knot: Update to 3.5.7
Knot DNS 3.5.7 (2026-08-18)
Improvements:
knotd: new debug logging for DDNS prerequisite errors
knotd: support for SO_BINDTODEVICE for remotes/via #977 (closed) (Thanks to Tore Anderson)
keymgr: 'keystore-bench' is slow with many threads and a high-latency HSM connection
keymgr: 'keystore-bench' command accepts a filter by signing algorithm
libs: upgraded embedded libngtcp2 to 1.25.0
doc: various improvements
Bugfixes:
knotd: server crash due to a missing check for malformed TCP packet in XDP mode (Thanks to Arthur Chan)
knotd: server crash when processing XFR or NOTIFY with non-IN records (Thanks to Qifan Zhang)
knotd: server crash when processing an outbound reply with non-IN records (Thanks to Qifan Zhang)
knotd: server crash on zone with NSEC3PARAM but without NSEC3 records (Thanks to Qifan Zhang)
knotd: incorrect ACL address range evaluation (Thanks to Qifan Zhang)
knotd: assertion failure if zone expire is set to maximum (Thanks to Qifan Zhang)
[12 lines not shown]
icinga2: updated to 2.16.5
2.16.5 (2026-08-18)
This release contains a bugfix for a regression in the `IcingaDB` feature that was introduced in v2.16.0 and some
security enhancements that fix a couple of minor vulnerabilities.
One vulnerability allowed an authenticated `ApiUser` with the `events/*` permission to obtain information about
objects through crafted filter expressions, without holding the relevant `objects/query/*` permission. The fix is to
correctly apply permissions to filter expressions on `/v1/events`.
The other vulnerability allowed an authenticated Icinga 2 node to use the ~1 GB message limit to possibly crash another
node through memory exhaustion. Depending on available memory, multiple compromised nodes may be required for
a successful attack since a node can only make one connection. The fix applies a 16 MiB limit to messages from nodes
lower in the hierarchy.
Security Enhancements
* Apply user permissions to filter expressions for `/v1/events` similarly to `/v1/objects`
[9 lines not shown]
resterm: Update to 1.2.0
New
Read OS environment variables through normal Resterm variables
Fixed
Runtime values written by scripts, captures, workflows, or @apply are now always treated as plain data. A runtime value beginning with env: will no longer unexpectedly read an OS environment variable.
Captured response data can no longer choose which OS environment variable a later request reads.
Missing environment references remain undefined and correctly shadow lower precedence values.
Empty references such as env: now produce a clear error in request and environment files.
Environment references now behave consistently in ordinary requests, workflows, generated OpenAPI documents, scripts, and templates.
Secret values created during compare runs are now carried with their individual result and redacted from compare history.
Secret collection and sensitive header masking are now consistent across results, explain output, normal history, compare history, and the UI.
croc: Update to 11.2.1
What's Changed
feat: remember best relay by @schollz in #1262
fix: public relay by @schollz in #1263
feat: implement multiple relays Fixes #1040 by @schollz in #1260
feat: web send+receive text Fixes #1256 by @schollz in #1257
fix: disableclipboard Fixes #1258 by @schollz in #1259
adguardhome: updated to 0.107.79
0.107.79
Security
Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.6.
AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC.
This is GHSA-w6v6-f44j-3rj2. We thank @ATinyShoe for reporting this security issue.
Added
Bootstrap servers configuration now supports comments.
New property "language" in POST /control/install/check_config and POST /control/install/configure HTTP APIs.
The user is able to remove the static lease's hostname via the HTTP API.
[14 lines not shown]
grpc: updated to 1.83.0
1.83.0
Core
[Security] Default to Post-Quantum Cryptography in TLS key exchange.
[authz] don't pass RBAC policy by value when constructing authorization engine.
C#
Migrate CSharp Grpc.Tools to new DotNet Version.
[C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28.
Python
[Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x.
[Python] Add abort_with_status to the aio ServicerContext ABC.
[Python] Update lower bound for protobuf from 6.33.5 to 7.35.1.
[4 lines not shown]
py-modelsearch: updated to 1.3.2
1.3.2
Fix SQLite MatchExpression for Django >=6.1
Disable indexing signals during fixture loading
Resolve IndexEntry table dynamically in enable_trigram
Add tests for filtering on django-treebeard tree operations
py-astroid: updated to 4.3.1
4.3.1
Fix inference of the attributes of a namedtuple created with
rename=True. The renamed fields were applied to _fields and to the
class body, but the instance kept the field names as written, so an instance
of namedtuple("Tuple", "abc def", rename=True) was inferred as having a
def attribute instead of _1, and duplicate field names collapsed into
a single attribute instead of being renamed.
qt6: updated to 6.11.2
Qt 6.11.2 is now available for download. As a patch release, Qt 6.11.2 doesn’t
introduce new features, but it delivers around 400 bug fixes, security
improvements, and quality enhancements on top of Qt 6.11.1. For a full overview
of the most notable changes, take a look at the Qt 6.11.2 release notes.
news/brochure: import package
Keyboard-driven, distraction-free terminal RSS reader.
Features
- RSS & Atom — both feed formats supported out of the box
- 24 themes — 17 dark and 7 light built-in colour themes, plus custom TOML
themes with live preview
- Zen mode — distraction-free full-screen reading view that hides all chrome,
configurable content width
- Inline images — PNG, JPEG, and SVG images rendered directly in article
content
- Categories — organise feeds into collapsible groups (state remembered across
restarts)
- Saved articles — star any article and group saves by source
- OPML import/export — bring your existing subscriptions in, or take them out
- Readability fetch — pulls full article body when the feed only provides
a summary
- Fetch policy — choose when brochure refreshes: on start, every hour, every
[6 lines not shown]
devel/ldis - Update the package to version 20260818
+ set SPDX values properly
+ attempt to fix MAKE_JOBS_SAFE issue by adding .WAIT directive appropriately
+ expand a comment about paresing the lua 5.5 file header to be a tad less cryptic
pkgsrc changes:
+ just define the version number in one place, for later ease of maintenance
misc/sesh: Update to 2.28.0
Picker TUI gains preview pane, custom icons, index jumping and session
aliases.
Changes since 2.27.0:
- fix: remove placeholder debug log statements from main()
- feat: enrich tmux session names with GitHub issue titles
- fix: create wildcard windows when connecting from outside tmux
- Fix wildcard matching for relative connect paths
- fix(shell): run preview_command through the shell so operators like &&
work
- Show window names in the picker
- Session aliases with optional auto-connect
- Add an opt-in preview pane to the picker TUI
- fix(picker): cap the fuzzy length penalty so long names can rank first
- Picker TUI: #{1-9} index jump and a --query prefill flag
- Support custom icons for configured sessions and wildcards in the picker
py-tmuxp: update to 1.74.0
User-visible changes since 1.67.0:
1.74.0 tmuxp debug-info reports the full tmux version, keeping the
point-release letter (3.7a) it used to normalize away.
1.73.0 Workspaces can select a third-party builder with the
workspace_builder key; new workspace_builder_options with
pane_readiness: auto|always|never. The new default, auto,
waits for the shell prompt only under zsh -- previously it
waited everywhere.
1.72.0 tmux 3.7 features (floating panes, new options, format
variables and command flags) reachable from the Python API
and tmuxp shell. YAML workspace format unchanged.
1.71.0 tmux 3.7 supported; no change for older tmux.
1.70.1 Fix: the pytest plugin failed to import under pytest 9.1,
breaking test collection for users of tmuxp's fixtures.
1.70.0 Fix: session and window listing could silently return empty
results under a non-UTF-8 locale.
[3 lines not shown]
py-libtmux: Update to 0.61.0
0.61.0 (2026-07-04) -- hardening for the tmux 3.7 patch line.
- Pane.break_pane() no longer names the broken-out window "libtmux" on
tmux 3.7a/3.7b when no window_name is given; tmux's own default
(usually the running command) is kept.
- New libtmux.common.get_version_str(), returning the raw tmux version
string with the point-release suffix ("3.7a") that get_version()
strips for numeric comparison.
- The test suite now passes against tmux 3.7a and 3.7b. A window-name
test had assumed the ":"/"." rejection introduced in 3.7, which tmux
reverted in 3.7a.
0.60.0 (2026-06-28) -- completes tmux 3.7 feature parity. Every 3.7-only
surface is version-gated, so tmux 3.2a-3.6 keep working unchanged.
- Floating panes via Window.new_pane() and Pane.new_pane(): a pane that
sits above the tiled layout like a popup but behaves like a real pane.
[17 lines not shown]
