pkgconf: update to 3.0.5.
Changes from 3.0.4 to 3.0.5:
----------------------------
* Correctness fixes:
- Shell quoting and backslash escapes in pc(5) properties are now consumed
once, after variable substitution, instead of while splitting the property
beforehand. Quoting arriving from a variable is therefore treated like
quoting written inline, --variable reports a value as the .pc file spells
it, and fragments are escaped exactly once when rendered. This supersedes
the 3.0.4 fix, which unescaped whitespace at parse time and so hid the
escaping from consumers such as cmake's FindPkgConfig.
See https://github.com/pkgconf/pkgconf/issues/575 and
https://github.com/pkgconf/pkgconf/issues/579.
- Metadata queries no longer consult Conflicts rules between the modules named
on the command line, as reporting metadata does not combine them into a
build. This covers --license, --license-file, --modversion, --path,
--print-provides, --print-requires, --print-requires-private,
[41 lines not shown]
libssh: update to 0.12.1.
version 0.12.1 (released 2026-07-21)
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
* CVE-2026-59843: Denial of service via zero advertised channel packet size
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Allow hybrid ML-KEM key exchange in FIPS mode
[53 lines not shown]
mame: update to 0.289.
After two long months, MAME 0.289 is ready, and it’s an undeniably
massive update! But before we talk about emulation, there are a
few more mundane things to mention. The sdljoy joystick input module
now supports game controllers with up to 128 buttons. Finally,
outputs have been overhauled, improving performance and fixing
issues, but you may need to update your configuration if you’ve
got external programs hooked up, and some artwork files may need
updating.
You’ll notice a number of systems and coprocessor cards based around
NS32000 family CPUs are now working. If you aren’t familiar with
it, the NS32000 architecture was one of the first single-chip CPU
families with a 32-bit ALU. It used a highly orthogonal instruction
set with clear influences from Digital Equipment Corporation’s
earlier work. In retrospect, it didn’t have enough registers, the
instruction encoding was too complex, it took them too long to
overtake Motorola’s 68k family’s performance, and bugs in the
[31 lines not shown]
moor: update to 2.16.2.
2.16.2
Before this release, a file that the syntax highlighter saw as one
single token -- a file holding nothing but a number, for example --
came out with every character in the same color.
With this release, highlighting that would look uniform is skipped and
the text is shown plain. Thanks @knirch for reporting #445!
Also in this release:
On Windows, arrow and function keys now work immediately after
returning from an editor opened with "v", instead of being ignored for
up to a tenth of a second
Faster .zst decompression on arm64 (Apple Silicon), and corrupt .zst
input now reports an error rather than decoding to garbage
Compressed files and streams are now properly closed, so moor no
[31 lines not shown]
OpenJPH: update to 0.31.0.
This release has a few fixes, new features, and many people contributed to it.
Importantly, this release adds Qfactor.
This release however breaks API and ABI.
rumdl: update to 0.2.49.
0.2.49 - 2026-08-02
Security
config: keep an extends target's path and contents out of messages about it (72bcb49)
An extends value is expanded from the environment before it is resolved, so naming the resolved path in an error or warning printed environment variable values wherever that message went, which under CI is the build log. extends also points at an arbitrary path, so a target that is not valid TOML had its offending line quoted back. A file reached through extends is now named by the reference as written, and its own text is never repeated. A config you name yourself is unchanged, and rumdl config, the language server's report to its editor, and RUST_LOG=debug still show resolved paths.
Reported privately by Shuvam Kumar.
Fixed
md072: keep every trailing newline when sorting frontmatter keys (a5e7c40)
fix-utils: measure fix ranges against the content the rule read (2ed4238)
md044: read a wikilink's display text, not the page name it hides (51d584e)
md039: keep wikilinks and nested images intact when trimming link text (aabd859)
md045,md057,md044: stop reporting wiki embeds as images (1147d17)
[85 lines not shown]
zxing-cpp: update to 3.1.1.
Patch release
QRCode: improve Version 1 detection rate
QRCode: fix detection regression in 3.1.0
python: fix use of 'None' keyword usage and wrong '**kwargs' tag
MicroPDF417: fix out of bounds access
MultiFormatWriter: fix BarcodeFormat::Aztec and QRCodeModel2 support
Android: make binary a little smaller (hidden symbols)
PDF417: match codewords using integer arithmetic by @nyluke in #1138
ReedSolomon: add missing header for GCC-16 by @parona-source in #1137
py-cryptography: update to 50.0.0.
50.0.0 - 2026-07-31
~~~~~~~~~~~~~~~~~~~
* **SECURITY ISSUE**:
:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
Credit to **@X1AOxiang** for reporting the issue
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
* Added ``xof()`` class methods to
:class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
[51 lines not shown]
