py-draftjs_exporter: updated to 7.3.1
7.3.0
Added
Add md_line_break as a reusable line break component. Markdown output now converts newlines in block text to CommonMark hard line breaks (\ + newline), degrading to a space in headings, via a default composite decorator in MARKDOWN_CONFIG and build_markdown_config.
Export md_code_block_fence from the package root, to allow customizing the code block fence character in Markdown output.
Changed
The Markdown importer now parses backslash line-end hard breaks (\ + newline) as newlines, matching the exporter's md_line_break output.
tor: updated to 0.4.9.15
Changes in version 0.4.9.15 - 2026-10-28
This is another security release that includes new DoS defenses against large
volumes of directory requests received by relays. Another significant change
is that the HSDir flag is now sticky, meaning it persists across restarts.
This release primarily affects relays so please upgrade as soon as possible.
py-flakes: updated to 4.1.0
4.1.0 (2026-10-28)
- Drop support for EOL python 3.10
- Significant performance improvements
- Fix handling of ``Literal`` and ``Annotated`` for lazy imports
appstream: updated to 1.2.2
1.2.2
Features:
* content-rating: Add attribute titles and group descriptions
* pool: Allow adding extra data locations with explicit scope and origin
* ascli: sysinfo: Print some more information about the OS, like its support period
* bundle: Drop Limba, add Manifold
Bugfixes:
* cli: Fail YAML validation for missing input
* compose: Fix build on a newer kernel with an old glibc
* pool: Work around all Flatpak origins having the same name
* pool: Include scope in metadata cache keys for Flatpak
* apt: Don't hang when tar emits lots of stderr output
* its: Support MetaInfo files that use the specification's namespace
* system-info: Don't prefix an OS ID that already is rDNS
* sysinfo: Also replace `-` with `_` at `dns_to_rdns` function
gperftools: updated to 2.19.2
gperftools 2.19.2 is out!
This is another quick bug-fix release on top of 2.19.1. It updates
the vendored aw-backtrace.
Updated aw-backtrace expands x86-64 DRAP support. With -march=x86-64-v3
(e.g. Ubuntu 26.04's amd64v3 variant) gcc realigns the stack for AVX
much more often, and a realigned function that also passes arguments
on the stack uses a DRAP frame. The layout of those frames turned out
to be more general than we previously assumed, so backtraces through
them were truncated (this affected CPU and heap profiles as well as
debugallocation's stack traces). This fixes the test failures seen on
github's Ubuntu 26.04 builders.
gperftools 2.19.1 is out!
[19 lines not shown]
grafana: add some go modules manually to fix the build
show-go-modules doesn't pick these up consistently,
presumably due to our go.mod patch.
This is an annoying issue and needs to be revisited later.
tailscale: update 1.104.4
- Tailscale SSH performs Unix socket forwarding on behalf of the
authenticated user rather than as root, preventing authorized peers
from using local and remote forwarding to reach root-only Unix
sockets such as the Docker socket or the tailscaled local API. This
fix addresses a security vulnerability described in TS-2026-014.
- Tailscale SSH bounds the memory used for session handling and
releases it when the peer disconnects, preventing denial of service
through unbounded memory growth in tailscaled from continuous
window-change messages and environment variable appends. This fix
addresses a security vulnerability described in TS-2026-015.
- Tailscale Serve restricts TCP forwards to Unix socket backends and
revalidates backend paths on each connection, preventing access to
privileged Unix sockets such as the tailscaled local API socket.
This fix addresses a security vulnerability described in
TS-2026-016.
[6 lines not shown]
p5-MIME-tools: update to 5.522.
5.522 2026-10-27 Dianne Skoll <dianne at skoll.ca>
* VERSION 5.522 RELEASED
* Many security issues were addressed (see the following ten CVEs)
Issues were brought to my attention, and patches supplied, by the
CPANSec security group.
* parse_params: flag a parameter list that could not be parsed
Detect additional ambiguous parse situations when parameter
names contain illegal characters. Fixes:
CVE-2026-116264 invalid parameter hides boundary/filename
* parse_params: check the boundary after RFC 2231 reassembly
Another ambiguous-parse case was missed (trailing space after
boundary was not detected for RFC-2231-encoded boundaries.) Fixes:
CVE-2026-116265 RFC 2231 boundary skips ambiguity checks
[106 lines not shown]
p5-HTTP-Body: update to 1.24.
1.24 2026-10-26 18:28:01+01:00 Europe/Berlin
- SECURITY, CVE-2026-116131: urlencoded bodies are limited to
$HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
$HTTP::Body::MultiPart::max_parts parts (1000 each); reported and
patched by CPANSec
- SECURITY, CVE-2026-116132: the temporary file of an upload that is
still incomplete at DESTROY-time is now always deleted; reported and
patched by CPANSec (also fixes RT#84004)
- SECURITY, CVE-2026-116133: a multipart body without a boundary or with
a malformed delimiter line no longer takes quadratic time; a malformed
delimiter line now croaks, and padding or an epilogue after the close
delimiter is accepted; reported and patched by CPANSec
- SECURITY, CVE-2026-116134: a multipart part's header block is limited
to $HTTP::Body::MultiPart::max_header_size bytes (32768) and
$HTTP::Body::MultiPart::max_header_lines lines (100); reported and
patched by CPANSec
- SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in
[22 lines not shown]
gatus: Update to version 5.38.0
What's Changed
feat(alerting): add Resend alerting provider by @geffersonFerraz in #1830
fix(maintenance): validate maintenance windows for external, DNS and SSH endpoints by @anandghegde in #1804
fix(alerting): Redact telegram token from errors on send failure by @hippi345 in #1843
fix(websocket): apply the client timeout to reads and writes by @somaz94 in #1845
fix(ssh): support keyboard-interactive authentication for endpoints and tunnels by @peckto in #1863
fix(security): add comprehensive logging and diagnostics for OIDC (#1802) by @tech00exploere in #1862
fix(jsonpath): support object keys containing dots via quoted accessors by @leotemtem in #1864
fix: Honor minimum-reminder-interval for external endpoints by @yzxcj797 in #1773
chore(alerting): restyle matrix alerts with errors, safe links and escaping by @mazzz1y in #1875
upx: Updated to version 5.3.0
Changes in 5.3.0 (28 Oct 2026):
* new format win64/arm64; based on work by hoptodesk and Johannes Schindelin
* bug fixes - see https://github.com/upx/upx/milestone/25
news/brochure: update to 0.13.0
Full mouse support, notification cards, and a full-screen image viewer.
Highlights
Drag scrollbars and lists with the mouse
Notification cards with live refresh progress
Click an article image to view it full screen
Popups and dialogs work with the mouse
Text selection follows scrolling and copies fully
multimedia/moviebox-tui: update to 0.1.27
[0.1.27] - 2026-10-23
Fixed
Media Playback & Subtitle Engine:
Removed --play-and-exit from VLC player invocations so the player stays active across adaptive and HLS chunk transitions.
Reset legacy Android player defaults in graphical X11 and Wayland sessions so native Linux players take precedence over external Android intent dialogs.
Prioritized native Linux media player paths over foreign container fallbacks on Linux systems and preserved dynamic auto-player resolution for unconfigured sessions.
Providers & Stream Resolution:
Recovered playable signed MP4 streams via /resource-position/v2 when MovieBox returns deprecation notice clips, querying exact seasons and episodes and reporting accurate file sizes.
Stripped the DASH Referer header on direct MP4 streams to prevent CDN HTTP 429 throttling.
Bumped the MovieBox stream cache schema to v2_ to discard stale cached deprecation notices.
Filtered out unhosted MovieBox /hls/ signed cookie targets in manifest resolution, which stops unplayable H.264 stream entries from failing with HTTP 404 during downloads or media playback.
Download Engine & Batch Queue:
Fixed season batch downloads by arming is_waiting_for_download_stream during queue steps, eliminating immediate empty-list download calls that aborted multi-episode queues.
Reset the download resolution state lock on 4KHDHub resolver timeouts and errors so failed mirror resolutions do not block subsequent download attempts.
Added sequential single-connection fallback to the internal HTTP downloader when multi-worker segmented range requests receive HTTP 403, 429, or network disconnects.
[12 lines not shown]
misc/zellij: update to 0.45.1
[0.45.1] - 2026-08-28
fix: nested-session detection over SSH (#5522)
fix: some issues with notification parsing (eg. neovim notification on save) (#5523)
fix: kitty image size on startup and clearing with stacked unlisted full framed panes (#5526)
fix: focus event in remote attach (#5527)
fix: editing scrollback issue with a fullscreen floating pane (#5528)
feat: allow opting-out of scroll mode sync (#5532)
fix: save space for title row in fixed-layout panes in titles only mode (#5533)
fix: properly fire visibility event to plugins when their tab/floating-layer is hidden/shown (#5518 and #5534)
feat: allow setting explicit_theme_hue (light/dark) (#5536)
fix: input mode updates when switching tabs (#5535)
feat: allow starting a session with an initial command, eg. zellij attach -a my-session -- htop (#5543)
fix: release a CLI pipe when the plugin handling it crashes, instead of blocking the zellij pipe client until the plugin is unloaded (#5537)
[0.45.0] - 2026-08-20
[34 lines not shown]
