Change URLs for rust-openssl issue fixed in 0.10.78 from
https://github.com/rust-openssl/rust-openssl/releases/tag/openssl-v0.10.78
to
https://nvd.nist.gov/vuln/detail/CVE-2026-41681
and category from "unknown" to "stack-overflow", based on
input from wiz@.
Make some of the entries more specific, since in a few cases the
newer versions of the openssl crate has been included in updated
versions now in pkgsrc. The amended packages in this way are:
arti
chess-tui (openssl crate not used in newest versions)
py314-maturin
routinator
vaultwarden
vaultwarden: updated to 1.37.2
1.37.2
Fix Debian cross-linking with xx-cargo
Fix playwright test
Misc fixes and updates
Include user email in successful login logs
Fix sendmail executable permission check
add dummy revisionDate
Update to 0.15
Upstream changes:
0.15 2026-06-30 11:19:01-07:00 America/Vancouver
- Fix bug which resulted in zeroes being collapsed when they shouldn't,
affecting filenames with zeroes in them (e.g. "url(status-0.png)").
Thanks to Stefan Berger for reporting GH#5.
net/nsd: update to version 4.15.1.
Pkgsrc changes:
* Version & checksum changes.
Upstream changes:
4.15.1
================
FEATURES:
BUG FIXES:
- Fix for CVE-2026-18664: IP range access control restrictions are
bypassed for some unintended IP.
Thanks to Qifan Zhang, Palo Alto Networks for the report
Thanks to Claude and Ada Logics for the report
https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-18664.txt
- Fix for CVE-2026-18916: Any remote client can denial TCP service by
throttling the TCP receive window (down to 1).
Thanks to Akhil Koul (https://github.com/akoul) for the report
[10 lines not shown]
Update to 0.15
Upstream changes:
0.15 Fri Aug 07 16:15:00 EDT 2026
- Release 0.14_9901 without changes.
0.14_9901 Sun Jun 14 20:27:47 EDT 2026
- Fix $c->change_session_id causing "row not found" error (RT#112679).
Thanks to Cees Hek for the original report, violapiratejunky for the
patch, and MYSOCIETY for additional information in RT#178695.
- Fix typo in source. RT#87248
Update to 0,10028
Upstream changes:
0.10028 - 2026-08-08
- fix warnings when authenticating and no password is stored
- fix return value from Catalyst::Authentication::User::Hash->can
- update password_type documentation do discourage non-secure options
- fix use of CERT_ values in Credential::Remote source
- documentation spelling fixes
- fix develop prereq on Test::Pod::Coverage::TrustMe
0.10_027 - 2026-06-07
- When used with Catalyst::Plugin::Session, rotate the session id after a
successful login to avoid session fixation attacks (CVE-2009-10007).
0.10026 - 2026-05-21
- no changes since 0.10_025
0.10_025 - 2026-05-19
- fix password comparison to avoid timing attacks (CVE-2026-5091)
leaves: Initial package 0.2.0 (cross)
Text-mode disk usage visualization utility
Leaves is a disk usage analyzer inspired by WinDirStat and QDirStat.
It shows files and directories in a hierarchy of nested rectangles.
The area of a rectangle is proportional to its size.
A 200 MB file will have twice the size as a sibling with 100 MB.
The parent directory will have about 3 times the area of the smaller file.
filezilla: update to 3.71.1.
3.71.1 (2026-08-26)
- macOS: Work around a bug in macOS 27 where setting the locale to non-English triggers crashes in AppKit
- SFTP: Improved heuristic when keyboard-interactive requests are treated as a simple password prompt on servers not offering the password authentication method
fd-find: update to 10.5.0.
## Features
- Add `--ignore-parent` option to override `--no-ignore-parent`, see #1958 (@tmchow)
- Add `--exact` option to match the entire filename exactly (literal, non-substring).
## Bugfixes
- Sanitize control characters and bidirectional override characters in filenames
when output goes to a terminal, to prevent terminal escape-sequence injection.
Also reject a placeholder as the executable for `--exec-batch`, while still
allowing it for `--exec`.
- Handle invalid working directories gracefully when using `--full-path`, see #1900 (@Xavrir).
- Fire the "search pattern contains a path separator" diagnostic for any pattern containing `/`, not just patterns that happen to name an existing directory. Preserves the legacy Windows behaviour that also flags native `\` separators when the pattern resolves to a real directory. See #1873.
- Also fire the "search pattern contains a path separator" diagnostic for `--and` patterns, not only the primary positional pattern. `--and` patterns are matched against the file name just like the primary pattern, so a path separator in them silently returned zero results. See #1873.
- Fix bug where passing "-" as a directory argument didn't actually search that directory, see #849 (@Sean-Kenneth-Doherty).
- Fix panic when `--changed-before`/`--changed-within` is given an out-of-range `@` Unix timestamp; the value is now rejected gracefully, see #2081 (@nikolauspschuetz).
