dmarc-report-viewer: Update to version 2.7.0
## [2.7.0] - 2026-10-31
* Security: Limit maximum number of parallel DNS requests triggered by Web UI.
* Security: Check peer address for DNS responses.
* Fix: Added logging of missing DNS configuration values.
* Fix: Count on mail sources page now shows the number of instances the IP was reported.
* Fix: 500 Internal server error for some IP info requests is now gone.
* Change: Removed IP details from DMARC and SMTP TLS report details and replaced with new IP dialog.
* Feature: Greatly improved filtering options for summary charts, mails, DMARC and SMTP TLS reports.
* Feature: Allow custom time span filtering for summary charts, mails, DMARC and SMTP TLS reports (see issues #82 and #32).
* Feature: App uses now RwLocks instead of Mutex for app state and DNS cache to allow more parallel read operations.
* Feature: Show failure count sum in SMTP TLS report list.
* Feature: Show record count sum in DMARC report list.
* Feature: Added JSON bulk export of filtered DMARC and SMPT TLS reports (see issue #92).
* Feature: Added new IP dialog with all available information about an IP.
It also allows to open filtered lists of all DMARC or SMTP TLS reports for that IP (see issues #81 and #56).
* Updated Cargo dependencies.
py-test-mypy-plugins: updated to 4.1.0
4.1.0
Features
Added a marks field to test cases, applying pytest markers so cases can be
selected with pytest -m <marker>,
Adds official python3.15 support,
Support mypy at 2.4.0
Bugfixes
Remove fspath argument from YamlTestFile.from_parent,
Isolate mypy cache per pytest-xdist worker,
Include tests in the distribution
py-test-mypy: updated to 1.1.0
1.1.0
Update test dependencies
Drop support for xdist 1.x
Drop support for Python 3.8 & 3.9
Upgrade build deps
Update the tests
Update type annotations
Add isort to the static env
Run twine check with --strict
Test with Python 3.15
py-mypy: updated to 2.4.1
Mypy 2.4.1
- Process overloads as a whole in two-phase type checking
- Skip recursive setup for frame-private nested functions in mypyc
py-vcrpy: updated to 9.4.0
9.4.0
SOCKS proxies
Requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h://, with PySocks installed) are now recorded and played back. urllib3 uses its own connection classes for them, which vcrpy didn't patch, so these requests skipped the cassette entirely
Multipart form filtering
filter_post_data_parameters now filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data={"api_key": ...}, files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded
If you match on body: requests are filtered before they're matched, so cassettes recorded with unfiltered multipart bodies need re-recording.
Fixes
Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use
Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response()
py-cachetools: updated to 7.2.8
v7.2.8 (2026-10-31)
- Fix type stubs for ``TTLCache`` and ``TLRUCache`` with default
``timer``.
- Minor documentation and unit test improvements.
v7.2.7 (2026-10-28)
- Various performance improvements.
- Minor unit test improvements.
v7.2.6 (2026-10-26)
- Various performance improvements.
py-rapidjson: updated to 1.26
1.26 (2026-11-01)
* Add Windows ARM64 build
* Fix parse_mode flags without native or NaN number modes
* Validate number_mode in load and Decoder
* Reject JSON input truncated at an embedded NUL
* Reject oversized datetime, UUID and parse mode values before narrowing them to
their internal representations
* Generate wheels for riscv4
* Reject embedded NUL truncation in ``Validator`` schemas and documents
[5 lines not shown]
py-aioquic: updated to 1.7.1
1.7.1
* Fix streams which never ended when their FIN, written after all their data
had been sent, did not fit in the packet being built: the FIN was never
sent, so the peer kept waiting for it.
* Derive the keys for QUIC version 2 key updates with the ``quicv2 ku``
label, as :rfc:`9369` requires. After its first key update, a QUIC version
2 connection could no longer exchange packets with a conforming peer.
* Reject a FIN or RESET_STREAM whose final size is below the data already
received with ``FINAL_SIZE_ERROR``, as :rfc:`9000` recommends, instead of
silently discarding the data beyond it.
* Drop 1-RTT packets which a server receives on a connection ID it never
issued or which the client retired, as :rfc:`9000` requires, instead of
switching to that connection ID.
* Discard Retry packets which a client receives after processing a packet
from the server, or whose Retry Token is empty, as :rfc:`9000` requires.
Such a Retry restarted the connection attempt, and broke an established
[4 lines not shown]
ggml: update to 0.28.0.
This release adds a fused sparse-attention masking operation
(GGML_OP_TOP_K_MASK) with CPU, CUDA and Metal implementations, plus
accessors to read the precision configured on a compute node. MoE
and sparse-attention dispatch got cleaner semantics: an index of
-1 in MUL_MAT_ID / ADD_ID now means "skip this slot", so backends
skip the work and zero the output row instead of relying on
out-of-range index patching. The core relaxes SCALE to non-contiguous
views and SUM to non-contiguous inputs. Backends gained a lot of
throughput: MoE top-k and gate/up+GLU fusions and chunked graph
launches on CUDA, graph record/replay and XMX matrix-engine kernels
on SYCL, cooperative GEMMs, Q2_K/Q3_K weights and a lightning
indexer on OpenCL, subgroup reductions and src1 precision control
on Vulkan, and a restructured HTP backend with new repacking and
fusion machinery on Hexagon. ZDNN gained flash attention and WebGPU
gained Q2_0.
gobgp: Update to 4.11.0
Changelog
53ceb78 GoBGP 4.11.0
e01141a server: prepare peer state before advertising initial routes
d234c86 test: rename the route server policy scenarios to ExportPolicy
632031d test: remove duplicated route server policy scenarios
1c501ef test: use a soft reset out in the route server policy update scenarios
10d3f16 server: send the peer description in WatchEvent peer events
07af837 table: count destinations in the Adj-RIB-In table info
4b289a8 server: compare the AS too when matching a path to its source peer
1955816 ci: do not install linux-modules-extra on kernels that do not have it
6afb03a table: use the router ID when a reflected route has no cluster ID
f22b5dd table: look at every segment for an ASN as-path pattern
30786de packet/bgp: reject AS 0 in the path and aggregator attributes
9b86c50 server: check the label chunk from zebra before using it
bb09f17 packet/bgp: reject an EVPN MAC/IP route with a MAC length other than 48
3e7e231 zebra, server: do not wait forever for zebra to answer
a6798ec security: treat zebra as trusted
[169 lines not shown]
uriparser: update to 1.0.3.
2026-10-31 -- 1.0.3
>>>>>>>>>>>>> SECURITY >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
* Fixed: [CVE-2026-48841]
Protect `ComposeQueryEngine` from integer overflow (GitHub #313)
Thanks for the report to Joshua W. Windle!
>>>>>>>>>>>>> SECURITY >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
* Fixed: Protect `ToStringEngine` from integer overflow (GitHub #311)
Thanks for the report to Joshua W. Windle!
* Fixed: Protect `AppendQueryItem` from item count integer overflow
(GitHub #312)
Thanks for the report to Joshua W. Windle!
* Fixed: Fix undefined behavior in `FilenameToUriString` (GitHub #310)
* Fixed: Restore support for compilation with glibc <2.29
(GitHub #315, GitHub #316, GitHub #289, GitHub #320)
* Fixed: Fix support for GoogleTest >=1.17.0 (GitHub #325)
* Fixed: Mark `uriIsWellFormedHost*` functions as `URI_PUBLIC`
[19 lines not shown]
p5-DateTime-TimeZone: update to 2.72.
2.72 2026-10-28
- This release is based on version 2026f of the Olson database. This release includes contemporary
changes for Cuba.
p5-DateTime: update to 1.6800.
1.68 2026-10-29
- Added support for the `ddd` CLDR pattern, which formats the day of the month as an ordinal, like
"3rd". Before this, `ddd` was formatted as a zero-padded day, like "03". DateTime now requires
DateTime::Locale 1.47 or newer, which provides the data for this.
p5-DateTime-Locale: update to 1.47.
1.47 2026-10-29
- Rebuilt all locale data with the data from CLDR 49.0.0.
- CLDR 49 no longer ships data for locales that are below its "Basic" coverage level. This removes
199 locale codes, including aa, ab, an, co, cu, and all of their regional variants. Some languages
only lost some of their locales. For example, bal and bal-Arab are gone, but bal-Latn is still
available. Loading any of the removed locales will now fail.
- Added the ady (Adyghe) and kbd (Kabardian) locales, along with their regional variants.
- Added a new `$locale->day_of_month_format_abbreviated` method. This returns 31 strings for ordinal
days of the month, like "1st", "2nd", and "3rd". CLDR 49 added this data, along with a new `ddd`
pattern that uses it. This is currently only available for a small number of languages, including
English and French. For other locales, the days are just the numbers 1 to 31.
- Some locales, including en and fr, now have available formats that use the new `ddd` pattern, like
[2 lines not shown]
p5-Error: update to 0.17031.
0.17031 2026-10-27
- t/08warndie.t - update to handle blead's updated line number tracking by richardleach
- https://github.com/shlomif/perl-error.pm/pull/6
- Thanks @richardleach .
