devel/jj: add a patch to fix the build on big-endian hosts.
This applies the change from this upstream pull request:
https://github.com/facebook/watchman/pull/1238
Admittedly I'm not able to figure out which version of the
serde_bser crate has the fix and why it's not in devel/jj: the
crate appears to be version 0.4.0 both in devel/jj and at the head
of the github development branch, and this fix is in one but
not the other.
Reported upstream at https://github.com/jj-vcs/jj/issues/9992.
yazi: update to 26.8.15.
Added
Drag and drop (#4005, #4225)
Trash bin (#4144, #4204, #4212)
Bulk create (#3793)
Make help menu a command palette (#4074)
Input history (#4104)
Automatic dark/light theme switching (#4196)
Experimental %y, %Y, %t, %T, %yN, %YN, %tN, %TN shell formatting parameters (#4108)
Custom VFS provider (#4118)
Make visual mode support wraparound scrolling (#4101)
H/M/L Vim-like motion for moving cursor relative to viewport (#3970)
Context-aware icons for inputs (#4080)
Show file icons in trash/delete/overwrite confirmations (#4096)
Dynamic keymap Lua API (#4031)
Dynamic Lua API for preloader, spotter, fetcher (#4235)
Configurable border for the which component (#4189)
[42 lines not shown]
compiledb-go: update to 1.7.0.
feat: update existing compilation database by @fcying in #14
fix: merge legacy compilation database paths by @fcying in #15
refactor: harden command parsing and make wrapping by @fcying in #16
feat: add compiler argument option by @fcying in #17
feat: add predefined compiler macros by @fcying in #18
fix: record source commands without -c by @fcying in #19
fix: align Python compatibility details by @fcying in #20
dev by @fcying in #21
fix: harden compiler command detection by @fcying in #22
feat: improve make integration by @fcying in #23
feat: embed POSIX shell interpreter by @fcying in #24
feat: improve platform compatibility by @fcying in #25
refactor: clarify path handling domains by @fcying in #26
test: add build log memory benchmarks by @fcying in #27
refactor: parse shell commands with AST by @fcying in #28
feat: expand GNU compiler response files by @fcying in #29
fix: track recursive Make directories by @fcying in #31
docs: rewrite README by @fcying in #32
p5-DBI: update to 1.652.
1.652 - 2026-08-15, H.Merijn Brand & Robert Rothenberg
* DBI now requires perl-5.12, driven by CVE's
* Fix test for perl configured without threads (caught by perl-5.45.1)
* Small doc fix, (issue#155), thanks Dick Franks
* Add suggested dependency (issue#145), thanks Dick Franks
* Force placeholder limit on :# and :p# too (CVE-2026-73194)
* Limit statements to 292 Mb in preparse (CVE-2026-73193)
* Add a security policy (issue#174)
* Add dbm_updatable_key attribute to DBD::DBM to configure how keys are updated
* Fix missing import in DBI::DBD::SqlEngine
* Fix !Caller2 caller loss when $^P is set (PR#184) (Thanks Paul)
go: update to 1.25.13 and 1.26.5 (security)
These releases include 10 security fixes following the security policy:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
[117 lines not shown]
sysutils/xplr: update to 1.1.1
What's Changed
fix(search): fixed a bug that caused results to reshuffle during search.
other(search): xplr search will default to the default skim algorithm.
Others:
deps: upgraded dependencies.
docs: fix nonexistent util function in upgrade guide by @latent-9 in #777
ubuntu(snap): @mikoloism helped fix Ubuntu snap build.
sysutils/dua-cli: update to 2.42.1
v2.42.1
*the same as 2.42, and:
Starting directories with a large amount of files, like 50k, now see a 5x speedup on macOS and Windows as bulk-reading is also done there. Note also that this is still a small absolute difference, 100ms vs 500ms, but a good demonstration of how much large trees with a lot of such directories will benefit by this, as these small absolute improvements accumulate.
v2.42.0
The headline or this release is ~30% better traversal performance on macOS due to the usage of bulk-metadata APIs on supported filesytems.
Bug Fixes
sanitize control characters in marked path output
dua-cli's interactive TUI is built on ratatui, which protects the
paths it renders on screen. But marking a file for deletion and then
quitting prints that file's path directly to the terminal after the
TUI has already released terminal control, bypassing ratatui's
protective rendering entirely. A scanned file's name has no character
restrictions, so a crafted file name can inject terminal escape
sequences into the printed path.
[4 lines not shown]
resterm: Update to 1.1.0
Changelog
Path completion
Resterm now shows matching files and directories in the open and save dialogs, and while entering supported commands.
libxml2: update to 2.15.3.
From Showta Ishizaki in PR 60591.
v2.15.3: Apr 15 2026
### Security
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
### Improvements
- schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
- xmlreader: propagate reader resource loaders to validator parsers
- python: Make python bindings python2 compatible
[44 lines not shown]
www/gitea: update to 1.27.2
Changes in 1.27.2:
* SECURITY
- Fix: update collaborator access mode and httpsign
- Refactor: external render
- Fix(actions): resolve pull_request_target reusable workflows at the
base commit
- Refactor: markup render
- Fix(deps): update dependency mermaid to v11.16.1
- Fix(auth): set WebAuthn user verification per request
- Fix: render highlight language
* ENHANCEMENTS
- enhance: add missing npm package metadata properties
* BUGFIXES
- fix(actions): keep github.event.inputs as strings for
workflow_dispatch
- fix(actions): let a rerun of selected jobs read the previous
[419 lines not shown]
