openexr: update to 3.5.3.
## Version 3.5.3 (October 30, 2026)
Patch release that addresses 15 security vulnerabilities, 10 with
pending CVE IDs, primarily heap buffer overflows and out-of-bounds
writes triggered by malformed or malicious EXR files — several capable
of remote code execution. See the Security section below for details.
This release includes no new features or changes in behavior other
than improved error detection and rejection of invalid input, except
for a fix for a regression introduced in v3.4.14 in reading deep
images on big-endian hosts, due to a byte-order bug that returned an
incorrect deep sample count table. Little-endian hosts are unaffected.
As part of this effort, the full test suite now passes cleanly under
the address, undefined-behavior, and thread sanitizers.
Also in this release:
[11 lines not shown]
grafana-prometheus-datasource: update to 13.2.5.
(new brotli)
Bump backend dependency (#400)
Disable publish workflows (#354)
Let a host insert text at the Prometheus code editor's cursor
through the internal unstable_queryEditorInsertionV1 prop. (#390)
fribidi: update to 1.0.18.
Overview of changes between 1.0.17 and 1.0.18
=============================================
* Security and robustness fixes found by an automated scan (Anthropic's
OSS Scanner):
- fribidi_remove_bidi_marks(): fixed an out-of-bounds write before the
caller's map when the position maps returned by one call are passed to
a second call. The maps it returns are now correct, and removed
characters are -1.
- Fixed unchecked memory allocations in fribidi_reorder_line(),
fribidi_log2vis() and the bracket pairing code, which could crash
when memory ran out instead of returning failure.
- Fixed an out-of-bounds read in the CapRTL decoder on platforms where
plain char is unsigned (e.g. aarch64, arm, ppc64le, s390x).
- Fixed quadratic running time on paragraphs made of many back-to-back
isolates, and on deeply nested isolates containing brackets (N0).
* Fixed a stack buffer overflow in the CapRTL/UTF-8 output of fribidi and
[14 lines not shown]
py-nanobind: fix (at least on) on NetBSD
NetBSD's x86_64 runtime linker does not support the TLSDESC
thread-local storage ABI (R_X86_64_TLSDESC, relocation type 36).
Limit the check to Linux systems.
Submitted upstream.
Fixes py-pikepdf (and probably other py-nanobind dependencies).
Bump PKGREVISION.
databases/postgresql-postgis2: Update to 3.7.0
Packaging changes:
- Accomodate upstream's removal of address standardizer.
- Accomodate upstream's removal of TIGER geocoder.
Upstream NEWS:
PostGIS 3.7.0
2026/10/29
This version requires GEOS 3.10+, PostgreSQL 14-19beta3, Proj 6.1+, and libgmp.
To take advantage of all postgis extension features, GEOS 3.15+ is needed.
To take advantage of all postgis_sfcgal extension features SFCGAL 2.3+ is needed.
Python 3 is a new requirement to build the documentation.
Visual examples in the docs are off by default. To build docs with them,
configure with `--with-visual-examples` and make sure you have a running
[61 lines not shown]
patchelf: updated to 0.19.3
0.19.3
Bug fixes
Fix overlapping load segment mappings when growing an executable's interpreter
and then rewriting its RPATH. Preserve writable coverage of .dynamic so the
dynamic loader can update DT_DEBUG, fixing crashes in musl bootstrap GCC and
GNAT
Reuse the header load segment for further growth and reserve enough file and
virtual address space after strip removes padding, preventing later rewrites
from overlapping mappings or corrupting section contents
Keep the program header table covered by a load segment when repeated
executable rewrites split note segments and grow the table. This fixes invalid
PHDR coverage on x86_64 and an assertion failure on AArch64, including when
patching Grpc.Tools binaries
Update DT_VERDEF when .gnu.version_d is relocated, preventing the dynamic
loader from following stale symbol version definitions and crashing before
[3 lines not shown]
lerc: updated to 4.3.0
4.3.0
* Added more security fixes. Most of them found by AI. Added or fixed byte counting for the decoder to prevent a possible buffer overrun.
zstd: stop installing zstdgrep
The script requires GNU grep, and this leads to a bootstrap cycle
on systems that do not have GNU grep in the base system.
As proposed on tech-pkg.
zstdgrep will be packaged separately.
Bump PKGREVISION.
