net/dnscap: Update dnscap from version 1.4.1 (from 2015) to 2.5.1
Prompted by jperkin's MacOS 27 bulk build results
10+ years of changes are too many to summarise here, but TL;DR is that
+ there are a lot more dependencies (on a lot of archivers/compression
libraries), openssl, and ldns,
+ the package name in pkgsrc is now dnscap2,
+ and dnscap now supports plugins (${PREFIX}/bin/dnscap-rssm-rssac002
is one such).
tinyproxy: have rc.d script create /var/run/tinyproxy if missing
Have the example tinyproxy rc.d script in files/tinyproxy.sh create
the pid directory (@VARBASE@/run/tinyproxy) if it is not present
using start_precmd (e.g. as is done in /etc/rc.d/mdnsd). Needed
for cases where we reboot and /etc/rc.d/clearcritlocal deletes
the old pid directory from /var/run.
flawfinder: updated to 2.0.20
2.0.20
Fix unlikely vulnerabilities (involving malicious filenames/text
in analyzed systems) and implement various improvements
* Fix security vulnerabilities found by Gemini:
- Terminal injection in standard output: apply strip_controls() to
level and category in show().
- Terminal injection in CSV output: apply strip_controls() to all
untrusted fields in show_csv() (category, name, warning,
suggestion, note, context_text).
- XML injection in SonarQube output: use quoteattr() for all XML
attributes in output_sonar().
- Defense-in-depth: restrict setattr in Hit.__init__ to an allowlist
of known keys used by rule definitions, countering pickle attacks.
We previously warned to not load untrusted pickle files, but
completely preventing attacks is better.
- Shell injection in CI/CD file entrypoint.sh:
quoted args with "$@" and moved output filename to
[86 lines not shown]
py-cachetools: updated to 7.2.1
v7.2.1 (2026-10-05)
- Improve error handling for ``RRCache.popitem()`` when the cache is
empty.
- Minor style and documentation improvements.
- Update CI environment.
v7.2.0 (2026-09-16)
- Deprecate use of ``cache=None`` to suppress caching with the
``@cached`` decorator.
- Add support for Python 3.15.
- Minor test improvements.
- Minor documentation updates.
py-scp: updated to 0.16.2
0.16.2 (2026-10-06)
- Catch `EOFError` from `channel.close()` that happens sporadically on some devices
- Check erroneous server path on download
py-uvicorn: updated to 0.54.0
0.54.0
Send metadata after the response body
uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.
uv add uvicorn==0.54.0 "zttp>=0.0.34"
Send HTTP/2 response trailers. The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.
Hint at resources before the final response
Send 103 Early Hints over HTTP/2. Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.
py-jwcrypto: updated to 1.6.1
1.6.1
This release fixes CVE-2026-92091, a low security issue that may result in a Denial of Service on malformed JWK keys
py-utils: updated to 4.1.0
4.1.0
Keep UniqueList membership in sync when replacing an indexed item, and leave membership unchanged when the index is out of range, contributed
Keep UniqueList membership in sync for slice assignment, extend, pop, remove, clear, += and *=, so extend and += no longer add duplicates and removed values can be added again.
Accept one-shot iterables in UniqueList slice assignment, allow a slice to reuse the values it replaces, and reject a slice that repeats a value.
Make copy.copy and copy.deepcopy of a UniqueList return a working copy with its own membership.
Leave UniqueList membership unchanged when insert fails, and answer in for an unhashable value the way a list does.
Make CastedDict and LazyCastedDict load from pickle on every protocol, including pickles written by 4.0.1, and stop copy.copy and copy.deepcopy from casting the stored values a second time.
Cast what setdefault and |= store in a CastedDict or LazyCastedDict. A None default is stored as it is.
Cast the key of a LazyCastedDict once when it is stored. It was cast twice.
Let keyword arguments win over the mapping in update and the constructor of the casted dicts, as dict does.
Make != the opposite of == for SliceableDeque, and compare unequal to a set when an item is unhashable.
Remove the iterable of mappings from the DictUpdateArgs type alias. The code never accepted that shape.
Log the traceback in Logged.exception(), and name the caller in every record of Logged instead of logger.py. Code that passed stacklevel=2 to work around the wrong caller now points one frame too high.
Stop Logurud from crashing on a message with a brace in it. A message without arguments is logged as written, so braces that were doubled to avoid the crash now show doubled.
Keep the value of a class that combines Logged or Logurud with a type such as int or str.
Use the whole match in to_int and to_float for a pattern without a group, and never return a negative power from scale_1024.
[14 lines not shown]
