sysutils/onefetch: update to 3.2.0
What's Changed
New Features
Add an Activity field with a commits-per-month sparkline by @o2sh in #1902
Add --activity-months CLI argument to set the activity window by @o2sh in #1905
Add an Unreleased field with the commits since the last release by @o2sh in #1903
sysutils/dua-cli: update to 3.0.0
Documentation (BREAKING)
declare the Rust library API experimental
Mark the crate root so all Rust library exports participate in experimental
compatibility checks. Future API breaks require minor releases while patch
compatibility remains checked. Document tilde requirements for library
consumers and retain the stable CLI and dua-core compatibility policies.
The transition removes the previous stable Rust library API promise and
requires dua-cli 3.0.0. Let smart-release apply versions during release.
Bug Fixes (BREAKING)
retain filesystem paths in traversal errors
Just looked at the production code and rubber-stamped the tests.
All that really happens is a new error type that retains more information
[14 lines not shown]
sysutils/broot: update to 1.62.0
v1.62.0
fix nushell launcher rejected by upcoming nushell versions (reserved --help flag) - Fix #1230
an invalid flag in a verb argument, eg {file:space_separated}, is now reported as a configuration error
a flag in the terminal_title pattern, where flags have no effect, is now a configuration error
an unknown argument in a verb, eg {flie}, is now reported as a configuration error
an unknown argument in the terminal_title pattern is now a configuration error
a path-from-parent or path-from-directory flag on an argument provided by broot, eg {file:path-from-parent}, is now a configuration error
contradictory or repeated flags on a verb argument, eg {file:space-separated,comma-separated}, are now a configuration error
a space between the flags of a verb argument no longer breaks the argument when the execution is given as a single string
fix quotes in verb executions, broken since 1.56: quotes of an execution given as a single string were passed to the program, and items of an array with spaces weren't quoted when run through a shell
in a command run through a shell, all inserted values are now escaped, not only paths (eg {file-name}), and an empty value is passed as an empty argument
a path-from-parent argument now starts from the selection itself when it has no parent (the filesystem root), instead of being empty
an invalid verb in the configuration now prevents broot from starting, with an error giving its file and definition
errors displayed on exit are now highlighted
a verb argument defined in the invocation, eg {file} in invocation: "say {file}", now takes precedence over the standard argument with the same name
tab completion of the argument of :copy, :move, or of verbs using path-from-parent or path-from-directory, now starts from the directory the command will use
[4 lines not shown]
devel/cargo-bundle-license: update to 5.0.0
Breaking changes
Requires Rust 1.88 or newer.
License is now #[non_exhaustive]; downstream matches need a fallback arm.
Fixes and updates
Handle unknown licenses in expressions with AND, OR, and parentheses without changing their names, so license-file discovery and --previous keep working.
Warn when SPDX parsing fails before using the fallback parser.
Update dependencies, including TOML 1.1, and test both locked and fresh dependency resolution on Rust 1.88.
Build macOS amd64 downloads on an Intel runner and check the binary architecture before upload.
Thanks to Skgland for the dependency and parsing updates in #58. The combined changes landed in #60.
botan3: cleanup useless Makefile parts
GCC_REQD is set to 12 due to c++20
so no reason to set it to 11.
The auxinfo build problem was fixed
in 3.6.2 and it is now on version
3.9.0 that builds without the extra
configure arg on NetBSD.
The package builds fine on Illumos
and adds nsl and socket to the
linking line without having to add
it from pkgsrc.
toxcore: update to 0.2.24
- missing memzero on failure path
- Don't print strings that can lack `\0` without length.
- Improve conference teardown memory management.
- e2e fuzzing was setup wrongly and no pkgs where consumed
- Align group announcement interval with cleanup interval.
- We now make sure to validate signature keys during handshake
- disable nrvo clang warning for osx ci
- `handle_gc_mod_list()` return values in docs
- **crypto:** correct assertion message in `pack_extended_public_key`
- **events:** memory leak when event field alloc fails
- **msi:** invoke error callback on init and push failure paths
- **network:** check buffer length before reading family in
`unpack_ip_port`
- **ngc:**
- don't log bad nicks
- stale gconn ptr after realloc
- **rtp:** wrong slot used check could lead to oob Header only
[5 lines not shown]
py-django-import-export: updated to 4.4.4
4.4.4 (2026-10-27)
Fixed CSV being omitted from the default formats on Python 3.15 because tablib 3.10+ lazily imports tablib.core, leaving the format registry empty when the first is_available() check runs (2210)
Fixed django.utils.functional.cached_property is deprecated warning on Django 6.2 by using functools.cached_property
Fixed ExportActionMixin.get_actions() for Django 6.1, which deprecates overriding it without the new action_location parameter and, with the old signature, disables all change form actions on the admin. (2214)
chromium: update to 156.0.8078.79
* 156.0.8078.79
This update includes 22 security fixes. Please see the Chrome Security Page for more information.
[TBD][576215540] Critical CVE-2026-76024: Memory corruption in MediaStream. Reported by Xinyang Ge on 2026-10-21
[N/A][559780982] High CVE-2026-76025: Use after free in FileSystem. Reported by Google on 2026-09-10
[N/A][567673200] High CVE-2026-76026: Memory corruption in Autofill. Reported by Google on 2026-09-29
[N/A][568894475] High CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google on 2026-10-02
[N/A][569012015] High CVE-2026-76028: Use after free in FileSystem. Reported by Google on 2026-10-03
[TBD][572055997] High CVE-2026-76029: Memory corruption in Network. Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com) on 2026-10-09
[TBD][572269631] High CVE-2026-76030: Memory corruption in FileSystem. Reported by huntersnot4 on 2026-10-11
[TBD][572556403] High CVE-2026-76031: Use after free in Input. Reported by Arni Hardarson (Neonix Security) on 2026-10-12
[N/A][573264074] High CVE-2026-119260: Use after free in Frames. Reported by Google on 2026-10-13
[N/A][574213633] High CVE-2026-119261: Improper input validation in Skia. Reported by Google on 2026-10-16
[TBD][574660146] High CVE-2026-119262: Improper input validation in V8. Reported by Hyeonjun Ahn (@_deayzl) on 2026-10-17
[N/A][575143870] High CVE-2026-119263: Memory corruption in GarbageCollection. Reported by Xinyang Ge on 2026-10-18
[TBD][575150692] High CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a on 2026-10-19
[N/A][575201795] High CVE-2026-119265: Memory corruption in Quota. Reported by Google on 2026-10-19
[7 lines not shown]
py-gitpython: updated to 3.2.1
3.2.1
prepare for next release, v3.2
objects: decode a byte mode before reading its digits
build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group
fix(submodule): validate destinations before mutation
fix(util): create lock files in one exclusive step
fix(commit): accumulate gpgsig continuation lines in linear time
fix(index): accept a single PathLike in checkout
fix(util): redact URL credentials without corrupting the host
change line for changelogs
fix(commit): reject identity fields that alter commit headers
fix: stop stalled remote commands when their timeout expires
fix(util): reject symbolic links that alias .gitmodules
fix: send one object name or path per git stdin record
fix(stats): preserve whitespace in filenames
fix(config): preserve exact large integer values
[2 lines not shown]
soapy-sdr: updated to 0.9.0
0.9.0 (2026-10-10)
- Fixed SWIG parallel Device::make() overloads
- Replaced alternative operator representations
- Fixed CMAKE_INSTALL_LIBDIR definition
- Fixed macOS rpath installation
- Updated swig for compat with newer CMake
- Updated for compat with newer CMake
- Updated cmake_policy in swig for CMake 3.12 compat
- Updated Doxygen config to remove obsolete settings
- Fixed pre-callocate optionNames even if no names are provided
- Fixed use old get python lib for v2
- Fixed treat MinGW and MSYS CMake installation paths as Unix
- Fixed loadModule dlopen to hide symbols using RTLD_LOCAL
- Removed deprecated use of distutils, fix for Python 3.12+
- Fixed pkg-config use cmake full paths
- Added Python docstrings, depending on SWIG version
[15 lines not shown]
expat: updated to 2.10.0
Release 2.10.0 Mon November 2 2026
Security fixes:
1431 CVE-2026-113351 -- Fix denial of service with use of
`XML_ParserReset`
1433 1436 ..
1438 1439 ..
1442 CVE-2026-115506 -- Detect billion laughs attacks quicker
and more of its variations. Related payload fuzzer at:
https://github.com/hannob/lololol
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
In case of backporting, please note pull request 1439
in particular.
1444 CVE-2026-117610 -- Fix initial non-final empty subparser
parse calls. Was segfaulting previously.
1450 CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
function `storeAtts` from signed integer overflow
[34 lines not shown]
