Fix AttributeError in smb.set_system_sid from NAS-141946 backport
The backport of NAS-141946 (#19425) kept master's typed service
accessor (self.s.service) in smb_/sid.py, but the stable/26
ServiceContainer does not register a `service` attribute. Every
call that reached the winbindd restart decision failed with
"'ServiceContainer' object has no attribute 'service'", breaking
all AD domain joins in directory services CI.
Convert both calls to the string API used elsewhere on stable/26
and rewire the unit test mocks to match.
NAS-142050 / 26.0.0-BETA.3 / Fix method decorator (by anodos325) (#19471)
This fixes a bug where the periodic persistent keyring reinitialization
method was not properly decorated with a private designator.
Original PR: https://github.com/truenas/middleware/pull/19469
Co-authored-by: Andrew Walker <andrew.walker at truenas.com>
Partial-revert "[IR] Make semantics of strictfp consistent v2" (#213723)
This partially reverts 15bb4a97a7 ([IR] Make semantics of strictfp
consistent v2, #211769) due to a verifier failure in real-world code,
disabling just the verifier-check with a FIXME. The reason for a partial
manual-revert is because a clean revert doesn't apply cleanly: in
particular, the LangRef is untouched by this patch.
Ref:
https://github.com/llvm/llvm-project/pull/211769#issuecomment-5169150682
NAS-142050 / 26.0.0-RC.1 / Fix method decorator (by anodos325) (#19472)
This fixes a bug where the periodic persistent keyring reinitialization
method was not properly decorated with a private designator.
Original PR: https://github.com/truenas/middleware/pull/19469
Co-authored-by: Andrew Walker <andrew.walker at truenas.com>
[clang][APINotes] Do not duplicate Escapable and Copyable attributes (#213716)
Applying them when they already present is a wasted allocation and can
also cause trouble in the Swift compiler that can complain about
duplicated attributes.
rdar://174868727
NAS-142050 / 27.0.0-BETA.1 / Fix method decorator (#19469)
This fixes a bug where the periodic persistent keyring reinitialization
method was not properly decorated with a private designator.
NAS-142040 / 27.0.0-BETA.1 / Add recursive option to container delete (#19460)
## Problem
A container whose dataset has dependents could not be deleted at all,
and the attempt was not free: the libvirt domain was torn down before
ZFS refused the destroy, killing a running container and discarding a
suspended one's state for a delete that was never going to succeed.
## Solution
Validate the dataset up front, before any libvirt state is touched, so a
delete that cannot succeed is refused cleanly and the container is left
exactly as it was. Adds a `recursive` delete option that destroys the
dataset together with its dependents for callers who do want it gone.
Both refusals are now validation errors naming the option that lifts
them, which means deleting a running container without `force` returns a
validation error where it previously returned a call error.
CI: http://jenkins.eng.ixsystems.net:8080/job/tests/job/api_tests/9941/
Keep container records unless their pool was really destroyed
## Problem
The container FS attachment delegate was the only stateful-workload delegate whose `delete()` destroyed configuration: it undefined the libvirt domain and removed the `container_container` and `container_device` rows, while deliberately leaving the rootfs dataset alone. VMs and apps only stop. That made `pool.export(cascade=True, destroy=False)` — the flow that exists precisely because the pool is moving elsewhere intact — permanently orphan live storage. A container's definition, devices and idmap slice live only in SQLite, nothing on disk can rebuild them (unlike the migrated incus containers, we write no manifest), and a freed idmap slice can be reissued to another container while the surviving rootfs still carries its UID range.
`pool.dataset.delete` reached the same code with no cascade flag at all, so deleting a dataset that a container merely bind-mounted as a FILESYSTEM device destroyed the whole container. And since `query()` only reports containers in ACTIVE_STATES, the cleanup was not even coherent — it dropped the records of running containers and kept those of stopped ones.
## Solution
- **`delete()` is now stop-only**, matching the VM and apps delegates. Records are never removed from the delegate.
- **Record removal moved to a `pool.post_export` hook**, which is the only place that can see whether the data actually went away. It keys off a new `destroyed` flag from `pool.export` rather than `options['destroy']`: asking to destroy an OFFLINE pool leaves it untouched on its disks, so the requested option on its own would still have discarded records whose storage was intact. The hook matches on the dataset and ignores runtime state, so stopped containers are cleaned up too.
- **Containers are re-pointed at their storage when a pool is imported under a new name.** The dataset is always `<pool>/.truenas_containers/containers/<name>`, so the new location is derived rather than guessed. The remap is committed only when the old pool is genuinely gone, the derived dataset exists, and no other container claims it; each container is applied behind its own boundary so one failure cannot abort the import or block the rest.
- **`pool.reimport` no longer starts everything on the pool.** It walks the delegates in start-priority order (it was using registration order, quietly defeating the docker/apps ordering) and calls a new `start_on_import`, which containers and VMs override to honour `autostart`. Previously every stopped container and VM on the pool came up regardless.
Also documents why `storage_paths()` derives the container root from the dataset name rather than its real mountpoint — both consumers need the name-derived form, and switching to the mountpoint would silently stop matching containers on pool export and lock.
py-cryptography: update to 50.0.0.
50.0.0 - 2026-07-31
~~~~~~~~~~~~~~~~~~~
* **SECURITY ISSUE**:
:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
Credit to **@X1AOxiang** for reporting the issue
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
* Added ``xof()`` class methods to
:class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
[51 lines not shown]
[SLP]Allow unordered fadd reductions with reassoc only
The unordered reduction matcher required isAssociative() for fadd,
i.e. reassoc + nsz, a condition inherited from InstCombine-style
reassociation that also cancels and folds terms. Pure regrouping of
additions cannot change the sign of a zero result, so nsz is not
needed here: the reduction is seeded with the exact -0.0 identity,
the repeated-value multiplier preserves the sign of zero, and
constant folding is IEEE-exact. Brings the fadd requirement in line
with RecurrenceDescriptor, LV and with fmul, which accept reassoc
alone.
Reviewers: hiraditya, bababuck, RKSimon
Pull Request: https://github.com/llvm/llvm-project/pull/213261
py-beets: update to 2.13.1.
2.13.1
Bug fixes
Fixed source distributions not including the bundled man pages. 🐛 (#6882)
2.13.0
New features
Convert Plugin: Add new configuration option convert.refresh and command-line option --refresh, allowing to force Convert Plugin operation when original file is newer than existing converted file.
Edit Plugin: The interactive import editor now shows album-level fields (as configured by albumfields) as a YAML header section when editing an album import. Fields that appear in both itemfields and albumfields are shown only in the header, not per-track.
FetchArt Plugin: Add fetch_for_asis setting that enables fetching album art from online sources even when imported files are not modified by the auto-tagger. Default is no which means FetchArt Plugin looks for art only in the local filesystem when the user (or quiet_fallback) chooses asis.
FtInTitle Plugin: Apply featured-artist rewriting to fetched metadata before commands such as MBSync Plugin use it. 🐛 (#1153)
LastGenre Plugin: Add support for normalizing genre spellings and naming variants with a new configuration option aliases. The feature is enabled by default and ships with a built-in list of regex patterns. These patterns can be replaced via the user's configuration. The default whitelist and genre tree were audited against the top 1,000 Last.fm tags: canonical names are now consistent across both files, long-standing mismatches between them have been resolved, and entries align with the built-in alias patterns. 🐛 (#6466)
Lyrics Plugin: Add lrcmux backend, which aggregates lyrics from various other sources.
Lyrics Plugin: Added a --no-keep-synced command option to override keep_synced: yes for a single manual lyrics fetch.
[29 lines not shown]
Fix method decorator
This fixes a bug where the periodic persistent keyring reinitialization method
was not properly decorated with a private designator.
devel/py-test-factoryboy: import py-test-factoryboy-2.8.1
pytest-factoryboy makes it easy to combine factory approach to the
test setup with the dependency injection, heart of the pytest
fixtures.
devel/py-titlecase: import py-titlecase-2.4.1
This filter changes a given text to Title Caps, and attempts to be
clever about SMALL words like a/an/the in the input. The list of
"SMALL words" which are not capped comes from the New York Times
Manual of Style, plus some others like 'vs' and 'v'.
The filter employs some heuristics to guess abbreviations that
don't need conversion.
