GIL builds in the version index: GIL CPython 3.13.12+ / 3.14.3+ were missing entirely, and older GIL versions lacked full (--build-dir) builds.
py-zensical: update to 0.0.73.
0.0.73
This version fixes URL rewriting in the privacy plugin so assets
loaded by JavaScript resolve correctly on nested pages and during
local preview. It also corrects the nested list example included
in newly created projects.
Additionally, the user interface is updated to v0.0.39, adding
support for Mermaid 12 and improving scroll restoration when
following anchor links, reloading pages, or navigating back and
forward.
0.0.72
This version brings Zensical's behavior closely in line with MkDocs,
with support for the privacy plugin and fixes to Markdown rendering,
link handling, and project layouts.
[13 lines not shown]
hunspell: update to 1.7.6.
2026-10-26: Hunspell 1.7.6 release:
- add, add_with_flags, add_with_affix and remove apply the dictionary's
ICONV rules to the word, as spell does, so a caller that converted the
word itself must stop doing so (#616)
- A personal dictionary exclusion such as *afterwards also rejects the
word when the dictionary has it only as an affixed form (#1155)
- stem and analyze give st: stem fields again with COMPLEXPREFIXES
- analyze lists every analysis of a compound word, where a rejected
split of the word could hide the splits after it
- The text and XML parsers check the character after a character
entity such as à (#686)
- The interactive mode shows the first digit of a two digit
suggestion number (#158)
- The -a pipe interface checks a line of any length in one piece
(#220)
- The hunspell tool takes -- as the end of the options, the -u2 sed
script escapes the word and the suggestion, and a zipped ODF file
[23 lines not shown]
py-sphinxcontrib-jsmath: update to 2.0.0.
Release 2.0.0 (2026-10-20)
==========================
* Adopt Ruff
* Tighten MyPy settings
* Update GitHub actions versions
* Remove Sphinx as a required dependency, as circular dependencies may cause
failure with package managers that expect a directed acyclic graph (DAG)
of dependencies.
* Drop support for Python 3.5, 3.6, 3.7, and 3.8
* Raise minimum required Sphinx version to 5.0
* Replace `domain.has_equations()` with `context['has_maths_elements']`
Patch by Dmitry Shachnev.
* Declare support for Python 3.14, Python 3.15, and Python 3.16.
py-cryptodome: update to 4.2.0.
4.2.0 (24 October 2026)
++++++++++++++++++++++++++
New features
------------
* New module ``Crypto.PublicKey.MLKEM``, for ML-KEM keys (FIPS 203).
It is based on the portable C code of
`mlkem-native <https://github.com/pq-code-package/mlkem-native>`_ (v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.
* New module ``Crypto.PublicKey.Hybrid``, to model hybrid keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
* ``Crypto.Protocol.HPKE`` accepts ML-KEM keys and X-Wing keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.
4.1.0 (19 October 2026)
[317 lines not shown]
security/py27-cryptodome: import py27-cryptodome-3.24.1nb1
PyCryptodome is a self-contained Python package of low-level cryptographic
primitives.
This is the last version supporting Python 2.
py-googleapis-common-protos: update to 1.76.0.
1.76.0 (2026-10-22)
Features
declare support for Python 3.15 (#18737) (65c8767)
update API sources and regenerate (#18797) (be4d954)
py-google-api-core: update to 2.43.0.
2.43.0 (2026-10-22)
Features
api_core: support DirectPath over Interconnect with TLS composite credentials and ?force-xds (#18431) (fbd3188)
observability: suppress redundant gRPC auto-instrumentation spans (#18592) (a597007)
py-uv py-uv-build: updated to 0.13.6
0.13.6
Enhancements
Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently
Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table
Python
Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2
Preview features
Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants
Nest each module's owners in an object in uv workspace metadata output
Report the unsupported properties required by an incompatible wheel variant
[23 lines not shown]
py-ruff: updated to 0.17.3
0.17.3
Preview features
[suspicious] Add shared-clock-mock
Bug fixes
[pyupgrade] Avoid incorrect conversions to f-strings (UP032)
Performance
Buffer stdout in ruff format
Specialize ASCII identifier lexing
Speed up identifier and keyword lexing
Documentation
[2 lines not shown]
py-pyrate-limiter: updated to 4.5.1
4.5.1
Bug fixes only. One behaviour change to note: a decorated call that the limiter
can never admit now raises instead of running (see the first entry).
Fixed
- **`as_decorator` ran the wrapped function even when denied.** Both the sync
and async wrappers discarded the result of `try_acquire()` and called the
function unconditionally. With the default `blocking=True, timeout=-1` that
result is only `False` when the weight can never be admitted under the
configured rates (e.g. `weight=5` on `Rate(2, Duration.SECOND)`), so the
limiter's verdict was silently bypassed. Such calls now raise `RuntimeError`.
- **`Limiter.close()` never closed its buckets.** `BucketFactory.close()` read
the bucket list off the leaker after tearing the leaker down, so it always
iterated an empty list: SQLite connections and Postgres connection pools
stayed open. It now snapshots the buckets first. `SingleBucketFactory` also
closes its bucket when no leak was ever scheduled; factories that hold buckets
[21 lines not shown]
