waybar: update to 0.16.0
What's Changed:
ci: bump flake lock actions by @khaneliman in #4822
fix: update tooltip method to use pango markup formatting by @Cprakhar in #4831
Fix include of poll.h by @hannesbraun in #4828
fix(image): treat missing interval as once by @khaneliman in #4838
docs: fix typo in waybar.5 in expand-right field info by @esensar in #4847
fix: remove unnecessary console log for battery status by @Cprakhar in #4844
memory: use markup rather than text for memory tooltip by @chrisvittal in #4858
fix: use pango markup for consistent formatting in format and tooltip-format by @Cprakhar in #4857
fix: use SafeSignal in ipc in order to not call GTK funcs from a thread by @sliedes in #4854
fix(keyboard-state): fix segfault on device hotplug removal by @tobixen in #4852
hyprland/workspaces: Add enable-bar-scroll option by @VAWVAW in #3088
bump: niri/workspaces: change icons priority by @cebem1nt in #4869
fix: ensure AAppIconLabel image remains not visibile if icons are disabled by @olliestone in #4863
fix(cava): remove silent CSS class on reactivation by @GG2R10 in #4874
feat: add tooltip-format config option in cpu module by @Cprakhar in #4856
[326 lines not shown]
p5-HTTP-Body: update to 1.25.
TOOL_DEPENDS -> TEST_DEPENDS for a test dependency.
1.25 2026-11-05 18:47:08+01:00 Europe/Berlin
- SECURITY, CVE-2026-117500: the suffix of an upload's filename is
worked out from its last 255 bytes only, only when $file_temp_suffix
is unset, and for the default $basename_regexp by a string search
instead of the regexp; a filename of many dots ending in a backslash
made the default $basename_regexp take time quadratic in its length
(7 s per part at the 32 KiB header limit, once per part) in the
default configuration
- SECURITY, CVE-2026-117501: a chunked body is framed line by line with
a limit on the chunk-size line ($HTTP::Body::max_chunk_line_size,
1024 bytes), chunk data is passed on as it arrives instead of being
held until the chunk is complete, malformed framing (a line that is
no chunk-size line, a size that does not fit an integer, chunk data
not followed by CRLF) croaks instead of buffering forever, and
nothing after the trailer or after the body parser is done is kept
[21 lines not shown]
Update to version 2.46
- fix downloads of wrong audio for some words that give multiple
search results in 'pthai-url-lingopolo
- add consonant names to 'pthai-consonants
- allow audio play of individual consonants in 'pthai-highlight-say-bounds
- return full thai name and class in 'pthai-lookup-consonant
- for 'pthai-show-* functions, unify display formatting
- clean up comments in a few places
routinator: Update to version 0.16.0
Breaking changes
Enabled ASPA and BGPsec by default. The command line options --enable-aspa and --enable-bgpsec have been replaced with --disable-aspa and --disable-bgpsec, respectively. (#1112)
Enabled strict validataion mode is by default. The command line option --strict has been replaced with --relaxed. (#1112)
Added the ability to separately configure if and where repository issues get logged via the new repository-log-level, repository-log and friends. The previous log-repository-issues was removed in favour of this new scheme.
This also slightly changes the JSON produced by the /status endpoint. (#1088)
Limited the value of the refresh option to a week to avoid integer overflows. (#1144)
New
Added support for Resource Signed Checklists (RSC, RFC 9323). (#1077)
Added support for SLURM v2 which adds filtering and adding ASPA assertions. (#1106)
Improvements
Reject any rsync argument starting with --rsh. (#1150)
Reject a history-size of 0. (#1151)
Bug fixes
Correctly merge ASPAs with an AS0-only provider list. (#1143)
[11 lines not shown]
basilisk: Update to 2026.11.01
This brings basilisk up to the most recent version of UXP (Pale Moon's
engine), with associated web compatibility and security fixes.
geography/qgis: Update comment about LTR status
3.44 remains LTR, and a 4.x blessed as LTR is expected in Spring 2027
at the earliest. (And just this week, 4.4.0, was delayed due to
unresolved blockers.) Point out wip/qgis for people looking for qgis4
in the meantime.
py-cachetools: updated to 7.3.0
v7.3.0 (2026-11-05)
- Use ``OrderedDict`` for defined and faster ``LFUCache`` eviction.
- Various unit test improvements.
- Minor type stub improvements.
- Minor documentation improvements.
py-authlib: updated to 1.9.5
1.9.5
Security
authlib.jose refuses as an HMAC secret every OpenSSH public key or certificate that it can load as an RSA, EC or OKP key. It used to accept a key with a tab after the key type, and certificates. These keys verify RS256 and EdDSA tokens, so anyone who knew the public key could forge an HS256 token for an application that did not restrict the algorithms. This completes the fix for CVE-2026-114615. GHSA-f7j6-p4qx-gq99
translate-toolkit: updated to 3.20.4
3.20.4
This release improves translation key validation and fixes Nextcloud
JSON fallbacks for untranslated strings.
openvpn: updated to 2.7.9
2.7.9
Security fixes
- win32: restrict loading plugin dependencies (DLLs) to plugin, app
and system directories.
- win32: run openvpn.exe from the interactive service at "high integrity
level", that is, process memory of openvpn.exe and all its threads are
protected from tampering. Signals/Events are still permitted.
- win32: openvpnserv: strictly filter user-defined environment variables
before passing to openvpn.exe (CVE-2026-121720)
- win32: openvpnserv: make validation of openvpn command line more robust
to invalid-quoting attacks (CVE-2026-115342)
[63 lines not shown]
multimedia/moviebox-tui: fix dependency
Spotted by leot@ during mpv revbump.
moviebox-tui only depends on the mpv executable.
While here remove duplicate line.
ansible-lint: updated to 26.11.0
26.11.0
fix: pin Python to 3.13 to avoid Ansible compatibility issues with…
Amazon Linux 2027 is in Preview
fix: resolve collection playbooks with extensions
fix: preserve explicit YAML tags like !!python/name during --fix
fix: do not color stderr output when stderr is redirected
Combine cache exclusion, YAML formatting, and event-query fixes
perf: avoid deepcopy in _sanitize_task
fix(security): update dependencies to resolve Dependabot alerts
ansible-core: updated to 2.21.6
2.21.6
Minor Changes
- ansible-test - Replace FreeBSD 14.4 remote with 14.5.
- ansible-test - Replace FreeBSD 15.0 remote with 15.1.
- ansible-test - Replace RHEL 10.1 remote with 10.2.
- ansible-test - Replace RHEL 9.7 remote with 9.8.
Security Fixes
- ``ansible-galaxy collection install`` - fix validating ``FILES.json`` entries are contained in the collection before creating them. (CVE-2026-89091)
- ``ansible-galaxy role install`` - fix validating the role name is contained to the configured role path. (CVE-2026-105929)
Bugfixes
- ansible_facts - initial facts from ``run_once`` tasks no longer reference the same object and can be updated for individual hosts
[4 lines not shown]
py-markdown: updated to 3.11.3
3.11.3 - 2026-11-05
Fixed
* Fix cases in new emphasis handling that did not handle long chains of tokens
like they should
* Fix quadratic-time parsing of many consecutive reference definitions, and of
many consecutive footnote definitions in the `footnotes` extension.
* Support automatic links with URL schemes other than HTTP and FTP, such as
`<ssh://example.org>`
* Fix quadratic-time id generation in the `toc` extension when many headers
share the same text.
* Ignore glossary abbreviations with empty definitions after inline elements,
consistently with abbreviations before inline elements.
* Strip complete HTML tags with quoted `>` characters from `toc` labels and
generated heading IDs.
* Fix quadratic-time regex backtracking in `attr_list` when a block ends with an
[13 lines not shown]
py-ruff: updated to 0.17.4
0.17.4
Preview features
[flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004)
[security] Implement tarfile-ignore-zeros-true
Bug fixes
Accept a bare raise before a semicolon
Allow match identifiers after a semicolon
Fix panic on BOM-prefixed files in diagnostic renderer
[flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102)
Rule changes
Show more nonprinting characters in diagnostic fix diffs
[28 lines not shown]
