firefox153: update to 153.5
Mozilla Foundation Security Advisory 2026-108
Security Vulnerabilities fixed in Firefox ESR 153.5
Announced
October 13, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.5
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-109704: Privilege escalation in the Application Update component
Reporter
[546 lines not shown]
py-pydantic-settings: updated to 2.15.0
2.15.0
Highlights
Behavior changes
case_sensitive now applies to init kwargs and config-file sources. InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
Fields with unresolved forward references now emit a warning. Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
Non-JSON env values for strict fields now raise ValidationError instead of a less specific error.
New features
Show environment variable names in CLI help via cli_show_env_vars=True, so generated --help output doubles as configuration documentation.
PYDANTIC_SETTINGS_DEBUG for debugging settings resolution. Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
toml_table_header for regular TOML files, letting you root settings at a nested table in any TOML file, not just pyproject.toml.
Traversable support for JSON/TOML/YAML file sources, so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
GCP: project_id can come from an earlier settings source, rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
py-truststore: updated to 0.10.5
0.10.5
Take the context lock in wrap_bio() as wrap_socket() does
Add validation for server_hostname and check_hostname for wrap_socket…
Add explicit support for Python 3.15
Mitigate thread safety issues during handshakes
py-validators: updated to 0.36.0
0.36.0 (2026-10-10)
_**Breaking**_
* Drops support for Python `v3.9` and `v3.10`. Python `v3.11` or newer is required.
* Stricter validation: the following inputs, previously accepted by mistake, are now rejected.
* `isin()` now verifies the check digit, which was previously ignored. Lowercase ISINs are still accepted.
* `cusip()` and `sedol()` require a numeric check digit.
* `md5()`, `sha1()`, `sha224()`, `sha256()`, `sha384()`, `sha512()`, `base16()`, `base32()`, `base58()` and `base64()` reject trailing characters, such as a trailing newline.
* `ind_pan()` requires a full-string match.
* `fr_ssn()` no longer accepts a comma as the gender or Corsica department character.
* `domain()` rejects an underscore in the last label
* `mastercard()` accepts only the 2221-2720 range of the 2-series BINs.
* `eth_address()` rejects non-hexadecimal characters.
* `mac_address()` rejects mixed separators.
* `slug()` rejects a trailing newline, and telnet URIs reject control characters.
[9 lines not shown]
py-braintree: updated to 4.47.0
4.47.0
Fix path traversal vulnerability in CreditCard, CreditCardVerification, Customer, MerchantAccount, PayPalAccount, PaymentMethod, PaymentMethodNonce, Plan, SepaDirectDebitAccount, Subscription, Testing, Transaction, TransactionLineItem, UsBankAccount, and UsBankAccountVerification gateways by validating that IDs used in request paths do not contain path separators or relative-path segments
Add ach_type to transaction search
Add surcharge_amount to Transaction.refund()
py-test-check: updated to 3.0.1
3.0.1
Fixed
- Truncate long local values in check pseudo tracebacks with `-l` or `-lv`, while preserving full values with `-lvv` (issue 208). Thanks [Neallin-917](https://github.com/Neallin-917)
3.0.0
Highlights
- This plugin should now work fine with tests running in parallel with other plugins such as `pytest-run-parallel`, `pytest-swarm`, or `pytest-freethreaded`.
Migration Notes
- Failures raised in helper threads remain part of their parent test's report. When reading `check_log` from a worker thread, its failure state is now independent of other concurrently running threads.
- Thanks [dpadninja](https://github.com/dpadninja) for getting the ball rolling on this
[8 lines not shown]
py-absl-py: updated to 2.5.1
2.5.1
Added
(testing) Add assertIsSubclass and assertNotIsSubclass to absltest.TestCase, matching the unittest.TestCase methods added in Python 3.14.
(flags) Add support for disabling ReloadDetector via the ABSL_RELOAD_DETECTOR environment variable.
Changed
(testing) Include argument repr in absltest.TestCase.assertDataclassEqual failure message when an argument is not a dataclass instance.
Fixed
(app) Add __init__ to the app.UsageError type stub.
(logging) Fix the type signature of logging.skip_log_prefix to preserve the decorated function's return type.
(testing) Strip ANSI escape sequences from test output before XML escaping in xml_reporter.
py-utils: updated to 4.1.2
4.1.2
Count the time that passed across a daylight saving change in timesince for a timezone-aware datetime.
Raise the error of a tzinfo whose utcoffset() raises or returns something other than a timedelta from timesince, where 4.1.1 printed a wall-clock difference.
py-installer: update to 1.1.0.
## v1.1.0 (Oct 12, 2026)
- Add early return when there are no optimization levels to compile bytecode for (#341)
- Avoid building a `pathlib.Path` object for each record entry (#342)
- Declare support for Python 3.15 (#346)
- Use `os.path.commonpath` instead of `os.path.commonprefix` to address deprecation warnings on Python 3.15 (#345)
py-jsonpatch: updated to 1.35
1.35
Refactor JsonPatch class and improve documentation
Add pytest configuration for non-standard test file naming
Document JSON Pointer escaping for special characters
Improve list diffing to avoid unnecessary item replacements
Use correct SPDX-Identifer
Improve coverage reporting by combining test runs
ci: run tests on every PR and pushes to master
Add support for Python 3.13 and 3.14
Improve list diffing with sequence alignment to avoid cascading changes
Handle self-containing values in make_patch and add 180 regression tests
Only reject '-' in replace when it refers to an array
Reject moving any location into its own children, fixes 214
Compare values in 'test' by JSON equality
Hash patch operations by their 'op' and 'path'
Require jsonpointer>=3.2
[10 lines not shown]
py-django-cms: updated to 5.1.3
5.1.3
fix: Some inline editing modals did not contain _popup=1 query param for Django
fix: Migration 0045 failed on PostgreSQL for databases with duplicate page paths
fix: Slug uniqueness ignored site
fix: GrouperAdmin wrote to the wrong content object when one was selected by pk
fix: Preserve best-effort CMS mail delivery
fix: Wizard now rejects pages for other sites
fix: page-tree copy can disclose view-restrictions
docs: Provide redirect for help menu
fix: CurrentUserMiddleware hang in async mode
fix: Check page source when adding a apage
chore: Prepare release 5.1.3
fix: cross-placeholder parent authorization in paste-a-copy
fix: Harden CMS permissions
fix: AddPageForm did not check all required CMS permissions
fix: appresolver get_app_patterns
fix: Restricted placeholders hid explicitly declared child plugins
prosody: update to 13.0.7
Changes since 13.0.3:
13.0.7:
Minor changes
rostermanager, mod_roster: Include 'approved' attribute in roster items (thanks singpolyma)
util.startup: Always apply umask (thanks Max Hearnden)
Update TLS profile data from Mozilla/TLSRef
net.server_epoll: Disable read timeouts on server sockets
net.unbound: Reset and apply new config on reload
net.unbound: Simplify by removing cancel()
util.poll: Reject file descriptors outside of FD_SETSIZE in all methods
net.websocket: Release connection and input state on disconnect
net.server_select: Release queued strings on forced close
net.unbound: Let in-flight queries complete after re-initialization
net.server_epoll: Release pending write buffers on destruction
[100 lines not shown]
