py-more-itertools: update to 11.2.1.
11.2.1
This release includes #1331, a packaging-related change. No module code changed.
11.2.0
New random_ordered_range function
New subfactorial function
Python 3.10 is no longer officially supported
Python 3.15 is now officially supported
py-markdown: update to 3.11.1.
Update serializer to be non-recursive (#1644).
Improve ancestor handling in the inline Treeprocessor (#1646).
Keep a raw HTML comment inside an inline HTML element that closes in the
same paragraph, instead of splitting the paragraph around it (#1643).
Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).
Complete rework of emphasis handling to improve nested emphasis handling better (#1632).
py-fonttools: update to 4.67.0.
4.67.0 (released 2026-10-14)
----------------------------
- [varLib] Support decreasing design-space axis mappings, via a new keyword-only
``allow_decreasing`` argument to ``models.normalizeValue`` (#3970, #4217, #4243).
- [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes
on an ``<axis-subset>`` are taken from the parent axis, as the spec says (#4205).
- [designspaceLib] Fix ``DesignSpaceDocument.normalize()`` for mapped axes: axis
bounds and rule conditions are now normalized from their original values (#4218).
- [designspaceLib] ``splitInterpolable`` and ``splitVariableFonts`` now warn when a
source or instance is dropped because it lies outside the document's own axes,
instead of silently discarding it (#4244).
- [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
- [varLib.instancer] Apply VVAR vertical-origin deltas to ``VORG``, and use OpenType
rounding for instanced advances and vertical origins (#4221).
- [varLib.instancer] Keep a universal FeatureVariations record when pinning removes
its last condition but other axes remain (#4247).
[83 lines not shown]
py-filelock: update to 4.2.2.
4.2.2
fix(api): keep the hold count when the lock path cannot be resolved by @spicysharkco in #856
4.2.1
chore(type): type fallback class swap for ty by @gaborbernat in #837
perf(test): skip futile per-test GC on GraalPy by @gaborbernat in #847
fix(test): collect every 20th test on GraalPy by @gaborbernat in #848
ci(graalpy): run GraalPy weekly, not per change by @gaborbernat in #849
ci(graalpy): set the OSR option where tox sees it by @gaborbernat in #850
fix(test): poll reclaims instead of timing them by @gaborbernat in #851
test(stress): verify exclusion, cut tracer load by @gaborbernat in #853
fix(api): keep holds consistent when interrupted by @gaborbernat in #840
fix(api): keep a relative lock path across chdir by @gaborbernat in #841
fix(async-rw): end only the closing wrapper's holds by @gaborbernat in #832
test(async): probe only the lock path for lstat by @gaborbernat in #852
[10 lines not shown]
misc/weatherman: import package
A weather app written entirely in Rust, desktop GUI and terminal UI.
Weather Man ships two front-ends from a single Rust workspace, backed by a
shared, framework-free core that doubles as a drop-in weather API provider
library.
misc/weatherman: import package
A weather app written entirely in Rust, desktop GUI and terminal UI.
Weather Man ships two front-ends from a single Rust workspace, backed by a
shared, framework-free core that doubles as a drop-in weather API provider
library.
polkit: update to 128.
All pkgsrc patches were merged upstream.
## polkit 128
### Highlights:
- fix two authentication-helper input vulnerabilities (CVE-2026-4897 and CVE-2026-85498) [7e122c8, eea1729]
- sanitize values written to syslog from authorization requests [9dca831]
- fix a use-after-free in the authentication agent's session handling [6f3cec7]
- revalidate the administrator behind cached `auth_admin_keep` authorizations [9a49bd6]
- fix agent cleanup races, resource leaks, and several error-path leaks [148422b, 4e67dde, 8ceeed8, ac4d9ac, dae50d6]
- support systemd watchdog notifications and locked system accounts with systemd 257+ [b3492d5, 13276c1]
- improve FreeBSD and Solaris portability, including tests without Linux user namespaces [c3aefa7, 3111583, 72c2878, 0453c24]
- add Kazakh, Serbian, and Serbian Latin translations; update Slovenian [6fe59cd, 8a797e5, 0d87075]
- add a polkit-agent-helper manual page and expand contributor documentation [5195b3a, 3ee2927, 935f9cd, 46df56e, d3ba690]
- remove the systemd service memory limits introduced in polkit 127 [44365bb]
jjui: update to 0.10.12.
Mostly a bugfix release, with fixes for the bookmark pane and view
layering, live theme reloading, and groundwork for context-aware
key bindings.
hiredis: update to 1.5.0.
Breaking Changes
Add optional TLS peer certificate name verification @hristostaykov-del (#1355)
Bug Fixes
Fix use after free in redisMacOSAttach on CF failure @Hashim1999164 (#1368)
Drain Linux socket error queue after nonblocking TCP connect @swills (#1375)
Guard Windows wincert check when cacert_filename is NULL @Hashim1999164 (#1370)
Add a maxdepth redisReader configuration member. @michael-grunder (#1335)
Protect against overflow of map elements @michael-grunder (#1323)
Maintenance
Fix Release Drafter release naming and draft isolation @uglide (#1385)
Remove spellcheck CI and modernise Release Drafter config @uglide (#1384)
[10 lines not shown]
gopls: update to 0.24.0.
This release includes a number of improvements to support for Go
assembly files, including Hover, DocumentHighlight, References,
and “zero configuration” (automatic selection of appropriate build
tags).
chromaprint: update to 1.6.2.
Switch to ffmpeg9.
Version 1.6.2 -- October 15, 2026
=================================
- Fixed a crash in fpcalc when the channel layout changes mid-stream
(e.g. AC-3 files switching between 5.1 and stereo)
- Fixed decoding of audio with more than 8 planar channels in fpcalc
- Fingerprint decoding now rejects invalid input that previously caused
undefined behaviour (shifting past 32 bits)
- The C API encoding/decoding functions now return an error for a negative
size, a NULL buffer with a nonzero size, and, when encoding, more items
than the fingerprint header can hold (previously silently truncated)
