lang/rust/cargo.mk: Make cargo-vendor-crates recipe more robust.
1. Fail if digest command fails for any reason.
2. Don't leave each final .json file around if interrupted.
No functional change intended in the success case.
firefox153: update to 153.7.0
Mozilla Foundation Security Advisory 2026-127
Security Vulnerabilities fixed in Firefox ESR 153.7
Announced
November 10, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.7
#CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
Reporter
Mozilla
[886 lines not shown]
lang/rust/cargo.mk: Set CARGO_BUILD_JOBS=${_MAKE_JOBS_N} in MAKE_ENV.
This fixes excessive parallelism in py-maturin, anything that uses
Python setuptools-rust, and generally anything that assembles its own
cargo(1) command line instead of using ${CARGO_ARGS}.
py-pdf: updated to 7.0.1
7.0.1, 2026-11-10
Security (SEC)
- Determine image buffer sizes using the actual bytes per pixel
Performance Improvements (PI)
- Don't parse content streams without text operators in extract_text()
Bug Fixes (BUG)
- Decode UTF-8 text strings
- Fix page reference lookup for hierarchical page trees in PdfWriter
- Copy the operations in ContentStream.replicate()
- Deal with more rendering intents for inline images
py-pipx: updated to 1.18.16
1.18.16 - 2026-11-07
Changes
pipx ensurepath no longer claims it added the binary directories to PATH when they were already there; the summary now says so and points at --force for adding them again
Fixed
Rebuild shared pip environments created with Python older than 3.10, and refresh existing applications’ references to the rebuilt environment before running their installers
py-sqlparse: updated to 0.6.1
End of Maintenance
Version 0.6.1 marks the final release of sqlparse.
After many years of maintaining this project, I have decided to end its
active development and maintenance. The increasing volume of security reports,
particularly those generated through automated vulnerability research, has made
the workload unsustainable for me as a sole volunteer maintainer.
No further releases, including security fixes, are planned.
The source code and existing releases will remain available.
I would like to thank everyone who has contributed to sqlparse over the years.
Notable Changes
[27 lines not shown]
py-alembic: updated to 1.20.1
1.20.1
bug
[bug] [autogenerate]
Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don’t store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.
[bug] [autogenerate] [postgresql]
Fixed rendering of the PostgreSQL DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.
[bug] [autogenerate] [postgresql]
Fixed false-positive “Computed default cannot be modified” warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.
[bug] [autogenerate] [postgresql]
Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.
[bug] [postgresql]
[13 lines not shown]
py-aioquic: updated to 1.7.2
1.7.2
* Fix data written to a stream returned by
:meth:`~aioquic.asyncio.QuicConnectionProtocol.create_stream` being
truncated when it was a :class:`memoryview` whose items are wider than one
byte.
* Improve type annotations: all functions in the library are now annotated.
* Fix the demo application with Starlette 1.0.
* Remove the SiDUCK example, as the draft it implemented expired without being
adopted.
lz4: updated to 1.11.1
1.11.1
LZ4 v1.11.1 is a point release, whose main purpose is to fix LZ4_resetStreamHC(), an obsolete symbol, on dirty memory. While reset functions are expected to reset valid states, LZ4_resetStreamHC() has been working fine on dirty memory, which made it possible to employ it as an initializer instead. Hence, some (hopefully rare) applications may have developed a dependency on this property. v1.11.0 did not respect this undocumented behavior: on a dirty state, compression at levels >= 10 could result in a write out of bounds. Thus v1.11.1 is released to restore the previous behavior.
This is mostly of importance for distributions and package managers, as liblz4 may be paired with older binaries that are no longer updated. LZ4_resetStreamHC() was replaced by LZ4_initStreamHC() in v1.9.0 (2019). Applications still employing this symbol are invited to migrate.
This release also restores the (deprecated) unprefixed lz4frame enums, for applications that still need them. They now generate a deprecation warning: once again, actively maintained applications should move to the prefixed names. Build configurations accidentally broken in v1.11.0 work again: make with BUILD_STATIC=no or BUILD_SHARED=no, and MinGW with clang and lld.
mit-krb5: updated to 1.22.3
Major changes in 1.22.3 (2026-11-09)
Fix a logic error when checking PAC server checksums [CVE-2026-111423].
Check for unkeyed checksums when validating CAMMAC verifiers [CVE-2026-71199].
Fix a loophole in the KDC's client authdata filtering which could allow clients to include fake PAC and CAMMAC authdata values when requesting service tickets. These fake values would be rejected by application servers, were it not for the two bugs noted above.
Check for the lockdown_keys attribute when processing password change protocol requests in kadmind [CVE-2026-107884].
In libgssrpc, when processing RPC messages using the RPCSEC_GSS flavor, use the verified service type included in the RPC request to determine how to unwrap arguments and wrap return values, instead of the unverified service type included during authentication [CVE-2026-118380].
In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI is only needed for very old (pre-1.4) clients [CVE-2026-112322] [CVE-2026-112323].
Fix numerous null pointer deferences, read overruns, unbounded memory allocations, and memory leaks that could be used as denial of service attacks against the KDC, kadmind, application servers, or client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200] [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778] [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316] [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319] [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323] [CVE-2026-119079].
Fix a client crash when a KKDCP proxy daemon closes the TLS session without supplying any response data.
Shut down kpropd gracefully when a termination signal is received, when operating in incremental propagation mode.
Detect when an incremental propagation update is applied to a nonexistent principal; when this happens, force a full resync instead of crashing.
Fix a KDC crash when the LDAP KDB module loses its connection to the LDAP server.
Avoid a crash on macOS when the native API ccache type is used before and after forking a process.
When an application accepts a GSS context without asking for delegated credentials, discard any credentials sent by the initiator without parsing them first.
On Windows, prevent buffer overflows when the KDC sends an unexpectedly long prompt string via OTP preauthentication.
On Windows, move the default per-machine krb5.ini location from C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as the former location could be pre-created by an unutrusted user before KfW installation.
[3 lines not shown]
lazygit: updated to 0.66.3
0.66.3
Fix removing a submodule in a linked worktree breaking the submodule in the main worktree
Ignore submodules whose name or path in .gitmodules leads outside the repository
py-uv*: update to 0.13.7
Preview features
Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
Report aliased OSV records as a single vulnerability in uv audit (#22990)
Bug fixes
Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
Allow uv remove with an empty inline tool.uv.sources table (#23012)
Documentation
Correct the cache-keys inline table example (#22984)
apache24: updated to 2.4.70
Apache 2.4.70
*) mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows.
*) mod_cgid: Increase limits for number and length of
environment variables, URI and arguments.
[Emmanuel Dreyfus <manu netbsd.org>, Joe Orton]
*) mod_substitute: Fix an integer overflow that can happen in very special
setups.
*) mod_cache: Do not store a response whose "Vary: *" was set via
"Header always".
*) mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which
under-reserved space for the stored key length field, written as
apr_size_t but sized as int.
sysutils/dua-cli: update to 3.0.1
This release fixes builds for free-desktop/linux,
which is not(target_os = "macos"), not(target_os = "ios"), not(target_os = "android")
