security/zoneminder: Partially rototill perl dependencies
Organize perl dependencies according to
- what upstream checks for in CMake
- what is used by upstream foo.pm
= what is likely leftover from historical zoneminder packages
This commit is textually large but changes very little in the built
package. It adds dependencies on several needed packages.
As the research papers always say, more rototilling is needed.
lean4: update to 4.32.2.
Lean 4.32.2 (2026-07-28)
This point release fixes a soundness bug in the kernel.
The issue was discovered by Ramana Kumar and reported by Kiran
Gopinathan.
A malicious meta program can trick the kernel into accepting a
proof of False, or any other theorem. The kernel’s handling of
nested inductive types with phantom type parameters was incomplete
and bypassed the type checker.
The bug can be exploited even when using comparator.
The external checker nanoda does not suffer from the same bug.
However, by the nature of this bug, it is possible to write proof
terms that exploit it and at the same time exploit unrelated bugs
[12 lines not shown]
net/xfr: update to 0.9.25
[0.9.25] - 2026-07-31
Fixed
Heavy-loss columns no longer render as red fragments floating at the top of the sparkline — v0.9.24's hue-free severity marking applied reverse video in every theme, but reverse video swaps foreground and background within each cell, and a partial bar glyph only covers the cell's bottom — so the swap painted the empty top fraction and hid the bar (reported by brettowe within a day). Color themes now carry heavy loss as a red bar plus an underline (the artifact-free modifier), and the reverse-video treatment is reserved for the monochrome theme — where the widget now fills the whole column so heavy loss renders as one solid full-height pillar with the throughput bar as a negative silhouette inside it, instead of fragments at whatever height each bar's top cell sat. (#93 follow-up, #158)
[0.9.24] - 2026-07-30
Fixed
Quitting on an effectively-dead link no longer discards your stats — on a zombie connection (e.g. WiFi that is associated but passing nothing), pressing q/Ctrl+C in the TUI waits up to 5 seconds for the server's final summary with a visible Waiting for server (Ns)... countdown, then exits with a partial summary built from locally accumulated counters and a warning — previously it printed "Test cancelled." and dropped everything. One genuinely unbounded hang is also closed: the control-channel Cancel write ran before its timeout was armed, so a full send buffer could stall quit until the test-duration deadline. Partial summaries are never written to --output files. (#159)
Changed
The monochrome theme is now actually usable in sunlight — it was built from hardcoded RGB grays whose mid-tone distinctions are exactly what glare washes out, and its fixed white text was invisible on light terminal backgrounds (the setup that works best outdoors, since dark screens mirror). It now renders in the terminal's own default colors at maximum contrast with just three levels, adapting to dark and light backgrounds alike. Loss severity in the throughput sparkline is additionally encoded without color in every theme: light loss underlines the bar, heavy loss reverses the cell into a bright pillar — so lossy intervals survive glare, monochrome, NO_COLOR, and colorblindness. Setting the standard NO_COLOR environment variable now selects the monochrome theme by default (an explicit --theme, config value, or saved preference still wins, and the env-induced choice is never persisted). (#158)
[0.9.23] - 2026-07-29
Added
[29 lines not shown]
audio/spotify-player: update to 0.24.1
v0.24.1
This release includes a patch to fix an issue resulted from a new policy change from Spotify - https://developer.spotify.com/blog/2026-06-18-refresh-token-expiration. As a result, users will be asked to re-authenticate when they launch the app with the release (to update the corrupted cached token stored in user_client_token.json)
What's Changed
feat(device): track integrated device via is_integrated flag by @aome510 in #1019
fix invalid token with Spotify's new token expiration policy by @aome510 in #1041
v0.24.0
Highlights
The main theme of this release is improving robustness and reliability. Several long-standing pain points around image rendering, authentication, and app stopped working after running for a while have been reworked:
More reliable album art — migrated from viuer to ratatui-image (#969).
Hardened authentication — a more robust OAuth flow, an enforced Web API client, and improved docs make logging in far less fragile (#1013).
Smarter reconnection — reworked auto-reconnect logic so the app recovers more gracefully from dropped connections (#1016).
What's Changed
[19 lines not shown]
shells/oh-my-posh: update to 30.4.0
v30.4.0
Bug Fixes
git: restore main worktree context lazily (d62f1aa)
git: share main worktree cache across worktrees (4ab3524)
git: support main worktree paths in WSL (6885361)
prompt: apply shell integration marks to the transient prompt (986a878), closes #7750
Features
git: expose main worktree path (3d8332f)
v30.3.0
Bug Fixes
git: close native status parity gaps found in review (b89bb81)
studio: use configurator nonce fragment (bd14374)
[9 lines not shown]
sysutils/gravityfile: update to 0.3.0
v0.3.0
Security
Enforced plugin sandbox permissions - Declared PluginPermissions are now bridged into an enforced SandboxConfig scoped to the scan root, so a plugin's filesystem/network/env/command grants are actually applied rather than advisory; filesystem access defaults to deny-all via the new fs_read_roots configuration
Hardened hook dispatch - Added a Tower-based middleware pipeline (timeout/util) around hook dispatch to bound plugin execution
WASM runtime removed - Removed the Extism/WASM plugin runtime because the latest Extism release pins a vulnerable Wasmtime line; Lua and Rhai plugin runtimes remain supported
Fixed
Data-loss-safe overwrites - Overwrite/OverwriteAll copy and move operations now stage into a temporary sibling and atomically swap into place, so a mid-operation failure can never destroy the existing destination
Directory recursion guard - Added a maximum directory recursion depth to prevent stack overflow on adversarially deep nesting during recursive copy/move
Lua value conversion drift - Centralized Lua↔Value conversions in lua/convert.rs so the main runtime and the isolated context can no longer disagree on array-vs-object handling (the isolate previously flattened Lua arrays into objects)
Quit unresponsive during mouse activity - Replaced sync crossterm::event::poll/read drain loop with async EventStream::now_or_never(), fixing key events (q, Ctrl-C) being dropped when mouse motion floods the event queue
Slow quit - Skip event drain, navigation check, and suspend handling once quit is triggered; reduced runtime shutdown timeout from 100ms to 10ms
Terminal cleanup on quit - Drain buffered events after disabling mouse capture before restoring terminal, preventing raw escape sequences from leaking to the shell
Crossterm backend alignment - Updated Ratatui/Crossterm integration to use a single Crossterm 0.29 backend stack
Unused treemd dependency - Removed the optional Rust treemd crate and feature while preserving external treemd command integration
[94 lines not shown]
devel/gitlogue: update to 0.10.0
✨ Features
feat(git): detect renames in diff extraction and preserve old_path (782e28f)
🐛 Bug Fixes
fix(ci): bump cachix/install-nix-action to v31 in release.yml (f9c046f)
fix(ci): bump cachix/install-nix-action from v27 to v31 (d52afc8)
fix(ci): bump rust-cache prefix-key to invalidate stale cache (e2e1fbf)
fix: address CodeRabbit review findings on rename detection and ignore handling (2f50404)
📝 Other Changes
chore: bump version to v0.10.0 (1733beb)
chore(deps): bump clap from 4.6.2 to 4.6.3 (cb16226)
chore(deps): bump serde from 1.0.228 to 1.0.229 (bfa2e8f)
chore(deps): bump anyhow from 1.0.103 to 1.0.104 (59a5273)
[76 lines not shown]
sysutils/dua-cli: update to 2.41.0
2.41.0 (2026-08-03)
There are two major features: 30x and more performance on Windows, and --ignore-from <file> support. This makes this release the best one yet, and I do hope that I can last a week or more until the next one.
New Features
add --ignore-from to exclude paths with gitignore-style patterns Reads gitignore-syntax patterns from one or more files and leaves everything they match out of the report, in both aggregate and interactive mode. This is the equivalent of rsync's --exclude-from and restic's --exclude-file, so the same pattern file can answer "how much of this would actually be backed up?".
Matching is powered by gix-ignore, which is already a dependency, so negation, anchoring, ** and directory-only patterns all behave exactly like Git. Excluded directories are pruned from the walk rather than only hidden, and excluded top-level paths are dropped before the walk so they are absent from the report instead of appearing as empty.
Bug Fixes
propagate background root device errors
Background traversal replaced failed root-device lookups with device ID zero. Readable root metadata could then be rejected as cross-device while the traversal incorrectly retained a successful error count.
Skip roots whose lookup fails and carry their per-root errors in the traversal completion event, restoring the previous statistics and exit status. Keep interleaved overlapping and duplicate roots isolated by including each root path Arc allocation in private directory-map keys while preserving public traversal event types.
[35 lines not shown]
p5-Data-Entropy: update to 0.010.
0.010
[Security]
- The RandomOrg and RandomnumbersInfo sources were not properly fixed in 0.009, and have been removed.
The concept of downloading random data from an external source is flawed.
- This module has been deprecated since version 0.008. Please use an alternative such as
Crypt::URandom, Crypt::SysRandom or Crypt::PRNG.
This now uses Devel::Deprecate to warn loudly about deprecation.
[Documentation]
- Adjusted the Changes file.
0.009
[Security]
- The RandomOrg and RandomnumbersInfo sources now make requests over https. (CVE-2026-18536)
[16 lines not shown]
devel/p5-Devel-Deprecate: import p5-Devel-Deprecate-0.01
Many times we find ourselves needing to deprecate code or have a
deadline and just don't have time to refactor. Instead of trying
to remember about this, posting it to a wiki or sending an email,
it's better to have an automatic way to deprecate something. This
module allows you to do that and embeds the deprecation directly
in the code you wish to deprecate.
As we don't want to break production code, deprecations are only
triggered when running tests.
