sysutils/mirador: update to 1.10.1
v1.10.1
Release Notes
Changed
The notes panel no longer prints its count twice. The border already
carries it, so the row above the list is spent on an active search or
nothing at all — and when it is nothing, the list and the note it is
pointing at get the row. The count returns for the two cases where the
border stops carrying it: an empty panel, where no notes is the only
thing saying the panel is working, and a failed save, where the counter is
spent on unsaved!.
v1.10.0
Release Notes
Fixed
The clock's date was cut without saying so. On a narrow terminal
[47 lines not shown]
py-copier: updated to 9.18.2
9.18.2 (2026-09-07)
Fix
- allow overwriting destination symlinks when `preserve_symlinks: false`
- **cache**: resolve submodules from the current checkout's .gitmodules
Security
- prevent trust bypass via ambiguous URL characters
To prevent URL confusion attacks, trusted prefix matching is now restricted to
repository URL paths containing only [RFC 3986 §2.3] "unreserved" characters
(letters, digits, `-`, `.`, `_`, `~`) and `/`. URL paths containing other
characters now require an exact, verbatim match.
dpkg: updated to 1.23.10
dpkg (1.23.10) unstable; urgency=medium
[ Guillem Jover ]
* Output messages:
- dselect: Remove spurious doubled newline from help output message.
* Perl modules:
- Dpkg::File: Do not fail when touching a non-file in file_touch().
* Code internals:
- start-stop-daemon: Parametrize program name into a new macro.
- libdpkg: Move URL out of translated string (round two).
- dselect: Move leading double newlines outside of translated string.
- Move paragraph separator newlines into their own print calls.
* Packaging:
- Update lintian overrides.
* Test suite:
- Skip t.tmp pathnames in codespell checks.
nginx-devel: updated to 1.31.5
Changes with nginx 1.31.5 02 Sep 2026
*) Feature: control API.
*) Feature: predicate locations.
*) Feature: the ngx_http_json_module.
*) Feature: the "client_body_early_read" directive.
*) Bugfix: use-after-free might occur in a worker process if proxying
with buffering was used and an error occurred while sending the
response to an HTTP/2 client.
*) Bugfix: a worker process might not exit or "accept4() failed (9: Bad
file descriptor)" alerts might appear in logs if the worker process
ran out of file descriptors before graceful shutdown.
[6 lines not shown]
tor: updated to 0.4.9.12
Changes in version 0.4.9.12 - 2026-09-08
Another security release containing several high security fixes reported by
the exciting and controversial world of LLMs. One important note is that new
protocol versions are recommended for clients and relays (41316).
Furthermore, authorities will NOT accept relay descriptor containing TAP keys
anymore hence the importance for all relays to upgrade to the latest 0.4.9.x
stable version. We very strongly recommend upgrading as soon as possible.
o Major bugfixes (security):
- Do not purge memory for OOM from within low-level code.
Previously, we would handle OOM conditions from within
append_cell_to_circuit_queue, which could appear at various places
within our call stack, and lead to objects being freed at
surprising points in the code, with attendent risk of use-after-
free errors. Now we only check for OOM conditions there, and
handle them from much higher in the stack. Fixes bugs 41341,
[78 lines not shown]
openldap: updated to 2.7.1
OpenLDAP 2.7.1 Release (2026/09/08)
Fixed libldap BER leak on notice of disconnection
Fixed libldap request leak on malformed BER response
Fixed libldap error stack handling with OpenSSL < 4.0
Fixed lload non-blocking BIO handling in SSL renegotiations
Fixed slapo-ppolicy handling of old passwords
Documentation
slapo-pcache added note about referral chasing
Minor Cleanup
py-time-machine: updated to 3.5.1
3.5.1
Only pass the compiler option -mno-omit-leaf-frame-pointer when the compiler supports it, checked with a tiny probe program. The option is unsupported outside of x86 and ARM64, so this fixes building from source on other architectures, like PowerPC, which failed since the option was added in version 3.3.0.
Fix the mocked datetime.date.today() and datetime.datetime.today() to be exact for all supported dates, like datetime.datetime.now(). Previously, they went through a floating-point timestamp, which could round the microseconds, or even the whole day, for dates far in the future.
Fix the class decorator to stop time travelling when tearDownClass() raises an exception, or when setUpClass() raises an exception not deriving from Exception, such as the skip outcome from pytest.skip(). Previously, time remained mocked for the rest of the process in these cases.
Fix Traveller.move_to() to keep the current timezone mocked when the given destination is unsupported. Previously, the timezone was restored before the destination was checked, leaving it unmocked whilst still time travelling.
Fix the time_machine pytest fixture to not try to stop a traveller that failed to start.
Fix the mocked time.strftime() to raise TypeError when passed None as its second argument, like the unmocked function, rather than treating it as the current time.
Fix the Migration CLI to keep the rewritten imports on the same line when a freezegun import shares its line with other code, like if TYPE_CHECKING: from freezegun import freeze_time, FakeDate. Previously, the remaining from freezegun import FakeDate was moved to a new line, outside the block.
Extend the Migration CLI to migrate uses of FrozenDateTimeFactory in string annotations, like freezer: "FrozenDateTimeFactory". Previously, the import was removed whilst such annotations were left referring to it.
[10 lines not shown]
ansible: updated to 14.4.0
14.4.0
Major Changes
community.vmware
- Bump required ``vmware.vmware`` collection version to 2.10.0 (https://github.com/ansible-collections/community.vmware/pull/2568).
fortinet.fortios
- Supported multiple versions of log fact modules.
- Supported new versions 7.6.7 and 8.0.0.
- Updated the Q&A for importing a certificate in the fortios_certificate_remote module.
ansible-core: updated to 2.21.4
2.21.4
Minor Changes
- mask_url function in module_utils to allow for masking of auth data embedded in urls.
Bugfixes
- apt_key module now masks authentication information in all displays and returns of uri information.
- get_url module now masks authentication information in all displays and returns of uri information.
- module_utils - ``mask_url`` now masks the password in URLs that contain a password but no username, such as ``redis://:password at host``, instead of returning them unmasked.
- module_utils.urls now all errors mask in line url authentication information.
- rpm_key module now masks authentication information in all displays and returns of uri information.
- tempfile - reject prefix and suffix values that contain path components to prevent path traversal.
- uri module now masks authentication information in all displays and returns of uri information.
- url lookup now masks authentication information in all displays and returns of uri information.
