net/coturn: Update to 4.17.0
Upstream NEWS content, less bugfixes and minor improvements:
Release 4.17.0
Changelist:
- Enable stateless nonce by default (#2036) (Pavel Punsky <eakraly at users.noreply.github.com>)
- Log format: ISO-8601 timestamp by default, no thread id, space delimiter (#2031) (Pavel Punsky <eakraly at users.noreply.github.com>)
- Start the DTLS listeners only when --dtls is given (#2026) (Pavel Punsky <eakraly at users.noreply.github.com>)
shells/oh-my-posh: update to 30.5.0
Bug Fixes
blog: fix link formatting for configurator app (413f96f)
runtime: honor COLUMNS fallback without a TTY (102edf0)
status: reset .Executed per prompt in cmd, bash and nushell (#7765) (cbf313f), closes #7757
Features
config: add native cursor_style option (41ef31d), closes #7742
deve/cargo-nextest: update to 0.9.143
v0.9.143
Added
A new junit.report-skipped configuration setting controls which skipped tests are emitted in the JUnit XML report as <testcase> elements with a <skipped> child. (#885)
Thanks to liangfu for your first contribution!
While listing tests, nextest now shows a progress bar if listing takes longer than 2 seconds. Listing is usually fast, but can be slow in some environments, such as with antivirus software that scans each test binary before it runs. (#3471)
The binaries metadata (used by archives and --binaries-metadata) now records whether Cargo built each non-test binary for the host or the target platform. Future versions of nextest will use this to configure environment variables correctly in cross-compilation scenarios. (#3520)
Changed
Nextest now orders the dynamic library search path the way current versions of Cargo do, with the Cargo artifact directory ahead of the deps directory. Previously the two were reversed, so a test could potentially resolve a dylib to a different copy than cargo test would. (Cargo swapped the two in 1.93.)
Fixed
[52 lines not shown]
biology/openbabel: update to 3.2.1
This release reflects the latest stable version, including many bug fixes, including some potentially security related.
As noted with our 3.2.0 release, we anticipate further bug-fix releases over the course of 2026 and appreciate the many contributions and reports from everyone.
🪲 Bug Fixes
Fix tetrazole protonation handling in the pH model by @Jnelen in #2975
ChemDraw CDX: handle additional aromatic/fractional bond-order codes by @jlkjr in #2979
🔒 Security and Hardening
Fix CVE-2026-54751: MMD parser uninitialized value use can expose prior atom data by Carmelo Lin @Carmel0
Update SECURITY.md with GitHub Security Advisory links by @ghutchis in #2968
Fix several formats with sscanf validation by @ghutchis in #2973
Fix more fuzz bugs by @ghutchis in #2977
Fix stack overflow in gaussformat and cube by @ghutchis in #2985
Fix additional crashes from fuzz testing by @ghutchis in #2986
Fix more reported crashes by @ghutchis in #2988
[16 lines not shown]
archivers/arqiver: update to 1.0.2
Main changes:
● Corrected the usage of --fast-read with bsdtar.
● Used the original file name with Gzip.
● Added LZ4 support.
● Removed an old workaround about translations, which prevented some languages from being loaded due to a recent change in Qt.
libXfont2: update to 2.0.9.
This release contains the fixes for the issues reported in today's security advisory:
https://lists.x.org/archives/xorg-announce/2026-August/003734.html
- CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write
- CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow
Additionally, it changes a build-time default. Previously fontserver support
was compiled in by default unless --disable-fc was provided at configure time.
The new default is *disabled by default* unless --enable-fc is provided at
configure time. Doing so protects us from future fontserver-connection related
issues. Fontservers have been deprecated for many years and the vast majority
of users will not notice this changed default (Debian has built with
--disable-fc for years).
