p5-MIME-tools: update to 5.522.
5.522 2026-10-27 Dianne Skoll <dianne at skoll.ca>
* VERSION 5.522 RELEASED
* Many security issues were addressed (see the following ten CVEs)
Issues were brought to my attention, and patches supplied, by the
CPANSec security group.
* parse_params: flag a parameter list that could not be parsed
Detect additional ambiguous parse situations when parameter
names contain illegal characters. Fixes:
CVE-2026-116264 invalid parameter hides boundary/filename
* parse_params: check the boundary after RFC 2231 reassembly
Another ambiguous-parse case was missed (trailing space after
boundary was not detected for RFC-2231-encoded boundaries.) Fixes:
CVE-2026-116265 RFC 2231 boundary skips ambiguity checks
[106 lines not shown]
p5-HTTP-Body: update to 1.24.
1.24 2026-10-26 18:28:01+01:00 Europe/Berlin
- SECURITY, CVE-2026-116131: urlencoded bodies are limited to
$HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
$HTTP::Body::MultiPart::max_parts parts (1000 each); reported and
patched by CPANSec
- SECURITY, CVE-2026-116132: the temporary file of an upload that is
still incomplete at DESTROY-time is now always deleted; reported and
patched by CPANSec (also fixes RT#84004)
- SECURITY, CVE-2026-116133: a multipart body without a boundary or with
a malformed delimiter line no longer takes quadratic time; a malformed
delimiter line now croaks, and padding or an epilogue after the close
delimiter is accepted; reported and patched by CPANSec
- SECURITY, CVE-2026-116134: a multipart part's header block is limited
to $HTTP::Body::MultiPart::max_header_size bytes (32768) and
$HTTP::Body::MultiPart::max_header_lines lines (100); reported and
patched by CPANSec
- SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in
[22 lines not shown]
gatus: Update to version 5.38.0
What's Changed
feat(alerting): add Resend alerting provider by @geffersonFerraz in #1830
fix(maintenance): validate maintenance windows for external, DNS and SSH endpoints by @anandghegde in #1804
fix(alerting): Redact telegram token from errors on send failure by @hippi345 in #1843
fix(websocket): apply the client timeout to reads and writes by @somaz94 in #1845
fix(ssh): support keyboard-interactive authentication for endpoints and tunnels by @peckto in #1863
fix(security): add comprehensive logging and diagnostics for OIDC (#1802) by @tech00exploere in #1862
fix(jsonpath): support object keys containing dots via quoted accessors by @leotemtem in #1864
fix: Honor minimum-reminder-interval for external endpoints by @yzxcj797 in #1773
chore(alerting): restyle matrix alerts with errors, safe links and escaping by @mazzz1y in #1875
upx: Updated to version 5.3.0
Changes in 5.3.0 (28 Oct 2026):
* new format win64/arm64; based on work by hoptodesk and Johannes Schindelin
* bug fixes - see https://github.com/upx/upx/milestone/25
news/brochure: update to 0.13.0
Full mouse support, notification cards, and a full-screen image viewer.
Highlights
Drag scrollbars and lists with the mouse
Notification cards with live refresh progress
Click an article image to view it full screen
Popups and dialogs work with the mouse
Text selection follows scrolling and copies fully
multimedia/moviebox-tui: update to 0.1.27
[0.1.27] - 2026-10-23
Fixed
Media Playback & Subtitle Engine:
Removed --play-and-exit from VLC player invocations so the player stays active across adaptive and HLS chunk transitions.
Reset legacy Android player defaults in graphical X11 and Wayland sessions so native Linux players take precedence over external Android intent dialogs.
Prioritized native Linux media player paths over foreign container fallbacks on Linux systems and preserved dynamic auto-player resolution for unconfigured sessions.
Providers & Stream Resolution:
Recovered playable signed MP4 streams via /resource-position/v2 when MovieBox returns deprecation notice clips, querying exact seasons and episodes and reporting accurate file sizes.
Stripped the DASH Referer header on direct MP4 streams to prevent CDN HTTP 429 throttling.
Bumped the MovieBox stream cache schema to v2_ to discard stale cached deprecation notices.
Filtered out unhosted MovieBox /hls/ signed cookie targets in manifest resolution, which stops unplayable H.264 stream entries from failing with HTTP 404 during downloads or media playback.
Download Engine & Batch Queue:
Fixed season batch downloads by arming is_waiting_for_download_stream during queue steps, eliminating immediate empty-list download calls that aborted multi-episode queues.
Reset the download resolution state lock on 4KHDHub resolver timeouts and errors so failed mirror resolutions do not block subsequent download attempts.
Added sequential single-connection fallback to the internal HTTP downloader when multi-worker segmented range requests receive HTTP 403, 429, or network disconnects.
[12 lines not shown]
misc/zellij: update to 0.45.1
[0.45.1] - 2026-08-28
fix: nested-session detection over SSH (#5522)
fix: some issues with notification parsing (eg. neovim notification on save) (#5523)
fix: kitty image size on startup and clearing with stacked unlisted full framed panes (#5526)
fix: focus event in remote attach (#5527)
fix: editing scrollback issue with a fullscreen floating pane (#5528)
feat: allow opting-out of scroll mode sync (#5532)
fix: save space for title row in fixed-layout panes in titles only mode (#5533)
fix: properly fire visibility event to plugins when their tab/floating-layer is hidden/shown (#5518 and #5534)
feat: allow setting explicit_theme_hue (light/dark) (#5536)
fix: input mode updates when switching tabs (#5535)
feat: allow starting a session with an initial command, eg. zellij attach -a my-session -- htop (#5543)
fix: release a CLI pipe when the plugin handling it crashes, instead of blocking the zellij pipe client until the plugin is unloaded (#5537)
[0.45.0] - 2026-08-20
[34 lines not shown]
misc/rozi: update to 0.0.34
Added
Mouse pointer feedback covers pane applications and Rozi controls. Choose Off, Pane apps only, or Rozi and pane apps in Settings → General → Mouse pointer, or set cursor.pointer to off, panes, or all. Changes apply live and persist to config.toml. (#248)
Changed
Remote images stay current when programs redraw faster than clients can display them. Rozi skips superseded frames and sends only changed image regions over SSH when all attached clients support them. Older clients continue to receive full frames. (#250)
Shutting down a remote session removes it from Sessions immediately. The row shows Killing… while shutdown runs, remains available with an error if shutdown fails, and cannot be acted on again while pending. (#252)
Fixed
Floating panes that extend past the left or top canvas edge keep their far border visible.
Restored commands wait until the shell prompt is ready before appearing, so they are not echoed twice. Shells without an input-ready marker use a three-second fallback. (#251)
Switching back to a session before its previous transition finishes now plays the selected animation correctly. (#253)
Compatibility
Image-region updates are sent only when every attached client advertises graphics-root-frame-edits. Older clients receive full frames, and older and newer clients can attach to each other's servers. No user action is required. (#250)
net/py-junos-eznc: Upgrade to version 2.8.2.
Pkgsrc changes:
* Bump a few dependencies
* Checksum changes
Upstream changes:
## Release 2.8.2 - 22 Jun 2026
## Features Added
- Gather facts for the satellite devices
## Bugs Fixed
- Updated the SW install output messages in the progress callback
## Release 2.8.1 - 1 Jun 2026
## Features Added
[23 lines not shown]
devel/ruby-mize: update to 0.7.0
0.7.0 (2026-10-17)
Breaking
* Removed support for Ruby 3.0 from the CI test matrix.
* Removed the vestigial MonitorMixin inclusion from Mize::DefaultCache, as
the class is now a plain Hash wrapper relying on the GVL for atomicity.
Features
* Added Mize.synchronize API to expose the internal MUTEX for atomic
* multi-step operations, with specific handling for ThreadError in trap
contexts.
* Added a GitHub Actions workflow (static.yml) to generate YARD
documentation and deploy it to GitHub Pages.
[68 lines not shown]
devel/ruby-msgpack: update to 1.8.6
1.8.6 (2026-10-27)
* Fix use-after-free when a recursive extension proc rescues, skips or
resets.
* Speed up decoding of oversized integers.
* Avoid excessive memory allocation from crafted container headers.
