go: update to 1.26.7 and 1.25.4
These minor releases include a fix to address a breakage affecting unencrypted
HTTP/2 (h2c) connections caused by a security patch included in last week’s
release. See go.dev/issue/80876 for details.
ed: Update to 1.22.6
2026-08-20 Antonio Diaz Diaz <antonio at gnu.org>
* Version 1.22.6 released.
* Pacify gcc's static analyzer. (Reported by Mikel Olasagasti Uranga).
main.c: (show_help): Print "*See also* regex(7)" for man page.
(print_escaped): Don't escape backslashes.
* ed.texi: Document that 'e' and 'E' delete the cut buffer.
(Reported by Tim Chase).
Document the use of REs inside the command-list of a global command.
(Reported by Artyom Bologov).
www/grafana-prometheus-datasource: import grafana-prometheus-datasource-13.1.7
Grafana no longer bundles this plugin since 3.2.0 and the upstream
plugin catalog only distributes Darwin, Linux and Windows binaries,
so we need a pkgsrc package for it.
mimir: update to 3.2
3.2:
- Remote execution on by default; upgrade all queriers to 3.1 first.
- Removed: -query-frontend.enable-multiple-node-remote-execution-
requests, MQE projection-pushdown and prune-toggles flags.
3.1:
- TSDB blocks must use index v2; no index-headers built from v1.
- Removed: -target=flusher (use /ingester/flush), ring heartbeat
disabling, -querier.response-streaming-enabled.
- Per-step stats unsupported under MQE.
3.0 (major; plan the upgrade):
- Query-scheduler is REQUIRED; embedded one gone, so -querier.frontend-
address, -querier.max-outstanding-requests-per-tenant and
-query-frontend.querier-forget-delay are removed.
- MQE also default in query-frontend; queriers no longer serve the
Prometheus HTTP API (go via query-frontend).
- Removed: read-write deploy mode, Redis cache, memcached addresses-
provider, instant query splitting, -query-frontend.downstream-url,
[8 lines not shown]
resterm: Update to 1.2.2
New
Warnings for unknown and misplaced directives
Fixed
Ignored or unknown directives no longer close an active workflow or interrupt an open workflow branch.
Invalid directives cannot accidentally create or modify a request while the parser determines whether they apply.
devel/task: update to 3.53.1
Features
* Remote Taskfiles are now generally available! This has been an
experimental feature for 3 years, but is now enabled by default. Massive
thanks to all those that contributed and gave feedback (too many to list
here). We've also given the Remote Taskfiles documentation a bit of a
polish.
* Added a per-command timeout that terminates a command once it exceeds the
given duration (Go duration syntax). It covers shell commands, task
calls, deferred commands, deps and the if condition, obeys ignore_error,
and reports exit code 124. Callers that join a run: once or when_changed
task already running now honor their own timeout, and inherit that task's
failure instead of being told it succeeded.
* Considerably improve performance of fingerprinting on large repositories
(monorepos). Fingerprinting is up to 86% faster and make up to 70% fewer
memory allocations on the more advanced scenarios. Benchmarks were added
as well. We're basically skipping work when not needed.
[46 lines not shown]
grafana: update to 13.2.0
CVE-2026-17183
An authenticated organization user who can create or edit alert rules
in a folder can query a datasource for which they do not have
datasources:query permission.
grafana: update to 13.1.3
pkgsrc change:
This update disables support for sqlite as storage backend on most
platforms because grafana has switched to a sqlite driver that is
very difficult to support in a generic manner in pkgsrc.
(It needs transpiled code shipped by the upstream for every
MACHINE_PLATFORM.)
On such a platform you can use PostgreSQL instead.
Other major breaking changes since 11.x:
Angular plugin support is fully removed
Data source UID enforcement
Upgrading rewrites the whole annotation table; budget 2–3x its size
React 19. Update all plugins before upgrading, or they may break
Folders and dashboards migrate off legacy SQL tables on startup
grafana-cli and grafana-server are removed (use grafana cli / grafana server)
Image Renderer no longer supported as a plugin (run it as a separate service)
Dashboards migrate to schema v2 automatically when opened
rumdl: update to 0.2.58.
0.2.58
Added
wasm: load extends chains from embedder-supplied config files (e7c7d8f)
0.2.57
Fixed
MD013: let a sentence open with a number under require-sentence-capital (5060333)
lsp: keep a CRLF document's line endings through fixes and code actions (c88a7da)
py-json-logger: updated to 4.2.0
4.2.0
Changed
Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict.
Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735).
Fixed
$ style formats now support unbraced $name fields, not just ${name}
py-flask-security: updated to 5.8.2
5.8.2
Fixes
- (:pr:`1265`) Fix for GHSA-f66q-9rf6-8795 - WebAuthn reauthentication freshness bypass. (tonghuaroot)
- (:issue:`1263`) :py:data:`SECURITY_CACHE_CONTROL` directives were added to every
application response instead of just responses from Flask-Security endpoints
as documented. (Ceirced)
- (:issue:`1212`) Newly introduced :py:meth:`.UserMixin.is_locked` logic is inverted.
- (:issue:`1244`) Fix login form remember me checkbox.
Backwards Compatibility Concerns
- The fix for the inverted `is_locked` logic will require any application using it
to invert their logic.
