bsd.buildlink.mk: add hack/workaround for PR 57517
Something, at some point, some years back, changed the interaction of
things such that for builtin packages, BUILDLINK_PREFIX.pkg gets set
before we're done assessing whether to use the builtin package, and in
particular before the logic that makes USE_BUILTIN.pkg=no transitive
across deps.
The result has been that when this logic sets USE_BUILTIN.pkg=no, it's
ignored and we buildlink and use the builtin package anyway. This then
results in broken builds of things like fontconfig and Xft2 where this
matters.
As a workaround, clear BUILDLINK_PREFIX.pkg if we set USE_BUILTIN.pkg
to no in this logic. It will then get set to PKGBASE as needed later.
Strengthen the comments in and around this logic too, as what it does
is itself somewhat complicated and confusing and the implementation
is more so.
[4 lines not shown]
py-pydantic*: update to 2.50.2/2.14.2
This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.
Packaging
Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @Viicos in #14003
Bump speedate to v0.18.0 by @Viicos in #14007
Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @Viicos in #14083
Performance
Avoid Python tuple allocation during model fields validation by @Viicos in #13955
Lazily call repr of values during nested union serialization by @Viicos in #14082
Skip decorator field checks when no field decorators exist by @alexmojaki in #14111
Avoid heap allocation for small JSON model field buffers by @alexmojaki in #14113
Fixes
[49 lines not shown]
py-zensical: update to 0.0.74.
This version adds support for the optimize plugin and includes
fixes for redirects, blog dates, validation settings, privacy
downloads, and llms.txt output.
py-websockets: update to 17.4.
Security fix
websockets 17.4 fixes a security issue.
:meth:`~asyncio.connection.Connection.recv` now rejects fragmented messages split into more than 4096 frames. You may adjust the limit with the :envvar:`WEBSOCKETS_MAX_FRAGMENTS` environment variable.
Earlier versions were vulnerable to denial of service by memory exhaustion because they didn't enforce such a limit (CVE ID pending). All implementations were affected.
:meth:`~asyncio.connection.Connection.recv_streaming` isn't affected.
Improvements
Chained consistently to :exc:`~exceptions.ConnectionClosed` exceptions that close the connection.
py-urwid: update to 5.0.1.
Urwid 5.0.0
2026-10-28
Breaking Changes ⚠
Drop Python 3.9 and 3.10: urwid requires Python 3.11 or newer by @penguinolog in https://github.com/urwid/urwid/pull/1401
Allow display attributes to inherit colors and settings: canvas content and Text.get_text() carry LayeredAttr for nested attributes, custom screens have to call BaseScreen.resolve_attr() instead of reading the palette, and an attribute an AttrMap maps to None shows the map’s None attribute by @penguinolog in https://github.com/urwid/urwid/pull/1409
🗹 AttrSpec foreground and background default to 'inherit'; also a new feature, see “Major features” below: Draw OSC 8 hyperlinks from display attributes by @penguinolog in https://github.com/urwid/urwid/pull/1415
Drop code planned for removal in 5.0: the Columns, Pile, GridFlow, Frame and ListBox get_focus/set_focus methods and 1.1-era list attributes, the Frame header/body/footer getters and setters, ListBox.contents() called as a method, content_delta, shards_delta, shard_cviews_delta, BaseScreen.run_wrapper, font.add_font, WidgetWrap._set_w, AttrWrap.w and Filler.body; MonitoredDeque.insert() with an index without __index__ raises TypeError by @penguinolog in https://github.com/urwid/urwid/pull/1402
⚡ Remove the vterm escape compatibility constants and plain-tuple CSI_COMMANDS entries, return WHSettings members from Pile.options() for 'given' and 'weight', and require typing_extensions on Python older than 3.13; also see “Deprecations” below: Unify deprecation warnings and removal versions by @penguinolog in https://github.com/urwid/urwid/pull/1421
Stop re-exporting unrelated names from urwid.graphics by @penguinolog in https://github.com/urwid/urwid/pull/1163
[237 lines not shown]
py-sphinx-autoapi: update to 3.9.0.
Features
Detect source file changes based on content hashing instead of modification time to support caching in CI environments. (#573)
Bugfixes
Stop documenting code under if __name__ == "__main__". Only its first definition used to show up, now none of it does, as with autodoc. (#429)
Fix autoapisummary showing only the return annotation of a function, in place of its arguments. (#531)
Create directory symlinks used by the test suite at runtime so tests pass from source distributions. (#565)
Fix infinite recursion when a nested class inherits from its enclosing class. (#571)
Improved Documentation
Update the landing page grid layout so that the cards stack on narrow screens (#575)
py-platformdirs: update to 4.14.3.
4.14.3
Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (#679) by @mikegit123git and @gaborbernat.
4.14.2
Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (#677) by @AlvaroBalbin and @gaborbernat.
4.14.0
Features
Accept a keyword-only ensure_exists in the module-level media directory functions, such as user_documents_path, to create a directory set through XDG_*_DIR or user-dirs.dirs (#656) by @darrenhuai and @gaborbernat.
Bug fixes
Return the media and fonts directories under root's home for root with use_site_for_root, ignoring the invoking user's XDG_*_DIR, user-dirs.dirs and XDG_DATA_HOME, and create no inherited media directory under ensure_exists (#661) by @gaborbernat.
[33 lines not shown]
py-fonttools: update to 4.68.0.
[feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
[scaleUpem] Also scale the MATH lengths that are not MathValueRecords (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
[cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
[instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
[cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
[feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
[designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
[instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
[filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
[glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
[ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
[VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
[woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
Build Windows ARM64 wheels (#4366).
[instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).
py-filelock: update to 4.2.6.
4.2.6 (2026-10-31)
Fixed
=====
- Fix a race in :class:`~filelock.SoftFileLock`, :class:`~filelock.MarkerSoftFileLock` and
:class:`~filelock.SoftFileLease` when three or more contenders reclaim a dead marker. The race could strand a live
holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the
marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the
contender leaves its marker at the lock path for later recovery (:pr:`899`) by :user:`dxbjavid` and
:user:`gaborbernat`.
4.2.5 (2026-10-30)
Fixed
=====
[50 lines not shown]
py-deepmerge: update to 4.0.0.
Handle mixed dictionary key types in append_unique by @vitalivo in #44
Handle unhashable tuples in append_unique by @xingzhao-ji in #47
(fix with breaking changes): Deduplicate incoming values in append_unique by @muneikh in #46
openexr: update to 3.5.3.
## Version 3.5.3 (October 30, 2026)
Patch release that addresses 15 security vulnerabilities, 10 with
pending CVE IDs, primarily heap buffer overflows and out-of-bounds
writes triggered by malformed or malicious EXR files — several capable
of remote code execution. See the Security section below for details.
This release includes no new features or changes in behavior other
than improved error detection and rejection of invalid input, except
for a fix for a regression introduced in v3.4.14 in reading deep
images on big-endian hosts, due to a byte-order bug that returned an
incorrect deep sample count table. Little-endian hosts are unaffected.
As part of this effort, the full test suite now passes cleanly under
the address, undefined-behavior, and thread sanitizers.
Also in this release:
[11 lines not shown]
