patch: update to 2.8.1.
Changes in version 2.8.1:
* Prevent creation of out-of-tree files (CVE-2026-115207).
Changes in version 2.8:
* The --follow-symlinks option now applies to output files as well as input.
* 'patch' now supports file timestamps after 2038 even on traditional
GNU/Linux platforms where time_t defaults to 32 bits.
* 'patch' no longer creates files with names containing newlines,
as encouraged by POSIX.1-2024.
* Patches can no longer contain NUL ('\0') bytes in diff directive lines.
These bytes would otherwise cause unpredictable behavior.
* Patches can now contain sequences of spaces and tabs around line numbers
and in other places where POSIX requires support for these sequences.
* --enable-gcc-warnings no longer uses expensive static checking.
Use --enable-gcc-warnings=expensive if you still want it.
[6 lines not shown]
py-html-sanitizer: updated to 2.7.0
2.7 (2026-10-25)
- Added the ``preserve_whitespace`` setting which keeps whitespace inside the
listed tags as-is. Defaults to ``{"pre"}``, which only has an effect if
``pre`` is added to the allowed tags.
- Added the ``embedded_hosts`` setting which allows embedding content such as
``iframe`` elements from the listed hosts.
- Added the ``drop_disallowed_contents`` setting which removes disallowed tags
including their contents.
py-lxml-html-clean: updated to 0.4.6
0.4.6 (2026-10-26)
Bugs fixed
* Fixed a ReDoS (regular expression denial of service) vulnerability in the
CSS ``expression()`` sanitizer. The pattern ``expression\s*\(.*?\)`` with
``re.S`` was quadratic when input contained many ``expression(`` tokens
without a closing parenthesis. The body is now bounded to 1024 characters;
longer bodies are handled fail-closed by ``_has_sneaky_javascript()``, which
drops the entire style. Reported by Brian Willows.
* Fixed a ReDoS vulnerability in the conditional comment detector used when
``comments=False``. The pattern ``\[if\s+.*?]\s*>`` with ``re.S`` was
quadratic when comment text contained many ``[if`` tokens without a closing
``]>``. Replaced with a linear two-pass search. Reported by Brian Willows.
* Fixed a ReDoS vulnerability in the CSS comment stripper. The pattern
[10 lines not shown]
python311 py311-html-docs: updated to 3.11.18
Python 3.11.18
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE-2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE-2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
python312 py312-html-docs: updated to 3.12.16
Python 3.12.16
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
python313 py313-html-docs: updated to 3.13.18
Python 3.13.18
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
Tests
gh-159015: Fix test.test_math failing to import on musl-based systems. The skip condition of test_fma_zero_result compared the boolean returned by test.support.linked_to_musl() with a version tuple.
python314 py314-html-docs: updated to 3.14.10
Python 3.14.10
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
Core and Builtins
gh-160491: Fix the location reported for invalid escape sequences in f-strings and t-strings. The SyntaxError now points at the literal part that contains the escape, instead of at the closing quote.
gh-160268: Fix a crash in tokenize when a mismatched closing bracket follows the opening brace of an f-string or t-string replacement field, as in f'{]a'. It now raises the same “unmatched” error as the parser.
gh-106045: Fix venv path discovery when the base executable resolves to a location outside the installation pointed to by the home key in pyvenv.cfg. The standard library is now found from home, and extension modules from the resolved executable’s installation, instead of falling back to the compiled-in prefix.
gh-160162: Fix a crash on 32-bit platforms when left shifting an int by a count close to sys.maxsize * sys.int_info.bits_per_digit. OverflowError is now raised, as for other too large counts.
gh-160179: Fix bytearray.__init__() leaving uninitialized memory in the object when it fails on a list or tuple containing an integer not in range(256). The object is now empty after the failed call.
gh-159739: Fix a possible crash when assigning metadata to classmethod or staticmethod objects.
gh-159739: Fix a race in list.__sizeof__() when a list is concurrently resized on a free-threaded build.
[69 lines not shown]
py-pipx: updated to 1.18.4
1.18.4
Bugfixes
pipx reset now cancels instead of crashing when the confirmation prompt reads EOF (Ctrl-D on POSIX, Ctrl-Z then Enter
on Windows).
security/pkcs11-provider: Import pkcs11-provider 1.3.0
Quoting from the README:
> This is an OpenSSL 3.x provider to access Hardware and Software
> Tokens using the PKCS#11 Cryptographic Token Interface. Access to
> tokens depends on loading an appropriate PKCS#11 driver that knows
> how to talk to the specific token. The PKCS#11 provider is a
> connector that allows OpenSSL to make proper use of such drivers.
> This code targets PKCS#11 version 3.2 but is backwards compatible to
> version 3.1, 3.0 and 2.40 as well.
This can replace the pkcs11 engine for OpenSSL from security/libp11.
`Engines' are the deprecated legacy interface; `providers' are the
modern shiny interface.
devel/cargo-about: update to 0.9.3
Fixed
PR#319 and PR#320 fixed issues with manifest synthesis.
PR#324 resolved #323 by writing the archive name into each release .sha256 file, so sha256sum -c can check it.
PR#328 updated rustls etc to fix stupid CA.
sysutils/xplr: update to 1.2.2
Highlight
This release fixes tty crashes when using CustomGraphics/CustomOutput introduced in 1.2.
Also done a major cleanup of the codebase to simplify many things.
What's Changed
Cleanup by @sayanarijit in #794
Fix tty crash when rendering graphics by @sayanarijit in #795
Rendered image quality will not be rich due to some simplification, but will be there eventually.
sysutils/gravityfile: update to 0.4.1
Release Notes
The release binaries for 0.4.0, which were never published because the
static Linux build failed. What changed in 0.4.0, a rewrite of the scanner,
explorer and command line, is in the
0.4.0 notes.
Fixed
The static (musl) Linux build links. The no-overwrite rename now makes the
renameat2 system call itself, since musl has no wrapper for it, and CI
builds and tests for musl.
