Pull up following revision(s) (requested by riastradh in ticket #539):
sys/arch/amd64/amd64/machdep.c: revision 1.381
amd64: Make XSAVE area overlap mcontext_t on signal delivery.
Additionally, if the stack pointer is already such that pushing a
struct sigframe_siginfo would make it congruent to -8 modulo the
stack alignment, as the signal handler expects (-8 for the return
address on an aligned stack frame), don't re-align it again -- it's
just fine as is.
Previously, for NetBSD 11.0, we would copy out an XSAVE area
separately from ucontext_t, and copy out the FXSAVE content twice in
two different places on the stack -- one in the ucontext_t for
compatibility so older applications can still read x87/SSE registers,
and one in the XSAVE area:
+-----------------------+ | (other XSAVE stuff) | |
[88 lines not shown]
net/stund: Update to 1.0.1 and assign maintainership
Port been forked, updated and adoped by a new maintainer.
Co-authored-by: Michael Osipov <michaelo at FreeBSD.org>
PR: 299433
[AMDGPU] Don't copy TargetSchedModel in SIPreEmitPeephole (NFC) (#234860)
run() and collectUnpackingCandidates copied the subtarget's scheduling
model, including its ResourceFactors vector, once per block and once per
MFMA. Bind references instead.
Assisted-by: Claude Opus 5.5
py-django-treebeard: updated to 7.0.3
Treebeard 7.0.3 is a bugfix release.
Fixed some instances of nodes holding stale data after a move operation.
Fixed admin tree filters not showing all possible filter options.
Made delete() operations for MP_Node and NS_Node atomic to avoid inconsistent state if an exception was raised during deletion.
py-django-import-export: updated to 4.4.3
v4.4.3
* This release patches a denial-of-service vulnerability in :class:`~import_export.widgets.IntegerWidget`.
``IntegerWidget.clean()`` converted imported values using ``int(Decimal(value))`` with no bound on the
value's magnitude. A value written in exponent notation, such as ``1e1000000``, is cheap to parse as a
``Decimal`` but forces Python to expand every digit when converted to ``int``, a cost that grows
superlinearly with the digit count. A single such value could stall the importing process for several
seconds while pinning a CPU core, and a file containing many such rows multiplied the cost.
``IntegerWidget`` is the default widget for all integer model fields, including the ``id`` column used by
every resource that does not override ``import_id_fields``, so almost every import was affected. The stall
occurred during the initial dry run, before the confirmation step. Python's
``sys.set_int_max_str_digits()`` limit did not protect this path, as it only guards conversions between
``int`` and ``str``, not ``Decimal.__int__``.
This was an availability issue only. The resulting integers exceed the range of any standard database
[22 lines not shown]
py-django-bootstrap5: updated to 26.4
26.4 (2026-10-11)
- **Breaking:** Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.
- **Breaking:** Remove `django_bootstrap5.text.text_concat`. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines
- Remove `BaseRenderer.get_size_class`, which nothing called. The module-level `get_size_class` in `django_bootstrap5.size` is the one in use, and the method shadowed its name inside the class body.
- Fix a `template_name` set on a `RadioSelect`, `CheckboxSelectMultiple` or `ClearableFileInput` subclass being overwritten by this package's own widget template
- Accept a non-string URL value in `css_url`, `javascript_url` and `theme_url`, so a lazy `static()` value can be used directly instead of only inside the dict form
- Recognize `week`, `search` and `color` input-type widgets as form-control widgets, so `addon_before`/`addon_after` work on them, and warn instead of silently dropping addons on a widget that cannot have them
- Add the documented `inline_field_class` setting to `BOOTSTRAP5_DEFAULTS`, where it was missing. Its effective default is unchanged.
- Store `src/django_bootstrap5/widgets.py` with LF line endings, like every other file and as `.editorconfig` requires. It was the only file in the repository with CRLF.
- Support `addon_before`/`addon_after` on fields with `layout="floating"`
- Add a system check that warns about keys in the `BOOTSTRAP5` setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (`django_bootstrap5.W001`). Silence it with `SILENCED_SYSTEM_CHECKS` if you keep extra keys deliberately.
- Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on `github.actor`, which is spoofable in a `pull_request_target` context, and now gates on the pull request author, with `fetch-metadata` as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries `timeout-minutes`, and `ci.yml` declares `permissions: contents: read`.
- Fail `just lint` on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).
- Cover every statement and branch in the test suite, and hold it there with `fail_under = 100`, checked by a `coverage report` step in CI. Until that step existed the floor was set but never run.
- Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.
- Test on Python 3.15 against Django 6.1 and `main`. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.
[10 lines not shown]
py-asgiref: updated to 3.13.0
3.13.0 (2026-10-23)
* It is now possible to nest ``ThreadSensitiveContext`` by providing an
explicit ``executor`` for thread-sensitive tasks. This enables moving a block
of such work away from the parent context's shared worker.
The provided executor must run work sequentially and on a single thread, as
per ``ThreadPoolExecutor(max_workers=1)``, and the calling code is
responsible for managing the executor's lifecycle.
See the README for more details.
* ``Local`` attribute access is now 2-3x faster. ``Local(...)`` now uses one
of two internal specialisations, selected by ``thread_critical``, instead of
checking the mode on every access.
As a result ``Local`` is now marked ``@final`` and raises ``TypeError`` if
[9 lines not shown]
py-pyvcd: updated to 0.5.1
pyvcd-0.5.1 (2026-10-19)
* fix: declare the total bit width for aliases of compound vector variables
* fix: write `realtime`, `shortreal`, and `real_parameter` variable values as
real numbers. `realtime` values were previously written in binary, e.g.
``b1`` instead of ``r1``, and fractional values were rejected
* feat: default sizes for `shortreal` (32) and `real_parameter` (64)
variables
py-evalidate: updated to 2.1.6
2.1.5
Few more checks added to EvalModel.security_check(), including .format() and .format_map(), Thanks to Nagizaaz Shaik
.security_check() and .expr() now methods of EvalModel (backward-compatible).
README.md updated
py-websockets: updated to 17.3
17.3
Improvements
Tested compatibility with uvloop in the :mod:`asyncio` implementation.
Used non-blocking reads in the :mod:`threading` implementation. Depending on platforms, this can make connection termination more reliable.
Bug fixes
Fixed a crash when authenticating client connections with HTTP Basic Authentication using non-ASCII credentials.
Fixed a race condition between receiving the next frame of a fragmented message and canceling :meth:`~asyncio.connection.Connection.recv`.
py-utils: updated to 4.1.4
4.1.4
Build from the source distribution with uv_build 0.13 and later. The build
requirement was uv_build>=0.11,<0.13, so a frontend other than uv, such as
python -m build or a distribution package build, refused to build 4.1.3 once
uv_build 0.13 was the installed version.
py-xlsxwriter: updated to 3.3.0
3.3.0 - October 22 2026
* Added the :func:`set_zoom_to_fit()` method for chartsheets. It ensures that a
chartsheet is zoomed automatically by Excel to fit the screen even when the
window is resized.
* Added alt text ``description`` and ``title`` options to worksheet Tables.
* Added the :func:`use_custom_theme()` method to change the default workbook
theme to a user supplied ``.thmx``, ``.xlsx`` or ``theme1.xml`` file, along
with the ``default_format_properties``, ``default_row_height`` and
``default_column_width`` constructor options to change the default font and
cell size to match the theme.
* Changed the exception raised for an unsupported ``source`` type in
``Image()`` and an unsupported ``theme`` type in ``use_custom_theme()`` from
``ValueError`` to ``TypeError``.
[17 lines not shown]
py-tzlocal: updated to 5.4.5
5.4.5 (2026-10-22)
- Recognize timezone file names with multiple slashes in the TZ environment variable.
- Use HTTPS in place of FTP to retrieve tzdata archive.
