devel/gitpane: update to 0.18.0
[0.18.0] - 2026-10-29
Added
Gitpane Explorer for VS Code shows workspace repositories, linked worktrees and changed files beside the file tree. It updates as workspace repositories change and opens file changes in the editor. The extension includes branch review, the commit graph, repository and worktree actions, submodule inspection, sessions, themes and configured launchers. (#107, closes #106)
Install Gitpane Explorer from the VS Code Marketplace, or download a VSIX with its bundled backend for Apple Silicon and Intel Macs, Linux ARM64 and x64, and Windows x64. The README includes a rendered preview, installation steps and settings. (#107)
Fixed
Git process arguments use ordinary Windows paths while repository identity checks retain canonical paths. This fixes content reads and worktree operations that failed on canonical Windows paths. (#107)
Parent repository status remains available when a registered submodule is replaced by a file or symlink. (#107)
Update libz-sys to 1.1.31 for RUSTSEC-2026-0418 and include the latest merged Git and TLS dependency fixes. (#107, #104, #102, #96)
resterm: Update to 1.17.1
Failed tests in the text report
JavaScript asserts show their text once
--timeout stops JavaScript tests
Loop variables in step conditions
+ needs text on one side
Other changes
multimedia/moviebox-tui: update to 0.1.28
Fixed
Providers & Stream Resolution:
Extracted signed CDN MP4 streams from MovieBox subject detector links (/subject-api/get), restoring movie streaming and multi-resolution playback after upstream restricted play-info with deprecation clips.
Reported explicit error causes when MovieBox serves placeholder clips instead of generic "no streams available", and surfaced upstream HTTP failure statuses directly to the user.
Download Engine & Batch Queue:
Recorded only flushed bytes to .part.json segment progress during downloads, preventing aborted or paused workers from leaving zero-byte gaps and file corruption on resume.
Changed
Dependencies & Build Infrastructure:
Upgraded tokio to 1.54.1, scraper to 0.29.0, lru to 0.19.0, zip to 9.1.0, sha2 to 0.11.1, open to 5.4.5, libc to 0.2.191, and serde_json to 1.0.154.
misc/rozi: update to 0.0.39
v0.0.39
Added
You can remove an extension from its installed report with Ctrl+K. A Discover entry for an extension that is already installed opens that extension in the Installed tab, where you can enable, update, or remove it. (#280)
Rozi can send one anonymous weekly usage report per install. The first launch shows an Anonymous usage count notice, and the first report is sent on a later day. Set [updates] count_usage = false, [updates] check = false, or DO_NOT_TRACK=1 to opt out. CI environments and debug builds are not counted. (#282)
Drag one workspace tab onto another in the workbar to swap their panes, layout, and name. You stay on the workspace you dragged, under its new number. (#284)
After an update, a What's new dialog shows the release notes once. Use release-notes in the command palette to open them again, or set [updates] release_notes = false to turn off the automatic dialog. First installs and source builds without embedded notes do not show it. (#286)
On a first install without an existing config file, a Welcome to rozi card introduces sessions, panes, workspaces, and the keys bound to common commands. Press Enter to close it or Ctrl+L to open the getting-started guide. (#287)
Fixed
Renaming a temporary session from the Sessions picker updates its row and the sidebar as soon as the server confirms the rename. The highlight stays on the renamed session.
Hovering a clickable workbar badge now highlights its rounded or pointed ends along with the rest of the badge. (#285)
Update notices now ask you to restart running sessions when the session protocol differs, without showing the internal protocol number. They continue to name extension API version changes. (#283)
Documentation links in the Anonymous usage count notice and update notice now point to the Rozi website. (#287)
Compatibility
[15 lines not shown]
devel/sem: update to 0.29.0
v0.29.0
Bumps every crate, the npm package and the MCP registry entry to 0.29.0.
Minor bump because what sem extracts changed (#538): new entity kinds in
C, C++, C#, Rust, Java, Kotlin and Elixir, C++ headers in `.h` files
read as C++, and recovered definitions in regions tree-sitter cannot
parse.
v0.28.3
Release the merged ignore-handling fix (#536), caller-batch lookup reuse
(#534), and publishing reliability improvements. Synchronizes all five
workspace crate versions, internal dependencies, Cargo.lock, npm, MCP
metadata, and changelog. Validation: locked offline Cargo metadata and
git diff --check passed; the underlying fix passed focused regressions
and all CI checks, including Windows.
v0.28.2
[4 lines not shown]
Update jxrlib to 1.4.4
Motivated by wiz@ in
https://mail-index.netbsd.org/pkgsrc-users/2026/10/26/msg043665.html
Breaking change: include directory renamed from jxrlib to libjxr
Changelog
* V1.4.4; 2026/10/09
+ Fix potential size_t overflow in the memory allocation limit
check of calloc_lim
* V1.4.3; 2026/09/02
+ tmpnam security mitigations:
o Use a local buffer instead of its internal one
o Fail to open file if it exists (requires C11)
* V1.4.2; 2026/07/07
+ Fix buffer overflow in outputNChannel (OSS Fuzz 532002884)
* V1.4.1; 2026/06/03
[44 lines not shown]
luanti: update to 5.18.0
Deprecations and compatibility notes
- Lua API: Missing x, y or z values in vectors now cause an error.
Deprecation warnings were issued since version 5.13.0.
- The setting secure.enable_security has been removed. A
command-line argument has been added to cover cases where it is
- for whatever reason - necessary to disable it.
Client / Audiovisuals
- Performance improvements
- Improve zoom level status text
- Autoforward is again forwarded to get_player_control().up
(5.17.0 regression)
- Better text placement for the media loading step
- The Enter key event no longer leaks into formspecs opened from
the chat
- Re-added a client setting to disable digging particles
- Moved the primary actions (buttons) in main menu dialogs to the
[58 lines not shown]
megacmd: update to 2.7.0
Thu Oct 15 02:34:44 PM UTC 2026 - linux at mega.co.nz
- Update to version 2.7.0:
* Faster uploads, especially of many small files
* FUSE: mounts now stream files, so they open at once instead of after a full download
* FUSE: reads through a mount skip the integrity check a full download does. Use "get" for files meant to be run or installed. See "help --streaming"
* Transfers and streaming now indicate when they wait for transfer quota or for free storage
* mv: moving a folder onto a file no longer deletes the file
* mkdir, put, mv and cp no longer create items named "." or ".."
* Hardened webdav, ftp and local session file handling
* Stability, memory, typos and other improvements
- Use builtin megasdk-10.21.0
audio/fasttracker2: Update to 2.27
Changes since 2.26.1:
v2.27 - 25.10.2026
* Fixed: Sample files shouldn't be listed when in "Instr." item mode
in Disk Op.
* Fixed double-free memory bug when loading .OGG samples
* Scope interpolation tweak (again)
audio/din: Update to 66.2
Changes since 65:
DIN Is Noise 66:
/*
new overtone tuning
the ratios of all intervals are octave shifted harmonics
of the key note.
now the default tuning
*/
/*
on beater and voice-modualtion editors:
infinite beat labels
[53 lines not shown]
py-awscrt: updated to 0.38.0
0.38.0
Python 3.15
bind out expected checksum
feat: add support for windows-arm64
Add eventual consistency to fix mqtt test failures
py-url-normalize: updated to 3.1.0
3.1.0
Changed
BREAKING: Drop support for end-of-life Python 3.10; Python 3.11 or newer is required.
BREAKING: Remove the legacy charset API argument and -c / --charset CLI option.
Declare Python 3.15 support in package metadata.
Require idna>=3.20.
Fixed
Write CLI error diagnostics in UTF-8, including Unicode arguments on Windows.
Strip trailing Unicode IDNA label separators from hosts and custom allowlist domain keys in one normalization pass.
Normalize allowlisted query parameter names consistently with URL query keys, including Unicode and spaces, while keeping literal plus signs, encoded plus signs, and encoded spaces distinct.
Internal
[5 lines not shown]
py-dns: updated to 2.9.1
2.9.1
The resolver now assigns a new random query id to every query.
For transports that require a 0 query id, set it in a way that does not break TSIG.
dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.
DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.
dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.
DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.
dns.ttl.from_text() now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. 1h0, as it already did for other numbers, e.g. 1h5, and as BIND does. The check for a trailing number tested its value instead of whether there was one, so 1h0 was read as one hour.
dns.dnssec.sign_zone() now adds the apex NSEC record when the origin is the only name in a relativized zone. The origin is then the empty name, which is false, so the closing NSEC was skipped and the signed zone had no NSEC at all, and so no authenticated denial of existence (RFC 4035 section 2.3).
TLSA and SMIMEA now reject a certificate association data field whose length does not match the matching type (RFC 6698 section 2.1.3: type 1 is SHA-256, 32 octets, and type 2 is SHA-512, 64 octets), and SSHFP rejects a fingerprint whose length does not match the fingerprint type (SHA-1, 20 octets, RFC 4255 section 3.1.3; SHA-256, 32 octets, RFC 6594 section 3.2). Both the wire and the text parser accepted any length, including empty, so they took records that conforming parsers reject. The DS family already rejects a digest of the wrong length.
A $GENERATE modifier width greater than 127 is now a syntax error, as BIND rejects a substitution that does not fit in 127 characters. The width was not limited, so a short line such as $GENERATE 1-1 ${0,100000000,d} A 10.0.0.1 built a 100 MB padded label before anything was checked, and the dns.transaction.TransactionLimiter meant for untrusted zone files never saw it.
dns.name.from_text() and the parsing of quoted strings and SVCB parameter values no longer take time quadratic in the length of the text. They appended to bytes one character at a time, so e.g. a 1 MB label took about 7 seconds to be rejected as too long.
dns.reversename.to_address() now rejects IPv4 reverse-map names without exactly 4 labels. A label containing an escaped . was joined into the address text, so e.g. 4\.3\.2\.1.in-addr.arpa. and 2\.1.3.4.in-addr.arpa. were both accepted as 4.3.2.1, although only 1.2.3.4.in-addr.arpa. is its reverse-map name.
NSEC3 now rejects an empty Next Hashed Owner Name, as RFC 5155 section 3.1.6 requires a hash length of 1 to 255 octets. The wire parser accepted it, next_name() returned the zone origin, and to_text() wrote an empty field, so reading the text back took the first type mnemonic as the hash, e.g. types NS SOA came back as next ns and type SOA.
BTree zones now keep delegation indexes and node flags consistent when a parent delegation hides or exposes nested NS records, when nodes are copied for a new version, and when CNAME replacement implicitly removes NS records. An origin learned from a zone file is also correctly identified as the origin rather than a delegation when names are absolute.
dns.asyncquery.quic() now verifies the server certificate against the hostname parameter. It passed the deprecated server_hostname alias to the QUIC connection instead, so a query made with hostname= accepted any certificate trusted by the CA set, with no check of the name or address in it. dns.query.quic() was not affected.
DNSSEC validation now rejects an ECDSA signature that is not exactly 64 (P-256) or 96 (P-384) octets long (RFC 6605 section 4), and a DSA signature that is not 41 octets long or whose T octet differs from the key’s (RFC 2536 section 3). The signature halves were read with no length check, so e.g. inserting zero octets before S gave a different RRSIG that still validated.
[14 lines not shown]
py-frozendict: updated to 2.5.0
2.5.0
Breaking changes
Removed frozendict.__deepcopy__. deepcopy() now always returns a copy, even if the frozendict is hashable.
Pure py: | accepts only dict and frozendict, like the C Extension and dict.
Speed
C Extension: freelists for frozendicts and keys make creating small frozendicts faster: the constructor, set() and delete().
C Extension: frozendicts take less memory in some cases.
Pure py: faster set, setdefault, delete and |.
fd | {} and frozendict() | fd now return fd immediately.
Fixes
set, setdefault, delete and | could return a frozendict not tracked by the GC, so its reference cycles were never collected.
[5 lines not shown]
py-cachebox: updated to 6.2.10
6.2.10
This is a patch release fixed a critical bug in TTLCache/VTTLCache (popitem()
method), and focused on correctness, deadlock avoidance, and internal
robustness.
