dbus: comment out Solaris-only flag
not supported on Illumos, says meson; I don't know how to check for
that in particular, but we have Illumos bulk builds and none for Solaris,
so let's fix these.
py-acme py-certbot*: updated to 5.10.0
5.10.0
Fixed
Fixes a race condition in the webroot plugin where, if the webroot could be modified by a less privileged user while Certbot ran, the ownership and mode of an unintended file could be changed instead of those of the challenge directory Certbot had just created.
Rejects invalid ARI suggested renewal windows whose end time is not after their start time.
py-awscli: updated to 1.46.3
1.46.3
* bugfix:alias: Pass Windows external alias args to cmd.exe as literals
* bugfix:codedeploy: Tighten file permissions for the on-premises instance configuration file written by ``aws deploy install``
py-boto3: updated to 1.44.2
1.44.2
* api-change:``autoscaling``: [``botocore``] Amazon EC2 Auto Scaling now supports ASGAverageCPUUtilizationHighResolution as a predefined metric type for target tracking scaling policies.
* api-change:``backup``: [``botocore``] Adding new notification types for SNS notifications
* api-change:``cleanrooms``: [``botocore``] Adds a retry signal to protected query and protected job errors that indicates whether running the same request again might succeed, and defines error codes that identify the category of the failure.
* api-change:``cloudwatch``: [``botocore``] Adds support for saving, retrieving, listing, and deleting CloudWatch metric data query definitions.
* api-change:``cloudwatchomni``: [``botocore``] Add aggregationTemporality and monotonicity to GetContextGraph MetricMetadata
* api-change:``connect``: [``botocore``] This release adds a LastModifiedTime and LastModifiedRegion field to ListIntegrationAssociations so customers can see at what time and in which Region an IntegrationAssociation was last modified in.
* api-change:``ec2``: [``botocore``] This release adds support for multiple features, including EC2 Image Builder image recipes and container recipes in AMI usage reports, Amazon EC2 Detailed Monitoring adds opt-in metrics, and Global Accelerator and API Gateway V2 as resource exclusions for VPC Encryption Control.
* api-change:``emr-containers``: [``botocore``] This release updates range of maxInQueueDepth and maxConcurrency limit from 10000 to 1000.
* api-change:``gameliftstreams``: [``botocore``] Adds support for ApplicationStartedAt on stream sessions, a timestamp that indicates when the application launched for the stream session, returned by GetStreamSession and StartStreamSession. Also added streamingStartedAt and streamingEndedAt.
* api-change:``guardduty``: [``botocore``] Adds the ListInvestigationRecords API, which returns the step-by-step records of a completed investigation. Adds investigation scope details and an optional structured summary to GetInvestigation. Adds filter criteria and investigation type to ListInvestigations.
* api-change:``lightsail``: [``botocore``] Amazon Lightsail now offers web addresses, so you can quickly make a website or application reachable at a name like mysite.amazonlightsail.com. A web address is free while attached to a Lightsail CDN, with no domain to register and no SSL TLS certificate to create or renew.
* api-change:``mediaconnect``: [``botocore``] MediaConnect adds four features. (1) RTMP Push on Router Input and Flows (RTMP, RTMPS, eRTMP). (2) PID Remapping on Router rewrites PIDs inline without transcoding. (3) Key Frame Switching transitions router inputs on video boundaries. (4) SRT Merge Input bonds redundant SRT streams.
* api-change:``medialive``: [``botocore``] AWS Elemental MediaLive now adds a caption language setting for MediaPackage V2 output groups that signals a stream carries no closed captions.
* api-change:``mediatailor``: [``botocore``] Add post origin manifest hook, add HLS tag processor
* api-change:``mwaa``: [``botocore``] Amazon MWAA now supports Airflow environments with IAM Identity Center (IDC) integration and exposes OSS Airflow Multi-Team feature. Users can configure individual IDC-backed identities and fine-grained authorization, and define Dags on per-team basis.
[7 lines not shown]
py-botocore: updated to 1.44.2
1.44.2
* api-change:``autoscaling``: Amazon EC2 Auto Scaling now supports ASGAverageCPUUtilizationHighResolution as a predefined metric type for target tracking scaling policies.
* api-change:``backup``: Adding new notification types for SNS notifications
* api-change:``cleanrooms``: Adds a retry signal to protected query and protected job errors that indicates whether running the same request again might succeed, and defines error codes that identify the category of the failure.
* api-change:``cloudwatch``: Adds support for saving, retrieving, listing, and deleting CloudWatch metric data query definitions.
* api-change:``cloudwatchomni``: Add aggregationTemporality and monotonicity to GetContextGraph MetricMetadata
* api-change:``connect``: This release adds a LastModifiedTime and LastModifiedRegion field to ListIntegrationAssociations so customers can see at what time and in which Region an IntegrationAssociation was last modified in.
* api-change:``ec2``: This release adds support for multiple features, including EC2 Image Builder image recipes and container recipes in AMI usage reports, Amazon EC2 Detailed Monitoring adds opt-in metrics, and Global Accelerator and API Gateway V2 as resource exclusions for VPC Encryption Control.
* api-change:``emr-containers``: This release updates range of maxInQueueDepth and maxConcurrency limit from 10000 to 1000.
* api-change:``gameliftstreams``: Adds support for ApplicationStartedAt on stream sessions, a timestamp that indicates when the application launched for the stream session, returned by GetStreamSession and StartStreamSession. Also added streamingStartedAt and streamingEndedAt.
* api-change:``guardduty``: Adds the ListInvestigationRecords API, which returns the step-by-step records of a completed investigation. Adds investigation scope details and an optional structured summary to GetInvestigation. Adds filter criteria and investigation type to ListInvestigations.
* api-change:``lightsail``: Amazon Lightsail now offers web addresses, so you can quickly make a website or application reachable at a name like mysite.amazonlightsail.com. A web address is free while attached to a Lightsail CDN, with no domain to register and no SSL TLS certificate to create or renew.
* api-change:``mediaconnect``: MediaConnect adds four features. (1) RTMP Push on Router Input and Flows (RTMP, RTMPS, eRTMP). (2) PID Remapping on Router rewrites PIDs inline without transcoding. (3) Key Frame Switching transitions router inputs on video boundaries. (4) SRT Merge Input bonds redundant SRT streams.
* api-change:``medialive``: AWS Elemental MediaLive now adds a caption language setting for MediaPackage V2 output groups that signals a stream carries no closed captions.
* api-change:``mediatailor``: Add post origin manifest hook, add HLS tag processor
* api-change:``mwaa``: Amazon MWAA now supports Airflow environments with IAM Identity Center (IDC) integration and exposes OSS Airflow Multi-Team feature. Users can configure individual IDC-backed identities and fine-grained authorization, and define Dags on per-team basis.
[7 lines not shown]
py-cloudflare: updated to 5.10.0
5.10.0
This release adds the K2 streaming, Monetization, Zero Trust CWS, and Billing
Spend Policies APIs, plus Zero Trust Access user populations and MFA catalog
resources. It also removes the Magic Cloud Networking and Tenant Custom
Nameservers resources and changes several pagination and response types. Review
the breaking changes before upgrading.
py-pylsqpack: updated to 1.1.1
1.1.1
* Cap the encoder's dynamic table at 4096 bytes, whatever the decoder allows,
as lsquic and nghttp3 do. This lowers memory use per connection.
* Accept any HTTP/3 setting value in :meth:`Encoder.apply_settings`, up to
2**62 - 1. Since 1.1.0, values of 2**32 or more were refused.
1.1.0
* Add a ``max_field_section_size`` argument to :class:`Decoder`, which limits
the size of the decoded headers of a header block, counted as in
:rfc:`9114#section-4.2.2`. It defaults to 256 KiB, so header blocks which
decode to more than that are now refused. They raise
:class:`FieldSectionTooLarge`, a subclass of :class:`DecompressionFailed`.
* Raise :class:`ValueError` for integer arguments which are out of range,
instead of silently wrapping them around: settings must fit in 32 bits and
stream IDs must be QUIC stream IDs.
[6 lines not shown]
py-aioquic: updated to 1.8.0
1.8.0
* Remove HTTP/3 server push, which saw almost no deployment. Clients no
longer send MAX_PUSH_ID, so servers cannot push, and either endpoint now
closes the connection with ``H3_ID_ERROR`` on a CANCEL_PUSH frame, as
:rfc:`9114` requires when no push was allowed. The ``push_id`` field of
:class:`~aioquic.h3.events.HeadersReceived` and
:class:`~aioquic.h3.events.DataReceived` is gone. For compatibility,
``H3Connection.send_push_promise()`` is kept as a deprecated stub which
always raises ``NoAvailablePushIDError``, and ``PushPromiseReceived`` is
never emitted. They will be removed in a future release.
* Make :class:`~aioquic.quic.connection.QuicConnection` raise exceptions
derived from :class:`~aioquic.quic.exceptions.QuicError`, such as
:class:`~aioquic.quic.exceptions.OutOfRangeError` or
:class:`~aioquic.quic.exceptions.StreamStateError`. Code which catches
:class:`ValueError` or :class:`RuntimeError` around its methods should
catch :class:`~aioquic.quic.exceptions.QuicError` instead.
[33 lines not shown]
py-bottleneck: updated to 1.6.1
Bottleneck 1.6.1
Maintenance
- Add Python 3.15 support, including free-threaded Python 3.15
- Drop Python 3.10 support, Python 3.11 or newer is now required
- Drop support for numpy 1.x, numpy 2.0 or newer is now required
- Raise the upper bound on the numpy build requirement to `numpy<2.8`
- Add Windows arm64 wheels, drop 32-bit Windows wheels
- Drop free-threaded Python 3.13 wheels
- Test the wheels built in CI before they are uploaded
- Allow building against CPython's Limited API (not used for the wheels
published in this release)
- Move project metadata and build configuration to `pyproject.toml`
- Switch linting and formatting to `ruff`
- Pin GitHub Actions and audit workflows with `zizmor`
- Publish to PyPI with trusted publishing
- Require pytest 9
[12 lines not shown]
modular-xorg-server: update to 21.1.26.
This release contains the fixes for these issues reported:
* CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write
* CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
* CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
* CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow
* CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
* CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow
* CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass
* CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply
In addition we have a variety of fixes outlined by the shortlog below:
Acts1631 (3):
Xv: prevent overflow in shared-memory bounds check
XTest: validate valuator range before writing
XRes: prevent overflow in client ID request size
[19 lines not shown]
xwayland: update to 24.1.15.
This release contains the fixes for the these issues:
* CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
* CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
* CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow
* CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
* CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow
* CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass
* CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply
In addition we have a variety of fixes outlined by the shortlog below.
Acts1631 (3):
Xv: prevent overflow in shared-memory bounds check
XTest: validate valuator range before writing
XRes: prevent overflow in client ID request size
[11 lines not shown]
dbus: update to 1.16.4.
dbus 1.16.4 (2026-11-12)
========================
Security support scope:
• Add `SECURITY.md` documenting various security considerations
(dbus!597, dbus!603, dbus!606; Simon McVittie, ooonea)
Denial-of-service fixes:
• Prevent a denial-of-service vulnerability on the system bus:
if a privileged user was running a monitor such as `dbus-monitor --system`
or `busctl monitor --system`, then an unprivileged user could cause the
dbus-daemon to crash by arranging for delivery of a broadcast signal
from the dbus-daemon to be prevented, for example by filling up the
outgoing message queue towards a client that subscribed to it.
This vulnerability could be seen as an incomplete fix for CVE-2023-34969.
[85 lines not shown]
p11-kit: updated to 0.26.6
0.26.6 (stable)
* rpc: added PQC support
* rpc: added support for more mechanisms
* rpc: list-objects should no longer print garbage when used via RPC
* rpc: memory management fixes and hardening
* p11-kit: import-object now rejects malformed RSA public keys
* trust: do not truncate DirectoryStrings with embeded NULL byte
* Build fixes
* Update translations
* Documentation
tcpflow: updated to 1.7.0
1.7.0
This release fixes security vulnerabilities, improves packet processing and
portability, and introduces automated releases with a signed Windows executable
and Linux Snap packages.
