megacmd: update to 2.7.0
Thu Oct 15 02:34:44 PM UTC 2026 - linux at mega.co.nz
- Update to version 2.7.0:
* Faster uploads, especially of many small files
* FUSE: mounts now stream files, so they open at once instead of after a full download
* FUSE: reads through a mount skip the integrity check a full download does. Use "get" for files meant to be run or installed. See "help --streaming"
* Transfers and streaming now indicate when they wait for transfer quota or for free storage
* mv: moving a folder onto a file no longer deletes the file
* mkdir, put, mv and cp no longer create items named "." or ".."
* Hardened webdav, ftp and local session file handling
* Stability, memory, typos and other improvements
- Use builtin megasdk-10.21.0
audio/fasttracker2: Update to 2.27
Changes since 2.26.1:
v2.27 - 25.10.2026
* Fixed: Sample files shouldn't be listed when in "Instr." item mode
in Disk Op.
* Fixed double-free memory bug when loading .OGG samples
* Scope interpolation tweak (again)
audio/din: Update to 66.2
Changes since 65:
DIN Is Noise 66:
/*
new overtone tuning
the ratios of all intervals are octave shifted harmonics
of the key note.
now the default tuning
*/
/*
on beater and voice-modualtion editors:
infinite beat labels
[53 lines not shown]
py-awscrt: updated to 0.38.0
0.38.0
Python 3.15
bind out expected checksum
feat: add support for windows-arm64
Add eventual consistency to fix mqtt test failures
py-url-normalize: updated to 3.1.0
3.1.0
Changed
BREAKING: Drop support for end-of-life Python 3.10; Python 3.11 or newer is required.
BREAKING: Remove the legacy charset API argument and -c / --charset CLI option.
Declare Python 3.15 support in package metadata.
Require idna>=3.20.
Fixed
Write CLI error diagnostics in UTF-8, including Unicode arguments on Windows.
Strip trailing Unicode IDNA label separators from hosts and custom allowlist domain keys in one normalization pass.
Normalize allowlisted query parameter names consistently with URL query keys, including Unicode and spaces, while keeping literal plus signs, encoded plus signs, and encoded spaces distinct.
Internal
[5 lines not shown]
py-dns: updated to 2.9.1
2.9.1
The resolver now assigns a new random query id to every query.
For transports that require a 0 query id, set it in a way that does not break TSIG.
dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.
DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.
dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.
DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.
dns.ttl.from_text() now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. 1h0, as it already did for other numbers, e.g. 1h5, and as BIND does. The check for a trailing number tested its value instead of whether there was one, so 1h0 was read as one hour.
dns.dnssec.sign_zone() now adds the apex NSEC record when the origin is the only name in a relativized zone. The origin is then the empty name, which is false, so the closing NSEC was skipped and the signed zone had no NSEC at all, and so no authenticated denial of existence (RFC 4035 section 2.3).
TLSA and SMIMEA now reject a certificate association data field whose length does not match the matching type (RFC 6698 section 2.1.3: type 1 is SHA-256, 32 octets, and type 2 is SHA-512, 64 octets), and SSHFP rejects a fingerprint whose length does not match the fingerprint type (SHA-1, 20 octets, RFC 4255 section 3.1.3; SHA-256, 32 octets, RFC 6594 section 3.2). Both the wire and the text parser accepted any length, including empty, so they took records that conforming parsers reject. The DS family already rejects a digest of the wrong length.
A $GENERATE modifier width greater than 127 is now a syntax error, as BIND rejects a substitution that does not fit in 127 characters. The width was not limited, so a short line such as $GENERATE 1-1 ${0,100000000,d} A 10.0.0.1 built a 100 MB padded label before anything was checked, and the dns.transaction.TransactionLimiter meant for untrusted zone files never saw it.
dns.name.from_text() and the parsing of quoted strings and SVCB parameter values no longer take time quadratic in the length of the text. They appended to bytes one character at a time, so e.g. a 1 MB label took about 7 seconds to be rejected as too long.
dns.reversename.to_address() now rejects IPv4 reverse-map names without exactly 4 labels. A label containing an escaped . was joined into the address text, so e.g. 4\.3\.2\.1.in-addr.arpa. and 2\.1.3.4.in-addr.arpa. were both accepted as 4.3.2.1, although only 1.2.3.4.in-addr.arpa. is its reverse-map name.
NSEC3 now rejects an empty Next Hashed Owner Name, as RFC 5155 section 3.1.6 requires a hash length of 1 to 255 octets. The wire parser accepted it, next_name() returned the zone origin, and to_text() wrote an empty field, so reading the text back took the first type mnemonic as the hash, e.g. types NS SOA came back as next ns and type SOA.
BTree zones now keep delegation indexes and node flags consistent when a parent delegation hides or exposes nested NS records, when nodes are copied for a new version, and when CNAME replacement implicitly removes NS records. An origin learned from a zone file is also correctly identified as the origin rather than a delegation when names are absolute.
dns.asyncquery.quic() now verifies the server certificate against the hostname parameter. It passed the deprecated server_hostname alias to the QUIC connection instead, so a query made with hostname= accepted any certificate trusted by the CA set, with no check of the name or address in it. dns.query.quic() was not affected.
DNSSEC validation now rejects an ECDSA signature that is not exactly 64 (P-256) or 96 (P-384) octets long (RFC 6605 section 4), and a DSA signature that is not 41 octets long or whose T octet differs from the key’s (RFC 2536 section 3). The signature halves were read with no length check, so e.g. inserting zero octets before S gave a different RRSIG that still validated.
[14 lines not shown]
py-frozendict: updated to 2.5.0
2.5.0
Breaking changes
Removed frozendict.__deepcopy__. deepcopy() now always returns a copy, even if the frozendict is hashable.
Pure py: | accepts only dict and frozendict, like the C Extension and dict.
Speed
C Extension: freelists for frozendicts and keys make creating small frozendicts faster: the constructor, set() and delete().
C Extension: frozendicts take less memory in some cases.
Pure py: faster set, setdefault, delete and |.
fd | {} and frozendict() | fd now return fd immediately.
Fixes
set, setdefault, delete and | could return a frozendict not tracked by the GC, so its reference cycles were never collected.
[5 lines not shown]
py-cachebox: updated to 6.2.10
6.2.10
This is a patch release fixed a critical bug in TTLCache/VTTLCache (popitem()
method), and focused on correctness, deadlock avoidance, and internal
robustness.
py-wrapt: updated to 2.5.2
2.5.2
Bugs Fixed
The special methods added to the class generated for an wrapt.AutoObjectProxy, and adjusted when __wrapped__ was reassigned, were determined by inspecting the wrapped object itself, rather than the type of the wrapped object. As special methods are only ever looked up on the type of an object, this gave the wrong result in several cases. When the wrapped object was a class, the special methods it defined for its instances were added to the proxy class, so a proxy for a class defining __set_name__() raised TypeError when assigned to an attribute in a class body, a proxy for a class defining __get__() was bound as a descriptor on attribute access, and a proxy for a class defining __await__() or __iter__() was reported as awaitable or iterable by inspect.isawaitable() and collections.abc checks, even though the class itself was not. Special methods provided by the metaclass of a wrapped class, such as __iter__(), were not added to the proxy class. When the wrapped object was an instance, instance attributes shadowing the dunder names were treated as special methods of the wrapped object, and special methods which a __dir__() method of the wrapped object did not report were missed. The special methods are now always determined from the type of the wrapped object, so a proxy behaves the same as the object it wraps. This also covers a wrapt.LazyObjectProxy whose factory returns an object, as resolving the wrapped object reassigns __wrapped__. With thanks to ybai08 for pull request 361 which identified the issue.
py-django-reversion: update to 6.5.0.
6.5.0 - 2026-10-29
Django 6.1 and Python 3.15 support (@etianen).
Fixed 500 error in VersionAdmin when saving a model with no changed fields (@U-238).
Fixed createinitialrevisions not detecting the admin app when using a custom AdminConfig (@UnknownPlatypus).
6.4.0 - 2026-10-15
Added Persian translation (@elias-ebrahimpour).
sysutils/lsof: Really stop warning at start up.
* Really stop warning at start up.
This fix is provided from Yoshitaka Tokugawa <toku at tokugawa.org>.
* Merge patch-ah into patch-dialects_n+obsd_dproc.c.
Bump PKGREVISION.
routinator: Update to version 0.15.3
Security fixes
Switched to always caching CRL serial numbers to avoid a potential resource exhaustion through re-decoding the list over and over. (#1130)
Output individual payload items to HTTP clients or disk instead of building the whole set in memory first. (#1131)
Avoid stack overflow when releasing a payload set by implementing a non-recursive Drop for PayloadInfo. (#1132)
Added a timer to the HTTP/1 connection establishment to prevent indefinite task blocking in the HTTP server. (#1133)
Added a way to deal with manifest file names clashing with directory names of publication points by ignoring the colliding publication point. (#1134)
A fetched TA certificate is now only stored if it is found to be valid. This avoids overwriting the last known good certificate. (#1135)
Added a check to the RRDP collector that the list of deltas is consecutive rather than happily processing non-consecutive lists. (#1139)
Updated rpki-rs to 0.20.0. This version also includes a number of security fixes. See its release notes for more information.
Improvements
Move the stored RRDP archive to a temporary place before updating to avoid a partially updated state if processing aborts. (#1136)
Added a check that the authority key identifier of a CRL matches the subject key identifier of the issuing CA certificate. (#1140)
Bug fixes
Skip publication points that have never succeeded during dump. Previously, such a publication point would lead to a crash. (#1137)
Reject CRLs that have a thisUpdate field in the future. (#1138)
[6 lines not shown]
py-djangocms-video: updated to 3.2.0
3.2.0
Bump sqlparse from 0.4.4 to 0.5.0 in /tests/requirements
Bump django from 3.2.20 to 3.2.25 in /tests/requirements
feat: modernize test setup to match djangocms-frontend constraints
feat: include 5.1 alpha in test matrix
chore: upgrade GitHub Actions versions
feat: Add referrer policy to iframe in video player template
ci: Replace isort and flake8 with ruff check
ci: add Python 3.15 to CI
fix: Fixed Vimeo video URL embedding
docs: clarify configuration and show published supported versions
feat: Implemented HLS stream source as new plugin type
chore: Prepare release 3.2.0
py-gcovr: updated to 8.8
8.8
New features and notable changes:
Change the breadcrumbs of in the source view of the GitHub theme.
Bug fixes and small improvements:
Fix removing coverage for internal functions in C sources.
Fix release pipeline to upload standalone applications for MacOs again.
Internal changes:
Add zizmor to scan pipeline for security issues.
Add dependabot configuration for version updates.
Change exclusion handling to use a data class instead of simple integers.
Add nox session to cleanup duplicate reference data and notify session after import.
