editors/xwpe: update to 1.6.9
Switch to the new maintained branch of xwpe.
The project has been (relatively) recently resumed elsewhere by Juan
Manuel Mendez Rey. Most distributions packaging xwpe have already
switched to this repo.
Thanks to zakinko at snowrabbit.org for providing diffs. See pkg/#60821
# CHANGES (since 1.5.30a)
Bugs fixed in 1.6.x:
* Options > Editor: checkboxes and radio buttons could not be ticked in xwpe
(X11) -- fixed (1.6.3). Space, mouse-click and the Alt-<letter> hotkey all
flipped the option's value, but in X11 nothing was drawn, so the box looked
unchanged ("I can't mark it"). Root cause: with NEWSTYLE the dialog redrew
the marks via e_make_xrect_abs -- a 3D bevel in the extbyte overlay whose
checked vs unchecked states differ only by one highlight bit, visually
[1622 lines not shown]
pkgconf: update to 3.0.11.
Changes from 3.0.10 to 3.0.11:
------------------------------
* Security fixes:
- Package paths are accepted only in queries made directly on the command
line, not in Requires or Requires.private. This prevents a crafted pc(5)
file from causing infinite recursion by requiring itself through a path.
See GHSA-qcp5-98c5-hvh7.
- Limit the bytecode produced when a variable is repeatedly redefined in
terms of itself. This prevents a crafted pc(5) file from causing
exponential memory growth through self-referential variable expansion.
See GHSA-fr7f-m8jv-4qcm.
* Build and portability fixes:
- Include stdbool.h where needed by spdxtool, fixing its build on Windows.
* Documentation and command-line help:
[4 lines not shown]
filezilla: update to 3.72.0.
3.72.0 (2026-11-13)
! Updated to libfilezilla 0.59.0 and fzssh 1.5.2
! Fixed various crashes
! FTP over TLS: Add strict PROT P requirement, disconnect if input buffer is non-empty after AUTH
! MSW: File editing now disallows setting direct associations to cmd.exe and powershell.exe
! FTP: If the experimental "Strip VMS revisions" is set in filezilla.xml, filenames were not correctly sanitized when connecting to FTP servers configured with server type VMS in the Site Manager
! FTP: Passive mode data connections are now always established to the same IP address as the control connection, this can be reverted to previous behavior in the Site Manager on a per-site basis
3.72.0-rc1 (2026-11-03)
+ Added support for SSH proxies
+ SFTP: Added dynamic request pipeline depth calculation to improve download performance with some servers
+ SFTP: Added option to disable use of SSH agent to settings dialog
- Fixed layout issues in the Site Manager
- macOS: Improved UI layout on macOS 27
- macOS: Fixed a regression in number formatting
fzssh: update to 1.5.2.
1.5.2 (2026-11-13)
! Fixed a crash parsing invalid RSA private keys and reduced maximum allowed modulus size
1.5.1 (2026-11-03)
+ Added channel_flags allowing to request hgue channel windows even in case of multiplexed transports
- Improved state tracking in the the socket interface representing opened channels
1.5.0 (2026-10-23)
+ Added support for pin at openssh.com extension
+ Added sftp_client::initial_rtt() as estimate of initial channel rtt
- Improved logging when processing File Attributes with malformed extended attributes
libfilezilla: update to 0.59.0.
0.59.0 (2026-11-13)
! MSW: Fix argument quoting when directly trying to start .bat/.cmd as executable
! HTTP: Fix redirects on same host but different protocol/port
+ Add support for certificates with IP SAN, these can now be checked against the system trust store
- fz::event_with_source accepts const source pointers; source() now returns a const source-identity pointer
- Minor fixes to key purpose handling in certificate requests
0.58.0 (2026-10-23)
+ Added fz::socket::srtt to get an estimate of the the smoothed rounttrip time of the connection, if available
+ Added fz::rename_file flags to control replacement and cross-filesystem copying; no-replace uses native atomic operations where available, otherwise a best-effort check
+ Added fz::result::cross_device to report filesystem-boundary failures
+ Added fz::local_filesys modification time overloads for native file and directory handles
+ Added fz::is_valid_x509_distinguished_name
+ Added shared interface for buffer access
- fz::uri::get_authority now correctly preserves IPv6 literal addresses
[3 lines not shown]
p5-Sereal*: update to 7.002
7.002
* Add an opt-in paranoid preset for authenticated input, bounded
decompression and container sizes, UTF-8 validation, restricted
object blessing and THAW, and a recursion limit of 2048. Explicit
constructor options can override each default.
* Add allow_classes for ordinary and frozen objects and
track_classes for per-class object counts. Permit genuine Regexp
objects through refuse_objects unless an allowlist excludes them.
* Add allow_unsigned as an explicit checksum-policy opt-out. Lower
the normal recursion limit from 10000 to 8192, or 4096 on Cygwin.
Clarify the trust assumptions and limits of paranoid mode.
* Balance custom-op argument and result references on Perl builds
with PERL_RC_STACK.
* Fix native floating-point declaration tests on older FreeBSD and
macOS Perls. Remove hobodecoder's od dependency and make child
tests portable on Windows. Bound randomized test runtime and TAP
memory use, and adapt deep-recursion tests to Cygwin's stack.
p5-Cpanel-JSON-XS: update to 4.81.
4.81 2026-11-09 (rurban)
- Fix memory leak when croak is called while encoding a tied hash
in canonical mode (PR #261, Nikolay Shaplov, ISP RAS)
p5-JSON-XS: update to 4.05.
4.05 Fri 13 Nov 2026 05:21:06 CET
- the incremental parser would not properly reset parsing offset
after removing a top-level number json number, causing memory
corruption. this is potentially a very serious vulnerability.
(reported by Albert Gierlach).
- the ignore initial whitespace optimisation in the incremental
parser could result in the parser reading beyond the end of string,
potentially leading to parsing errors or skipping json texts.
- FREEZE method calls could move the stack and cause a use-after-free.
requires allow_tags and a suitable FREEZE method to be exploited
(reported by Albert Gierlach).
- json_sv_grow would not allocate space for the trailing 0 byte.
possibly exploitable. (reported by Albert Gierlach).
- the incremental parser did not properly detect embedded NUL
characters as an error (reported by Peter Juhasz and his LLM).
- string and object decoding failures could leak a partially
constructed perl scalar (reported by Peter Juhasz).
[2 lines not shown]
xmag: update to 1.0.9.
Alan Coopersmith (6):
Improve man page formatting
man page: fix warnings from `mandoc -T lint` and `groff -rCHECKSTYLE=10`
gitlab CI: drop the ci-fairy check-mr job
Strip trailing whitespace from source files
meson: Add option to build with meson
xmag 1.0.9
