[clang-tidy][NFC] Move isOverloadedOperator matcher into utils::Matchers (#228548)
AI Usage: Assisted by Grok 4.6 (Cursor)
Co-authored-by: Cursor <cursoragent at cursor.com>
SelectionDAG: Mark inline asm clobbers dead when an output covers the read (#233202)
An inline asm clobber was only marked dead if no glued CopyFromReg
read an overlapping register. A read of an output register that
overlaps a wider clobber kept the whole clobber live, even though the
output def already provides the read value. For example,
"={a1},~{a[0:15]}" left the $agpr0_..._agpr15 clobber live.
Ignore glued reads fully covered by an output def of the asm,
producing the same flags LiveVariables would later add, with a live
def of the output and a dead def of the clobber.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
add warning not to use `Match exec` in /etc/ssh/ssh_config to control
EnableSSHKeysign, as the user effectively controls how `Match exec`
commands are run.
Anthropic ANT-2026-1W8VNWB5
(Anthropic proposed a fix, but IMO this is likely such a rarity that an
admonition is sufficient).
net/tigervnc-viewer: Rebuild against FLTK 1.4
vncviewer that was built with FLTK 1.4 will no longer launch:
ld-elf.so.1: Shared object "libfltk_images.so.1.3" not found, required by "vncviewer"
PR: 300260
net/tigervnc-viewer: Rebuild against FLTK 1.4
vncviewer that was built with FLTK 1.4 will no longer launch:
ld-elf.so.1: Shared object "libfltk_images.so.1.3" not found, required by "vncviewer"
PR: 300260
py-awscrt: updated to 0.38.0
0.38.0
Python 3.15
bind out expected checksum
feat: add support for windows-arm64
Add eventual consistency to fix mqtt test failures
ssh-keysign identifies the name that it will sign a hostbased challenge
for using the connected socket. On some platforms it's possible to
construct that returns an off-host address via getpeername(). In these
cases, ssh-keysign (if enabled) can be tricked into a signing a challenge
for an arbitrary destination if a bunch other default-off dominos fall
just right.
This checks that the peername of the socket is actually an address that
appears on an attached interface.
Anthropic ANT-2026-1BDN8VMO
py-url-normalize: updated to 3.1.0
3.1.0
Changed
BREAKING: Drop support for end-of-life Python 3.10; Python 3.11 or newer is required.
BREAKING: Remove the legacy charset API argument and -c / --charset CLI option.
Declare Python 3.15 support in package metadata.
Require idna>=3.20.
Fixed
Write CLI error diagnostics in UTF-8, including Unicode arguments on Windows.
Strip trailing Unicode IDNA label separators from hosts and custom allowlist domain keys in one normalization pass.
Normalize allowlisted query parameter names consistently with URL query keys, including Unicode and spaces, while keeping literal plus signs, encoded plus signs, and encoded spaces distinct.
Internal
[5 lines not shown]
py-dns: updated to 2.9.1
2.9.1
The resolver now assigns a new random query id to every query.
For transports that require a 0 query id, set it in a way that does not break TSIG.
dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.
DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.
dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.
DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.
dns.ttl.from_text() now rejects a BIND-style TTL that ends in a 0 without a unit, e.g. 1h0, as it already did for other numbers, e.g. 1h5, and as BIND does. The check for a trailing number tested its value instead of whether there was one, so 1h0 was read as one hour.
dns.dnssec.sign_zone() now adds the apex NSEC record when the origin is the only name in a relativized zone. The origin is then the empty name, which is false, so the closing NSEC was skipped and the signed zone had no NSEC at all, and so no authenticated denial of existence (RFC 4035 section 2.3).
TLSA and SMIMEA now reject a certificate association data field whose length does not match the matching type (RFC 6698 section 2.1.3: type 1 is SHA-256, 32 octets, and type 2 is SHA-512, 64 octets), and SSHFP rejects a fingerprint whose length does not match the fingerprint type (SHA-1, 20 octets, RFC 4255 section 3.1.3; SHA-256, 32 octets, RFC 6594 section 3.2). Both the wire and the text parser accepted any length, including empty, so they took records that conforming parsers reject. The DS family already rejects a digest of the wrong length.
A $GENERATE modifier width greater than 127 is now a syntax error, as BIND rejects a substitution that does not fit in 127 characters. The width was not limited, so a short line such as $GENERATE 1-1 ${0,100000000,d} A 10.0.0.1 built a 100 MB padded label before anything was checked, and the dns.transaction.TransactionLimiter meant for untrusted zone files never saw it.
dns.name.from_text() and the parsing of quoted strings and SVCB parameter values no longer take time quadratic in the length of the text. They appended to bytes one character at a time, so e.g. a 1 MB label took about 7 seconds to be rejected as too long.
dns.reversename.to_address() now rejects IPv4 reverse-map names without exactly 4 labels. A label containing an escaped . was joined into the address text, so e.g. 4\.3\.2\.1.in-addr.arpa. and 2\.1.3.4.in-addr.arpa. were both accepted as 4.3.2.1, although only 1.2.3.4.in-addr.arpa. is its reverse-map name.
NSEC3 now rejects an empty Next Hashed Owner Name, as RFC 5155 section 3.1.6 requires a hash length of 1 to 255 octets. The wire parser accepted it, next_name() returned the zone origin, and to_text() wrote an empty field, so reading the text back took the first type mnemonic as the hash, e.g. types NS SOA came back as next ns and type SOA.
BTree zones now keep delegation indexes and node flags consistent when a parent delegation hides or exposes nested NS records, when nodes are copied for a new version, and when CNAME replacement implicitly removes NS records. An origin learned from a zone file is also correctly identified as the origin rather than a delegation when names are absolute.
dns.asyncquery.quic() now verifies the server certificate against the hostname parameter. It passed the deprecated server_hostname alias to the QUIC connection instead, so a query made with hostname= accepted any certificate trusted by the CA set, with no check of the name or address in it. dns.query.quic() was not affected.
DNSSEC validation now rejects an ECDSA signature that is not exactly 64 (P-256) or 96 (P-384) octets long (RFC 6605 section 4), and a DSA signature that is not 41 octets long or whose T octet differs from the key’s (RFC 2536 section 3). The signature halves were read with no length check, so e.g. inserting zero octets before S gave a different RRSIG that still validated.
[14 lines not shown]
py-frozendict: updated to 2.5.0
2.5.0
Breaking changes
Removed frozendict.__deepcopy__. deepcopy() now always returns a copy, even if the frozendict is hashable.
Pure py: | accepts only dict and frozendict, like the C Extension and dict.
Speed
C Extension: freelists for frozendicts and keys make creating small frozendicts faster: the constructor, set() and delete().
C Extension: frozendicts take less memory in some cases.
Pure py: faster set, setdefault, delete and |.
fd | {} and frozendict() | fd now return fd immediately.
Fixes
set, setdefault, delete and | could return a frozendict not tracked by the GC, so its reference cycles were never collected.
[5 lines not shown]
py-cachebox: updated to 6.2.10
6.2.10
This is a patch release fixed a critical bug in TTLCache/VTTLCache (popitem()
method), and focused on correctness, deadlock avoidance, and internal
robustness.
py-wrapt: updated to 2.5.2
2.5.2
Bugs Fixed
The special methods added to the class generated for an wrapt.AutoObjectProxy, and adjusted when __wrapped__ was reassigned, were determined by inspecting the wrapped object itself, rather than the type of the wrapped object. As special methods are only ever looked up on the type of an object, this gave the wrong result in several cases. When the wrapped object was a class, the special methods it defined for its instances were added to the proxy class, so a proxy for a class defining __set_name__() raised TypeError when assigned to an attribute in a class body, a proxy for a class defining __get__() was bound as a descriptor on attribute access, and a proxy for a class defining __await__() or __iter__() was reported as awaitable or iterable by inspect.isawaitable() and collections.abc checks, even though the class itself was not. Special methods provided by the metaclass of a wrapped class, such as __iter__(), were not added to the proxy class. When the wrapped object was an instance, instance attributes shadowing the dunder names were treated as special methods of the wrapped object, and special methods which a __dir__() method of the wrapped object did not report were missed. The special methods are now always determined from the type of the wrapped object, so a proxy behaves the same as the object it wraps. This also covers a wrapt.LazyObjectProxy whose factory returns an object, as resolving the wrapped object reassigns __wrapped__. With thanks to ybai08 for pull request 361 which identified the issue.
[SandboxVec][LoadStoreVec] Don't pack non-integral pointer constants (#236984)
This patch fixes `getEquivalentConstantWithType()` by adding a check
that won't vectorize non-integral pointers constants.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[DAGCombiner] Don't always spill widened dynamic insertelt chains via stack (#232086)
`visitINSERT_VECTOR_ELT` folds a chain of runtime-index inserts
into one stack temporary when `isOperationExpand` says each insert
would spill. That check is true for every illegal type, including
`TypeWidenVector`, so a short vector was spilled even though widening
redoes the insert on the widened type. The predicate now follows
widening and keeps the chain in registers when that insert is
`Legal` or `Promote`.`Custom` action still uses stack, because
that lowering can fall back to a temporary.
On gfx942, the `<9 x double>` tests no longer use scratch. A per-lane
index is lowered with `v_cndmask`, and an index shared by the wave
uses `s_set_gpr_idx`.
It solves https://amd-hub.atlassian.net/browse/ROCM-30603
used cached hostname for `Match host` when UseDNS=yes; avoids multiple
lookups for same host and a different number of lookups when the user
exists vs not.
Anthropic ANT-2026-14BFHJ3R
