rust: update 1.99.1
From wip, by he@, adam@, and pin@.
1.99.1 is a bugfix release for 1.99.0.
1.99.0
Language
Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows
Extend unconditional_panic lint to function calls that panic when the chunks/windows size is zero
Stabilize C-variadic function definitions
Stabilize the ability to use #[unsafe(naked)] functions to define C-variadic functions (#![feature(c_variadic_naked_functions)]).
Trait methods are now resolved on an adjusted never type (producing a FCW)
Coerce from inference variables to trait objects if the inference variable is related via subtyping to a type that is known to be Sized
Stabilize #[my_macro] mod foo;. This allows outlined modules (mod foo;) anywhere in the body of a custom attribute or derive macro.
Fix the overflowing_literals lint with repeated negation. For instance, it will now no longer lint on --128_i8, which is already detected by the arithmetic_overflow lint.
Add POSIX symbols to the invalid_runtime_symbol_definitions and suspicious_runtime_symbol_definitions lints
[61 lines not shown]
vfu: Update to version 5.09
5.09: 22.Jun.2023
! 1. fixed problem with some tools (key "T", tools menu) when current
directory has no entries.
! 2. fixed shell escaping for pipe char (and % jtbs)
tailscale: update to 1.104.7
Go is updated to Go 1.27.4, to explicitly resolve an issue in TLS
ClientHello where some middleboxes break connections to the Tailscale
control plane.
net/coturn: Update to 4.19.0
Upstream NEWS content, less bugfixes and minor improvements:
Release 4.19.0
Changelist:
- Update integrity key generation to use default SHA type (Pavel Punsky <eakraly at users.noreply.github.com>)
chromium: update to 157.0.8103.78
* 157.0.8103.78
This update includes 83 security fixes. Please see the Chrome Security Page for more information.
[N/A][568699166] Critical CVE-2026-126885: Use after free in ServiceWorker. Reported by Xinyang Ge on 2026-10-02
[N/A][575524700] Critical CVE-2026-126895: Use after free in CSS. Reported by Xinyang Ge on 2026-10-19
[N/A][576736463] Critical CVE-2026-126879: Use after free in Layout. Reported by Xinyang Ge on 2026-10-22
[N/A][580857377] Critical CVE-2026-126846: Use after free in Skia. Reported by Google on 2026-11-02
[TBD][580921803] Critical CVE-2026-126911: Use after free in Accessibility. Reported by Andrew Boni on 2026-11-02
[$4,000][567827593] High CVE-2026-126864: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-30
[N/A][560620348] High CVE-2026-126889: Off-by-one error in V8. Reported by Google on 2026-09-12
[N/A][563340397] High CVE-2026-126859: Link following in FileSystem. Reported by Google on 2026-09-18
[N/A][567611696] High CVE-2026-126886: Use after free in Frames. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][567611698] High CVE-2026-126887: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][568906910] High CVE-2026-126870: Uninitialized resource in ANGLE. Reported by Google on 2026-10-02
[N/A][569286603] High CVE-2026-126912: Buffer overflow in Skia. Reported by Xinyang Ge on 2026-10-05
[N/A][569674220] High CVE-2026-126919: Use after free in BrowserTag. Reported by Xinyang Ge on 2026-10-05
[TBD][572312779] High CVE-2026-126878: Information leak in Core. Reported by Anthropic and Ada Logics on 2026-10-10
[69 lines not shown]
py-test-asyncio: updated to 1.5.0
1.5.0
Added
A fixture-scope value for asyncio_default_fixture_loop_scope. With it, an asynchronous fixture without loop_scope uses its scope as its loop scope. This is the behavior of an unset option in pytest-asyncio 1.x.
Fixed
Invalid arguments to the asyncio marker, including an invalid loop_scope, are reported with a message that names the test instead of a traceback.
cargo-nextest: updated to 0.9.152
0.9.152
Added
cargo nextest self setup accepts a new --source install-script value. The upcoming install scripts at get.nexte.st run cargo nextest self setup --source install-script after installing nextest. As with other sources, setup is currently a no-op.
Changed
Nextest now rejects malformed or untrusted inputs in a few more places:
When reusing builds, archive extraction now fails if the archive contains entries other than regular files and directories, such as symlinks, hard links, devices, or FIFOs. Archives created by cargo nextest archive never contain such entries.
This is not classified as a security issue because build archives are not (and cannot be, because they contain arbitrary executable code) a trust boundary.
When reusing builds for a custom target, nextest now rejects target triples that contain path separators or are absolute paths.
The common situation where this can happen is with a build archive. Like in the above case, this is not classified as a security issue.
[10 lines not shown]
textproc/groff-pdfmark: import groff-pdfmark-26.10
Packaged for wip by Louis Guillaume.
The groff-pdfmark package provides a suite of GNU roff macro
packages together with the pdfroff Bourne shell driver script. It
facilitates creation of PDF files that contain active hyperlinks,
bookmarks, document metadata and other PDF features, using GNU
troff as the primary typesetting engine.
Originally distributed as a contributed component of GNU groff, the
macros and pdfroff were removed from the main groff distribution
starting with version 1.24 and are now maintained separately.
This package installs the macros into share/groff/site-tmac so that
they are automatically found by groff without modifying the main
groff package.
devel/stirmake: import stirmake-0.4.5
Packaged in wip by Juha-Matti Tilli
Stirmake is a fast build tool intended to allow easily developing
correct build systems with one global directed acyclic graph for
projects spanning multiple directories and potentially including Git
submodules. It is fully programmable in the embedded Amyplan programming
language. The intention is that with Stirmake, one never has to type the
equivalent of "make clean" to fix a build.
