audio/fasttracker2: Update to 2.28
Changes since 2.27:
v2.28 - 30.10.2026
* Fixed crash when using the "Fix DC" button (S.E.Ext) on a marked
selection
* Did some tweaks to the routines in Smp. Ed. -> Effects
miniflux: Update to version 2.3.5
New features
Added OpenID Connect admin role mapping: set OAUTH2_ADMIN_GROUP and OAUTH2_GROUP_CLAIM to grant or revoke the admin role at login based on the user's groups. The group claim is read from the user info response or the ID token, and OAUTH2_ADDITIONAL_SCOPES can request extra scopes from the provider.
Allowed WebAuthn/Passkeys as the only login method when DISABLE_LOCAL_AUTH is enabled. Register at least one passkey while another authentication method is still available before turning off local authentication.
Added a force parameter to the feed refresh API endpoint (PUT /v1/feeds/{id}/refresh?force=true) to bypass the HTTP cache and reprocess existing entries, matching the forced refresh in the web UI. The Go client gains ForceRefreshFeed.
Rejected invalid CSS selectors when saving rewrite and scraper rules, instead of silently ignoring them.
Moved the username, password, OAuth2 account linking, and passkey settings to a dedicated Authentication page under Settings.
Performance improvements
Stopped creating database web sessions for anonymous visitors, crawlers, media proxy requests, and other public pages that don't need one. Logged-out language and theme preferences are now kept in a cookie, and anonymous sessions are removed after 24 hours, which keeps the web_sessions table from growing with thousands of unused rows.
Security
Required the current password before setting a new one on the Authentication page.
Signed out other sessions when a password is changed, from the web UI, the API, or the -reset-password command. The current session gets a new identifier so a copied cookie stops working.
Prevented administrators from editing their own account through the user management page, which bypassed the current password check.
Restricted feed cookies to the feed's own website, so they are no longer sent to third-party hosts when scraping articles, fetching icons, or discovering feeds.
Blocked 6to4 and IPv4-compatible IPv6 addresses that could bypass the server-side request forgery filter.
Stopped caching shared entry pages in public caches and removed the CSRF token from them.
[23 lines not shown]
dnscontrol: Update to 5.7.2
Changelog
Provider-specific changes:
9b9ad49: fix(p/CLOUDFLAREAPI): Let CF to reject invalid proxy settings; don't guess what is invalid (#5051) (@ybai08)
148c2d4: fix(p/CLOUDPRESS): halve zone fetches and make retry backoff configurable (#5046) (@arnoschoon)
40a2436: fix(p/DNSIMPLE): add URL as supported type (#5054) (@philpennock)
c8d0fd0: fix(p/LUADNS): bug: occasional "Server returned bad status code (500)" fails a push (#5042) (@TomOnTime)
CI/CD:
81a6eab: build(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 (#5050) (@dependabot[bot])
c679839: build(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2 (#5049) (@dependabot[bot])
01079f5: build(deps): bump zod and puppeteer (#5044) (@dependabot[bot])
08c0d2a: build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 (#5045) (@dependabot[bot])
security/ruby-auth-sanitizer: update to 0.2.5
0.2.4 (2026-10-23)
Security
* SanitizedLogger now redacts configured keys in Ruby Hash#inspect output
(both Ruby 3.4+ {"key" => "value"} / {key: "value"} and pre-3.4
hash-rocket formats), fixes a mangling bug where the form-pair pattern
partially matched :key=>"value" pairs, and no longer raises on
invalid-encoded message bytes. This closes the OAUTH_DEBUG
cleartext-logging bypass reported for oauth2 as GHSA-cmh8-5q25-68v6, where
Faraday renders Hash request bodies with pretty_inspect. Reported by
iamibi.
Other changes are too many to write here, please refer:
<https://github.com/ruby-oauth/auth-sanitizer/releases#release-v0.2.4>.
[20 lines not shown]
devel/ruby-version_gem: update to 1.1.17
1.1.16 (2026-10-23)
Added
* kettle-jem-template-20260913-001 - Templating now also surfaces a review
entry in dependency_conflicts.resolve when a direct development dependency
doesn't support one or more of this project's declared engines: and has no
template-managed modular home (e.g. sqlite3 on jruby). Review each entry
and pick a resolution per the project's own engine support needs.
Changed
* kettle-jem-template-20260801-001 - Generated README gem dashboard links
now use ClickGems instead of BestGems.
* [kc] kettle-jem/prepare: updated 17 project files:
- configuration (1)
[48 lines not shown]
devel/ruby-anonymous_loader: update to 0.1.5
0.1.4 (2026-10-23)
Added
* kettle-jem-template-20260720-005 - README Support & Community links now
include RubyForum.
* kettle-jem-template-20260726-001 - Projects now include YARD lint
configuration and documentation dependencies so documentation issues fail
before generated docs are refreshed.
* kettle-jem-template-20260727-001 - Spec harness documentation now lists the
RSpec helpers provided by kettle-test.
* kettle-jem-template-20260913-001 - Templating now also surfaces a review
entry in dependency_conflicts.resolve when a direct development dependency
doesn't support one or more of this project's declared engines: and has no
template-managed modular home (e.g. sqlite3 on jruby). Review each entry
and pick a resolution per the project's own engine support needs.
[89 lines not shown]
databases/ruby-sequel: update to 5.110.0
5.110.0 (2026-11-01)
* Raise error if attempting to use a quoted identifier containing " on
Oracle (jeremyevans)
* Deprecate Microsoft Access support (jeremyevans)
* Raise error if attempting to use a quoted identifier containing ] on
Microsoft Access (jeremyevans)
* Replace aliasing of Kernel methods inside modules with define_method and
Kernel.instance_method (jeremyevans)
* Deprecate Sequel::SPLIT_SYMBOL_CACHE constant (jeremyevans)
* Deprecate Sequel.split_symbols= (jeremyevans)
[20 lines not shown]
ansilove: updated to 4.2.3
AnsiLove/C 4.2.3 (2026-11-02)
- Document support for PabloDraw 24-bit ANSI sequences
- Add an IceDraw test file and register it with CTest
- Use a distinct output filename for the Retina test
- Fix a memory leak in SAUCE handling
- Fix SAUCE reading with respect to file size and EOF markers
libansilove: updated to 1.4.4
libansilove 1.4.4 (2026-11-02)
- Check if high_font_data_xbin is set rather than trusting the xbin_flags
data (CVE-2026-111144, found by HaiND and reported by Alexander Shvedov)
- Fix source files used by format fuzzers
- Refactor the XBIN loader to use a common error label and fix canvas
memory leaks
- Fix out-of-bounds reads in RLE decoder (CVE-2026-111143, found by HaiND)
fluidsynth: updated to 2.6.2
fluidsynth 2.6.2
Fix inconsistent note-onset-ramps when fluidsynth reuses a voice
Preserve MIDI parser state except on System Reset
Performance optimization for the IIR-filter
Fix infinite loop in DSP when sample-loop-wrap leaves phase negative
Fix the 4 ms predelay in Dattorro reverb
Honor sustain when releasing sostenuto
The MIDI player now rejects zero tempo in MIDI files
Fix loud and distorted sound for some SF3 files
Fix NoteOff events possibly reviving stale notes after receiving AllNotesOff and AllSoundsOff
When switching between MIDI modes, fluidsynth now force-releases playing notes, as per MIDI spec
Fluidsynth now enforces the data value of CC126 events only when being in OMNI OFF mode, and remembers it when in OMNI ON mode
Fix libfluidsynth's install name on MacOS to make it relocatable (@rpath) rather than tied to an absolute build/install path
Fix memory leaks in the SDL3 audio driver
Fix a race-condition during multi-threaded rendering
bsd.buildlink.mk: add hack/workaround for PR 57517
Something, at some point, some years back, changed the interaction of
things such that for builtin packages, BUILDLINK_PREFIX.pkg gets set
before we're done assessing whether to use the builtin package, and in
particular before the logic that makes USE_BUILTIN.pkg=no transitive
across deps.
The result has been that when this logic sets USE_BUILTIN.pkg=no, it's
ignored and we buildlink and use the builtin package anyway. This then
results in broken builds of things like fontconfig and Xft2 where this
matters.
As a workaround, clear BUILDLINK_PREFIX.pkg if we set USE_BUILTIN.pkg
to no in this logic. It will then get set to PKGBASE as needed later.
Strengthen the comments in and around this logic too, as what it does
is itself somewhat complicated and confusing and the implementation
is more so.
[4 lines not shown]
py-pydantic*: update to 2.50.2/2.14.2
This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.
Packaging
Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @Viicos in #14003
Bump speedate to v0.18.0 by @Viicos in #14007
Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @Viicos in #14083
Performance
Avoid Python tuple allocation during model fields validation by @Viicos in #13955
Lazily call repr of values during nested union serialization by @Viicos in #14082
Skip decorator field checks when no field decorators exist by @alexmojaki in #14111
Avoid heap allocation for small JSON model field buffers by @alexmojaki in #14113
Fixes
[49 lines not shown]
py-zensical: update to 0.0.74.
This version adds support for the optimize plugin and includes
fixes for redirects, blog dates, validation settings, privacy
downloads, and llms.txt output.
py-websockets: update to 17.4.
Security fix
websockets 17.4 fixes a security issue.
:meth:`~asyncio.connection.Connection.recv` now rejects fragmented messages split into more than 4096 frames. You may adjust the limit with the :envvar:`WEBSOCKETS_MAX_FRAGMENTS` environment variable.
Earlier versions were vulnerable to denial of service by memory exhaustion because they didn't enforce such a limit (CVE ID pending). All implementations were affected.
:meth:`~asyncio.connection.Connection.recv_streaming` isn't affected.
Improvements
Chained consistently to :exc:`~exceptions.ConnectionClosed` exceptions that close the connection.
py-urwid: update to 5.0.1.
Urwid 5.0.0
2026-10-28
Breaking Changes ⚠
Drop Python 3.9 and 3.10: urwid requires Python 3.11 or newer by @penguinolog in https://github.com/urwid/urwid/pull/1401
Allow display attributes to inherit colors and settings: canvas content and Text.get_text() carry LayeredAttr for nested attributes, custom screens have to call BaseScreen.resolve_attr() instead of reading the palette, and an attribute an AttrMap maps to None shows the map’s None attribute by @penguinolog in https://github.com/urwid/urwid/pull/1409
🗹 AttrSpec foreground and background default to 'inherit'; also a new feature, see “Major features” below: Draw OSC 8 hyperlinks from display attributes by @penguinolog in https://github.com/urwid/urwid/pull/1415
Drop code planned for removal in 5.0: the Columns, Pile, GridFlow, Frame and ListBox get_focus/set_focus methods and 1.1-era list attributes, the Frame header/body/footer getters and setters, ListBox.contents() called as a method, content_delta, shards_delta, shard_cviews_delta, BaseScreen.run_wrapper, font.add_font, WidgetWrap._set_w, AttrWrap.w and Filler.body; MonitoredDeque.insert() with an index without __index__ raises TypeError by @penguinolog in https://github.com/urwid/urwid/pull/1402
⚡ Remove the vterm escape compatibility constants and plain-tuple CSI_COMMANDS entries, return WHSettings members from Pile.options() for 'given' and 'weight', and require typing_extensions on Python older than 3.13; also see “Deprecations” below: Unify deprecation warnings and removal versions by @penguinolog in https://github.com/urwid/urwid/pull/1421
Stop re-exporting unrelated names from urwid.graphics by @penguinolog in https://github.com/urwid/urwid/pull/1163
[237 lines not shown]
