mpv: Update to 0.42.0
pkgsrc changes:
- Bump BUILDLINK_ABI_DEPENDS.mpv due .so bump
Changes:
0.42.0
==============
We are excited to announce the release of mpv 0.42.0.
Key highlights:
* libcurl based network backend with HTTP/2, HTTP/3 and connection reuse
* DVD-Video, Blu-ray HDMV and BD-J menu navigation
* DVD-Audio playback
* Direct playback of .iso images of DVD-Video, DVD-Audio and Blu-ray discs
* Dolby Vision Profile 7 enhancement layer support in `gpu-next`
* MPEG-TS programs and HLS variants are exposed as editions
* DSD-over-PCM (DoP) passthrough with `--audio-spdif=dsd`
[15 lines not shown]
libplacebo: Update to 7.387.0
pkgsrc changes:
- Bump BUILDLINK_ABI_DEPENDS.libplacebo given the .so bump, no revbump will be
needed because multimedia/mpv is the only dependency and it will be updated
shortly, this update was driven by mpv-0.42.0.
Changes:
7.387.0
This release introduces a new compositor API with support for multiple
video inputs, JSON-based scene descriptions and animation, alongside
support for Dolby Vision Profile 7 FEL. It also includes significant
improvements to color management, HDR tone mapping, frame interpolation,
deinterlacing and GPU backends, as well as numerous bug fixes.
openssh: update to 10.6p2.
Changes since OpenSSH 10.6p1
============================
This release contains a critical security workaround that affects
Linux systems that use the musl libc and PAM disabled.
This release also includes a number of bugfixes that had already
been committed on the portable OpenSSH V_10_6 stable branch.
Security
========
* sshd(8): avoid password authentication bypass that is exploitable
through sshd(8) that affects some Linux systems when built and run
with PAM support disabled. We consider the root cause of this bug
to be outside sshd, but it is exploitable via sshd and can be
avoided there.
[27 lines not shown]
multimedia/moviebox-tui: update to 0.1.29
Fixed
Providers & Stream Resolution:
Restored MovieBox TV series streaming by generating and attaching the official X-Client-Build APK certificate stamp with signed requests.
Preserved multi colon and namespaced media identifiers (such as Kitsu anime IDs) in Stremio addon stream aggregation.
Replaced hard assertions on HTTP client builders with safe fallbacks in MovieBox, CircleFTP, and DhakaFlix clients.
Networking & DNS:
Added runtime fallback to public DNS (Cloudflare, Google, Quad9) in FallbackResolver when primary system DNS lookup fails or is blocked by an ISP.
Media Playback & Sidecar Proxy:
Handled poisoned watchdog activity locks gracefully in the stream proxy sidecar loop to prevent unwrap crashes.
Standardized cross-platform temporary subtitle cleanup path joins to eliminate forward-slash path issues on Windows.
Test Infrastructure:
Synchronized environment dependent player tests with ENV_MUTEX and probed Android intent openers dynamically to eliminate parallel test race conditions.
Changed
Dependencies & Build Infrastructure:
Upgraded unicode-width to 0.2.3, log to 0.4.35, and zip to 9.2.1 (#234).
audio/spotify-player: update to 0.25.2
What's Changed
fix selected item handling in filtered lists by @aome510 in #1084
fix playback not transferred correctly upon re-connection in d7978f6
Add TLS backend features (rustls-tls / native-tls) — fixes auth panic on Termux by @Aypex in #1060
fix: use /nscpot_login redirect URI for ncspot client by @geetarOS in #1108
security/ruby-net-sftp: update to 4.1.1
4.0.1 (2026-10-22)
* Allow net-ssh 8 [#181]
4.0.2 (2026-10-25)
* Security: Recursive downloads refuse to follow an existing local symlink
at a server-named path instead of writing through it. The local path
passed by the caller may still be a symlink. Suggested in #162 by
srosenhamer [#186]
* Security: Recursive downloads reject file names from the server that are
not a single path component (such as `../x` or `a/b`) instead of writing
outside the target directory. Reported in #162 by srosenhamer [#185,
#162]
* Net::SFTP now works with frozen string literals enabled: `File` reads and
`Dir#glob` no longer mutate frozen strings, and `glob` no longer modifies
[114 lines not shown]
security/ruby-net-scp: update to 4.2.1
4.1.1 (2026-10-22)
* Allow net-ssh 8
* Fix frozen string literal compatibility [npezza93, mfazekas]
- Use mutable string for scp command construction
- Use mutable string for error_string initialization
* Add Ruby 3.4 and ruby-head to CI matrix
* Add Ruby 4.0+ compatibility (logger, rdoc gems)
* Drop EOL Ruby 2.3-2.5 from CI
4.1.2 (2026-10-25)
* Security: Downloads no longer apply setuid, setgid or sticky bits sent by
the server, check that a server-chosen local name matches the requested
remote basename (as OpenSSH does since CVE-2019-6111), and refuse to
follow an existing local symlink at a server-named path instead of writing
through it. The local path passed by the caller may still be a symlink.
[80 lines not shown]
security/ruby-metasploit-payloads: update to 2.0.258
2.0.254 (2026-10-07)
* Merge pull request #820 from adfoster-r7/run-ci-job;
Update Python test runner
2.0.255 (2026-10-08)
* Merge pull request #816 from MRX-72/fix/751-stat-st-dev-overflow;
Python Meterpreter: mask 64-bit st_dev in stat to fit the wire format
* Merge pull request #817 from
sfewer-r7/bugfix-python-meterpreter-freebsd-ps
2.0.256 (2026-10-13)
* Merge pull request #819 from pauljccode/fix/php-udp-read-flags;
Consume UDP datagrams when reading channels
[10 lines not shown]
Update botan3 to version 3.14.0
CVE fixes from changelog since version 3.9.0:
CVE-2026-118770 Fix a use after
free in the TLS asio integration which depending on application
usage patterns may allow leaking heap memory to the peer.
CVE-2026-118771 Fix a bug in TLS 1.3 which could allow an
unauthenticated peer to pin unlimited amounts of memory in the
handshake by sending many dummy ChangeCipherSpec messages.
CVE-2026-118766 Fix a blind SSRF during OCSP request processing.
A malicious OCSP responder or network attacker could cause the
application to perform a blind GET to an internal service.
CVE-2026-118765 Fix a bug in AutoSeeded_RNG, affecting only platforms
without a system RNG, where an API sequence of calling first clear,
followed by randomize writing to an empty buffer, resulted in the RNG
[22 lines not shown]
arti: update to 2.8.0.
# Arti 2.8.0 — 3 November 2026
Arti 2.8.0 continues our steady progress on relay and directory authority development,
including on computing the consensus from votes,
bootstrapping router descriptors and microdescriptors,
as well as relay bandwidth rate-limiting,
descriptor encoding, and the relay DNS cache implementation.
Additionally, we have made a number of cleanups and
clarifications to the Tor specification.
This release has a number of security fixes; please see below.
As usual, there are also many under-the-hood improvements and bug fixes,
which are documented below.
### Security fixes
[17 lines not shown]
