py-genshi: updated to 0.7.12
0.7.12
* Add support for Python 3.15 and PyPy 3.12
* Fix reference leak in Markup.__mod__ for mapping arguments
* Drop processing instructions (PI) and CDATA sections in HTMLSanitizer
* Track nesting depth when removing unsafe elements in HTMLSanitizer
* Update CI test matrix to add Python 3.15 release and PyPy 3.12
* Several RTD build fixes
* Update versions of GitHub actions.
py-curl: updated to 7.49.0
PycURL 7.49.0 - 2026-10-26
This release adds SSH_HOSTKEYFUNCTION and several missing libcurl SSH
constants, and accepts CurlShare subclasses in setopt. It fixes a
use-after-free when a mime part's content is replaced and makes object
teardown exception-safe by moving cleanup into tp_finalize. The build
system has also been cleaned up: custom setup.py command line options have
been removed in favor of their environment variable equivalents, and wheels
no longer install documentation and examples.
cargo-nextest: updated to 0.9.150
0.9.150
Security
Fixed GHSA-vc25-qg58-w57c: with the experimental run recording feature enabled, cargo nextest run --rerun with a malicious portable recording could run arbitrary code during the build.
Reruns inherit the original run's build scope (defined as the combination of package, target, and feature selection options). Nextest versions 0.9.125 through 0.9.149 recorded the build scope as raw Cargo arguments, and passed them to Cargo unchanged. A crafted recording could therefore add any Cargo option, such as a --config that sets build.rustc-wrapper. That code ran as the invoking user during the build, before any tests started, even with a warm build cache.
Nextest now records the build scope as structured data, and passes each value to Cargo joined to its flag (for example, --package=<value>), so a recording can no longer add other Cargo options.
To ensure that everyone working on your repository uses a fixed version, set the minimum required version in .config/nextest.toml:
nextest-version = "0.9.150"
Added
cargo nextest archive has a new --zstd-long option, which enables Zstandard long-distance matching with a 128 MiB window. For large archives, this can significantly improve the compression ratio at lower compression levels. Extracting these archives needs no extra options.
[15 lines not shown]
fix word_match() / IS_ALNUM() / TOLOWER() macros for ctype abuse.
i had a gid.core, and it showed this was the problem, and doing the
correct cast (unsigned char) fixes the crash.
bump pkg revision.
upx: Update to version 5.2.1
==================================================================
User visible changes for UPX
==================================================================
Changes in 5.2.1 (27 Aug 2026):
* bug fixes - see https://github.com/upx/upx/milestone/24
Changes in 5.2.0 (08 Jun 2026):
* new format cpm86/cmd
* bug fixes - see https://github.com/upx/upx/milestone/23
Changes in 5.1.1 (05 Mar 2026):
* ELF: MIPS r3000 (32-bit) shared libraries are supported
* bug fixes - see https://github.com/upx/upx/milestone/22
Changes in 5.1.0 (07 Jan 2026):
* ELF: new format linux/riscv64
[61 lines not shown]
rhythmbox: remove grilo support
libsoup2 (required by rhythmbox) and libsoup3 (pulled in by grilo)
can not coexist in the same binary, see PR 60929.
Bump PKGREVISION.
dnscontrol: Update to 5.7.1
Changelog
Provider-specific changes:
2155390: fix(p/BIND): bug: Writing zonefile mangles "repeated zone" labels (#5037) (@spicysharkco)
ee93a55: fix(p/NAMECHEAP): stop corrupting TXT records longer than 255 bytes (#5036) (@louneskmt)
329c40e: fix(p/AZURE_DNS): bug: intermittent "resource type does not match the type in the request body" errors (#5040) (@TomOnTime)
Bug fixes:
ec3d801: fix(D_EXTEND): ignore the empty tag when extending a subdomain (#5034) (@spicysharkco)
f0e54a9: fix(IGNORE): bug: .foo and **.foo both act like **.foo (.foo has no "stop" pattern) (#5038) (@spicysharkco)
d0901a6: fix(LOC): preserve thousandths of arcseconds in coordinates (#5035) (@spicysharkco)
py-markdown: update to 3.11.2.
Sanitize attribute names in the fenced_code and legacy_attrs extensions so an
attribute name cannot break out of its tag and inject markup (#1663).
For backwards compatibility, revert the enforcement of CommonMark style
punctuation rules (#1657).
py-importlib-metadata: update to 10.1.0.
v10.1.0
=======
Features
--------
- Detecting whether a distribution supplies metadata no longer reads or parses
that metadata where the metadata directory can be inspected instead, so
retrieving a distribution by name, which prefers the valid candidates, is
substantially faster.
- Reverted the preference for the greater metadata directory added in v9.1.0.
The ordering was lexicographic on the directory name and not on the parsed
version, so it only approximated a preference for the newer version. Where a
path supplies more than one metadata directory for a distribution, discovery
once again reports them in the order the path supplies
(python/cpython#100666).
[37 lines not shown]
py-filelock: update to 4.2.4.
4.2.4
Keep GitHub Release notes free of extra blank lines while retaining
the PyPI and version comparison links. #863
4.2.3
Creating a lock on a Python 3.15 interpreter without types.LazyImportType
no longer triggers AttributeError at exit. #860
Handle EFTYPE when a no-follow open refuses a symlink in a soft
reader/writer lock's protocol tree, so heartbeat reports lost
ownership rather than a transient refresh error.
tree-sitter-markdown: update to 0.5.4.
What's Changed
Allow make test to run via the top-level Makefile by @mavit in #244
ci: bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #253
fix(scanner): prevent serialization buffer overflow on deep nesting by @WillLillis in #279
fix(scanner): end and comment blocks on their opening line by @hasansezertasan in #272
Avoid quadratic parse time on long * / _ / ` / ~ runs by @brandon-arrendondo in #278
fix: recognize a closing code fence at the end of input by @hasansezertasan in #271
fix(python): make setup.py work again by @WOnder93 in #249
Remove junk Requires: @TS_REQUIRES@ in tree-sitter-markdown*.pc by @mavit in #246
Fix python bindings by @atupone in #264
fix: regenerate parser with tree-sitter 0.27.1 by @clason in #281
Add a field for info_string nodes in code fences by @the-mikedavis in #201
fix(rust): build for wasm32 with tree-sitter 0.27 by @lexoliu in #265
fix(scanner): drop the MSVC pragma from UNUSED by @WillLillis in #282
release v0.5.4 by @clason in #283
