py-textual: update to 8.2.8.
8.2.8
Fixes for extended key processing, and a crash bug for clicking
the screen padding area.
8.2.7
This release adds additional support for the Kitty key protocol.
Which enables some additional keys on some terminals. Additionally,
Textual will report modifier keys as separate key events.
Additionally there are a few more shortcuts to the Text Area.
This release sponsored by Mistral AI. See release notes for detail.
8.2.6
[12 lines not shown]
py-authlib: updated to 1.9.4
1.9.4 — 2026-11-04
Security
IDJAGGrant stores the verified claims of the ID-JAG in request.id_jag_claims. authenticate_user can use them to resolve the user with the iss and sub claims, and tenant for a multi-tenant IdP. The documentation used to resolve the user with sub alone. An IdP, or a tenant of an IdP, could then get access tokens for the users of another one. Update authenticate_user if your server trusts several IdPs or a multi-tenant IdP. GHSA-9qr6-8289-9j56
harfbuzz: updated to 15.1.0
15.1.0
- Add buffer deserialization APIs that report progress as a byte offset, for
use from introspection bindings.
- Fix Indic shaping of the Unicode 18 Devanagari and Bengali additions.
- Fix Arabic fallback shaping: wrong ligatures when a component is missing from
the font, and disappearing marks in legacy fonts.
- Fix `COLR` glyph extents and mark positioning in fonts with empty layers.
- Fix AAT shaping: wrong `kerx` kerning (formats 1 and 2) and mark positioning
(format 4, a 14.3.0 regression), and ignored `kern` and `mort` tables with a
non-first initial state.
- Various fixes to the Graphite2 shaper.
- Report HarfRust shaping failures through `hb_buffer_allocation_successful()`.
- Fix wrong outlines in `gvar` fonts with intermediate tuples.
- Fix `hb_face_create_or_fail()` rejecting face indices with named-instance
bits set.
- Fix wrong fallback metrics: the vertical descender in fonts without `vhea`,
and the hanging baseline for some scripts.
[30 lines not shown]
nodejs: bump libuv BUILDLINK_API_DEPENDS minimum to 1.52
Recent releases expect the following feature in libuv, or builds will
fail due to the missing field.
* unix,win: add f_frsize field to uv_statfs_t (Ben Noordhuis)
shader-slang: update to 2026.21
- Document how to install Metal Developer Tools
- Return the parse result from
IGlobalSession::parseCommandLineArguments
- Allow global constant inlining with shader debug information
- Keep a global-scope call whose callee needs a local variable out of
force inlining
- Add optional slang-standard-modules embedding library
- git-worktree-add.sh: add --force to replace an existing branch and
worktree
- Fix MSVC 2019 internal compiler error in unit-test-string.cpp
- SPIR-V: emit pointer-to-signed-int casts through an unsigned
integer
- Fix CUDA Gather on combined samplers and reject GatherCmp on CUDA
- Make abs of an unsigned integer the identity on SPIR-V, LLVM and
GLSL
- render-test: create an untyped object input in the program's
session
[133 lines not shown]
security/pkcs11-provider: Do revbump after all with base openssl fix.
Previously it would build _by default_ with pkgsrc openssl; revbump
is needed because this default changes.
ggml: update to 0.29.0.
ggml v0.29.0 adds an OCP FP8 E4M3 tensor type, a new
ggml_flash_attn_ext_rows op where each query slice attends to its
own list of K/V rows, a batched tensor copy API, and initial support
for multi-node tensor parallelism through a new multi-process
communicator interface. Core improvements include bounding tensor
views by the bytes their strides reach, zero-copy GGUF export of
host-buffer tensors, and vm_allocate-based allocations on Apple
platforms. Performance work spans all major backends: new SVE
kernels in the CPU backend, DPAS flash attention for quantized KV
in SYCL, fused MoE MMQ in CUDA, faster MXFP4 mat-vec in Metal,
split-K tuning in Vulkan, and a large expansion of quantized
GEMM/GEMV coverage in OpenCL. The Hexagon backend gains support
for several new ops, including the lightning indexer, top-k mask,
conv2d and upscale.
fd-find: update to 10.5.1.
Bugfixes
Fix --absolute-path turning verbatim (\\?\) search paths into relative paths on Windows: \\?\UNC\server\share is now reported as \\server\share, and \\?\Volume{...} paths are kept intact, see #2207 (@Duo-ee)
Make --ignore and --no-hidden after -u override only their half of -u, see #2192 (@NavpreetSSidhu)
Fix inline case-insensitive regex flags incorrectly making other --and patterns case-sensitive, see #2184 (@mabunemeh)
Accept --format templates that start with - when passed as a separate argument, see #2126 (@vulragrag-star)
Don't incorrectly escape newlines in error messages, see #2104
Restore jemalloc as default allocator on supported systems
Fix the cargo binstall release URL, which named the crate (fd-find) instead of the binary (fd) and fell back to a third-party mirror
Fix integer overflow when parsing size constraints, rejecting values that exceed u64::MAX instead of panicking, see #2196 (@parneetsingh022).
Various fixes and updates to zsh completion
Fix --glob patterns when using --full-path on windows. See #2067.
proc-cli: Update to version 2.3.0
Changes since 2.2.0:
- on, info, for and why show the same card for a process
- process tables show the user, uptime and command
- ports says if each port is reachable from the network
- values proc cannot read show as "-", not 0
- JSON adds parent name, child count, CPU time, open files
rsync: update to 3.5.2.
# NEWS for rsync 3.5.2 (4 Nov 2026)
## Changes in this version:
### BUG FIXES:
- Fixed interrupted `--append` and `--inplace` transfers writing the final
256 KiB buffer twice. An interrupted destination now remains a clean prefix
which the next transfer can resume or repair.
- Fixed uploads through `rrsync` when the destination file already exists.
Existing files are now reached beneath a pinned parent directory instead of
being passed as an unwritable `/proc/self/fd/N` destination.
- Fixed poor matching performance on large sparse and repeated-block files
when duplicate checksum chains exhausted the search limit. Valid basis
blocks are no longer hidden behind duplicate entries.
- Bounded strong-checksum work when a malicious receiver supplies weak
checksums that collide with consecutive rolling windows
(CVE-2026-119741).
[46 lines not shown]
www/typo3-14: update to 14.3.10
14.3.8 (2026-10-09)
This version is a bugfix and maintenance release.
It also updates the third-party dependency "enshrined/svg-sanitize" for
cleaning up external references in SVG files.
14.3.9 (2026-10-13)
This release is a combined bug fix and security release.
Find more details in the security bulletin:
TYPO3-CORE-SA-2026-024 / CVE-2026-109162: Security Misconfiguration
in Form Framework
[10 lines not shown]
www/typo3-13: update to 13.4.37
13.4.36 (2026-10-09)
This version is a bugfix and maintenance release.
This version contains security related updates for the third-party package
enshrined/svg-sanitize. The SVG sanitization got stricter and removes
external URL references in embedded links and style definitions.
13.4.37 (2026-10-22)
This version is a bugfix and maintenance release.
It also updates the third-party dependency "enshrined/svg-sanitize" to the
security release 1.1.1 and fixes an incompatibility with version 1.1 when
sanitizing HTML with embedded SVG, for example via . In addition,
"symfony/expression-language", "symfony/http-foundation" and "symfony/yaml"
are updated to address security advisories.
www/php-concrete-cms: update to 9.5.7
9.5.5 (2026-10-06)
New Features
* Enhanced Thumbnail Editor: Crop Controls, Live Preview, and Dialog Improvements (#13016) (thanks katalysis)
* Add an option to exclude system pages from the Remove Old Page Versions task (thanks digitmaster)
Behavioral Improvements
* Bug: Completed tasks can remain shown as running (#418) (thanks digitmaster)
* The Home Folder is not pre-selected when uploading files from blocks (#12794) (thanks broreece)
* Add date_public to the Page API transformer (#13125) (thanks broreece)
* Fixed: File dialogs throw a fatal error instead of "Invalid file" when fID is empty or non-numeric (#13152) (thanks janscarton)
* Better breadcrumb support in the Dashboard Express pages (thanks mlocati)
* Persist Dashboard panel visibility preference (#12994) (thanks digitmaster)
* Dashboard panel now will stay closed for much longer if the user manually closes it.
* Express Entry List block: check the classes when reading its settings back (#13237) (thanks mlocati)
[100 lines not shown]
