mikmod: updated to 3.2.10
3.2.10
- Fix a few spelling mistakes (thanks to Stephen Kitt.)
- Updated OS2 EMX makefile for KLIBC environment (build tested with
cross-os2emx toolchain at https://github.com/komh/cross-os2emx)
- Added a few OpenWatcom/DOS bits (needs further work.)
- A few minor fixes and clean-ups.
libmikmod: updated to 3.3.14
3.3.14
- Fix out-of-bounds writes in unimod v6 loader with crafted files.
- Add bounding checks for DSMI AMF channel remap table.
- Add limit check to numchan in DSM loader.
- Fix IT pattern loader allocation to match maximum allowed row count
- Fix ULT loader numchn, numpat, numtrk calculations corner cases.
- Fix DSM and OKT loaders numtrk integer overflow with crafted files
- Added Windows WASAPI output driver.
- Added Playstation Vita output driver.
- Updated webaudio driver with stereo output support.
- Fixed Windows XAudio2 driver build using MinGW-w64.
- Revised SDL output driver for MikMod_Reset() issue.
- Updated OS2 EMX makefile for KLIBC environment (build tested with
cross-os2emx toolchain at https://github.com/komh/cross-os2emx )
- Cmake build system now installs documentation and the autoconf macro.
- Minor cmake build system fixes.
- A few other minor fixes and clean-ups.
py-dulwich: updated to 1.2.15
1.2.15 2026-09-14
* Detect delta cycles in ``Pack.resolve_object``: a crafted pack with
REF_DELTA objects that name each other sent ``get_raw`` into an
unbounded loop. Such chains now raise ``DeltaCycle``.
* Fix ``porcelain.clean`` when the target directory and the repository path
are spelled differently, such as via a relative path or a symlink.
(Jelmer Vernooij)
* Memoize tag peeling on the object store, so refs sharing an annotated tag
chain no longer re-walk it once per ref. ``show_ref --dereference`` and the
ref advertisement were quadratic.
* Give a ``.gitignore`` in a subdirectory precedence over one closer to the
root, matching git. A negation in a deeper file no longer loses to a rule
at the root, and a nested negation no longer re-includes a path whose
[38 lines not shown]
jemalloc: updated to 5.4.0
5.4.0 (Sep 17, 2026)
This release contains over 160 commits, focusing on the technical debts
cleaning including refactorings, bug fixes, test coverage improvement, and
option cleanups. The release also includes portability improvements per
upstream issues report.
New features:
- Add `EXTENT_ALLOC_FLAG_PINNED` so custom extent-allocation hooks can
mark non-reclaimable mappings, such as HugeTLB pages, for preferential
reuse outside the decay and purge pipeline. Add the mallctl interfaces
`stats.pinned`, `stats.arenas.<i>.pinned`,
`stats.arenas.<i>.extents.<j>.npinned`,
`stats.arenas.<i>.extents.<j>.pinned_bytes`, and
`stats.arenas.<i>.mutexes.extents_pinned.{counter}` to report
pinned-memory usage and mutex statistics. (@binliu19: be2de8cc)
- Allow resuming per-CPU arena selection via `thread.arena`.
[86 lines not shown]
py-unidiff: updated to 1.0.1
1.0.1 - 2026-09-14
* Exposed git submodule (gitlink) entries through the file mode and the new
PatchedFile.is_submodule property
* Fixed parsing of patches that add multiple files in a row sharing the
/dev/null source, such as quilt-generated patches
* Fixed metadata_only parsing of empty (including DOS "\r\n") context lines.
* Fixed an UnboundLocalError on malformed patches with a target file header
and no preceding source header; UnidiffParseError is now raised
* Fixed a TypeError on binary diffs without a target filename, such as
Mercurial's "Binary file X has changed".
py-urwid: updated to 4.1.5
Urwid 4.1.5
New features
* Support async callbacks set via MainLoop if backend support
* Support async callbacks in ZMQEventLoop, make ZMQEventLoop async
* Add full palette and AttrSpec support for WEB display
* Add capital letters to thin 4x3 font
Deprecations
* Announce removal of old display import aliases
Bug fixes
* Fix screen redraw on window resize for curses display
* Implement nested popups support
Refactoring
* Optimise code and extend test coverage for Canvas classes
* Optimise BarGraph logic
py-threadpoolctl: updated to 3.7.0
3.7.0 (2026-09-15)
Fixed an intermittent OSError on Windows when DLLs are loaded or unloaded concurrently during library discovery (for example when importing conda-forge OpenCV). On Python 3.14+, discovery uses ctypes.util.dllist when available. If dllist raises OSError, threadpoolctl emits a RuntimeWarning instead of crashing so the failure can be reported upstream with a minimal reproducer. Older Pythons use a Toolhelp snapshot enumerator, with graceful per-module fallbacks.
Added the ability to check whether a limiting API affects just the current thread or the whole process. Mainly aimed at debugging and diagnostics, and somewhat unreliable, it is therefore enabled by default only for command-line usage.
Only warn about simultaneous libomp and libiomp usage on Linux, where the incompatibility is known to cause crashes.
Fixed a deadlock triggered by getting or setting MKL's number of threads from parallel threads when using MKL with libiomp (Intel threading) on Linux.
Going forward, setting the number of threads will only have a thread-local impact if feasible (for example, at minimum the underlying library must support this option, and many don't.)
For MKL, setting the number of threads is now thread-local, i.e. limiting the number of threads won't impact MKL's thread pool size when using MKL in other Python threads.
For OpenBLAS compiled with OpenMP on Linux and macOS, setting the number of threads is now thread-local, i.e. won't impact OpenBLAS thread pool size in other Python threads. On Windows behavior is likely process-wide, but this may depend on how OpenBLAS was compiled with OpenMP.
Fix OpenBLAS detection for conda package on Windows
[10 lines not shown]
py-url-normalize: updated to 3.0.1
3.0.1
Fixed
Preserve invalid UTF-8 percent-encoded octets instead of replacing them with U+FFFD; valid UTF-8 still normalizes to NFC.
Preserve percent-encoded reserved characters in paths, keeping values such as a%2Fb distinct from a/b.
Preserve encoded plus signs (%2B) in query parameters and explicit empty values such as flag=.
Normalize Unicode and unsafe characters in URL credentials while preserving encoded delimiters; correctly separate credentials containing @ from the host.
Correctly parse bracketed IPv6 hosts and ports, lowercase IPv6 addresses, and preserve zone identifier case.
Recognize long and custom URL schemes, protocol-relative URLs, and bare domains or localhost with numeric ports.
Remove leading whitespace and parser-ignored control characters before applying default domains and detecting URL schemes, preserving the intended destination.
Trim trailing authority whitespace without discarding trailing spaces or punctuation belonging to paths, query values, or fragments.
Convert hashbang fragments (#!) into a single escaped query parameter, preserving existing parameters and leaving ordinary fragments intact.
Match query parameter allowlists against normalized hosts and equivalent custom domain keys, including Unicode/Punycode aliases, case variants, and trailing dots. Exact canonical keys take precedence over aliases.
Decode IDNA host output as ASCII regardless of the charset argument.
Keep encoded backslashes and C0/C1 control characters encoded in url_humanize() output, and retain the normalized URL when a decoding candidate cannot be parsed.
Resolve query parameter allowlists once per URL to avoid repeated domain alias scans for each parameter.
[8 lines not shown]
py-curl: updated to 7.48.0
PycURL 7.48.0 - 2026-09-15
This release adds a CurlUrl object wrapping libcurl's URL API (with
CURLOPT_CURLU support), adds support for Python 3.15, adds CURL_LOCK_DATA_HSTS
as a CurlShare option, and adds support for several new libcurl options.
This release also fixes several crashes, a memory leak, and other minor
issues.
