py-setuptools_scm: updated to 10.2.2
10.2.2 (2026-09-01)
Miscellaneous
- The `pkginfo` workdir discovery entry point moved to vcs-versioning; `vcs-versioning>=2.3.2` is now required (the workspace pin carries a `.dev0` suffix so in-tree builds resolve, matching the existing convention). `setuptools_scm._integration._discover.discover_pkginfo` remains as a re-export.
- Stop shipping a per-package `uv.lock` in the sdist. It could not be generated correctly whenever `setuptools-scm` required an unreleased `vcs-versioning`, which broke the release proposal workflow.
py-jupyterlab: updated to 4.6.3
JupyterLab 4.6 includes a number of new features, bug fixes, and enhancements.
This release is compatible with extensions supporting JupyterLab 4.0.
Extension authors are encouraged to consult the [Extension Migration Guide](https://jupyterlab.readthedocs.io/en/stable/extension/extension_migration.html#jupyterlab-4-5-to-4-6) which lists deprecations and changes to the public API.
py-jupyter_server: updated to 2.21.0
2.21.0
Enhancements made
- Show connectable URL for password authentication
- Allow clients to supply a `kernel_id` on kernel/session creation
Bugs fixed
- Fix referer token leak in server logs when the request causes a 500
- Self-remove event subscriber on `WebSocketClosedError`
- Use hostname in wildcard browser redirect files
- Fix `resolvePath` handling for home-relative paths
py-ipywidgets: updated to 8.1.9
8.1.9
Remove JupyterCon 2025 announcement banner
Fix CI/build
Fix Output capture from background threads
Add Juyter-wide banner to ipywidgets docs
Drop support for JupyterLab 3 and update build to use Jupyter Builder
Update Python and Node support
Upgrade to Typescript 6
Update issue lock actions
Update the documentation to use JupyterLite 0.8.x
Update pytest
Have get_model retry multiple times until we get the model from the backend
py-jupyter-builder: added version 1.2.2
Build tools for JupyterLab extensions - extracted from the core JupyterLab
codebase to be maintained and used independently.
py-copier: added version 9.18.1
A library and CLI app for rendering project templates.
* Works with local paths and Git URLs.
* Your project can include any file and Copier can dynamically replace values
in any kind of text file.
* It generates a beautiful output and takes care of not overwriting existing
files unless instructed to do so.
catch2: updated to 3.16.0
3.16.0
Fixes
* Multiple fixes in `catch_discover_tests`:
* Fixed `<target>_TESTS` variable accumulating JSON fragments alongside test names.
* This was introduced during the refactoring in last release.
* Fixed `<target>_TESTS` variable from `catch_discover_tests` not escaping test names to be properly parsed by CMake.
* This means that e.g. test names with semicolons will not be split into multiple partial test names.
* This bug has existed since the first version of the script.
* Fixed `TEST_PREFIX`/`TEST_SUFFIX` args having leading/trailing whitespace stripped.
* Added workaround for Clang 20-21 compile error with `TEMPLATE_PRODUCT_TEST_CASE`
Improvements
* Verbosity option is now handled per reporter.
* The standalone `--verbosity` flag is propagated to all reporters as default, just like `--colour-mode`.
* The JSON reporter considers verbosity when listing tests.
* Another set of performance improvements for `catch_discover_tests` performance
[10 lines not shown]
postgresql-timescaledb: updated to 2.29.2
2.29.2 (2026-08-18)
This release contains bug fixes since the 2.29.1 release. We recommend that you upgrade at the next available opportunity.
Bugfixes
* Fix user-defined functions named time_bucket causing SQLSTATE XX000
* Fix time_bucket_gapfill() with window aggregates over constants
* Repair mismatched dimensional CHECK constraints
* Fix compressed SkipScan dropping uncompressed rows when sort keys do not match distinct keys
* Do not attach SkipScan to mismatched IndexScan paths under MergeAppend
* Fix wrong results for IS NULL predicates with min/max sparse-index pushdown
2.29.1 (2026-08-04)
This release contains performance improvements and bug fixes since the 2.29.0 release and fixes for security vulnerabilities. You can check the security advisory for more information on the vulnerability and the platforms that are affected. We recommend that you upgrade at the next available opportunity.
[10 lines not shown]
libde265: updated to 1.1.2
v1.1.2 is a security and bugfix release. It is ABI- and API-compatible with v1.1.1 and is a drop-in replacement. Two enum values were added: DE265_ERROR_INVALID_ARGUMENT and DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING.
Security fixes
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free in multi-threaded (WPP) decoding. A crafted stream whose slice segments repeat or rewind their slice_segment_address within a picture re-ran CTB rows that were already marked finished, so the CABAC context handoff between rows was no longer ordered and the shared context table was released twice. Slice segments that do not follow the previous one in tile-scan order are now rejected with the new warning DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row progress is reset for each slice segment. (medium)
CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after de265_reset(): the pointer to the previous slice header was left dangling when the DPB was cleared, and a dependent slice pushed after the reset copied from freed memory. (medium)
Thanks to @rohitmahesh1, @l1ve709, and @sonicnew for reporting these issues.
Hardening
de265_push_NAL() rejects NAL units shorter than the two-byte NAL unit header (including negative lengths) with the new DE265_ERROR_INVALID_ARGUMENT instead of calling memcpy() with a NULL destination and then aborting the decode
SEI parsing: the overflow guard on the accumulated payload_size compared the wrong variable and could never trigger, so a crafted size could wrap around silently (thanks @94xhn)
The per-CTB progress counters and the image integrity flag are atomic with acquire/release ordering; ThreadSanitizer reported data races on them with several worker threads
Bug fixes
[6 lines not shown]
SDL3: updated to 3.4.16
3.4.16
This is a stable bugfix release, with the following changes:
Fixed loading BMP files with < 8 bits per pixel and odd widths
Fixed the depth format sample count support check in the GPU API
Fixed the SDL_QueryGPUFence() return value on Apple platforms
Fixed textures being rendered with half opacity on PS2
Fixed windows staying on screen after SDL_Quit() on macOS
Removed WM_TAKE_FOCUS from WM_PROTOCOLS for X11 windows
Added SDL_HINT_ANDROID_AAUDIO_INPUT_PRESET instead of hard-coding the camcorder preset on Android
Report SDL_PenInputFlags in SDL_PenProximityEvent
Fixed vertical high-resolution mouse wheel scaling on evdev
Fixed joystick stick calibration on Nintendo Joy-Con controllers
libclc: added version 21.1.8
libclc is an open source implementation of the library requirements of
the OpenCL C programming language, as specified by the OpenCL 1.1
Specification. The following sections of the specification impose
library requirements:
6.1: Supported Data Types
6.2.3: Explicit Conversions
6.2.4.2: Reinterpreting Types Using as_type() and as_typen()
6.9: Preprocessor Directives and Macros
6.11: Built-in Functions
9.3: Double Precision Floating-Point
9.4: 64-bit Atomics
9.5: Writing to 3D image memory objects
9.6: Half Precision Floating-Point
libclc is intended to be used with the Clang compiler's OpenCL frontend.
[4 lines not shown]
