Pull up following revision(s) (requested by riastradh in ticket #539):
sys/arch/amd64/amd64/machdep.c: revision 1.381
amd64: Make XSAVE area overlap mcontext_t on signal delivery.
Additionally, if the stack pointer is already such that pushing a
struct sigframe_siginfo would make it congruent to -8 modulo the
stack alignment, as the signal handler expects (-8 for the return
address on an aligned stack frame), don't re-align it again -- it's
just fine as is.
Previously, for NetBSD 11.0, we would copy out an XSAVE area
separately from ucontext_t, and copy out the FXSAVE content twice in
two different places on the stack -- one in the ucontext_t for
compatibility so older applications can still read x87/SSE registers,
and one in the XSAVE area:
+-----------------------+ | (other XSAVE stuff) | |
[88 lines not shown]
net/stund: Update to 1.0.1 and assign maintainership
Port been forked, updated and adoped by a new maintainer.
Co-authored-by: Michael Osipov <michaelo at FreeBSD.org>
PR: 299433
[AMDGPU] Don't copy TargetSchedModel in SIPreEmitPeephole (NFC) (#234860)
run() and collectUnpackingCandidates copied the subtarget's scheduling
model, including its ResourceFactors vector, once per block and once per
MFMA. Bind references instead.
Assisted-by: Claude Opus 5.5
py-django-treebeard: updated to 7.0.3
Treebeard 7.0.3 is a bugfix release.
Fixed some instances of nodes holding stale data after a move operation.
Fixed admin tree filters not showing all possible filter options.
Made delete() operations for MP_Node and NS_Node atomic to avoid inconsistent state if an exception was raised during deletion.
py-django-import-export: updated to 4.4.3
v4.4.3
* This release patches a denial-of-service vulnerability in :class:`~import_export.widgets.IntegerWidget`.
``IntegerWidget.clean()`` converted imported values using ``int(Decimal(value))`` with no bound on the
value's magnitude. A value written in exponent notation, such as ``1e1000000``, is cheap to parse as a
``Decimal`` but forces Python to expand every digit when converted to ``int``, a cost that grows
superlinearly with the digit count. A single such value could stall the importing process for several
seconds while pinning a CPU core, and a file containing many such rows multiplied the cost.
``IntegerWidget`` is the default widget for all integer model fields, including the ``id`` column used by
every resource that does not override ``import_id_fields``, so almost every import was affected. The stall
occurred during the initial dry run, before the confirmation step. Python's
``sys.set_int_max_str_digits()`` limit did not protect this path, as it only guards conversions between
``int`` and ``str``, not ``Decimal.__int__``.
This was an availability issue only. The resulting integers exceed the range of any standard database
[22 lines not shown]
py-django-bootstrap5: updated to 26.4
26.4 (2026-10-11)
- **Breaking:** Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.
- **Breaking:** Remove `django_bootstrap5.text.text_concat`. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines
- Remove `BaseRenderer.get_size_class`, which nothing called. The module-level `get_size_class` in `django_bootstrap5.size` is the one in use, and the method shadowed its name inside the class body.
- Fix a `template_name` set on a `RadioSelect`, `CheckboxSelectMultiple` or `ClearableFileInput` subclass being overwritten by this package's own widget template
- Accept a non-string URL value in `css_url`, `javascript_url` and `theme_url`, so a lazy `static()` value can be used directly instead of only inside the dict form
- Recognize `week`, `search` and `color` input-type widgets as form-control widgets, so `addon_before`/`addon_after` work on them, and warn instead of silently dropping addons on a widget that cannot have them
- Add the documented `inline_field_class` setting to `BOOTSTRAP5_DEFAULTS`, where it was missing. Its effective default is unchanged.
- Store `src/django_bootstrap5/widgets.py` with LF line endings, like every other file and as `.editorconfig` requires. It was the only file in the repository with CRLF.
- Support `addon_before`/`addon_after` on fields with `layout="floating"`
- Add a system check that warns about keys in the `BOOTSTRAP5` setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (`django_bootstrap5.W001`). Silence it with `SILENCED_SYSTEM_CHECKS` if you keep extra keys deliberately.
- Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on `github.actor`, which is spoofable in a `pull_request_target` context, and now gates on the pull request author, with `fetch-metadata` as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries `timeout-minutes`, and `ci.yml` declares `permissions: contents: read`.
- Fail `just lint` on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).
- Cover every statement and branch in the test suite, and hold it there with `fail_under = 100`, checked by a `coverage report` step in CI. Until that step existed the floor was set but never run.
- Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.
- Test on Python 3.15 against Django 6.1 and `main`. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.
[10 lines not shown]
py-asgiref: updated to 3.13.0
3.13.0 (2026-10-23)
* It is now possible to nest ``ThreadSensitiveContext`` by providing an
explicit ``executor`` for thread-sensitive tasks. This enables moving a block
of such work away from the parent context's shared worker.
The provided executor must run work sequentially and on a single thread, as
per ``ThreadPoolExecutor(max_workers=1)``, and the calling code is
responsible for managing the executor's lifecycle.
See the README for more details.
* ``Local`` attribute access is now 2-3x faster. ``Local(...)`` now uses one
of two internal specialisations, selected by ``thread_critical``, instead of
checking the mode on every access.
As a result ``Local`` is now marked ``@final`` and raises ``TypeError`` if
[9 lines not shown]
py-pyvcd: updated to 0.5.1
pyvcd-0.5.1 (2026-10-19)
* fix: declare the total bit width for aliases of compound vector variables
* fix: write `realtime`, `shortreal`, and `real_parameter` variable values as
real numbers. `realtime` values were previously written in binary, e.g.
``b1`` instead of ``r1``, and fractional values were rejected
* feat: default sizes for `shortreal` (32) and `real_parameter` (64)
variables
py-evalidate: updated to 2.1.6
2.1.5
Few more checks added to EvalModel.security_check(), including .format() and .format_map(), Thanks to Nagizaaz Shaik
.security_check() and .expr() now methods of EvalModel (backward-compatible).
README.md updated
py-websockets: updated to 17.3
17.3
Improvements
Tested compatibility with uvloop in the :mod:`asyncio` implementation.
Used non-blocking reads in the :mod:`threading` implementation. Depending on platforms, this can make connection termination more reliable.
Bug fixes
Fixed a crash when authenticating client connections with HTTP Basic Authentication using non-ASCII credentials.
Fixed a race condition between receiving the next frame of a fragmented message and canceling :meth:`~asyncio.connection.Connection.recv`.
py-utils: updated to 4.1.4
4.1.4
Build from the source distribution with uv_build 0.13 and later. The build
requirement was uv_build>=0.11,<0.13, so a frontend other than uv, such as
python -m build or a distribution package build, refused to build 4.1.3 once
uv_build 0.13 was the installed version.
py-xlsxwriter: updated to 3.3.0
3.3.0 - October 22 2026
* Added the :func:`set_zoom_to_fit()` method for chartsheets. It ensures that a
chartsheet is zoomed automatically by Excel to fit the screen even when the
window is resized.
* Added alt text ``description`` and ``title`` options to worksheet Tables.
* Added the :func:`use_custom_theme()` method to change the default workbook
theme to a user supplied ``.thmx``, ``.xlsx`` or ``theme1.xml`` file, along
with the ``default_format_properties``, ``default_row_height`` and
``default_column_width`` constructor options to change the default font and
cell size to match the theme.
* Changed the exception raised for an unsupported ``source`` type in
``Image()`` and an unsupported ``theme`` type in ``use_custom_theme()`` from
``ValueError`` to ``TypeError``.
[17 lines not shown]
py-tzlocal: updated to 5.4.5
5.4.5 (2026-10-22)
- Recognize timezone file names with multiple slashes in the TZ environment variable.
- Use HTTPS in place of FTP to retrieve tzdata archive.
py-ruff: updated to 0.17.2
0.17.2
Preview features
[complexity] Add unnecessary-regular-expression-compile
Bug fixes
Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053)
[pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417)
[pylint] Avoid false positive on starred elements (PLE0643)
[pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120)
[pyupgrade] Mark fix unsafe when deleting comments (UP035)
Performance
Avoid intermediate names in lint name resolution
[11 lines not shown]
cad/openscad-devel: Update and enable experimental features
Update to 2026.10.23 and enable experimental features
PR: 299642
Reported by: Arthur Chance
py-dulwich: updated to 1.2.19
1.2.19 2026-10-22
* Keep the assume-unchanged flag (and other index flags) on entries
whose content does not change, rather than clearing it when ``status``
refreshes the stat cache or on reset, checkout, restore, stash pop and
add. (Jelmer Vernooij)
* Split the interactive rebase todo list only on newlines, so a carriage
return or other line separator in a commit subject can no longer add an
instruction such as ``exec`` to the rebase. (Kartik Kenchi)
* In ``update_working_tree``, leave a path alone when one of its leading
directories has been replaced by a symlink, rather than following the
symlink and removing a file outside the work tree. (Kartik Kenchi)
* Walk the commit graph with a ``deque`` in ``_collect_ancestors`` so
enumerating reachable commits (during ``upload-pack`` negotiation and
[6 lines not shown]
py-svglib: updated to 2.3.2
2.3.2 (2026-10-23)
Security
- A long run of digits in the arguments of a path arc command (`A` or `a`)
could make parsing take exponential time, so a tiny SVG could block a
process for minutes or longer (CWE-1333, CWE-400, GHSA-249c-7rgc-f52h).
Arc arguments are now read one token at a time, without regex backtracking.
Parsing of a malformed arc stops at the first argument that does not fit.
Fixed
- Accept explicit plus signs on arc rotation and endpoints, and tab, carriage
return and line feed separators in transform arguments, as allowed by SVG
- `svg2rlg()` no longer unpacks a `.svgz` file to a sibling `.svg` file, which
overwrote an existing file of that name and then deleted it. The compressed
data is now read as a stream
[16 lines not shown]
[OpenMP][offload] Size only reductions that fill the device by their size
A cross-team reduction whose loop is too short for one block per compute
unit now gets the grid of a kernel without a reduction. In SPMD mode,
that is the low-trip-count rule, which lowers the number of threads per
block to spread the iterations over more compute units. Keeping all
threads made such reductions, e.g. one of 1792 iterations, up to 2.5x
slower on MI210.
Claude assisted with this patch.
[OpenMP][offload] Size the grid of cross-team reductions by their size
Every block adds to the cost of combining the partial results of a
cross-team reduction. Launch one block per compute unit for reductions
that work with a reduction data size of more than 32 bytes, and enough
blocks for a per-device number of waves per compute unit (16 on AMDGPU)
for the smaller reduction data sizes, capped by the trip count. Such
kernels keep their number of threads: the low-trip-count reduction of
threads does not apply to them. libomptarget reads the number of compute
units and the platform backend of the device through liboffload, as part
of its geometry properties.
This is an upstream port of the corresponding downstream.
Claude assisted with this patch.
[OpenMP][offload] Trade threads for blocks in Generic-SPMD kernels
The threads of a Generic-SPMD block run the inner parallel loops, whose
trip counts are unknown. Halve the threads down to one warp while the
distribute loop has an iteration for every block, and default to 6
blocks per CU on AMDGPU (LIBOMPTARGET_AMDGPU_GENERIC_SPMD_TEAMS_PER_CU).
libomptarget reads the number of compute units and the platform backend
of the device through liboffload, as part of its geometry properties.
This is an upstream port of the corresponding downstream.
Claude assisted with this patch.
devel/py-evdev: Use the evdev headers from base
evdev 1.9 expects the UI_FF_* constants from uinput.h, but the port
generated its ecodes module only from devel/evdev-proto's
linux/input.h and linux/input-event-codes.h, so "import evdev" fails
with KeyError: 'UI_FF'.
files/patch-v4l_compat, added with the port in 2015 when base had no
dev/evdev headers, removes upstream's #ifdef __FreeBSD__ branches for
<dev/evdev/...> and makes the port build against evdev-proto instead.
Base now installs dev/evdev/input.h, input-event-codes.h and uinput.h,
which evdev's setup.py uses on FreeBSD by default, and build_ext
generates the ecodes module itself. Drop the patch, the evdev-proto
dependency, USES=localbase and the build_ecodes, --evdev-headers and
--include-dirs arguments, and bump PORTREVISION.
The 14.5 and 15.1 base headers define FF_MAX_EFFECTS; older ones
(13.5, 14.2, 14.3, 14.4 and 15.0) lack it, and evdev falls back for it.
[3 lines not shown]
