libextractor: update to 1.15.
Security fix release.
Fix pkglint.
Add test arget.
Mon Jun 29 07:58:39 PM CEST 2026
Fix potential 4 MB on-stack memory allocation that could
result in a stack-based buffer overflow in the OLE2 extractor.
Thanks to Haitam Lazaar for reporting.
Releasing GNU libextractor 1.15. -CG
Mon May 25 12:43:20 PM CEST 2026
Revive REAL plugin (fixes #2518).
Revive VLC plugin (fixes #2075).
Fix issues in ELF plugin (fixes #8514).
Fix issues in HTML plugin (fixes #8620).
Fix issues in EXIV2 plugin (fixes #8513, #9223).
Revive Applefile plugin (fixes #2517).
[3 lines not shown]
Update to version 9.2.1116.
Changes:
- patch 9.2.1116: 'tagfunc' not used for tag completion
- patch 9.2.1115: ml_updatechunk() rescans all chunks on every line update
- patch 9.2.1114: Visual selection is not highlighted at the cursor position
- runtime(nasm): move options to separate ftplugin
- patch 9.2.1113: use-after-free and memory leak in serverSendToVim()
- runtime(c,cpp): Update syntax, fix number patterns
- runtime(sh): touch does not end at curly block
- patch 9.2.1112: set_indent() adjusts text properties without any present
- patch 9.2.1111: Crash in a zero-width window with a status line
- patch 9.2.1110: regexp NFA compilation reallocates scratch buffers each time
- patch 9.2.1109: Popup image is drawn over a popup with a higher zindex
- runtime(doc): fix wrong notation of :qall in quickfix.txt
- patch 9.2.1108: Scrolling recomputes the height of every visible line
- runtime(nginx): syntax highlighting is slow on large configs
- patch 9.2.1107: getregionpos() is slow when only the region bounds are needed
- patch 9.2.1106: GTK4: cell edges are blurry with fractional scaling
[119 lines not shown]
lang/ruby40: update to 4.0.7
This release contains fix for CVE-2026-80212 and CVE-2026-80213 in resolv
gem.
4.0.7 (2026-09-15)
* Bug #22188: addr2line doesn't find symbols when compiled with GCC LTO
* Bug #22210: Check if issue #19969 is still reproducible / re-opened in 4.0.x
* Bug #22217: Segmentation fault when resuming execution with Coverage.start
and ruby/debug
* Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request
#18206
* Bug #22200: ObjectSpace._id2ref can return a different object than the
id's owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic
[59 lines not shown]
textproc/treemd: update to 0.9.1
(leaf pkg)
[0.9.1] - 2026-09-14
Fixed
Images inside a list item are drawn. - item  rendered the text and nothing else, and the image was not selectable. The list renderer drops images from its inline run on the grounds that they are drawn separately, which was true while the parser hoisted a list item's image out to a top-level block; since 2.0.0 it correctly keeps the image in the item, so nothing picked it up. The item now reserves the same placeholder rows a paragraph does, registers the image in the element index, and the existing image pass draws into them (#87)
A nested paragraph or list is no longer measured as if it reserved image rows. Only a top-level block reserves them, so counting a nested one that way overstated its height by thirteen rows and pushed everything below it out of position
Internal
The renderer is checked against the line count that production actually uses. The check previously compared against count_block_lines, which the live path does not call for a top-level list, paragraph or image, so those three were being validated against a function that never measures them. index_elements now records the rows it walked and the test compares that
[0.9.0] - 2026-09-14
turbovault-parser 2.1.0, which closes every parser defect reported from here since 0.7.0.
Fixed
[16 lines not shown]
sysutils/mirador: update to 1.13.1
(leaf pkg)
1.13.1 - 2026-09-15
Fixed
The clock's border offers h. 1.13.0 put the 12-hour key only in the ? overlay, so a clock with room to spare never showed it. It is now on the border and the status bar, after Shift+↑↓ move and before d remove, as h 12/24h. At the default width the border is unchanged; h appears as soon as the clock is wide enough for it.
1.13.0 - 2026-09-15
Added
A 12-hour clock (#265). h switches the clock panel between 24- and 12-hour, and the choice is remembered; [clocks].twelve_hour = true sets it in the config. The default stays 24-hour. AM or PM sits small at the top right of the numerals, over the seconds, and the zone table follows: its time_format is converted to 12-hour with your padding kept. With 12-hour off, time_format is used as written, as before.
Fixed
A 12-hour zone row keeps its day marker. A time_format with AM or PM in it, such as %I:%M:%S %p, was cut to … where the +1d belongs; the table now makes room for it.
A task's note preview says when it has been cut. A note longer than the two-row preview lost its later rows with nothing to show it, so the seeded overdue task's note ended a sentence early and looked complete. The last visible row now ends in ….
The watch log's empty state reads as a sentence. "which f on the agenda panel sets" was missing a word; it now says that pressing f on the agenda panel sets [agenda].file.
[13 lines not shown]
nginx: Update to 1.30.5
Changes with nginx 1.30.5 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
resterm: Update to 1.8.1
This release adds HTTP traffic recording.
Point your application's API base URL at a local Resterm listener and use the application as usual.
Resterm forwards the traffic to your API and saves it in a Resterm .http
file as runnable requests, mock responses, or both.
dnscontrol: Update to 5.1.0
Changelog
Provider-specific changes:
f496a86: feat(p/CLOUDFLAREAPI): Normalize CF_WORKER_ROUTE TTL to avoid TTL-only corrections (#4871) (@cafferata)
b35d0cb: fix(p/AUTODNS): clear the legacy "main" record on zone update (#4881) (@dkorunic)
80299f7: fix(p/AUTODNS): send bare FQDN as MX value, not full RDATA (#4880) (@dkorunic)
65fe80a: fix(p/AUTODNS): transmit an MX preference of 0 (#4882) (@dkorunic)
aa20783: fix(p/CLOUDFLAREAPI): Preserve Single Redirect order. New redirects added to end of list. (#4869) (@KyleMit)
c29831e: fix(p/CNR): offer the debug mode levels as a list in init (#4879) (@cafferata)
df419c5: fix(p/DNSMADEEASY): ask the sandbox setting as a yes/no question in init (#4877) (@cafferata)
72a18fd: fix(p/INWX): ask the sandbox setting as a yes/no question in init (#4876) (@cafferata)
3b4078d: fix(p/TENCENTDNS): match package grades case-insensitively (#4884) (@Alice39s)
Bug fixes:
a32953c: fix: remove duplicate "(optional)" in init prompts and add ConfirmValue for yes/no fields (#4875) (@cafferata)
CI/CD:
05b5f9f: Build(deps): Bump joi from 18.2.3 to 18.2.9 (#4872) (@dependabot[bot])
f66211b: ci: adopt conventional commits (#4873) (@TomOnTime)
Other changes and improvements:
3ae38d7: HOSTINGDE: Fix SOA mailbox with a host being dropped (#4866) (@jonathan8devs)
