py-time-machine: updated to 3.6.0
3.6.0 (2026-10-25)
Drop Python 3.10 support.
Extend the Migration CLI to migrate freeze_time() class decorators on pytest-style test classes to the pytest.mark.time_machine() marker. Previously, such decorators were left unchanged and reported, since time_machine.travel() only supports unittest.TestCase subclasses as a class decorator, but they can be migrated to the marker instead.
Extend the Migration CLI to migrate freeze_time() calls that pass the destination with the time_to_freeze keyword argument. The argument is made positional, or renamed to destination if it follows another kept keyword argument.
py-numba: updated to 0.68.1
0.68.1 (26 October 2026)
This is a patch release of Numba that fixes two performance regressions
(``np.sum`` and fancy indexing), aligns the accumulator dtypes of
reductions with NumPy, and fixes caching of functions
imported from a zip archive on Windows.
py-sphinx-automodapi: updated to 0.22.1
0.22.1 (2026-10-15)
- Fixed a bug to avoid problem from target object ``__dict__``
changing during iteration in ``generate_automodsumm_docs()``.
py-sphinx-autodoc-typehints: updated to 3.17.4
3.17.4 (2026-10-27)
Fixed
- Link each name in the type after an attribute, data or property name with the role its docstring field uses, so a
``type`` alias an inventory lists as data, such as ``numpy.typing.NDArray``, resolves through intersphinx
3.17.3 (2026-10-27)
Packaging
- Publish categorized GitHub Release notes with PyPI and version-comparison links
3.17.2 (2026-10-17)
[4 lines not shown]
py-aioquic: updated to 1.7.0
1.7.0
* Migrate clients to the server's preferred address, as :rfc:`9000` allows.
.. note::
If you drive :class:`~aioquic.quic.connection.QuicConnection` with your
own I/O, you must send each datagram to the address returned alongside
it by ``datagrams_to_send()``. That address may now differ from the one
passed to ``connect()``, so a connected UDP socket or a tunnel with a
single fixed destination no longer works.
* Add :meth:`~aioquic.quic.connection.QuicConnection.get_peer_address`, which
returns the address datagrams are currently sent to. It can change when
either endpoint migrates.
* Improve path validation and connection migration as :rfc:`9000` requires:
[58 lines not shown]
py-pylsqpack: updated to 1.0.0
1.0.0
* Adopt semantic versioning.
* Add :meth:`Decoder.cancel_stream` to cancel decoding for a reset or
abandoned stream.
* Grow the encoder's buffers on demand instead of capping them at 4 kB, so
that large header blocks (e.g. with large cookies) no longer fail to encode.
* Allocate the decoder's buffers using Python's memory allocator, making them
visible to :mod:`tracemalloc`.
* Update vendored `ls-qpack`_ from version 2.6.2 to 2.7.0, which brings:
* a fix for decoding header blocks when the encoder selects a dynamic table
capacity lower than the maximum,
* fixes for a use-after-free and a double-free,
* stricter validation of encoder and decoder stream instructions, header
lengths and Huffman padding.
grafana: update to 13.2.5.
Security
Security: Fix CVE-2026-100105
Security: Fix CVE-2026-103506
Security: Fix CVE-2026-88858
Security: Fix CVE-2026-88967
Features and enhancements
Git Sync: Ignore hidden paths in repository scans and diffs #135028, @ferruvich
Provisioning: Default save from a branch preview to the previewed branch #135174, @Clarity-89
Provisioning: Never replace the repository root folder during incremental sync #135463, @ferruvich
Bug fixes
Plugins: Don't report loaded plugins as not registered when a request times out #135665, @leventebalogh
Provisioning: Fix PR dashboard previews when served from a sub-path #135559, @gustaff-weldon
py-jupyter-builder: updated to 1.2.4
1.2.4
Enhancements made
- Add a `jupyterlab.rspackConfig` alias
Bugs fixed
- Fix UTF-8 decoding in captured build tests
- Fix TypeError when package.json omits dependencies field
- Fix \_resolve_core_path_for_jupyterlab_builder overwriting installed package.json
Maintenance and upkeep improvements
- Pass `GITHUB_TOKEN` to the minimum-versions and prerelease test jobs
- Fix flaky macOS CI tests by authenticating GitHub API calls
py-python-discovery: updated to 1.6.6
1.6.6
Bug fixes
Treat version specifiers with an item that cannot be parsed, such as >=3.x, >=3.12 <4 or >=3.12,foo, as literal executable paths instead of raising a bare AssertionError or ignoring the item during discovery
Accept relative interpreter paths that step up a directory, such as ../venv/bin/python, which were found and queried but never matched the spec
Match ~=X.Y compatible-release specifiers against later minor versions, as PEP 440 defines, instead of only the same minor; ~=3.10 now accepts 3.11 and newer 3.x
py-configargparse: updated to 1.9.0
1.9.0
Behavior changes
A false value for a flag now overrides lower-priority sources
Previously, setting a flag (an arg that takes no value, such as store_true, store_false, count or store_const) to false in an environment variable or a higher-priority config file added nothing to the command line, so a true for the same flag in a lower-priority config file still turned it on. Now the false value counts as setting the flag, and lower-priority config files no longer set it. For example, VERBOSE=false now wins over verbose = true in a config file. Args that take a value are unchanged.
A bare -- in a list value is now an error
A list value from a config file or environment variable, such as items = [a, --], used to put a bare -- on the command line, which ended option parsing and turned the user's own command-line options after it into positional args. It now fails with an error that names the key.
Fixes
Options after -- on the command line no longer block other sources
IniConfigParser.serialize() escapes %
Saved config files keep store_false and store_const values
[2 lines not shown]
py-test-remotedata: updated to 0.4.3
0.4.3 (2026-10-27)
- The ``--remote-data`` option now sets its ``dest`` explicitly so that
it can share it with a short option defined by another plugin (e.g.,
``-R`` in ``pytest-astropy``) with the development version of
pytest.
- The socket blocker no longer calls ``socket.getfqdn()`` on every
intercepted connection. This could take tens of seconds per call on
some systems (e.g. macOS CI runners). Connections to the machine's own
hostname or fully qualified domain name are now detected by checking
whether the resolved address is local. The addresses of the allowed
data hosts are also now only resolved once per process.
- Versions of Python <3.11 and pytest <7.2 are no longer supported.
- The package is now built with ``hatchling`` and all packaging metadata
[4 lines not shown]
libjpeg-turbo: updated to 3.2.1
Significant changes relative to 3.2.0:
Fixed a regression introduced by 3.2 beta1[9] that broke Un*x builds in which position-independent code (PIC) was not enabled for static libraries. This issue could be worked around by explicitly setting the CMAKE_POSITION_INDEPENDENT_CODE CMake variable or using a toolchain, such as the ones provided by Ubuntu, that automatically enables PIC.
The RISC-V Vector (RVV) forward DCT modules now use strided segment load intrinsics to simultaneously load sample rows from memory and transpose them into columns, as well as multiply-accumulate intrinsics where appropriate. When using the accurate integer DCT algorithm, RGB-to-baseline JPEG compression is approximately 10-17% (avg. 13%) faster (relative to libjpeg-turbo 3.2.0) with GCC 14 and 1-8% (avg. 4%) faster with Clang 20. (Tested on a 1.6 GHz Ky X1 CPU. Actual mileage may vary.)
Symbols from the in-tree zlib and libspng implementations introduced by 3.2 beta1[9] are now hidden, which prevents the symbols from being exposed in downstream shared libraries and applications that link with the static TurboJPEG API library. Symbols from the in-tree zlib implementation are now also renamed, which prevents downstream shared libraries and applications that link with the static TurboJPEG API library from accidentally calling the in-tree zlib implementation when they intend to call the system-supplied zlib implementation.
Fixed an integer overflow and subsequent buffer overrun that occurred when attempting to use tj3LoadImage12() or tj3LoadImage16() from a 32-bit build of libjpeg-turbo to load a packed-pixel image with more than 2^31 components.
Fixed a division-by-zero error (CVE-2026-75466) that occurred when attempting to load a non-grayscale indexed-color PNG image using tj3LoadImage*() if the pixel format of the packed-pixel buffer was unspecified (TJPF_UNKNOWN.)
Fixed an issue whereby tj3DecompressToYUV*() produced incorrect chrominance values when decompressing a 4:2:0, 4:1:0, or 2:4 JPEG image with the "fast" IDCT algorithm and a scaling factor of 1/2. (In other words, TJPARAM_FASTDCT was not ignored as it should be when decompression scaling is enabled.)
Fixed a buffer overrun and subsequent segfault that occurred on certain platforms when attempting to partially decompress a specially-crafted 4:2:0 JPEG image using the merged (non-fancy) upsampling algorithm with the libjpeg-turbo SIMD extensions disabled and a cropping region that would have caused any of the component planes to be cropped to a width of 1 or 2 samples.
Hardened the libjpeg API against hypothetical applications that may erroneously attempt to decompress a full-color 12-bit-per-sample JPEG image with both one-pass color quantization and RGB565 color conversion enabled. This could have caused a buffer overrun in one of the quantizer's color index arrays. The buffer overrun did not likely pose a security risk, since an application that abused the API in the aforementioned manner could never work properly.
[16 lines not shown]
tex-pdfjam: add some missing dependencies
I tried to panelize a sticker for printing with this command and it
complained at run time about missing TeX packages:
$ pdfjam --paper a4paper --nup 2x6 --noautoscale true --delta "2mm 2mm" \
--frame true -o sheet.pdf sticker.pdf 1,1,1,1,1,1,1,1,1,1,1,1
