openssl: updated to 3.6.4
OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed
in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
[27 lines not shown]
croc: Update to 11.3.2
Highlights
Automatically advertises and negotiates experimental-derp-attach-group-v1 in normal supported builds.
Two v11.3.2 peers use eight striped streams over four raw-direct paths with no flags.
Mixed-version peers remain compatible through one-stream legacy Attach.
Raw setup retains one-stream manager fallback, with croc relay fallback in automatic mode.
11.3.1
Highlights
Pins derphole to github.com/schollz/derphole v0.18.2-croc.1 while preserving its upstream module identity.
Adds modular AttachGroup bundle and lifecycle support for the qualified eight-stream/four-path topology.
Keeps automatic AttachGroup advertisement disabled in this release; peers continue using compatible legacy DERP Attach until activation is qualified separately.
Reduces CI cost by avoiding duplicate branch-push validation and reserving full cross-platform builds for main and manual runs.
What’s Changed
DERP transport: connection bundles, client-local providers, clean group-close handling, and safe striped-sender teardown.
Benchmarks: consolidated 8/4 qualification data and benchmark-only build tagging.
[2 lines not shown]
sysutils/broot: update to 1.59.0
- new shell_command verb attribute: run a command through a shell (sh -c / cmd /C) so &&, ; and pipes work, without leaving broot - Fix #1145
- fix invalid official Mac binary (duplicate linked dylib) with new build chain - Fix #1194
- Sixel graphics support for image preview, auto-detected: works in iterm2, Windows Terminal 1.22+ and Sixel-capable Unix terminals (foot, mlterm, xterm built
with Sixel, recent WezTerm). Kitty remains the preferred protocol when available. Note: this requires broot to be compiled with sixel feature
(eg cargo install broot --features sixel) - Fix #568 - Thanks @jamison-wilde
- High-Res images in Rio terminal (detect it to enable the Kitty image protocol) - Fix #1179
- fix content-exact match line number off-by-one when the match starts at the first byte of a line (broot jumped to the line above) - Thanks @YuriNachos
- new :no_action internal, doing nothing, which can be used to disable a key - Fix #328
- fix: detect a duplicate broot server name instead of silently overtaking the running server - Fix #1065 - Thanks @YuriNachos
- fix preview transformers extension matching not working with double extensions such as .tar.gz - Fix #1195
- strip escape sequences from displayed names to prevent OSC injections - Fix #1188 - Thanks @carfeii
- fall back to numeric uid/gid instead of ???? when the user or group name can't be resolved, which is always the case on statically linked musl
builds - Fix #1075
- fix panic on a content regex matching the empty string at the end of a line ending with a control char (eg cr/$/ on a CRLF file)
- fix Windows paths (containing backslashes) being mangled by the launcher's eval when using :cd and similar; also fixes escaping of paths containing
a single quote - Fix #1100 - Thanks @Cyrus580529
- fix br failing on Windows/PowerShell when the temp path contains a space (e.g. a space in the Windows username) - Fix #788 - Thanks @chinhkrb113
[3 lines not shown]
net/ttl: update to 0.22.0
What's Changed
chore(deps): bump the cargo-dependencies group across 1 directory with 12 updates by @dependabot[bot] in #125
chore(deps): bump the cargo-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #127
chore: clippy 1.98 nits (prerequisite) by @lance0 in #130
chore(deps): bump lru 0.18.0 → 0.18.2 (LAN-1114) by @lance0 in #128
perf(tui): skip snapshot+draw when idle (LAN-1222 experiment) by @lance0 in #129
chore(tui): make the render fingerprint exhaustive over its inputs by @lance0 in #131
par2: updated to 1.3.0
1.3.0
Issues:
* Missing include src/utf8.h
PRs:
* Bump actions/checkout from 6 to 7
* Bump cross-platform-actions/action from 1.2.0 to 1.3.0
* Fix macOS unoptimised builds (more general building improvements for the github workflows)
* Printing performance tweaks
xournalpp: updated to 1.3.7
1.3.7
This is a new minor version of Xournal++ with bug fixes and improvements from the community.
Fixed Lua API changeToolColor not recognizing some tool names
Fixed failing assertion when right clicking
Updated translations
py-zeroconf: adapt PLIST for cython 3.3.0
cython 3.3.0 is more strict in checking signatures, which stops it
building the C extension for py-zeroconf.
Reported this upstream, remove the .so files from the PLIST for now.
Bump PKGREVISION.
audio/fasttracker2: Update to 2.23
Changes since 2.22:
v2.23 - 23.08.2026
* Fixed: If the "WAV exporting" screen was open, the "Render
individual tracks" checkbox would have a much taller clickable
area than it should, which could interfere with for example moving
sample loops in the sample editor screen or interacting with the
pattern editor.
* Fixed: Several of the functions in Smp. Ed. -> Effects didn't set
the "song is modified" flag.
* Fixed: When zapping the song, the Disk Op. module filename wasn't
reset
* The Zap dialog's text was maybe a bit unclear. Changed from "Total
devastation of the..." to "What do you want to clear?". Also
changed the "All" button to "Everything".
