py-setuptools: update to 84.2.1.
v84.2.1
=======
Bugfixes
--------
- Changed wheel tags and stable-ABI validation to use sysconfig data. (#5360)
- Fixed unimportable extensions on free-threaded Python 3.13 and 3.14 when
``Extension.py_limited_api`` is enabled. These builds now use their
version-specific extension suffix instead of using the unsupported ``.abi3t``
suffix. (#5363)
Improved Documentation
----------------------
- Replaced broken link to Python Eggs documentation with an archived version from the Wayback Machine. (#1929)
[58 lines not shown]
tealdeer: update to 1.9.1 (security)
This patch release updates tealdeer's dependencies. Most notably, the zip
crate and the webpki roots are updated to the latest version. This prevents a
hypothetical attack on tealdeer in which an attacker uses the recently
compromised TLS certificates to pose as the archive source for updating the
cache, and then serves a malicious zip archive that exploits vulnerabilities
in the zip crate.
I am not aware of any such attacks in the wild, but it can't hurt to play it
safe and update. If you are using tealdeer versions before 1.9, please check
whether your distribution ships an up-to-date build of your tealdeer version,
or build tealdeer from source yourself (without using the committed lockfile).
Additionally, this release contains bug fixes for three edge cases.
py-brotlicffi: update to 1.2.1.0.
Limit Darwin file name change to Python>3.14.
1.2.1.0 (2026-10-21)
--------------------
- Upgraded libbrotli to v1.2.1, which remediates CVE-2026-111497, an
out-of-bounds write that permits remote code execution.
- Changed one-shot ``decompress()`` and streaming ``Decompressor.process()`` /
``Decompressor.decompress()`` to raise ``brotlicffi.error`` for trailing bytes
after a complete Brotli stream, including calls without an output limit.
Previously tolerated input is now rejected, and any output produced during
the failing call is discarded. This prevents infinite drain loops in
streaming consumers.
py-dateutil: update to 3.0.0.
Version 3.0.0 (2026-10-21)
==========================
**This is the last major version of** ``dateutil`` **that will support any
version of Python older than 3.11.** The next release will be the 4.x series,
which will support Python 3.11 and later. We may release fixes for serious bugs
in the 3.0.x series, but there are no plans for new features there.
The biggest change in this release is a rewrite of ``tz.tzfile``, which affects
nearly every user of ``dateutil.tz`` and changes the UTC offset of
nonexistent times (see below). ``dateutil`` also now depends on the ``tzdata``
package, and no longer ships its own time zone database.
Data updates
------------
[90 lines not shown]
Revert "archivers/py-brotlicffi: Fix building on macOS"
This conflicted with the previous change, which seems to fix Python
3.15, but breaks all other Python versions.
Version 0.70.0, by Aleksey Cheusov, Sun, 25 Oct 2026 15:45:22 +0400
pkg_src_summary:
* fix -m for packages with MULTI-dependencies in parallel mode
* update tests
pkg_summary2deps:
* add options -T and -b
Update pkgtools/nih to 0.17.0
Do not use All/ subdirectory of $CACHEDIR
Fix help messages for "history" and "clean-cache" subcommands
Minor clean-ups in nih.1
nih clean-cache: add option -q
nih.default.conf: fix default REPOSITORY for SunOS/SmartOS -- always use x86_64 machine arch in URL
nih, pkg_status: prepand PATH with @bindir@
Fix support for local REPOSITORY
Use PKG_TOOLS_BIN instead of SBINDIR for pkg_{info,admin,add,delete,create}
p5-URI: update to 5.40.
5.40 2026-10-19 19:56:29Z
- URI->new no longer dies on malformed geo: URIs; the URI::geo accessors
croak instead (GH#201)
- Fix rel() returning an absolute-path or network-path reference
("/x", "//host/...") when a path has empty segments, so rel()->abs()
round-trips again (GH#205)
5.39 2026-10-19 16:38:21Z
- Reject over-long IDNA labels before punycode encoding or decoding, so
a long non-ASCII host no longer takes seconds to fail (GH#207) (Olaf
Alders)
5.38 2026-10-19 03:58:47Z
- Preserve leading and trailing whitespace in file:// URI paths built from
mac file names; URI::file::Mac supplies its own escaping and so was not
covered by the GH#95 fix (GH#95) (@youdie006)
- Treat a percent-escaped ';' in an smb:// userinfo as part of the
[5 lines not shown]
p5-Sereal: update to 5.011.
5.011
* Robustness fixes. Thanks to Steffen Mueller and kumar-Prakash07.
* Preserve zstd deprecation warnings when building with IBM XL C on AIX.
* Raise the minimum supported Perl version to 5.14.
* Fix the Sereal::Decoder prerequisite version in generated Sereal-Encoder
package metadata. See https://github.com/Sereal/Sereal/issues/317
