mimir: update to 3.2
3.2:
- Remote execution on by default; upgrade all queriers to 3.1 first.
- Removed: -query-frontend.enable-multiple-node-remote-execution-
requests, MQE projection-pushdown and prune-toggles flags.
3.1:
- TSDB blocks must use index v2; no index-headers built from v1.
- Removed: -target=flusher (use /ingester/flush), ring heartbeat
disabling, -querier.response-streaming-enabled.
- Per-step stats unsupported under MQE.
3.0 (major; plan the upgrade):
- Query-scheduler is REQUIRED; embedded one gone, so -querier.frontend-
address, -querier.max-outstanding-requests-per-tenant and
-query-frontend.querier-forget-delay are removed.
- MQE also default in query-frontend; queriers no longer serve the
Prometheus HTTP API (go via query-frontend).
- Removed: read-write deploy mode, Redis cache, memcached addresses-
provider, instant query splitting, -query-frontend.downstream-url,
[8 lines not shown]
resterm: Update to 1.2.2
New
Warnings for unknown and misplaced directives
Fixed
Ignored or unknown directives no longer close an active workflow or interrupt an open workflow branch.
Invalid directives cannot accidentally create or modify a request while the parser determines whether they apply.
devel/task: update to 3.53.1
Features
* Remote Taskfiles are now generally available! This has been an
experimental feature for 3 years, but is now enabled by default. Massive
thanks to all those that contributed and gave feedback (too many to list
here). We've also given the Remote Taskfiles documentation a bit of a
polish.
* Added a per-command timeout that terminates a command once it exceeds the
given duration (Go duration syntax). It covers shell commands, task
calls, deferred commands, deps and the if condition, obeys ignore_error,
and reports exit code 124. Callers that join a run: once or when_changed
task already running now honor their own timeout, and inherit that task's
failure instead of being told it succeeded.
* Considerably improve performance of fingerprinting on large repositories
(monorepos). Fingerprinting is up to 86% faster and make up to 70% fewer
memory allocations on the more advanced scenarios. Benchmarks were added
as well. We're basically skipping work when not needed.
[46 lines not shown]
grafana: update to 13.2.0
CVE-2026-17183
An authenticated organization user who can create or edit alert rules
in a folder can query a datasource for which they do not have
datasources:query permission.
grafana: update to 13.1.3
pkgsrc change:
This update disables support for sqlite as storage backend on most
platforms because grafana has switched to a sqlite driver that is
very difficult to support in a generic manner in pkgsrc.
(It needs transpiled code shipped by the upstream for every
MACHINE_PLATFORM.)
On such a platform you can use PostgreSQL instead.
Other major breaking changes since 11.x:
Angular plugin support is fully removed
Data source UID enforcement
Upgrading rewrites the whole annotation table; budget 2–3x its size
React 19. Update all plugins before upgrading, or they may break
Folders and dashboards migrate off legacy SQL tables on startup
grafana-cli and grafana-server are removed (use grafana cli / grafana server)
Image Renderer no longer supported as a plugin (run it as a separate service)
Dashboards migrate to schema v2 automatically when opened
rumdl: update to 0.2.58.
0.2.58
Added
wasm: load extends chains from embedder-supplied config files (e7c7d8f)
0.2.57
Fixed
MD013: let a sentence open with a number under require-sentence-capital (5060333)
lsp: keep a CRLF document's line endings through fixes and code actions (c88a7da)
py-json-logger: updated to 4.2.0
4.2.0
Changed
Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict.
Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735).
Fixed
$ style formats now support unbraced $name fields, not just ${name}
py-flask-security: updated to 5.8.2
5.8.2
Fixes
- (:pr:`1265`) Fix for GHSA-f66q-9rf6-8795 - WebAuthn reauthentication freshness bypass. (tonghuaroot)
- (:issue:`1263`) :py:data:`SECURITY_CACHE_CONTROL` directives were added to every
application response instead of just responses from Flask-Security endpoints
as documented. (Ceirced)
- (:issue:`1212`) Newly introduced :py:meth:`.UserMixin.is_locked` logic is inverted.
- (:issue:`1244`) Fix login form remember me checkbox.
Backwards Compatibility Concerns
- The fix for the inverted `is_locked` logic will require any application using it
to invert their logic.
luanti: update to 5.17.0
Client / Audiovisuals
- Dropdowns now accept selection by (Mouse) Down -> Drag -> Release
- Formspecs no longer close when focusing the window
- Fix: Formspec model[] elements are again animated
- Implement basic gamepad support for in-game actions (not formspecs)
- Support multi-track animations (glTF models)
- Fixed an case where the held item stack (e.g. when dragging) size
was no longer displayed correctly
- The mouse cursor is no longer clamped to window bounds
- Shaders: Fix plants flickering when visual_scale > 1
- Chat: Pressing the Tab key now autocompletes to the next common
part of the player name
- The (main menu) progress bar now shows more media download details
- Formspec: Inventory slots and buttons now stay hovered on update
- Main menu: Mods are now sorted by their technical name (before:
directory name)
- Mostly fix the appearance of waving liquids (shader) below solid
[38 lines not shown]
chromium: update to 151.0.7922.173
* 151.0.7922.173
This update includes 7 security fixes. Please see the Chrome Security Page for more information.
[N/A][522819252] Critical CVE-2026-76017: Use after free in Chromoting. Reported by Google on 2026-06-11
[N/A][513757918] High CVE-2026-76018: Privilege elevation in Import. Reported by Google on 2026-05-16
[TBD][539032888] High CVE-2026-76019: Incorrect authorization in Workers. Reported by Anonymous on 2026-07-26
[TBD][541837151] High CVE-2026-76020: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-03
[N/A][541854084] High CVE-2026-76021: Use after free in DOM. Reported by Google BigSleep at Grape on 2026-08-02
[TBD][543798025] High CVE-2026-76022: Buffer overflow in Network. Reported by 0xAlessandro on 2026-08-07
[TBD][545124048] High CVE-2026-76023: Improper resource control in Linux Toolkit Theming. Reported by Keita Sode and Daisuke Hatakeyama of SYZD Research on 2026-08-11
* 151.0.7922.169
This update includes 15 security fixes. Please see the Chrome Security Page for more information.
[N/A][534923522] Critical CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15
[N/A][540087398] Critical CVE-2026-76036: Buffer overflow in Dawn. Reported by Google on 2026-07-28
[N/A][516715010] High CVE-2026-76033: Inappropriate implementation in CORS. Reported by Google on 2026-05-26
[12 lines not shown]
lang/nodejs: revert fix
After a discussion with wiz@ and some extended testing, it turns out
that the build fix for {macOS,NetBSD}/amd64 related to c-ares appears to
no longer be necessary. The pull-up request #7242 issued for lang/nodejs
version 26.3.1 (as per pkgsrc-2026Q2) remains relevant and correct
though, per my analysis of the issue.
Tested on NetBSD/amd64 (11.0_RC6)
