py-imagesize: updated to 2.0.1
2.0.1
Optimize metadata parsing and HTTP range reads.
Fix JPEG2000 box parsing.
Accept single-quoted SVG dimensions.
Return positive heights for top-down BMP images.
Remove the upper Python version cap, migrate packaging to pyproject.toml,
and add Python 3.15 CI coverage.
Bump the package version to 2.0.1 and add recent feedback contributors to
the README.
openssl: updated to 3.6.4
OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed
in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
[27 lines not shown]
croc: Update to 11.3.2
Highlights
Automatically advertises and negotiates experimental-derp-attach-group-v1 in normal supported builds.
Two v11.3.2 peers use eight striped streams over four raw-direct paths with no flags.
Mixed-version peers remain compatible through one-stream legacy Attach.
Raw setup retains one-stream manager fallback, with croc relay fallback in automatic mode.
11.3.1
Highlights
Pins derphole to github.com/schollz/derphole v0.18.2-croc.1 while preserving its upstream module identity.
Adds modular AttachGroup bundle and lifecycle support for the qualified eight-stream/four-path topology.
Keeps automatic AttachGroup advertisement disabled in this release; peers continue using compatible legacy DERP Attach until activation is qualified separately.
Reduces CI cost by avoiding duplicate branch-push validation and reserving full cross-platform builds for main and manual runs.
What’s Changed
DERP transport: connection bundles, client-local providers, clean group-close handling, and safe striped-sender teardown.
Benchmarks: consolidated 8/4 qualification data and benchmark-only build tagging.
[2 lines not shown]
sysutils/broot: update to 1.59.0
- new shell_command verb attribute: run a command through a shell (sh -c / cmd /C) so &&, ; and pipes work, without leaving broot - Fix #1145
- fix invalid official Mac binary (duplicate linked dylib) with new build chain - Fix #1194
- Sixel graphics support for image preview, auto-detected: works in iterm2, Windows Terminal 1.22+ and Sixel-capable Unix terminals (foot, mlterm, xterm built
with Sixel, recent WezTerm). Kitty remains the preferred protocol when available. Note: this requires broot to be compiled with sixel feature
(eg cargo install broot --features sixel) - Fix #568 - Thanks @jamison-wilde
- High-Res images in Rio terminal (detect it to enable the Kitty image protocol) - Fix #1179
- fix content-exact match line number off-by-one when the match starts at the first byte of a line (broot jumped to the line above) - Thanks @YuriNachos
- new :no_action internal, doing nothing, which can be used to disable a key - Fix #328
- fix: detect a duplicate broot server name instead of silently overtaking the running server - Fix #1065 - Thanks @YuriNachos
- fix preview transformers extension matching not working with double extensions such as .tar.gz - Fix #1195
- strip escape sequences from displayed names to prevent OSC injections - Fix #1188 - Thanks @carfeii
- fall back to numeric uid/gid instead of ???? when the user or group name can't be resolved, which is always the case on statically linked musl
builds - Fix #1075
- fix panic on a content regex matching the empty string at the end of a line ending with a control char (eg cr/$/ on a CRLF file)
- fix Windows paths (containing backslashes) being mangled by the launcher's eval when using :cd and similar; also fixes escaping of paths containing
a single quote - Fix #1100 - Thanks @Cyrus580529
- fix br failing on Windows/PowerShell when the temp path contains a space (e.g. a space in the Windows username) - Fix #788 - Thanks @chinhkrb113
[3 lines not shown]
net/ttl: update to 0.22.0
What's Changed
chore(deps): bump the cargo-dependencies group across 1 directory with 12 updates by @dependabot[bot] in #125
chore(deps): bump the cargo-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #127
chore: clippy 1.98 nits (prerequisite) by @lance0 in #130
chore(deps): bump lru 0.18.0 → 0.18.2 (LAN-1114) by @lance0 in #128
perf(tui): skip snapshot+draw when idle (LAN-1222 experiment) by @lance0 in #129
chore(tui): make the render fingerprint exhaustive over its inputs by @lance0 in #131
par2: updated to 1.3.0
1.3.0
Issues:
* Missing include src/utf8.h
PRs:
* Bump actions/checkout from 6 to 7
* Bump cross-platform-actions/action from 1.2.0 to 1.3.0
* Fix macOS unoptimised builds (more general building improvements for the github workflows)
* Printing performance tweaks
xournalpp: updated to 1.3.7
1.3.7
This is a new minor version of Xournal++ with bug fixes and improvements from the community.
Fixed Lua API changeToolColor not recognizing some tool names
Fixed failing assertion when right clicking
Updated translations
py-zeroconf: adapt PLIST for cython 3.3.0
cython 3.3.0 is more strict in checking signatures, which stops it
building the C extension for py-zeroconf.
Reported this upstream, remove the .so files from the PLIST for now.
Bump PKGREVISION.
