Update botan3 to version 3.14.0
CVE fixes from changelog since version 3.9.0:
CVE-2026-118770 Fix a use after
free in the TLS asio integration which depending on application
usage patterns may allow leaking heap memory to the peer.
CVE-2026-118771 Fix a bug in TLS 1.3 which could allow an
unauthenticated peer to pin unlimited amounts of memory in the
handshake by sending many dummy ChangeCipherSpec messages.
CVE-2026-118766 Fix a blind SSRF during OCSP request processing.
A malicious OCSP responder or network attacker could cause the
application to perform a blind GET to an internal service.
CVE-2026-118765 Fix a bug in AutoSeeded_RNG, affecting only platforms
without a system RNG, where an API sequence of calling first clear,
followed by randomize writing to an empty buffer, resulted in the RNG
[22 lines not shown]
arti: update to 2.8.0.
# Arti 2.8.0 — 3 November 2026
Arti 2.8.0 continues our steady progress on relay and directory authority development,
including on computing the consensus from votes,
bootstrapping router descriptors and microdescriptors,
as well as relay bandwidth rate-limiting,
descriptor encoding, and the relay DNS cache implementation.
Additionally, we have made a number of cleanups and
clarifications to the Tor specification.
This release has a number of security fixes; please see below.
As usual, there are also many under-the-hood improvements and bug fixes,
which are documented below.
### Security fixes
[17 lines not shown]
textproc/ruby-json_schemer: add version 2.5.0
ruby-json_schemer is required by ruby-mcp package.
My apologies for forgetting to commit ths package first.
JSONSchemer
JSON Schema validator. Supports drafts 4, 6, 7, 2019-09, 2020-12, OpenAPI
3.0, and OpenAPI 3.1.
textproc/ruby-hana: add version 1.3.7
ruby-hana is required by forthcoming ruby-json_schemer package which
is required by ruby-mcp.
hana
Implementation of JSON Patch(rfc6902) and JSON Pointer(rfc6901) RFC.
time/ruby-strptime: add version 0.2.5
ruby-strptime is required by ruby-rasn1 package. My apologies for
forgetting to commit ths package first.
Strptime
A fast strptime/strftime engine which uses VM.
jj: update to 0.47.1.
0.47.1
This release fixes a dependency error that broke Linux builds in the 0.47.0
release.
0.47.0
Templates now have a top-level revset(revset: Stringify) -> List<Commit>
function for evaluating revsets during templating.
In colocated workspaces, jj describe -r@, jj restore --into=@, etc. no
longer reset the staging area, just as snapshotting doesn't. jj new @- still
resets it.
py-textual: update to 8.2.8.
8.2.8
Fixes for extended key processing, and a crash bug for clicking
the screen padding area.
8.2.7
This release adds additional support for the Kitty key protocol.
Which enables some additional keys on some terminals. Additionally,
Textual will report modifier keys as separate key events.
Additionally there are a few more shortcuts to the Text Area.
This release sponsored by Mistral AI. See release notes for detail.
8.2.6
[12 lines not shown]
py-authlib: updated to 1.9.4
1.9.4 — 2026-11-04
Security
IDJAGGrant stores the verified claims of the ID-JAG in request.id_jag_claims. authenticate_user can use them to resolve the user with the iss and sub claims, and tenant for a multi-tenant IdP. The documentation used to resolve the user with sub alone. An IdP, or a tenant of an IdP, could then get access tokens for the users of another one. Update authenticate_user if your server trusts several IdPs or a multi-tenant IdP. GHSA-9qr6-8289-9j56
harfbuzz: updated to 15.1.0
15.1.0
- Add buffer deserialization APIs that report progress as a byte offset, for
use from introspection bindings.
- Fix Indic shaping of the Unicode 18 Devanagari and Bengali additions.
- Fix Arabic fallback shaping: wrong ligatures when a component is missing from
the font, and disappearing marks in legacy fonts.
- Fix `COLR` glyph extents and mark positioning in fonts with empty layers.
- Fix AAT shaping: wrong `kerx` kerning (formats 1 and 2) and mark positioning
(format 4, a 14.3.0 regression), and ignored `kern` and `mort` tables with a
non-first initial state.
- Various fixes to the Graphite2 shaper.
- Report HarfRust shaping failures through `hb_buffer_allocation_successful()`.
- Fix wrong outlines in `gvar` fonts with intermediate tuples.
- Fix `hb_face_create_or_fail()` rejecting face indices with named-instance
bits set.
- Fix wrong fallback metrics: the vertical descender in fonts without `vhea`,
and the hanging baseline for some scripts.
[30 lines not shown]
nodejs: bump libuv BUILDLINK_API_DEPENDS minimum to 1.52
Recent releases expect the following feature in libuv, or builds will
fail due to the missing field.
* unix,win: add f_frsize field to uv_statfs_t (Ben Noordhuis)
shader-slang: update to 2026.21
- Document how to install Metal Developer Tools
- Return the parse result from
IGlobalSession::parseCommandLineArguments
- Allow global constant inlining with shader debug information
- Keep a global-scope call whose callee needs a local variable out of
force inlining
- Add optional slang-standard-modules embedding library
- git-worktree-add.sh: add --force to replace an existing branch and
worktree
- Fix MSVC 2019 internal compiler error in unit-test-string.cpp
- SPIR-V: emit pointer-to-signed-int casts through an unsigned
integer
- Fix CUDA Gather on combined samplers and reject GatherCmp on CUDA
- Make abs of an unsigned integer the identity on SPIR-V, LLVM and
GLSL
- render-test: create an untyped object input in the program's
session
[133 lines not shown]
security/pkcs11-provider: Do revbump after all with base openssl fix.
Previously it would build _by default_ with pkgsrc openssl; revbump
is needed because this default changes.
