tailscale: update to 1.104.7
Go is updated to Go 1.27.4, to explicitly resolve an issue in TLS
ClientHello where some middleboxes break connections to the Tailscale
control plane.
net/coturn: Update to 4.19.0
Upstream NEWS content, less bugfixes and minor improvements:
Release 4.19.0
Changelist:
- Update integrity key generation to use default SHA type (Pavel Punsky <eakraly at users.noreply.github.com>)
chromium: update to 157.0.8103.78
* 157.0.8103.78
This update includes 83 security fixes. Please see the Chrome Security Page for more information.
[N/A][568699166] Critical CVE-2026-126885: Use after free in ServiceWorker. Reported by Xinyang Ge on 2026-10-02
[N/A][575524700] Critical CVE-2026-126895: Use after free in CSS. Reported by Xinyang Ge on 2026-10-19
[N/A][576736463] Critical CVE-2026-126879: Use after free in Layout. Reported by Xinyang Ge on 2026-10-22
[N/A][580857377] Critical CVE-2026-126846: Use after free in Skia. Reported by Google on 2026-11-02
[TBD][580921803] Critical CVE-2026-126911: Use after free in Accessibility. Reported by Andrew Boni on 2026-11-02
[$4,000][567827593] High CVE-2026-126864: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-30
[N/A][560620348] High CVE-2026-126889: Off-by-one error in V8. Reported by Google on 2026-09-12
[N/A][563340397] High CVE-2026-126859: Link following in FileSystem. Reported by Google on 2026-09-18
[N/A][567611696] High CVE-2026-126886: Use after free in Frames. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][567611698] High CVE-2026-126887: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][568906910] High CVE-2026-126870: Uninitialized resource in ANGLE. Reported by Google on 2026-10-02
[N/A][569286603] High CVE-2026-126912: Buffer overflow in Skia. Reported by Xinyang Ge on 2026-10-05
[N/A][569674220] High CVE-2026-126919: Use after free in BrowserTag. Reported by Xinyang Ge on 2026-10-05
[TBD][572312779] High CVE-2026-126878: Information leak in Core. Reported by Anthropic and Ada Logics on 2026-10-10
[69 lines not shown]
py-test-asyncio: updated to 1.5.0
1.5.0
Added
A fixture-scope value for asyncio_default_fixture_loop_scope. With it, an asynchronous fixture without loop_scope uses its scope as its loop scope. This is the behavior of an unset option in pytest-asyncio 1.x.
Fixed
Invalid arguments to the asyncio marker, including an invalid loop_scope, are reported with a message that names the test instead of a traceback.
cargo-nextest: updated to 0.9.152
0.9.152
Added
cargo nextest self setup accepts a new --source install-script value. The upcoming install scripts at get.nexte.st run cargo nextest self setup --source install-script after installing nextest. As with other sources, setup is currently a no-op.
Changed
Nextest now rejects malformed or untrusted inputs in a few more places:
When reusing builds, archive extraction now fails if the archive contains entries other than regular files and directories, such as symlinks, hard links, devices, or FIFOs. Archives created by cargo nextest archive never contain such entries.
This is not classified as a security issue because build archives are not (and cannot be, because they contain arbitrary executable code) a trust boundary.
When reusing builds for a custom target, nextest now rejects target triples that contain path separators or are absolute paths.
The common situation where this can happen is with a build archive. Like in the above case, this is not classified as a security issue.
[10 lines not shown]
textproc/groff-pdfmark: import groff-pdfmark-26.10
Packaged for wip by Louis Guillaume.
The groff-pdfmark package provides a suite of GNU roff macro
packages together with the pdfroff Bourne shell driver script. It
facilitates creation of PDF files that contain active hyperlinks,
bookmarks, document metadata and other PDF features, using GNU
troff as the primary typesetting engine.
Originally distributed as a contributed component of GNU groff, the
macros and pdfroff were removed from the main groff distribution
starting with version 1.24 and are now maintained separately.
This package installs the macros into share/groff/site-tmac so that
they are automatically found by groff without modifying the main
groff package.
devel/stirmake: import stirmake-0.4.5
Packaged in wip by Juha-Matti Tilli
Stirmake is a fast build tool intended to allow easily developing
correct build systems with one global directed acyclic graph for
projects spanning multiple directories and potentially including Git
submodules. It is fully programmable in the embedded Amyplan programming
language. The intention is that with Stirmake, one never has to type the
equivalent of "make clean" to fix a build.
devel/emmylua-ls: import emmylua-ls-0.25.1
Packaged by Sunil Nimmagadda for wip.
A high-performance Lua language server, code formatter, linter, and
documentation generator - built with Rust.
pmw: update to 5.34.
Set TEST_TARGET.
Version 5.34 21-September-2026
------------------------------
1. Added error checks to fclose() and fprintf() except when writing to stderr.
2. Implement [hairpins underlay] and /bu on individual hairpins.
3. For hairpins that do not have an explicit opening width setting (the /w
option), if the length is sufficiently short, reduce the width to be no more
than 2/9 of the length, but with a minimum of 2 points.
4. Merged more of Jan Nemecek's additional figured bass macros into the
standard macros.
5. If the second or a subsequent movement did not have any staves, the
[69 lines not shown]
