croc: Update to 11.2.2
11.2.2
What's Changed
fix: web show link Fixes #1266 by @schollz in #1268
build(deps): bump azure/trusted-signing-action from 0.5.0 to 2.0.0 by @dependabot[bot] in #1267
(newer version require Go 1.27, keeping on-hold once Go 1.27 will be available in pkgsrc formally)
p5-Catalyst-Plugin-Static-Simple: update to 0.38nb1.
Immediately to nb1 because this includes a patch for CVE-2026-15743.
0.38 - 2026-07-17
- canonical repository is now github, rather than catagits
graphics/simp: update to 3.11.0
- Update egui and a bunch of others deps
- Make smooth zoom
- Add option to sort images in list by different values like name, time and size
- Fix some text fields being impossible to enter text into
py-aiohttp-socks: updated to 0.12.0
0.12.0
Dropped support for Python 3.8.
Bumped python-socks upper bound to <4.0.0.
The entire codebase is now strictly type-annotated and fully compliant with mypy.
py-ipython: updated to 9.16.1
IPython 9.16
Summary
This release contains two security-hardening fixes — HTML-attribute escaping in
the display objects and closing an arbitrary-code-execution path in completion —
a new ``cell_meta`` field on
:class:`~IPython.core.interactiveshell.ExecutionInfo`, several completion, autoreload,
and path-handling fixes, and two backwards-incompatible changes (``%lsmagic``
default output and the removal of long-deprecated APIs). It also includes a
large amount of internal typing, test, and CI modernization.
py-django-debug-toolbar: updated to 7.1.1
7.1.1 (2026-08-14)
* Serialize ``TaskResult`` in the Tasks panel to accommodate the storage
mechanism.
* Removed whitespace on Task panel's ``kwargs`` column.
7.1.0 (2026-08-10)
* Added a Tasks panel that shows tasks queued during the request via
Django's built-in tasks framework (``django.tasks``, Django 6.0+). On
older versions of Django, the panel explains that upgrading is required.
* Fixed the Django version check in the SQL panel test suite for Django's
boolean parameter handling.
* Fixed ``show_toolbar_with_docker`` on Docker runtimes such as OrbStack that
can resolve ``host.docker.internal`` to an address outside the container
network.
* Restored the select and explain buttons for queries that run without
[6 lines not shown]
py-WebOb: updated to 1.8.11
1.8.11 (2026-08-02)
Security Fix
- The fixes for CVE-2024-42353 and GHSA-fh3h-vg37-cc95 were still
incomplete: besides removing tab, CR, and LF, ``urllib.parse.urljoin``
also strips leading and trailing C0 control and space characters from a
URL before parsing it. A Location value such as
``" //www.example.com/test"`` could therefore still be interpreted as a
protocol-relative URL (and ``" https://www.example.com/test"`` as an
absolute one), allowing an open redirect.
WebOb no longer uses ``urllib.parse.urljoin`` and instead ships its own
implementation of the RFC 3986 reference resolution algorithm,
``webob.util.urljoin``, which resolves the URL exactly as given without
removing any characters. It is now used to make the Location header
absolute, by ``Request.relative_url``, and by the ``_HTTPMove`` based
[5 lines not shown]
py-stripe: updated to 15.5.1
15.5.1 - 2026-08-18
better document StripeObject's to_dict behavior
15.5.0 - 2026-08-10
Add async iteration to v2 list auto-pagination
Adds async for support to v2 ListObject.auto_paging_iter().
Surface object property on EventNotification
Emit Claude Code plugin hint at module load time
Emits new Claude Code plugin hint when CLAUDECODE or CLAUDE_CODE_CHILD_SESSION environment variables are detected.
add/adjust event parsing helpers
[6 lines not shown]
