editors/2bsd-vi: Take maintainership
PR: 300135
Approved by: Chris Hutchinson <portmaster at BSDforge.com> (former maintainer)
Approved by: osa, fluffy (mentors, implicit)
py-vcrpy: updated to 9.4.0
9.4.0
SOCKS proxies
Requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h://, with PySocks installed) are now recorded and played back. urllib3 uses its own connection classes for them, which vcrpy didn't patch, so these requests skipped the cassette entirely
Multipart form filtering
filter_post_data_parameters now filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data={"api_key": ...}, files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded
If you match on body: requests are filtered before they're matched, so cassettes recorded with unfiltered multipart bodies need re-recording.
Fixes
Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use
Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response()
py-cachetools: updated to 7.2.8
v7.2.8 (2026-10-31)
- Fix type stubs for ``TTLCache`` and ``TLRUCache`` with default
``timer``.
- Minor documentation and unit test improvements.
v7.2.7 (2026-10-28)
- Various performance improvements.
- Minor unit test improvements.
v7.2.6 (2026-10-26)
- Various performance improvements.
py-rapidjson: updated to 1.26
1.26 (2026-11-01)
* Add Windows ARM64 build
* Fix parse_mode flags without native or NaN number modes
* Validate number_mode in load and Decoder
* Reject JSON input truncated at an embedded NUL
* Reject oversized datetime, UUID and parse mode values before narrowing them to
their internal representations
* Generate wheels for riscv4
* Reject embedded NUL truncation in ``Validator`` schemas and documents
[5 lines not shown]
py-aioquic: updated to 1.7.1
1.7.1
* Fix streams which never ended when their FIN, written after all their data
had been sent, did not fit in the packet being built: the FIN was never
sent, so the peer kept waiting for it.
* Derive the keys for QUIC version 2 key updates with the ``quicv2 ku``
label, as :rfc:`9369` requires. After its first key update, a QUIC version
2 connection could no longer exchange packets with a conforming peer.
* Reject a FIN or RESET_STREAM whose final size is below the data already
received with ``FINAL_SIZE_ERROR``, as :rfc:`9000` recommends, instead of
silently discarding the data beyond it.
* Drop 1-RTT packets which a server receives on a connection ID it never
issued or which the client retired, as :rfc:`9000` requires, instead of
switching to that connection ID.
* Discard Retry packets which a client receives after processing a packet
from the server, or whose Retry Token is empty, as :rfc:`9000` requires.
Such a Retry restarted the connection attempt, and broke an established
[4 lines not shown]
[StructurizeCFG] Fix miscompile with prefix flow blocks in loops (#217737)
Loop predicates stayed keyed on the original header after the backedge
moved to a new prefix block, causing an incorrect early loop exit
www/freenginx-acme-module: Align CPE_PRODUCT with the NVD naming scheme
Same change as in www/nginx-acme, both ports build the same upstream
module.
Sponsored by: Netzkommune GmbH
www/nginx-acme: Align CPE_PRODUCT with the NVD naming scheme
The NVD has no dictionary entry for this module yet, so the name is a
prediction. Every F5 product in the dictionary spells its name with
underscores, from nginx_open_source to nginx_modsecurity_waf, so
nginx_acme is the form the entry will most likely take.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Switch CPE_PRODUCT to nginx_open_source
The NVD files current nginx vulnerabilities under f5:nginx_open_source
rather than f5:nginx.
Sponsored by: Netzkommune GmbH
www/nginx: Switch CPE_PRODUCT to nginx_open_source
The NVD changed the product name it files nginx vulnerabilities under.
All 26 advisories published since February 2024 use f5:nginx_open_source,
while f5:nginx has received a single one in that time, CVE-2025-23419.
The two sets of CVE identifiers do not overlap at all, so the old name
no longer matches current advisories.
Sponsored by: Netzkommune GmbH
ggml: update to 0.28.0.
This release adds a fused sparse-attention masking operation
(GGML_OP_TOP_K_MASK) with CPU, CUDA and Metal implementations, plus
accessors to read the precision configured on a compute node. MoE
and sparse-attention dispatch got cleaner semantics: an index of
-1 in MUL_MAT_ID / ADD_ID now means "skip this slot", so backends
skip the work and zero the output row instead of relying on
out-of-range index patching. The core relaxes SCALE to non-contiguous
views and SUM to non-contiguous inputs. Backends gained a lot of
throughput: MoE top-k and gate/up+GLU fusions and chunked graph
launches on CUDA, graph record/replay and XMX matrix-engine kernels
on SYCL, cooperative GEMMs, Q2_K/Q3_K weights and a lightning
indexer on OpenCL, subgroup reductions and src1 precision control
on Vulkan, and a restructured HTP backend with new repacking and
fusion machinery on Hexagon. ZDNN gained flash attention and WebGPU
gained Q2_0.
gobgp: Update to 4.11.0
Changelog
53ceb78 GoBGP 4.11.0
e01141a server: prepare peer state before advertising initial routes
d234c86 test: rename the route server policy scenarios to ExportPolicy
632031d test: remove duplicated route server policy scenarios
1c501ef test: use a soft reset out in the route server policy update scenarios
10d3f16 server: send the peer description in WatchEvent peer events
07af837 table: count destinations in the Adj-RIB-In table info
4b289a8 server: compare the AS too when matching a path to its source peer
1955816 ci: do not install linux-modules-extra on kernels that do not have it
6afb03a table: use the router ID when a reflected route has no cluster ID
f22b5dd table: look at every segment for an ASN as-path pattern
30786de packet/bgp: reject AS 0 in the path and aggregator attributes
9b86c50 server: check the label chunk from zebra before using it
bb09f17 packet/bgp: reject an EVPN MAC/IP route with a MAC length other than 48
3e7e231 zebra, server: do not wait forever for zebra to answer
a6798ec security: treat zebra as trusted
[169 lines not shown]
