py-html-sanitizer: updated to 2.7.0
2.7 (2026-10-25)
- Added the ``preserve_whitespace`` setting which keeps whitespace inside the
listed tags as-is. Defaults to ``{"pre"}``, which only has an effect if
``pre`` is added to the allowed tags.
- Added the ``embedded_hosts`` setting which allows embedding content such as
``iframe`` elements from the listed hosts.
- Added the ``drop_disallowed_contents`` setting which removes disallowed tags
including their contents.
py-lxml-html-clean: updated to 0.4.6
0.4.6 (2026-10-26)
Bugs fixed
* Fixed a ReDoS (regular expression denial of service) vulnerability in the
CSS ``expression()`` sanitizer. The pattern ``expression\s*\(.*?\)`` with
``re.S`` was quadratic when input contained many ``expression(`` tokens
without a closing parenthesis. The body is now bounded to 1024 characters;
longer bodies are handled fail-closed by ``_has_sneaky_javascript()``, which
drops the entire style. Reported by Brian Willows.
* Fixed a ReDoS vulnerability in the conditional comment detector used when
``comments=False``. The pattern ``\[if\s+.*?]\s*>`` with ``re.S`` was
quadratic when comment text contained many ``[if`` tokens without a closing
``]>``. Replaced with a linear two-pass search. Reported by Brian Willows.
* Fixed a ReDoS vulnerability in the CSS comment stripper. The pattern
[10 lines not shown]
python311 py311-html-docs: updated to 3.11.18
Python 3.11.18
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE-2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE-2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
python312 py312-html-docs: updated to 3.12.16
Python 3.12.16
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
python313 py313-html-docs: updated to 3.13.18
Python 3.13.18
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
Tests
gh-159015: Fix test.test_math failing to import on musl-based systems. The skip condition of test_fma_zero_result compared the boolean returned by test.support.linked_to_musl() with a version tuple.
python314 py314-html-docs: updated to 3.14.10
Python 3.14.10
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
Core and Builtins
gh-160491: Fix the location reported for invalid escape sequences in f-strings and t-strings. The SyntaxError now points at the literal part that contains the escape, instead of at the closing quote.
gh-160268: Fix a crash in tokenize when a mismatched closing bracket follows the opening brace of an f-string or t-string replacement field, as in f'{]a'. It now raises the same “unmatched” error as the parser.
gh-106045: Fix venv path discovery when the base executable resolves to a location outside the installation pointed to by the home key in pyvenv.cfg. The standard library is now found from home, and extension modules from the resolved executable’s installation, instead of falling back to the compiled-in prefix.
gh-160162: Fix a crash on 32-bit platforms when left shifting an int by a count close to sys.maxsize * sys.int_info.bits_per_digit. OverflowError is now raised, as for other too large counts.
gh-160179: Fix bytearray.__init__() leaving uninitialized memory in the object when it fails on a list or tuple containing an integer not in range(256). The object is now empty after the failed call.
gh-159739: Fix a possible crash when assigning metadata to classmethod or staticmethod objects.
gh-159739: Fix a race in list.__sizeof__() when a list is concurrently resized on a free-threaded build.
[69 lines not shown]
py-pipx: updated to 1.18.4
1.18.4
Bugfixes
pipx reset now cancels instead of crashing when the confirmation prompt reads EOF (Ctrl-D on POSIX, Ctrl-Z then Enter
on Windows).
security/pkcs11-provider: Import pkcs11-provider 1.3.0
Quoting from the README:
> This is an OpenSSL 3.x provider to access Hardware and Software
> Tokens using the PKCS#11 Cryptographic Token Interface. Access to
> tokens depends on loading an appropriate PKCS#11 driver that knows
> how to talk to the specific token. The PKCS#11 provider is a
> connector that allows OpenSSL to make proper use of such drivers.
> This code targets PKCS#11 version 3.2 but is backwards compatible to
> version 3.1, 3.0 and 2.40 as well.
This can replace the pkcs11 engine for OpenSSL from security/libp11.
`Engines' are the deprecated legacy interface; `providers' are the
modern shiny interface.
devel/cargo-about: update to 0.9.3
Fixed
PR#319 and PR#320 fixed issues with manifest synthesis.
PR#324 resolved #323 by writing the archive name into each release .sha256 file, so sha256sum -c can check it.
PR#328 updated rustls etc to fix stupid CA.
sysutils/xplr: update to 1.2.2
Highlight
This release fixes tty crashes when using CustomGraphics/CustomOutput introduced in 1.2.
Also done a major cleanup of the codebase to simplify many things.
What's Changed
Cleanup by @sayanarijit in #794
Fix tty crash when rendering graphics by @sayanarijit in #795
Rendered image quality will not be rich due to some simplification, but will be there eventually.
sysutils/gravityfile: update to 0.4.1
Release Notes
The release binaries for 0.4.0, which were never published because the
static Linux build failed. What changed in 0.4.0, a rewrite of the scanner,
explorer and command line, is in the
0.4.0 notes.
Fixed
The static (musl) Linux build links. The no-overwrite rename now makes the
renameat2 system call itself, since musl has no wrapper for it, and CI
builds and tests for musl.
news/brochure: update to 0.12.0
v0.12.0
Nicer code blocks and tables in articles, and a faster way to install.
Highlights
Syntax-highlighted code blocks matching your theme
Tables drawn with borders and aligned columns
Install a prebuilt binary with cargo binstall
Fixes for nested lists, quotes, and code blocks
v0.11.0
FreshRSS sync, full mouse support, and a keybindings popup, plus a long list of fixes.
Highlights
Sync feeds and read state with FreshRSS
Click, scroll, drag, and open links with the mouse
[3 lines not shown]
misc/rozi: update to 0.0.33
Added
Edit sidebar tab settings in the app with Ctrl+E or Sidebar tabs…. Settings are saved to config.toml and take effect immediately. Extension tabs can also provide settings in their manifests. (#189)
Paste clipboard images and copied files into remote panes. Rozi uploads them and inserts their remote paths without submitting the prompt. (#188)
Use rozi context --format json to inspect the caller session and pane. --here targets that verified session. agents prompt --wait turn --capture text|ansi returns the prompted agent's result and a terminal snapshot. (#201)
Remove a worktree and optionally delete its local or remote branch with [worktrees] delete_branch or rozi worktrees remove --delete-branch. (#204)
Open a Worktrees checkout as a pane with Ctrl+click or Ctrl+Enter. [worktrees] sidebar_open sets whether a plain click opens a session or pane. (#212)
Read extension process output with rozi extensions logs <ID> [--unit <UNIT>] [-n <LINES>]. (#219)
Attach to a shared session using [session] on_attach or Settings → Sessions → On shared attach. Choose ask, follow, or take. rozi sessions attach also accepts --follow and --take-control. (#227)
Name a worktree checkout by branch with rozi worktrees open, remove, or unlock. Use --branch to select a branch explicitly. (#224)
Find a checkout's activation behavior at the right edge of its Worktrees row, including the action performed by Ctrl+click. (#225)
Set the host terminal window title with the focused session and pane. The window_title setting supports {session}, {pane}, {cwd}, and {host}. Set it to an empty string to leave the title unchanged. (#237)
Identify the agent conversation displayed in a pane through the agent_session field returned by list-panes. (#233)
Keep Kitty temporary-file and shared-memory images visible to session clients, including clients that attach after the image source is gone. (#241)
Update every extension with a known update from the Extensions screen with Ctrl+Shift+U, or run rozi extensions update --all. (#246)
Changed
[39 lines not shown]
devel/feluda: update to 1.18.0
What's Changed
build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2 in /examples/java-example/maven-example in the maven group across 1 directory by @dependabot[bot] in #281
feat: record resolved licenses for offline scans, fix pnpm and SBOM output by @anistark in #280
feat(purl): add arch, distro, upstream and epoch qualifiers to OS package PURLs by @anistark in #282
fix(filesystem): read the license from GNU grant sentences in pre-DEP-5 copyright files by @anistark in #283
build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /examples/java-example/maven-example in the maven group across 1 directory by @dependabot[bot] in #284
feat(sbom): choose spec versions and write licenses the specs accept by @anistark in #285
feat(sbom): read and write SPDX 3.0, SPDX tag:value and CycloneDX XML by @anistark in #286
fix(licenses): recognise BSD-2/BSD-3 texts that never say BSD by @abhinyaay in #277
docs: add the Open Source India 2026 talk to Field Reports by @anistark in #287
fix: correct lookups found by benchmarking and add a Performance page by @anistark in #288
build(deps): bump webpki crates to drop compromised emudhra roots by @anistark in #290
fix(java): remove maven search api license fallback (#296) by @slopgobblercobbler in #301
feat: cache OSI license data by @WilliamK112 in #300
build(deps): bump rustls from 0.23.40 to 0.23.46 in /examples/rust-example in the cargo group across 1 directory by @dependabot[bot] in #304
feat(filesystem): read the rpm Berkeley DB backend by @paoValle in #289
[4 lines not shown]
