prometheus: update to 3.13.5.
[SECURITY] Container images: Update CA certificates to distrust
"emSign ECC Root CA - G3" and "Comodo AAA Services root" following
the compromise of eMudhra intermediate CA private keys.
[SECURITY] Build with Go 1.27.3 to fix vulnerabilities in net/http,
net/textproto, crypto/tls and html/template.
[SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2
vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611,
GO-2026-6612, GO-2026-6617).
shuck: update to 0.2.7.
0.2.7
Bug Fixes
server: honor lint.source-paths (#1341) (4646189)
Documentation
refresh AGENTS.md and README to match the workspace (#1338) (f5e26ef)
Refactor
config: share settings resolution across CLI, LSP, and WASM (#1340) (f5449cf)
0.2.6
[29 lines not shown]
rspamd: update to 4.2.3.
4.2.3: 21 Oct 2026
** Incompatible changes **
* [Conf] phishing: Disable phishtank.rspamd.com by default (the zone no longer carries data)
* [Feature] rbl: Merge duplicate DNS queries from several checks into one request and one symbol insertion (a rule now scores once per matched value; set merge_checks = false to keep one insertion per check)
* [Fix] rbl: Fix the inverted dkim_domainonly test under dkim_match_from (eSLDs were compared when dkim_domainonly was off)
** Features **
* [Feature] force_actions: Promote rules that depend on composites to postfilters
* [Feature] force_actions: Add a priority setting to arbitrate between matching rules, shown as a priority:N symbol option
* [Feature] lua_task: Return the action name instead of its type from has_pre_result, plus its flags
* [Feature] metadata_exporter: Add unix_time to general metadata
** Bug fixes **
* [Fix] arc: Do not trust ARC forwarders whose seal failed verification (a whitelisted d= with a broken seal gave ARC_ALLOW_TRUSTED and its AAR could lower DMARC)
* [Fix] arc: Require exactly one ARC-Authentication-Results per instance and wait for all seal checks before publishing results
* [Fix] dkim: Report a key request that cannot be scheduled as a failure (ARC chains with such a seal published no result)
[26 lines not shown]
snmp_exporter: update to 0.31.0.
## 0.31.0 / 2026-10-25
BREAKING CHANGES:
Regenerating snmp.yml with the generator now maps enum lookup columns to
human-readable string labels (e.g. `"ioMemory"` instead of `"2"`) by default.
Dashboards, alerts, or recording rules that match on numeric enum label values
may need updating. Opt out per metric/lookup with `type: gauge`.
The generator now drops tables whose index type cannot be rendered as a label
(e.g. DateAndTime, Bits) with a warning, and fails when a chained lookup
promotes such a type to an index. Previously these produced configs that
crashed the exporter on scrape.
Building from source now requires Go 1.26 or newer.
* [FEATURE] Add DISPLAY-HINT support for SNMP OctetString formatting #1549
[49 lines not shown]
py-starlette: updated to 1.10.0
1.10.0 (October 24, 2026)
Changed
* Compare multidicts such as `FormData` and `QueryParams` by key while keeping the order of values under a repeated key, so `FormData` with repeated uploads no longer raises `TypeError`. `QueryParams("a=1&a=2")` and `QueryParams("a=2&a=1")` are no longer equal
* Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields
* Compare `Match` members by identity during routing
Deprecated
* Deprecate `starlette.formparsers.FormMessage`, which is no longer used
Fixed
* Parse the last URL-encoded form field when the request stream ends without an empty chunk
* Keep path parameter values that look like another placeholder in `url_path_for()`
* Default omitted `http.response.start` headers in `BaseHTTPMiddleware`, `GZipMiddleware` and `SessionMiddleware` instead of raising `KeyError`
[5 lines not shown]
py-pbs-installer: updated to 2026.10.25
2026.10.25
Version metadata is now stored in versions.json instead of a generated Python module.
New base_url parameter for get_download_link() / install() (and PBS_INSTALLER_BASE_URL env var) to download from a mirror.
Fix free-threaded builds shadowing GIL builds in the version index: GIL CPython 3.13.12+ / 3.14.3+ were missing entirely, and older GIL versions lacked full (--build-dir) builds.
py-zensical: update to 0.0.73.
0.0.73
This version fixes URL rewriting in the privacy plugin so assets
loaded by JavaScript resolve correctly on nested pages and during
local preview. It also corrects the nested list example included
in newly created projects.
Additionally, the user interface is updated to v0.0.39, adding
support for Mermaid 12 and improving scroll restoration when
following anchor links, reloading pages, or navigating back and
forward.
0.0.72
This version brings Zensical's behavior closely in line with MkDocs,
with support for the privacy plugin and fixes to Markdown rendering,
link handling, and project layouts.
[13 lines not shown]
hunspell: update to 1.7.6.
2026-10-26: Hunspell 1.7.6 release:
- add, add_with_flags, add_with_affix and remove apply the dictionary's
ICONV rules to the word, as spell does, so a caller that converted the
word itself must stop doing so (#616)
- A personal dictionary exclusion such as *afterwards also rejects the
word when the dictionary has it only as an affixed form (#1155)
- stem and analyze give st: stem fields again with COMPLEXPREFIXES
- analyze lists every analysis of a compound word, where a rejected
split of the word could hide the splits after it
- The text and XML parsers check the character after a character
entity such as à (#686)
- The interactive mode shows the first digit of a two digit
suggestion number (#158)
- The -a pipe interface checks a line of any length in one piece
(#220)
- The hunspell tool takes -- as the end of the options, the -u2 sed
script escapes the word and the suggestion, and a zipped ODF file
[23 lines not shown]
py-sphinxcontrib-jsmath: update to 2.0.0.
Release 2.0.0 (2026-10-20)
==========================
* Adopt Ruff
* Tighten MyPy settings
* Update GitHub actions versions
* Remove Sphinx as a required dependency, as circular dependencies may cause
failure with package managers that expect a directed acyclic graph (DAG)
of dependencies.
* Drop support for Python 3.5, 3.6, 3.7, and 3.8
* Raise minimum required Sphinx version to 5.0
* Replace `domain.has_equations()` with `context['has_maths_elements']`
Patch by Dmitry Shachnev.
* Declare support for Python 3.14, Python 3.15, and Python 3.16.
py-cryptodome: update to 4.2.0.
4.2.0 (24 October 2026)
++++++++++++++++++++++++++
New features
------------
* New module ``Crypto.PublicKey.MLKEM``, for ML-KEM keys (FIPS 203).
It is based on the portable C code of
`mlkem-native <https://github.com/pq-code-package/mlkem-native>`_ (v2.0.0),
with the Keccak code of PyCryptodome, also compiled for AVX2 and BMI2 (with 4-way SHA-3).
The keys can be exported and imported as PKCS#8 DER or PEM files.
* New module ``Crypto.PublicKey.Hybrid``, to model hybrid keys (post-quantum + traditional).
It supports the hybrid KEM MLKEM768-X25519 (X-Wing), which combines ML-KEM-768 and X25519.
For now, hybrid keys can only be generated and used with HPKE: they cannot be exported or imported.
* ``Crypto.Protocol.HPKE`` accepts ML-KEM keys and X-Wing keys,
for post-quantum HPKE (draft-ietf-hpke-pq), in the Base and PSK modes.
4.1.0 (19 October 2026)
[317 lines not shown]
security/py27-cryptodome: import py27-cryptodome-3.24.1nb1
PyCryptodome is a self-contained Python package of low-level cryptographic
primitives.
This is the last version supporting Python 2.
py-googleapis-common-protos: update to 1.76.0.
1.76.0 (2026-10-22)
Features
declare support for Python 3.15 (#18737) (65c8767)
update API sources and regenerate (#18797) (be4d954)
py-google-api-core: update to 2.43.0.
2.43.0 (2026-10-22)
Features
api_core: support DirectPath over Interconnect with TLS composite credentials and ?force-xds (#18431) (fbd3188)
observability: suppress redundant gRPC auto-instrumentation spans (#18592) (a597007)
