security/ruby-net-sftp: update to 4.1.1
4.0.1 (2026-10-22)
* Allow net-ssh 8 [#181]
4.0.2 (2026-10-25)
* Security: Recursive downloads refuse to follow an existing local symlink
at a server-named path instead of writing through it. The local path
passed by the caller may still be a symlink. Suggested in #162 by
srosenhamer [#186]
* Security: Recursive downloads reject file names from the server that are
not a single path component (such as `../x` or `a/b`) instead of writing
outside the target directory. Reported in #162 by srosenhamer [#185,
#162]
* Net::SFTP now works with frozen string literals enabled: `File` reads and
`Dir#glob` no longer mutate frozen strings, and `glob` no longer modifies
[114 lines not shown]
security/ruby-net-scp: update to 4.2.1
4.1.1 (2026-10-22)
* Allow net-ssh 8
* Fix frozen string literal compatibility [npezza93, mfazekas]
- Use mutable string for scp command construction
- Use mutable string for error_string initialization
* Add Ruby 3.4 and ruby-head to CI matrix
* Add Ruby 4.0+ compatibility (logger, rdoc gems)
* Drop EOL Ruby 2.3-2.5 from CI
4.1.2 (2026-10-25)
* Security: Downloads no longer apply setuid, setgid or sticky bits sent by
the server, check that a server-chosen local name matches the requested
remote basename (as OpenSSH does since CVE-2019-6111), and refuse to
follow an existing local symlink at a server-named path instead of writing
through it. The local path passed by the caller may still be a symlink.
[80 lines not shown]
security/ruby-metasploit-payloads: update to 2.0.258
2.0.254 (2026-10-07)
* Merge pull request #820 from adfoster-r7/run-ci-job;
Update Python test runner
2.0.255 (2026-10-08)
* Merge pull request #816 from MRX-72/fix/751-stat-st-dev-overflow;
Python Meterpreter: mask 64-bit st_dev in stat to fit the wire format
* Merge pull request #817 from
sfewer-r7/bugfix-python-meterpreter-freebsd-ps
2.0.256 (2026-10-13)
* Merge pull request #819 from pauljccode/fix/php-udp-read-flags;
Consume UDP datagrams when reading channels
[10 lines not shown]
Update botan3 to version 3.14.0
CVE fixes from changelog since version 3.9.0:
CVE-2026-118770 Fix a use after
free in the TLS asio integration which depending on application
usage patterns may allow leaking heap memory to the peer.
CVE-2026-118771 Fix a bug in TLS 1.3 which could allow an
unauthenticated peer to pin unlimited amounts of memory in the
handshake by sending many dummy ChangeCipherSpec messages.
CVE-2026-118766 Fix a blind SSRF during OCSP request processing.
A malicious OCSP responder or network attacker could cause the
application to perform a blind GET to an internal service.
CVE-2026-118765 Fix a bug in AutoSeeded_RNG, affecting only platforms
without a system RNG, where an API sequence of calling first clear,
followed by randomize writing to an empty buffer, resulted in the RNG
[22 lines not shown]
arti: update to 2.8.0.
# Arti 2.8.0 — 3 November 2026
Arti 2.8.0 continues our steady progress on relay and directory authority development,
including on computing the consensus from votes,
bootstrapping router descriptors and microdescriptors,
as well as relay bandwidth rate-limiting,
descriptor encoding, and the relay DNS cache implementation.
Additionally, we have made a number of cleanups and
clarifications to the Tor specification.
This release has a number of security fixes; please see below.
As usual, there are also many under-the-hood improvements and bug fixes,
which are documented below.
### Security fixes
[17 lines not shown]
textproc/ruby-json_schemer: add version 2.5.0
ruby-json_schemer is required by ruby-mcp package.
My apologies for forgetting to commit ths package first.
JSONSchemer
JSON Schema validator. Supports drafts 4, 6, 7, 2019-09, 2020-12, OpenAPI
3.0, and OpenAPI 3.1.
textproc/ruby-hana: add version 1.3.7
ruby-hana is required by forthcoming ruby-json_schemer package which
is required by ruby-mcp.
hana
Implementation of JSON Patch(rfc6902) and JSON Pointer(rfc6901) RFC.
time/ruby-strptime: add version 0.2.5
ruby-strptime is required by ruby-rasn1 package. My apologies for
forgetting to commit ths package first.
Strptime
A fast strptime/strftime engine which uses VM.
jj: update to 0.47.1.
0.47.1
This release fixes a dependency error that broke Linux builds in the 0.47.0
release.
0.47.0
Templates now have a top-level revset(revset: Stringify) -> List<Commit>
function for evaluating revsets during templating.
In colocated workspaces, jj describe -r@, jj restore --into=@, etc. no
longer reset the staging area, just as snapshotting doesn't. jj new @- still
resets it.
py-textual: update to 8.2.8.
8.2.8
Fixes for extended key processing, and a crash bug for clicking
the screen padding area.
8.2.7
This release adds additional support for the Kitty key protocol.
Which enables some additional keys on some terminals. Additionally,
Textual will report modifier keys as separate key events.
Additionally there are a few more shortcuts to the Text Area.
This release sponsored by Mistral AI. See release notes for detail.
8.2.6
[12 lines not shown]
py-authlib: updated to 1.9.4
1.9.4 — 2026-11-04
Security
IDJAGGrant stores the verified claims of the ID-JAG in request.id_jag_claims. authenticate_user can use them to resolve the user with the iss and sub claims, and tenant for a multi-tenant IdP. The documentation used to resolve the user with sub alone. An IdP, or a tenant of an IdP, could then get access tokens for the users of another one. Update authenticate_user if your server trusts several IdPs or a multi-tenant IdP. GHSA-9qr6-8289-9j56
