py-xhtml2pdf: updated to 0.2.28
0.2.28
New
Output for print shops: @page { bleed: 3mm; marks: crop cross } grows
the page around its trim size, with a TrimBox and a BleedBox,
backgrounds that reach into the bleed and crop and registration marks
outside it.
device-cmyk() and cmyk() colours in CSS, written to the PDF in
DeviceCMYK.
PDF/X-4: pdfx={"profile": ..., "condition": ...}, or
--pdfx-profile on the command line, adds the output intent, XMP
metadata and page boxes PDF/X asks for, tags RGB as sRGB and draws neutral
greys on the black plate.
A document with bleed, marks or PDF/X logs the images drawn under 300 ppi
and the text set in fonts that are not embedded.
@font-face takes OpenType fonts with PostScript (CFF) outlines, and
[20 lines not shown]
py-tornado: updated to 6.6
6.6.0
General changes
- Python 3.15 is now supported. Python 3.9 and 3.10 are no longer supported; 3.11 is the minimum
supported version.
- Free-threaded python interpreters are now supported; prebuilt wheels are available for 3.14t
and 3.15t.
- Windows on ARM is now supported and prebuilt wheels are available.
- Prebuilt wheels are now available for ``riscv64``, ``ppc64le``, and ``s390x`` architectures on
Linux. These architectures are experimental and have limited support and testing.
- PyPy 8.0 is now supported (for both Python 3.11 and 3.12).
- Error messages have been improved in many places.
- Improved handling of `asyncio.CancelledError` in various parts of the framework.
py-httpx2: updated to 2.16.0
2.16.0 (October 21st, 2026)
Changed
* Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the `Cookie` header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain.
Fixed
* Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with `client.cookies.jar.set_policy()` now applies to outgoing requests.
GraphicsMagick: Update to 1.3.49
This is a security update that fixes two potential arithmetic overflow
problems.
Verified to build on NetBSD, FreeBSD, OpenBSD, Linux, Darwin powerpc and
arm64.
p5-Starman: update to 0.4019.
0.4019 2026-10-24 02:02:21 PDT
[SECURITY]
- Stream chunked request bodies to the temporary buffer instead of
holding whole chunks in memory (CVE-2026-115824)
- Parse chunk-size lines in linear time with a 4 KiB length limit and
strict syntax; malformed lines get 400 (CVE-2026-115822)
- Do not send a response body for HEAD requests or 1xx, 204 and 304
responses, on both the array and streaming paths (CVE-2026-115823)
- Limit how long a request body may take to arrive: --read-timeout
(default 5 seconds) now also applies to each wait for more of the
body, and the new --body-timeout option limits the total time
(default 300 seconds; raise it or set it to 0 for slower uploads).
Expiry gets 408 (CVE-2026-115817)
- Reject Transfer-Encoding other than "chunked" (400/501) and close
the connection after a request with both Transfer-Encoding and
Content-Length. Completes the fix for CVE-2026-40560
- Reject malformed, negative and conflicting Content-Length headers
[24 lines not shown]
p5-Plack: update to 1.0057.
1.0057 2026-10-24 02:01:28 PDT
[BUG FIXES]
- Fix Plack, Plack::Request and Plack::Response in 1.0056 still declaring $VERSION 1.0055,
which kept PAUSE from indexing 1.0056. This release contains the same fixes as 1.0056,
including CVE-2026-115825
1.0056 2026-10-24 01:55:22 PDT
[SECURITY]
- Fix HTTP::Server::PSGI allocating a buffer as large as the declared Content-Length,
which let a single request crash the server with "Out of memory!" (CVE-2026-115825)
[BUG FIXES]
- Fix HTTP::Server::PSGI passing bytes after the Content-Length body to the app in psgi.input
- Fix HTTP::Server::PSGI accepting malformed, negative, duplicate or too long (more than
18 digits) Content-Length. Such requests now get 400 Bad Request
- Fix HTTP::Server::PSGI ignoring Transfer-Encoding and passing the raw chunked body to the app.
Such requests now get 501 Not Implemented
- Fix HTTP::Server::PSGI passing stray bytes after the headers as psgi.input when the request
[13 lines not shown]
