rust: update to 1.91
Based on wip/rust191 by he@, jperkin@, and adam@
Changes:
Add lint against dangling raw pointers from local variables
Stabilized APIs
Path::file_prefix
AtomicPtr::fetch_ptr_add
AtomicPtr::fetch_ptr_sub
AtomicPtr::fetch_byte_add
AtomicPtr::fetch_byte_sub
AtomicPtr::fetch_or
AtomicPtr::fetch_and
AtomicPtr::fetch_xor
{integer}::strict_add
[61 lines not shown]
xapian-omega: update to 1.4.30. Changes:
documentation:
* INSTALL: Replace with improved version based on xapian-core's.
indexers:
* omindex:
+ Fix segmentation fault if an SVG file contains both <dc:title> and <title>
with <dc:title> first. Bug introduced in 1.4.21.
xapian: update to 1.4.30. Changes:
API:
* Stem: 1.4.28 changed the English stemmer code to remove an exception
for "skis" which we incorrectly thought wasn't needed. This was not
intended to be a functional change, so we've restored the exception.
* Stem: Fix a bug in Snowball's runtime code for decoding 4-byte UTF-8
sequences. This affects grouping checks against Unicode codepoints U+40000
to U+7FFFF and U+80000 to U+FFFFF, and we would decode a higher codepoint
value. The largest codepoint used in a grouping in any stemmer we ship is
U+0585 so this seems to be a latent bug. Reported in Snowball by Stephane
Carrez.
documentation:
* The API docs still said DatabaseError was thrown for operations on a closed
database, but since 1.4.10 we throw its subclass DatabaseClosedError instead.
[19 lines not shown]
firefox140: update to 140.7.0
Mozilla Foundation Security Advisory 2026-03
Security Vulnerabilities fixed in Firefox ESR 140.7
Announced
January 13, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 140.7
#CVE-2026-0877: Mitigation bypass in the DOM: Security component
Reporter
mingijung
[142 lines not shown]
p5-App-Sqitch: update to 1.6.1. Changes:
- Fixed some ancient typos in sqitchtutorial-sqlite, with thanks to @ovid
for the report!
- Updated ClickHouse logic to always specify "default" as the hostname
when connecting and the URI includes not hostname. This ensures it
doesn't try to use `DSN=sqitch`, which is unlikely to be a configured
DSN, and to align with the behavior of the ClickHouse client.
p5-Cucumber-TagExpressions: update to 8.1.0. Changes:
- Render the empty tag expression as an empty string
- Improve error message for missing operands
mob: update to 5.4.1. Changes:
- Fix: `mob next` now correctly handles filenames with spaces when
determining the last modified file for the open command.
snac: update to 2.88. Changes:
## 2.88
If `disable_emojireact` is set to `true` in `server.json`, EmojiReacts
(incoming and outgoing) are totally disabled.
New command-line option `top_ten`, that returns the top ten most
popular posts by a user (ordered by the sum of likes and boosts)
(contributed by aov).
Added a new set of per-user muted words; if a post contains any of them,
it's hidden behind a dropdown (contributed by byte).
If an account has a metadata named `pronouns`, it's shown by the name
(contributed by violette).
Mastodon API: children of a post are returned recursively, not just the
first level (contributed by violette).
[44 lines not shown]
