interfaces: exclude VLAN devices from virtual queue; closes #10810
They were handled properly in dhcp6c cases later on, but that
changed when they became visible to through the device hook.
This is a direct commit to stable/26.7 since the master code
received a different fix along with assorted refactoring:
d5f3ea33ee7e5bde689c982fb7f858bab76b5025
net/freeipa-client: make host enrollment work on FreeBSD
This update make client enrollment against a net/freeipa-server
working.
PR: 297487
Approved by: kiwi (maintainer)
interfaces: reverse the queue build order to fix the last regression #10810
interfaces_configure() would re-classify VLAN as "software" after
making in pluggable, but the actual intention of the queues build
was that trackers, bridges and dhcp6c interfaces were started up
last. This wasn't given in the loop since the more specific checks
were at the end instead of at the front. It also reduces the
complexity in the processing.
[flang-rt] Fix out of bounds read in ExternalIOTest.cpp (#218966)
The test added by 076da86cd35aa58759c9be7d23ba4cd8693b7414 / #180605
fails when run with ASAN:
```
==339162==ERROR: AddressSanitizer: global-buffer-overflow on address 0xc565e049c86e at pc 0xc565e0ee9268 bp 0xffffd5d7de20 sp 0xffffd5d7de18
READ of size 1 at 0xc565e049c86e thread T0
#0 0xc565e0ee9264 in Fortran::runtime::TrimTrailingSpaces(char const*, unsigned long) /home/davspi01/llvm-project/flang-rt/lib/runtime/tools.cpp:21:19
#1 0xc565e0e41d7c in Fortran::runtime::io::OpenStatementState::set_path(char const*, unsigned long) /home/davspi01/llvm-project/flang-rt/lib/runtime/io-stmt.cpp:291:17
#2 0xc565e0d56a84 in _FortranAioSetFile /home/davspi01/llvm-project/flang-rt/lib/runtime/io-api.cpp:1072:11
<...>
0xc565e049c86e is located 0 bytes after global variable '.str.263' defined in '/home/davspi01/llvm-project/flang-rt/unittests/Runtime/ExternalIOTest.cpp' (0xc565e049c860) of size 14
'.str.263' is ascii string 'opennewextant'
```
The test calls SetFile with "opennewextant" and a length of 15, but the
length of that string is 13 (characters). TrimTrailingSpaces trusts that
length and does `s[n - 1]`, which accesses out of bounds.
Fix this by using the correct length of the string.
[libc++] Fix std::pmr::new_delete_resource() returning underaligned pointers (#219166)
We're currently using `__libcpp_allocate` inside
`std::pmr::new_delete_resource`. `__libcpp_allocate` calls `operator
new` without an alignment argument if the alignment is small enough.
This, however, violates the requirement that `new_delete_resource` needs
to return a pointer with an alignment greater or equal to the alignment
argument, since `operator new` without an alignment argument only has to
return "suitably aligned storage", which basically assumes that `size >=
alignment`. To fix that we can simply call the aligned operator new
unconditionally.
py-django-debug-toolbar: updated to 8.0.0
8.0.0 (2026-09-02)
* Refreshed the toolbar's visual design with self-hosted Alef (panel titles)
and Geist (body text) fonts, an updated color palette, and per-panel
navigation icons.
* Added a new project logo and brand identity, designed by Robin of
`RBNX Studio <https://www.rbnx.studio>`_.
* Added a "Docs" link to the toolbar that opens the documentation.
* Changed the highlight color for the current request and other
"relevant to you" rows from yellow to a green tint, with a left border
accent for legibility in dark mode.
* Added a design guidelines page to the documentation describing the project's
logo, color palette and typography.
* Improved toolbar accessibility: visible keyboard focus, keyboard-operable
scroll regions, reduced-motion support, ``aria-expanded`` on panel toggles,
an ``aria-live`` status for history refreshes, and WCAG 2.1 AA contrast in
both themes.
[12 lines not shown]
py-django-countries: updated to 9.0.0
9.0.0 (10 June 2026)
Features
- Nullable `CountryField` (with `null=True`) now returns `None` instead of `Country(code=None)` when the database value is NULL. This makes the nullability explicit at the field level rather than inside the `Country` object, resulting in cleaner typing where `Country.code` is always a `str` (never `None`).
**Breaking change:** Code that previously checked `obj.country.code is None` should now check `obj.country is None`. The common pattern `if obj.country:` continues to work unchanged.
- Add Django 6.0 and Python 3.14 support. Drop Django 3.2, 5.0, 5.1 and Python 3.8, 3.9. Minimum DRF bumped to 3.14.
- Add an opt-in `Countries.sorted(locale=...)` helper to return country choices sorted by translated display names.
Bugfixes
- Fix multiple type stub issues in `fields.pyi`: correct return types for `Country.name`, `Country.alpha3`, `Country.ioc_code` (now `str` instead of `str | None`), `Country.numeric` (now `int | None` instead of `str | None`), and `MultipleCountriesDescriptor.__iter__` (now `Iterator[Country]` instead of `Any`). Also add missing `blank_label` attribute and accept positional `verbose_name` argument in `CountryField.__init__` overloads.
- Exclude .mypy_cache directory from source distributions (was 73% of the sdist).
Improved Documentation
- Clarify that multiple=True returns a MultipleCountriesDescriptor, not a plain list.
py-django-js-asset: updated to 4.1.0
4.1 (2026-08-28)
- Fixed ``js_asset.Media`` crashing with an ``AttributeError`` when rendering an
asset that only implements Django's plain ``__html__`` contract (neither a
``MediaAsset`` nor one of our ``ImportMap``/``JSON`` types). Such assets now
fall back to ``__html__()`` exactly like ``django.forms.Media`` does; the
nonce cannot be threaded into an opaque ``__html__`` asset, same as with stock
Django.
- Fixed ``js_asset.Media`` treating html-safe strings -- e.g.
``mark_safe('<script defer src="..."></script>')``, a long-documented Django
idiom for embedding a complete asset tag -- as asset paths, so they were run
through ``static()`` and percent-encoded instead of being rendered verbatim.
Anything providing ``__html__()`` now takes the verbatim path, matching
``django.forms.Media``.
- ``js_asset.Media`` additionally renders html-safe strings correctly on Django
6.1, whose own ``forms.Media`` mangles them (fixed in Django for 6.1.1). Only
media built through ``js_asset.Media`` benefits; assets adopted from a plain
[25 lines not shown]
py-django-allauth: updated to 65.19.2
65.19.2 (2026-09-01)
Fixes
- Headless: Posting a well-formed JSON payload that was not an object (e.g. a
list or a string) to the headless endpoints resulted in a server error.
Security notice
- MFA: TOTP enrollment code verification was not rate limited. Impact is
limited, as to exploit this you would need to be already fully authenticated,
pass (rate-limited) reauthentication, and brute force within a 30s TOTP
window.
py-pipx: updated to 1.17.2
1.17.2 - 2026-09-01
Bugfixes
Fix KeyError stderr noise when installing packages in Python3.15.
1.17.1 - 2026-08-30
Bugfixes
pipx environment now reports PIPX_MAX_LOGS, and pipx environment –value PIPX_MAX_LOGS no longer exits with invalid choice.
Miscellaneous internal changes
1.17.0 - 2026-08-29
Features
Add PIPX_COOLDOWN, a default for –cooldown on install, install-all, inject, upgrade, upgrade-all and run, so one release-age policy covers every command. An explicit –cooldown still wins, –cooldown 0 opts a single command out, and a locked install ignores the variable rather than failing.
Bugfixes
Require packaging>=26. Earlier releases serialize a direct reference as name@ url rather than PEP 508’s name @ url, so the specifier pipx recorded in pipx_metadata.json and passed to the backend depended on which packaging happened to be installed.
translate-toolkit: updated to 3.19.19
3.19.19
Changes
Formats and Converters
Apple Stringsdict
Keep direct single-variable format references with their plural
units
Qt QM
Reject malformed messages with invalid lengths
XML-based formats
Honor inherited xml:space attributes to preserve significant
whitespace
Other
[6 lines not shown]
