www/ruby-aws-partitions: update to 1.1281.0
1.1281.0 (2026-08-14)
* Feature - Updated the partitions source data that determines the AWS
service regions and endpoints.
net/ruby-net-ping: update to 2.1.1
pkgsrc change: remove a pkglint warning, wrong CATEGORIES.
2.1.0 (2026-08-08)
* Publish platform-specific gem metadata so Linux installs cap2 and current
Windows RubyInstaller installs win32-security for ICMP support #44.
* Fix the FreeBSD ping6 timeout option #43.
* Add Ruby 4.0 to the test matrix and add win32ole as an explicit Windows
dependency, since it is no longer a default gem as of Ruby 4.0 #41.
* Move Net::Ping::VERSION into its own file so the gemspec version can no
longer drift out of sync with it #37.
* Fix Net::Ping::External#ping6 setting a spurious "undefined method '=~'
[8 lines not shown]
devel/ruby-simplecov: update to 1.1.1
pkgsrc change: remove pkglint warnings from DESCR.
1.1.1 (2026-08-12)
What's Changed
* Bump step-security/harden-runner from 2.20.0 to 2.20.1 by
@dependabot[bot] in #1258
* rspec-conductor Support by @sferik in #1259
Contributors
* @sferik
* @dependabot
devel/ruby-io-event: update to 1.19.5
1.19.5 (2026-08-14)
* Preserve the original exception or non-local control flow when
IO::Event::WorkerPool cancellation interrupts a blocked fiber, while still
cancelling and draining the in-flight blocking operation before returning
control to Ruby.
p5-Net-OAuth: update to 0.32.
0.32 Sun 16 Aug 00:51:04 BST 2026
[Security]
- The Net::OAuth smart_require function no longer memoizes
failures, which allowed attackers to exhaust memory with
requests for invalid signature methods. CVE-2026-72888
- Net::OAuth::Client no longer allows silent downgrades from
OAuth 1.0a to 1.0 when the remote provider drops the
oauth_verifier. The behavior can be re-enabled with the
allow_v1a_downgrade option. CVE-2026-72887
[Bug Fixes]
- RSA-SHA1 now pins PKCS#1 v1.5 padding and the SHA-1 hash rather
than inheriting Crypt::OpenSSL::RSA's defaults, which have drifted
(SHA-256 in 0.29_01, RSA-PSS in 0.35). Against 0.35 and later this
produced RSA-PSS signatures that no RFC 5849 3.4.3 compliant server
will accept. Reported as Debian #1142954.
[98 lines not shown]
sem: update to 0.21.1.
### Fixed
- **Building a graph over Svelte components no longer crashes
(SIGSEGV) on Linux/glibc.** `sem graph`/`context`/`orient` over
`.svelte` files deterministically exited 139 from an invalid free
in the `tree-sitter-htmlx-svelte` 0.1.8 grammar's scanner, hit
during parallel graph construction (macOS's allocator tolerated
the bad free, so it only showed on Linux). Bumped the grammar to
0.1.16, which carries the scanner fixes; the existing version
constraint already permitted it, so this is a lock-only dependency
update. Added a parallel-Svelte-graph regression test. Thanks @XF-FW
for the exhaustive isolation and the verified fix (#471).
rspamd: update to 4.1.5.
4.1.5: 14 Aug 2026
** Incompatible changes **
* [Rework] gpt: Return only a boolean from the condition callback (request content generation moved into gpt_check)
* [Conf] Ship explicit allow_file_and_shm_inputs = true defaults for the normal, controller and proxy workers (the default becomes false in the next major release)
** Features **
* [Feature] fuzzy: Share sender facts (SPF, DKIM, DMARC, PTR state, recipient bucket, TLS) with storages over encrypted rules
* [Feature] mime: Decode PDF simple font text via the font's /Encoding (Annex D base encodings and /Differences overrides)
* [Feature] mime: Parse PDF /ToUnicode CMaps and decode composite (Type0) fonts
* [Feature] elastic: Structured fuzzy match results and message size in the schema
** Bug fixes **
* [CritFix] protocol: Gate File/Path/Shm message sources behind allow_file_and_shm_inputs (any TCP client could have arbitrary files parsed)
* [Fix] controller: Rate limit authentication failures per source (max_auth_failures)
* [Fix] fuzzy: Per-key forbidden_ids replaces the default set instead of adding to it
* [Fix] fuzzy: Apply the per-key ACL to delayed v1 replies
[22 lines not shown]
py-webencodings: update to 0.6.1.
0.6.1
Packaging
Update links on PyPI.
0.6.0
Dependencies
Support Python 3.10, 3.11, 3.12, 3.13, 3.14.
Drop support of Python 2.6, 2.7, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8 and 3.9.
Packaging
Include license file in packages.
[10 lines not shown]
py-platformdirs: update to 4.11.3.
📄 docs: publish llms.txt from the docs build by @gaborbernat in #522
fix: don't crash when an XDG dirs variable holds only separators by @darrenhuai in #523
py-pdf: update to 6.16.1.
6.16.1
Security (SEC)
Limit iterations for outline retrieval and XForm text extraction (#3966) by @stefan6419846
6.16.0
Security (SEC)
Detect cycles in TreeObject.insert_child (#3964) by @stefan6419846
New Features (ENH)
AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#3917) by @PJBrs
AppearanceStream: Consider more encodings for Type1 core fonts (#3905) by @PJBrs
[24 lines not shown]
py-orjson: update to 3.12.0.
## 3.12.0 - 2026-08-14
### Changed
- Serialization implementation substantially rewritten.
- Publish PyPI wheels for Python 3.15. For Python 3.15 and later,
`manylinux_2_39` (2024) is targeted instead of `manylinux_2_17` (2012).
- No longer publish PyPI wheels for ppc64le and s390x.
py-httpx2: update to 2.10.0.
Added
Add support for running on WebAssembly / Emscripten via Pyodide by @hoodmane in #1119
Add max_event_size to cap SSE event buffering by @Kludex in #1071
Add RFC 9110 status code constants by @mbeijen in #1069
Add support for Python 3.15 by @hugovk in #1090
Changed
Improve SSE chunk buffering performance by @Kludex in #1117
Skip cookie extraction without Set-Cookie by @Kludex in #1107
Return str | None instead of Any from Headers.get by @ItsDrike in #1121
Fixed
Enforce WebSocket max message size across fragments by @Kludex in #1085
Ignore unsolicited and duplicate Pong frames by @Kludex in #1122
