toxcore: update to 0.2.24
- missing memzero on failure path
- Don't print strings that can lack `\0` without length.
- Improve conference teardown memory management.
- e2e fuzzing was setup wrongly and no pkgs where consumed
- Align group announcement interval with cleanup interval.
- We now make sure to validate signature keys during handshake
- disable nrvo clang warning for osx ci
- `handle_gc_mod_list()` return values in docs
- **crypto:** correct assertion message in `pack_extended_public_key`
- **events:** memory leak when event field alloc fails
- **msi:** invoke error callback on init and push failure paths
- **network:** check buffer length before reading family in
`unpack_ip_port`
- **ngc:**
- don't log bad nicks
- stale gconn ptr after realloc
- **rtp:** wrong slot used check could lead to oob Header only
[5 lines not shown]
py-django-import-export: updated to 4.4.4
4.4.4 (2026-10-27)
Fixed CSV being omitted from the default formats on Python 3.15 because tablib 3.10+ lazily imports tablib.core, leaving the format registry empty when the first is_available() check runs (2210)
Fixed django.utils.functional.cached_property is deprecated warning on Django 6.2 by using functools.cached_property
Fixed ExportActionMixin.get_actions() for Django 6.1, which deprecates overriding it without the new action_location parameter and, with the old signature, disables all change form actions on the admin. (2214)
chromium: update to 156.0.8078.79
* 156.0.8078.79
This update includes 22 security fixes. Please see the Chrome Security Page for more information.
[TBD][576215540] Critical CVE-2026-76024: Memory corruption in MediaStream. Reported by Xinyang Ge on 2026-10-21
[N/A][559780982] High CVE-2026-76025: Use after free in FileSystem. Reported by Google on 2026-09-10
[N/A][567673200] High CVE-2026-76026: Memory corruption in Autofill. Reported by Google on 2026-09-29
[N/A][568894475] High CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google on 2026-10-02
[N/A][569012015] High CVE-2026-76028: Use after free in FileSystem. Reported by Google on 2026-10-03
[TBD][572055997] High CVE-2026-76029: Memory corruption in Network. Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com) on 2026-10-09
[TBD][572269631] High CVE-2026-76030: Memory corruption in FileSystem. Reported by huntersnot4 on 2026-10-11
[TBD][572556403] High CVE-2026-76031: Use after free in Input. Reported by Arni Hardarson (Neonix Security) on 2026-10-12
[N/A][573264074] High CVE-2026-119260: Use after free in Frames. Reported by Google on 2026-10-13
[N/A][574213633] High CVE-2026-119261: Improper input validation in Skia. Reported by Google on 2026-10-16
[TBD][574660146] High CVE-2026-119262: Improper input validation in V8. Reported by Hyeonjun Ahn (@_deayzl) on 2026-10-17
[N/A][575143870] High CVE-2026-119263: Memory corruption in GarbageCollection. Reported by Xinyang Ge on 2026-10-18
[TBD][575150692] High CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a on 2026-10-19
[N/A][575201795] High CVE-2026-119265: Memory corruption in Quota. Reported by Google on 2026-10-19
[7 lines not shown]
py-gitpython: updated to 3.2.1
3.2.1
prepare for next release, v3.2
objects: decode a byte mode before reading its digits
build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group
fix(submodule): validate destinations before mutation
fix(util): create lock files in one exclusive step
fix(commit): accumulate gpgsig continuation lines in linear time
fix(index): accept a single PathLike in checkout
fix(util): redact URL credentials without corrupting the host
change line for changelogs
fix(commit): reject identity fields that alter commit headers
fix: stop stalled remote commands when their timeout expires
fix(util): reject symbolic links that alias .gitmodules
fix: send one object name or path per git stdin record
fix(stats): preserve whitespace in filenames
fix(config): preserve exact large integer values
[2 lines not shown]
soapy-sdr: updated to 0.9.0
0.9.0 (2026-10-10)
- Fixed SWIG parallel Device::make() overloads
- Replaced alternative operator representations
- Fixed CMAKE_INSTALL_LIBDIR definition
- Fixed macOS rpath installation
- Updated swig for compat with newer CMake
- Updated for compat with newer CMake
- Updated cmake_policy in swig for CMake 3.12 compat
- Updated Doxygen config to remove obsolete settings
- Fixed pre-callocate optionNames even if no names are provided
- Fixed use old get python lib for v2
- Fixed treat MinGW and MSYS CMake installation paths as Unix
- Fixed loadModule dlopen to hide symbols using RTLD_LOCAL
- Removed deprecated use of distutils, fix for Python 3.12+
- Fixed pkg-config use cmake full paths
- Added Python docstrings, depending on SWIG version
[15 lines not shown]
expat: updated to 2.10.0
Release 2.10.0 Mon November 2 2026
Security fixes:
1431 CVE-2026-113351 -- Fix denial of service with use of
`XML_ParserReset`
1433 1436 ..
1438 1439 ..
1442 CVE-2026-115506 -- Detect billion laughs attacks quicker
and more of its variations. Related payload fuzzer at:
https://github.com/hannob/lololol
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
In case of backporting, please note pull request 1439
in particular.
1444 CVE-2026-117610 -- Fix initial non-final empty subparser
parse calls. Was segfaulting previously.
1450 CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
function `storeAtts` from signed integer overflow
[34 lines not shown]
py-watchdog: updated to 7.0.0
7.0.0
**Breaking Changes**
- Drop support for Python 3.9 and 3.10.
- [core] Changed pattern matching mechanism from using ``path.match()`` to ``path.full_match()``. Users must update patterns to glob-like syntax: e.g., `*.py` to `**/*.py`.
- [core] Added ``FileAttribEvent`` and ``DirAttribEvent`` for file and directory metadata modifications (such as permissions or timestamps), separate from content modifications. These events no longer trigger ``on_modified()``; implement ``on_attrib()`` to handle them. On Windows 10 (1709+) and Windows Server 2016+, ``ReadDirectoryChangesExW`` is used to differentiate attribute modifications, with fallback to ``ReadDirectoryChangesW`` on older versions or unsupported file shares.
- [watchmedo] Changed the default ``--patterns`` value from ``"*"`` to ``"**"``, so the default matches absolute paths at any depth under the ``full_match()`` semantics introduced by 1101, and updated the CLI help text and docs to the ``**/`` glob syntax.
**Other Changes**
- Add support for Python 3.15
- [core] Add context manager support to ``Observer`` class. The observer can now be used with a ``with`` statement for automatic start/stop management.
- [core] Add support for the ``follow_symlink`` keyword argument to ``ObservedWatch``.
- [core] Added the ``ignore_policy`` argument to ``PatternMatchingEventHandler`` and ``RegexMatchingEventHandler`` to configure multi-path event filtering (moves/renames). ``PatternMatchingEventHandler`` is now strict by default, aligning with ``RegexMatchingEventHandler``.
- [core] Added the ``watchdog.utils.Seconds`` type alias and used it for the time-duration parameters (``timeout``, ``polling_interval``, ``kill_after``, ...) instead of documenting the unit in each docstring. Duration parameters previously hinted as ``int`` now accept ``float``.
- [core] Adjust ``Observer.schedule()`` ``path`` type annotation to reflect the ``pathlib.Path`` support.
[53 lines not shown]
py-eth-account: updated to 0.14.0
0.14.0
Breaking Changes
Drop support for Python 3.8 and 3.9
Bump eth-utils requirement to >=5.3.0 to allow for CamelModel usage
Features
Add support for Python 3.14
Internal Changes - for eth-account Contributors
Fix mypy errors with BaseModel.model_json_schema introduced with Pydantic 2.12
py-lexicon: updated to 3.26.0
3.26.0
Added
Providers can restrict the record types they accept through VALID_TYPES;
powerdns accepts any type
The gransy provider has a REST API backend, used when --auth-token is set.
zeep is only required for the SOAP backend
The ovh provider supports OAuth2 service accounts with --auth-client-id and
--auth-client-secret, and ovh-us is a valid --auth-entrypoint
Support for Python 3.15 is added
Modified
The ovh provider now requires only a token scoped to the managed zone
(/domain/zone/example.com/*) and strips the quotes the API adds around TXT
content. Behavior change: TXT content is no longer returned quoted
[30 lines not shown]
fuse-emulator-utils: updated to 1.5.1
1.5.1
* audio2tape
* Document PZX and CSW output support and format limitations
(thanks, Sergio Baldoví) (Fredrick Meunier).
* tapeconv
* Document PZX and CSW output support and format limitations
(thanks, Sergio Baldoví) (Fredrick Meunier).
* Improve conversion error messages and warn when PZX output omits
screen or inlay attachments (Fredrick Meunier).
* tzxlist
* Show TZX CSW recording details (bug 528) (thanks, AJ B)
(Fredrick Meunier).
* Read TZX metadata as UTF-8 from libspectrum when converting to
the current locale's character encoding (Fredrick Meunier).
[8 lines not shown]
