atf: updated to 0.26
0.26
Developer Workflow Changes
* Automate uploading release assets
* INSTALL.md: sync content with version from lutok
* [CI] Minor tweaks
Feature Enhancements
* Add kmod support on FreeBSD
harfbuzz harfbuzz-icu: updated to 14.5.0
Overview of changes leading to 14.5.0
- Update Unicode 18.0 data and script support, including script values for
Jurchen, Proto-Cuneiform, and Seal, and the corresponding shaping support.
- Add support for VARC table subsetting, including pruning auxiliary data,
remapping glyph IDs, and guarding the feature in lean builds.
- Add rendering work budgets to the draw and paint APIs and share them across
the raster, vector, GPU, and Cairo renderers so nested outline work remains
bounded.
- Improve performance in set iteration, lookup traversal, and the repacker, and
add coverage for new benchmarks and fuzzing seeds.
- Fix various correctness and robustness issues across the CFF, Graphite,
DirectWrite, and repacker code paths, including memory leaks, overflow checks,
bounds issues, and malformed-font handling.
- Various build, portability, and CI fixes.
- New API:
[26 lines not shown]
(cad/py-gdstk) Updated 1.0.0 to 1.0.1
# Changelog
## 1.0.1 - 2026-07-10
### Fixed
- Typos to `RobustPath` and `FlexPath` "extended" ends.
- Added default values to some C++ functions to fix provided examples.
glibmm2.68: updated to 2.90.0
2.90.0 (stable) 2026-09-13
API is identical to glibmm 2.89.1.
Meson build:
* Fix missing dependencies, making it possible to build with
https://github.com/michaelforney/samurai instead of ninja.
py-astropy: remove _compiler.c from PLIST
I guess some dependency update is to blame that it's not installed
any longer, but I don't know which one.
Bump PKGREVISION.
expat: updated to 2.8.5
Release 2.8.5 Tue September 22 2026
Security fixes:
CVE-2026-93990 -- Reject high surrogates not followed by a
low surrogate during UTF-16 decoding; previously, malformed
UTF-16 could be smuggled into the application using Expat
and could cause arbitrary damage there, depending on how
malformed UTF-16 was handled inside the application;
validation was not their job but Expat's. This is similar
to past vulnerability CVE-2022-25235.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)
Bug fixes:
lib: Fix OOM-related memory leak on a failed overflow check
lib: Fix memory alignment for architectures with 128bit
pointers like CHERI-RISC-V
[39 lines not shown]
lang/ocam/ocaml.mk: Limit findlib bl3 to build phase
This is used to find libraries; it's more or less pkg-config for
ocaml. There's no logical basis for it to be used at runtime by any
ocaml package that uses it to build.
libdvdread: add pkg-config to USE_TOOLS
Library failed to link when dvdcss option was set. Fix is to
add pkg-config to USE_TOOLS, as suggested by Taylor Campbell.
