NAS-145061 / 27.1.0 / Document a Secret field's default as its value in the API schema (by AlexKarpov98) (#20178)
`BaseModel` wraps a concrete default on a `Secret[...]` field in a
`Secret` (see `test_secret_default_wrap.py`). Pydantic encodes that
default in the JSON schema as the secret's redacted display: `""` for a
falsy value, `"**********"` otherwise. So the dump documents, for
example, `S3CredentialsModel.skip_region` as `{"type": "boolean",
"default": ""}` and `max_upload_parts` as `{"type": "integer",
"default": "**********"}`.
A default whose type contradicts its schema breaks generated clients.
`json-schema-to-typescript`, which `@truenas/api-client` uses, emits
`boolean & string` for these fields. That type is `never`, so no caller
can write them through the typed client.
## Changes
`utils.pydantic_.model_json_schema`, the one place the dump, the docs
and `get_json_schema` build schemas from, now uses a
[31 lines not shown]
[flang][OpenACC] Emit acc.reduction_combine for integer min and max (#240600)
Integer min/max reduction recipes were expanded into a load, arith.minsi
or arith.maxsi, and a store. GPU lowering only emits a cross-gang atomic
for acc.reduction_combine, so an array reduced across gangs could keep a
single gang's partial result. Integer min and max have no NaN edge
cases, so emit the combine operation for them. Floating-point min and
max stay expanded.
[AMDGPU] Fix repeated byte selector detection in dot4 combines (#240625)
The dot4 combine in `performAddCombine` can incorrectly omit byte
permutations when both inputs use the same repeated byte selectors.
The uniqueness check compares selectors in their original bit positions,
so identical nonzero selectors can compare unequal. Normalize each
selector to the low byte before comparing.
For example, a sum using byte pairs [1, 2, 1, 3] previously became a
dot4 over the original inputs, computing byte pairs [0, 1, 2, 3]. The
fixed output permutes both inputs before the dot4.
Adds a regression test to `idot4s.ll`.
OpenSSH: Update to 10.6p2
Full release notes are available at
https://www.openssh.org/txt/release-10.6p2 .
Selected items from the upstream release notes:
Future deprecation notice
-------------------------
* scp(1): begin deprecating the -R flag, which is used to perform a
remote-to-remote copy by executing scp on a remote host. This
option is a fragile optimisation that is difficult to use because
it requires credentials on the remote host. It also creates
security risks if the shell quoting rules on the remote system
where the copy is performed differ from the client's expectations.
From OpenSSH 10.6, this option will continue to work but will
cause a deprecation warning to be emitted to standard error. In
[6 lines not shown]
Expect the Reports folder in the Spotlight access test
test_the_user_does_not_find_what_the_user_cannot_open searches for
names that start with "report". The search ignores case. Thus the
folder Reports is a hit too. The test now expects the folder and the
file in it. The private file is still not a hit.
NAS-145128 / 28.0.0-BETA.1 / Validate container configuration values when they are saved (#20168)
## Problem
Several container settings passed create and update but only failed at
start, often as a raw IndexError or ValueError: an unparseable or empty
init, a cpuset with whitespace or CPUs that are not online, and a memory
limit above host RAM. A missing initdir made start report success for a
container that exited immediately.
## Solution
- **Save time**: init must parse to at least one token; cpuset must be
well formed and online, and memory within host RAM. The cpuset and
memory checks only run when the value changes, so a host that has since
lost CPUs or memory does not block unrelated edits.
- **Start time**: initdir must resolve to a directory inside the
container root.
- **Migration**: an incus CPU count, or a CPU set or memory limit this
host can't satisfy, is dropped with a job log line instead of failing
the container.
[3 lines not shown]
Revert "Reland "[compiler-rt][test] Apply CFLAGS from sanitizer_commo… (#240790)
This reverts commit #239742 as its causing buildbot failures for
clang-armv8-lld-2stage
https://lab.llvm.org/buildbot/#/builders/122/builds/352
tests: add test for NetworkInterface, one of the main risk points is slipping in changes that don't belown. This case tests if we are flushing out more than we should.
includes a minor change in NetworkInterface to choose our target filename for testing.
Services: Kea DHCPv4: Add a simple shared_networks option to subnets (#11115)
Subnets can now select an interface, subnets with the same interface will be put into a shared network.
This means its not decided by the interface IP of the receiving interface anymore, but by a mandatory client-classes membership
which is decided by matching a single DHCP option of the users choice as the gatekeeper to the subnet.
This way, multiple subnets can be served from the same interface.
(cherry picked from commit 1a3533dfbbd6865a7ecb05b5679f3ea00b71101f)
[NFC] Fixup comment on ADL re-visit prevention (#240400)
This comment is actually absolutely crap anyway, I don't know how I
managed to 1/2 english this :D As reported on #238975 the use of
'record' when dealing with record-decls was confusing. As I looked
again, I apparently gave up 1/2 way through typing the sentence to this
and the next declaration.
This patch fixes up both comments.
firefox153: update to 153.7.0
Mozilla Foundation Security Advisory 2026-127
Security Vulnerabilities fixed in Firefox ESR 153.7
Announced
November 10, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.7
#CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
Reporter
Mozilla
[886 lines not shown]
[NFC] Clarify comment on initializer size history, per request. (#240395)
As a followup to #239011, clarify the previous state of the initializer
size in the bitfield so we aren't tempted to do it again.
OpenSSH: Update to 10.6p1
This release contains security fixes and small bugfixes.
Full release notes are available at
https://www.openssh.com/txt/release-10.6 .
Selected items from the upstream release notes:
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind at openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
[33 lines not shown]
Interfaces: Devices: Point-to-Point - extend line ending validation to other fields as well.
PR: GHSA-f35q-c34m-pfw3
(cherry picked from commit c83cd64519769f1cbc60c3d3db4c16b151a4b33a)
[mlir][Dataflow] Revisit region arguments when operand change (#239658)
Alternative to https://github.com/llvm/llvm-project/pull/238782
`gpu.launch` body args weren't revisited after input dims lattice
changes.
* Add `GetLatticeFn` to sparse forward analysis
`visitNonControlFlowArguments`, obtaining lattice through it
automatically subscribe block on this lattice so it is revisited when
lattice change.
* Update `IntegerRangeAnalysis` and `IntegerDivisibilityAnalysis`.
* nonSuccessorInputs/nonSuccessorInputLattices may not match
successor.getSuccessor()->getArguments(), so compute index in
nonSuccessorInputs in `IntegerRangeAnalysis`.
Note to LLVM integration:
`SparseForwardDataFlowAnalysis::visitNonControlFlowArguments` now takes
an additional `GetLatticeFn getLattice` parameter. Use
[3 lines not shown]
