libmikmod: updated to 3.3.15
3.3.15
- Fix out-of-bounds writes in unimod version 6 loader with crafted files.
- Reject zero-channel samples to avoid division by zero.
pf: Drain the overload task before a vnet's rules are freed
pf_src_connlimit() queues an entry for pf_overload_task() when a
source exceeds max-src-conn or max-src-conn-rate and the rule has an
overload table. The entry holds a pointer to the rule, and the task
runs from taskqueue_swi with the vnet of the queue. Nothing drained
the task when the vnet went away: an entry queued just before could
be applied to a rule pf_unload_vnet_purge() had freed, or to a vnet
that was gone.
Drain the task at the start of pf_unload_vnet_purge(), before the
unlinked rules are freed. No packet can queue another by then, as the
hooks are already removed.
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60529
pf: Drain the overload task before a vnet's rules are freed
pf_src_connlimit() queues an entry for pf_overload_task() when a
source exceeds max-src-conn or max-src-conn-rate and the rule has an
overload table. The entry holds a pointer to the rule, and the task
runs from taskqueue_swi with the vnet of the queue. Nothing drained
the task when the vnet went away: an entry queued just before could
be applied to a rule pf_unload_vnet_purge() had freed, or to a vnet
that was gone.
Drain the task at the start of pf_unload_vnet_purge(), before the
unlinked rules are freed. No packet can queue another by then, as the
hooks are already removed.
Reviewed by: kp
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60529
[Bazel] Fix libc build after cf0b9d3 (#231134)
cf0b9d3 (#230528) added linux syscall wrappers for exit and exit_group
and switched exit.cpp, thread.cpp and the per-arch tls.cpp over to them.
Add Bazel targets for the new wrapper headers and depend on them from
`__support_osutil_exit`, `__support_threads_linux_thread` and
`__support_threads_linux_tls`. The latter two are full-build-only and
failed with `--@llvm-project//libc:build_mode=full`.
Supersedes #231110.
py-aiohttp: updated to 3.14.5
3.14.5 (2026-10-10)
Bug fixes
- Stopped failing the WebSocket connection when a control frame has RSV1 set after ``permessage-deflate`` was negotiated; some clients set the bit on every frame and control frames are never decompressed
Accept key_file alone when changing a dataset key
## Problem
change_key rejected a request that set only key_file with "Either Key or passphrase must be provided." because the check ran before the key was read from the input pipe and only looked at key and generate_key, so an encryption root could not be changed to a hex key uploaded as a file.
## Solution
Count key_file as a key source in that check and name all four key options in its error. Combinations of key options are still rejected by resolve_key_options and an invalid key file still fails in read_hex_key_from_pipe, both before anything is changed. The integration test uploads a key file and confirms both the stored key and that ZFS accepts it.
sqlite3: updated to 3.54.0
3.54.0
CLI enhancements:
CLI prompt strings may contain escape sequences that expand to show state information. The initial CLI prompt is now be initialized the values of the SQLITE_PS1 and SQLITE_PS2 environment variables, if those variables exist.
The default CLI prompt has been enhanced to take advantage of the new escape sequences described in the previous.
For columnar output modes, the CLI now shows the column name header by default even if the query returns no rows.
Use the new diskused() extension to implement the ".diskused" dot-command. The replaces the separate sqlite3_analyzer utility program, which is now deprecated.
On unix, the CLI preserves zero bytes when outputing unformatted BLOB values.
Enhance the .mode command with new options "--rowcount on" and "--titles always". The "--titles always" is now the default behavior (see item 3a above). Legacy behavior can be restored using "-titles on".
Enhance the .mode command with the new --ifmt option and --fpfmt option that allow the rendering of integer and floating-point values to be more precisely controlled using a printf-style format string.
The -csv command-line option automatically disables display limits, for legacy compatibility.
The default CLI prompt honors the NO_COLOR environment variable.
The ability to end an SQL command using the line that contains just "go" or "/" (for compatibility with SQL Server and Oracle, respectively) is discontinued, unless the CLI is compiled with option -DSQLITE_SHELL_LEGACY_COMMAND_TERMINATOR.
Query planner improvements:
When doing an UPDATE on a table that has expression indexes, do not change the expression index if the value being indexed is unchanged.
Improved optimization of "expr OR TRUE" and "expr OR FALSE".
Ignore DISTINCT in the SELECT statement on the right-hand side of an IN operator.
[17 lines not shown]
py-pydantic: updated to 2.14.1
2.14.1
Performance
Avoid Python tuple allocation during model fields validation
Avoid unnecessary extra dict allocation in model validation
Fixes
Fix arguments-v3 schema with variadic keywords
Fix TypeError on ForwardRef on Python 3.10.0
Support closed and extra_items via inheritance in TypedDict
Enforce the max_digits whole-digits limit in the Python Decimal validator
Reject out-of-range int inputs for timedelta
Support named tuples in Sequence validation
mail/rspamd: Package hs_helper configs with VECTORSCAN
Follow-up to 8f3058ca4f8 ("mail/rspamd: Add vectorscan support", PR 296532).
Both the HYPERSCAN and VECTORSCAN options pass -DENABLE_HYPERSCAN=ON to
CMake, and conf/worker-hs_helper.{conf,inc} are installed whenever
ENABLE_HYPERSCAN is on (cmake/InstallRspamdFiles.cmake). The packing
list, however, gates those entries on %%HYPERSCAN%% only:
- With VECTORSCAN enabled (the new default on amd64, aarch64 and
powerpc64le) the two files are staged but commented out of the
manifest: check-orphans/check-plist fail and the files are missing
from the package.
- On architectures where the HYPERSCAN option is not defined (aarch64,
powerpc64le, i386, armv7, powerpc, powerpc64) %%HYPERSCAN%% is never
defined in PLIST_SUB, so the literal leaks into the packing list.
The PLIST_SUB block dropped by 8f3058ca4f8 was what defined that
variable on non-amd64.
[6 lines not shown]
mail/rspamd: Package hs_helper configs with VECTORSCAN
Follow-up to 8f3058ca4f8 ("mail/rspamd: Add vectorscan support", PR 296532).
Both the HYPERSCAN and VECTORSCAN options pass -DENABLE_HYPERSCAN=ON to
CMake, and conf/worker-hs_helper.{conf,inc} are installed whenever
ENABLE_HYPERSCAN is on (cmake/InstallRspamdFiles.cmake). The packing
list, however, gates those entries on %%HYPERSCAN%% only:
- With VECTORSCAN enabled (the new default on amd64, aarch64 and
powerpc64le) the two files are staged but commented out of the
manifest: check-orphans/check-plist fail and the files are missing
from the package.
- On architectures where the HYPERSCAN option is not defined (aarch64,
powerpc64le, i386, armv7, powerpc, powerpc64) %%HYPERSCAN%% is never
defined in PLIST_SUB, so the literal leaks into the packing list.
The PLIST_SUB block dropped by 8f3058ca4f8 was what defined that
variable on non-amd64.
[6 lines not shown]
[X86] Custom lower v4i64 ISD::MULHS on 32-bit targets (#231102)
64-bit -> 128-bit multiplies are really poor on i686 - just do our best
with VPMULUDQ instead
Yak shaving work to eventually remove the S/UMUL_LOHI custom
scalarization on 64-bit targets
There's probably a similar case for v2i64 on SSE2+ 32-bit targets as
well
