py-rich-click: updated to 1.9.9
1.9.9
Fixed ctx.forward() not working with commands patched via rich_click.patch()
Added support for Click 8.5 (resolved DeprecationWarnings)
geography/mapserver: Update to 8.6.6
This release contains multiple security fixes, for issues that are
surely not all listed in pkg-vulnerabilities.
Upstream NEWS (misplaced in HISTORY.md), less non-NEWS content:
8.6.6 release (2026-09-06)
--------------------------
8.6.5 release (2026-07-10)
--------------------------
yara: updated to 4.5.8
4.5.8
Document the YR_RE_SCAN_LIMIT regular expression scan limit
BUGFIX: Bound rule table index in OP_PUSH_RULE and OP_INIT_RULE
BUGFIX: Bound tilde stream row-count read in dotnet module
BUGFIX: Bound repeat stack depth in _yr_re_fiber_sync
BUGFIX: Fix memory leak in yr_rules_load_stream (e13acd3).
BUGFIX: Add missing yr_le16toh byte-swapping in pe module (a2ff0db).
BUGFIX: Validate summary counts in yr_rules_from_arena
BUGFIX: Cast e_lfanew to int32_t before sign check in pe_get_header
BUGFIX: Bound export name count against 32-bit overflow in pe_parse_exports
BUGFIX: Null-terminate authenticode digest/thumbprint hex buffers in pe module
BUGFIX: Fix string memory leak in CLI args_free
BUGFIX: Honor -w/--no-warnings for the file-too-large skip message in CLI
BUGFIX: Avoid pointer wrap for large index in str_table_entry
BUGFIX: Bound iterator item count against value stack depth in yr_execute_code
BUGFIX: Byte-swap sh_entry_count in ELF symtab/dynsym link check
[14 lines not shown]
py-ruff: updated to 0.16.6
0.16.6
Preview features
Move pytest-fixture-autouse to the restriction category
[flake8-pytest-style] Add an autofix for PT020
[flake8-tidy-imports] Prevent fix loop between TID254 and TID255
[isort] Exclude pragma comments from line length calculation (I001)
Bug fixes
Validate unary expressions when parsing
[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514)
[flake8-bugbear] Fix panic on match subjects (B031)
[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901)
[flake8-pytest-style] Avoid duplicate PT017 diagnostics
[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102)
[15 lines not shown]
redis: Replace interpreter for scripts/build.sh.
Despite a comment at the top of the script saying it is designed for POSIX
sh, it uses the non-portable 'local' keyword.
py-xmldiff: updated to 3.0
3.0 (2026-06-11)
- Updated Python versions. 3.8 and 3.9 still works, but is officially unsupported,
added 3.13, 3.14 and 3.15 to the supported versions.
- Speeding up diffing by using dequeue [barucden]
- Support namespace-prefixed move nodes [barucden]
- Improved matching in certain cases [barucden]
py-pillow_heif: updated to 1.7.0
1.7.0 - 2026-09-06]
Added
- Reading and writing nominal diffuse white luminance HDR metadata: `nominal_diffuse_white_luminance` key in `info` dictionary.
- `py.typed` marker, the package type annotations are now visible to type checkers.
Changed
- `libheif` was updated from the `1.23.2` to `1.23.3` version.
- `libde265` was updated from the `1.1.1` to `1.1.2` version.
py-peewee: updated to 4.5.0
4.5.0
Backwards-incompatible:
* MySQL and MariaDB connections no longer set `sql_mode`. Peewee had been
setting `PIPES_AS_CONCAT`, but the param replaced the server's mode rather
than adding to it, which silently disabled `STRICT_TRANS_TABLES` (etc).
Going forward Peewee will not modify `sql_mode` by default and use
`CONCAT()` rather than `||` for MySQL/MariaDB.
* MySQL and MariaDB connection charset defaults to `utf8mb4` instead of `utf8`,
which is an alias for `utf8mb3` and cannot store 4-byte characters.
* A field's `sequence=` is now qualified with the model's `Meta.schema`. If the
name you pass already contains a dot it is treated as fully-qualified and
used as-is, so `sequence='other.seq'` is unaffected by `Meta.schema`. Also,
`sequence_exists()` accepts a schema-qualified name.
* SQLite `BEGIN`, `COMMIT` and `ROLLBACK` are issued directly on a cursor
rather than through `execute_sql()`, so they are no longer debug-logged, do
[43 lines not shown]
py-pebble: updated to 5.2.2
5.2.2
Fixes:
- Issue 164: fix pool channel cleanup logic. @mgorny
- Issue 167: fix type checking on Pool's APIs.
Improvements:
- Introduce type checking on the whole codebase.
- Introduce Ruff based code formatting.
enchant2: updated to 2.8.21
2.8.21 (September 3, 2026)
This release fixes two bugs in composite dictionaries: first, if any
dictionary creation failed during creation of a composite dictionary,
dictionaries already created would be leaked; and secondly, the broker error
status could end up indicating an error incorrectly when one provider or
language failed and a fallback later succeeded. Thanks to @lpyuu for the
report and fixes.
2.8.20 (August 25, 2026)
This release improves the man page for enchant(1), mostly by documenting
Ispell command-line options and pipe-mode commands that it ignores.
py-cattrs: updated to 26.2.0
26.2.0 (2026-09-08)
- Fix the `msgpack` and `cbor2` converters unstructuring naive datetimes as local time, which made the serialized value depend on the timezone of the machine doing the unstructuring; naive datetimes are now assumed to be UTC, matching what the structure hooks already read back.
- Fix `override(rename=...)` targets containing a quote (or other characters not safe in a bare string literal) crashing code generation with `SyntaxError`; the rename key is now embedded with `repr`.
- Fix `Counter` keys not being unstructured with the key type's own hook; the single-type-arg branch passed the whole type-args tuple to the key hook lookup instead of the key type.
- Fix `create_default_dis_func <cattrs.disambiguators.create_default_dis_func>` (aka `create_uniq_field_dis_func`) failing to disambiguate valid unions depending on the order of the member classes; unique fields are now resolved iteratively to a fixpoint.
- Support more recursive types on 3.14+ with specialized factories for [`annotationlib.ForwardRef`](https://docs.python.org/3/library/annotationlib.html#annotationlib.ForwardRef).
- `Converter <cattrs.Converter>` now uses specialized hook factories to generate hooks for tuples, increasing speed.
- Fix an `AttributeError` in `cattrs` internals that could be triggered by using the `include_subclasses` strategy in a `structure_hook_factory`
- Fix TypedDict codegen when keys contain single quotes.
- Add `CattrsError` exception type: all exceptions raised by `cattrs` inherit from this.
Literal and date-time validation raise this directly, instead of `Exception`.
- Fix the `detailed_validation` parameter being passed under the wrong name in {func}`namedtuple_dict_structure_factory <cattrs.cols.namedtuple_dict_structure_factory>`, causing it to be silently ignored.
- _cattrs_ is now autoformatted using Ruff.
- Support running the test suite without `cbor2` installed.
- The [union passthrough strategy](https://catt.rs/en/stable/strategies.html#union-passthrough) now supports PEP 695 type aliases as union members.
- {meth}`BaseConverter.register_structure_hook_factory` and {meth}`BaseConverter.register_unstructure_hook_factory` now properly return the factory when used as decorators.
- The {mod}`msgspec <cattrs.preconf.msgspec>` preconf converter now properly handles recursive classes on Python 3.14+.
py-ujson: updated to 6.0.0
6.0.0
Changed
Assorted cleanup refactors
Removed
Reduce bytes-like support to only bytes and bytearray
Fixed
Allow default handler to handle bytes
Update build dependencies to avoid warning about missing [tool.setuptools_scm] section
Tighten UTF-8 validation for ujson.loads()-ing strings from bytes
Fix memory leak when the default() handler returns non-serialisable objects until its recursion limit is hit
devel/serie: update to 0.9.0
What's Changed
Remove lib target by @lusingander in #164
Improve search option toggles by @lusingander in #166
Make graph test repository dumps opt-in by @lusingander in #167
Improve search option status display by @lusingander in #169
Add search target mode by @lusingander in #170
devel/sem: update to 0.24.0
[0.24.0] - 2026-08-23
Added
sem find, sem grep, and sem context now accept multiple queries in a single call. sem find name1 name2 … resolves each name independently — a miss on one doesn't affect the others; sem grep -e pattern1 -e pattern2 … (rg-style repeated -e) keeps each pattern's hits separate; sem context --entity A --entity B … packs context for several entities in one invocation, each under the same --budget, refusing on an ambiguous or unresolved name the same way the single-entity form does. The MCP find, grep, and context tools gained matching array parameters (queries[], patterns[], entities[]). Single-query usage is unchanged.
New sem_callers MCP tool, exposing the same reverse-caller lookup as the CLI's sem callers. sem callers itself gained --limit (cap the result list) and now refuses — listing every candidate — when a name matches more than one definition, instead of silently answering for just one.
A middle zoom level between an outline and full source: sem entities --signatures and sem context --headers. Each shows an entity's signature (up to where its body starts) plus the first line of its leading doc comment, instead of either the bare name alone or the full body. Available over MCP as signatures: true on entities and mode: "headers" on context.
Fixed
sem-mcp's format parameter now applies everywhere entities can return results. It was previously honored on some response shapes but ignored on others: entities' free-text and query-ranking modes always rendered human-readable text even when format=json was requested, and the cloud-served directory-listing fast path always returned raw JSON even for the default text format.
[0.23.1] - 2026-08-22
Fixed
CSV, JSON, and Vue entities no longer collide on generated ids with entities from other files. Their id-generation scheme is now disambiguated per plugin, closing a gap where two entities could silently collapse onto the same id and one would drop out of the graph.
Entities from non-code files (Markdown, TOML, YAML, JSON, CSV, Vue/Svelte) now carry accurate byte ranges, so tools that rely on byte offsets (extraction, editing, highlighting) work correctly for these file types instead of getting an inaccurate span.
Markdown headings that appear inside a fenced code block are no longer parsed as real document headings.
[8 lines not shown]
