mktool: Update to 1.5.11.
* Cargo: Upgrade all dependencies, including webpki certificate updates. The
minimum supported Rust version is now 1.88.
* check-portability: Handle non-UTF8 input without skipping shell checks or
failing to read patch files, and improve performance.
* fetch: Honour `MKTOOL_READ_TIMEOUT` for HTTP downloads.
* distinfo: Calculate all checksums in a single pass over each file, improving
performance of distinfo generation for www/grafana by another 33%.
nodejs: updated to 26.12.1
26.12.1 (Current)
Notable Changes
(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
(CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
deps: V8: backport 93cd21e8254b (Joyee Cheung)
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
tls: reject chains containing blocked public keys (Ulises Gascon)
[3 lines not shown]
mitmproxy: Update to 12.3.0
Changes:
mitmproxy 12.3.0
- Add `--emudhra` and `--emudhra-old` options to sign TLS certificates
with a compromised eMudhra intermediate CA key.
- Major improvements to the Web UI.
- Bug fixes
py-mitmproxy_rs: Update to 0.12.15
pkgsrc changes:
- Switch to released boringtun and adapt the path to the patch to add NetBSD
support (it is now upstream but not part of 0.7.1, it will available in the
next releases)
Changes:
mitmproxy_rs 0.12.15:
(There are no changes between 0.12.12..0.12.15 release because all of them
where re-released due CI/CD problems)
- Preserve OS error details when UDP and WireGuard servers fail to start.
- `Stream.is_closing()` now returns `True` once the server or UDP client task has shut down.
mitmproxy_rs 0.12.11:
- Add IPv6 support to Linux local capture mode.
mitmproxy_rs 0.12.10:
- Fix UDP connection establishment on IPv6-only networks.
[4 lines not shown]
unbound: update to 1.26.2
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Bug Fixes
- Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on
multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen
from Tsinghua University for the report.
- Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
records under a configured island trust anchor underneath an
insecure parent. Thanks to Qifan Zhang from Palo Alto Networks
for the report.
- Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression
work leads to degradation of service. Thanks to Yuheng Zhang
(Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun
Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen
[9 lines not shown]
devel/cargo-nextest: update to 0.9.149
Security
cargo nextest self update no longer trusts the eMudhra intermediate certificate authorities whose private keys were disclosed on 2026-10-20. Previously, an attacker able to intercept network traffic could have used these keys to make cargo nextest self update download and install a malicious binary.
Nextest's self-updater uses a bundled set of root certificates, so operating system and browser updates do not protect it. This release updates webpki-roots to 1.0.10 and rustls-webpki to 0.103.16, both of which distrust the compromised certificates.
Running tests does not involve network access and is not affected. Builds without the self-update feature, including most distribution packages, are also not affected.
Updating from an earlier version with cargo nextest self update would go through the affected code one last time. If you're concerned about your network being compromised, use one of the other installation methods instead.
Fixed
On riscv64 Linux, cargo nextest self update no longer panics. (#3649)
py-wcwidth: updated to 0.9.3
0.9.3
* **Bugfix** libwcwidth no longer has undefined behavior on NULL or empty input in the UTF-8 and
alignment functions
* **Changed** `HyperlinkParams.parse()`_ now rejects trailing text
* **Bugfix** `wrap()`_ should keep a link's own OSC 8 params across a line break
sysutils/gravityfile: update to 0.4.0
0.4.0 - 2026-10-13
A rewrite of the scanner, the explorer's internals and the command line, with release binaries for macOS, Linux and Windows. It is the first release on crates.io since 0.2.4: 0.3.0 was released on GitHub only, and 0.3.1 was never released, so its changes are listed here. Upgrading from 0.2.4, see also the 0.3.0 notes. Several changes are breaking: the gravityfile executable is gone (use grav), report options and JSON changed (schema_version 2), plugins are Lua only, and settings moved on macOS.
Security
Plugins cannot read past their read-size limit, even when they ask for a larger one, and cannot read special files such as FIFOs, which could block.
An archive cannot be created inside the directory being archived, and an interrupted archive leaves nothing behind.
zip is updated to 9.0, past RUSTSEC-2026-0367, -0368 and -0369. Those affect zip's own extraction helpers, which grav never used: its extraction already drops setuid and setgid bits and keeps symlinks inside the destination. Opening a ZIP still reads only its directory, not the whole archive, which zip 9 would otherwise scan.
Dependencies are updated past the vulnerable crossbeam-epoch 0.9.18 and the unsound git2 0.20 line; BLAKE3's unused memory-mapping feature, and with it memmap2, is gone.
Added
grav diff OLD [NEW] shows what grew, shrank, appeared or went between two scans, largest changes first per directory. Each side is a snapshot or a directory; with one snapshot it is compared with the same place today, scanned with the snapshot's scope. Text or JSON.
Plugins that work as documented. Hooks run in the background, so a slow plugin no longer freezes navigation; only on_delete_start (which can refuse the delete) and on_shutdown are awaited. gf.notify now shows its message in the status line, plugin failures are reported instead of only logged, and hooks receive the context (directory, theme, selected entry) as a third argument. Scan start and error, delete, copy, move and rename completion, and analysis hooks now fire. Hooks the explorer never fired and the unrendered ui namespace are removed, and the plugin guide and example are rewritten to match.
grav scan --top N lists the largest files anywhere below the root, and grav scan --by-type totals the space by file extension.
Scan history. Each full scan in the explorer, and grav scan --record, adds a summary to history.jsonl in the data directory. grav history [PATH] shows a directory's size over time and what changed most; --all lists every recorded directory. The explorer's header shows the change since the last scan of the same place. record_history = false turns it off.
Browse snapshots in the explorer. grav root.json.zst opens a saved scan or ncdu dump read-only, without touching the filesystem: navigation, search, the treemap, size toggling and age analysis work; file operations, rescans and duplicate detection are refused with an explanation.
[75 lines not shown]
python315 py315-html-docs: updated to 3.15.1
Python 3.15.1
Security
gh-159894: Bump the version of pip bundled in ensurepip to version 26.2.2.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
Core and Builtins
gh-159739: Avoid a crash if allocation fails while creating a string.templatelib.Template iterator.
gh-159739: Propagate errors during generic class construction and avoid a crash after failed generic alias substitution.
gh-159739: Raise OverflowError when the absolute value of a dynamic printf-style formatting width is too large.
gh-159739: Fix a reference leak in gc.get_objects() and gc.get_referrers() when an internal allocation fails in the free-threaded build.
gh-159739: Fix memory leaks during interpreter startup when a path configuration file is empty or too large, or when an audit hook rejects a command.
gh-159739: Avoid a crash when an interpreter configuration string cannot be encoded as UTF-8.
gh-159739: Preserve the original SyntaxError if allocating optional error metadata fails.
gh-159739: Avoid a crash if formatting an integer with the c presentation type runs out of memory.
gh-159739: Avoid a crash when a module filename cannot be encoded as UTF-8.
gh-159603: On FreeBSD, call pthread_attr_get_np() to get the stack size (and guard size) of the current thread. Patch by Victor Stinner.
[238 lines not shown]
python314 py314-html-docs: updated to 3.14.9
Python 3.14.9
Security
gh-159894: Bump the version of pip bundled in ensurepip to version 26.2.2.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Core and Builtins
gh-159739: Avoid a crash if allocation fails while creating a string.templatelib.Template iterator.
gh-159739: Propagate errors during generic class construction.
gh-159739: Raise OverflowError when the absolute value of a dynamic printf-style formatting width is too large.
gh-159739: Fix a reference leak in gc.get_objects() and gc.get_referrers() when an internal allocation fails in the free-threaded build.
gh-159739: Fix memory leaks during interpreter startup when a path configuration file is empty or too large, or when an audit hook rejects a command.
[116 lines not shown]
py-deepdiff: updated to 9.1.0
v9-1-0
- Added multiprocessing support for DeepDiff: parallel distance computation and parallel subtree diffing with aggregated worker stats, deterministic ordering, and automatic fallback to serial when unsafe (e.g. `custom_operators`, `*_obj_callback`, `ignore_order_func`)
- Added wildcard/glob pattern support for `exclude_paths` and `include_paths` thanks to [akshat62](https://github.com/akshat62)
- Reimplemented internal cache for improved performance
- Memoized `GlobPathMatcher` to remove exponential-time matching cliff
- Comprehensive type-hint corrections across `deephash.py`, `helper.py`, `delta.py`, `diff.py`, `distance.py`, `path.py`, and `serialization.py` (also fixed real bugs: misplaced paren in `path._guess_type` call, and `len(other.indexes > 1)` → `len(other.indexes) > 1` in `diff._compare_in_order`)
- Security: Delta dunder-attribute traversal in `check_elem()` now raises immediately instead of going through `_raise_or_log()`, with full-path preflight validation in `_get_elements_and_details()` so the `set_item_added` path cannot silently skip malicious dunder paths
- Fixed nested NamedTuple set/frozenset Delta updates dropping the outer container
- Fixed tuple Deltas using iterable opcodes silently doing nothing for insert/delete-only changes
- Fixed Delta with both moved and added iterable items mutating the Delta's own internal diff data
- Fixed crash during path sorting when removing multiple dictionary items with complex keys
- Packaging: added missing files to sdist and removed obsolete `MANIFEST.in` thanks to [mgorny](https://github.com/mgorny)
- Updated GitHub Actions workflows and dependencies
