NetBSD/pkgsrc N1CzBmWdoc CHANGES-2025

   Updated databases/py-sqlalchemy, www/py-tornado
VersionDeltaFile
1.7137+3-1doc/CHANGES-2025
+3-11 files

NetBSD/pkgsrc sdjq4qxwww/py-tornado distinfo Makefile

   py-tornado: updated to 6.5.3

   What's new in Tornado 6.5.3

   Security fixes

   - Fixed a denial-of-service vulnerability involving quadratic computation when parsing
     ``multipart/form-data`` request bodies.
     `CVE-2025-67726 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8>`_
     Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue.
   - Fixed a denial-of-service vulnerability involving quadratic computation when parsing repeated HTTP
     headers.
     `CVE-2025-67725 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64>`_.
     Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue.
   - Fixed a header injection and XSS vulnerability involving the ``reason`` argument to
     `.RequestHandler.set_status` and `tornado.web.HTTPError`.
     `CVE-2025-67724 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f>`_.
     Thanks to `Finder16 <https://github.com/Finder16>`_ and
     `Cheshire1225 <https://github.com/Cheshire1225>`_ for reporting this issue.

    [12 lines not shown]
VersionDeltaFile
1.33+4-4www/py-tornado/distinfo
1.45+2-2www/py-tornado/Makefile
1.20+3-1www/py-tornado/PLIST
+9-73 files

NetBSD/pkgsrc Lldzantdatabases/py-sqlalchemy distinfo Makefile

   py-sqlalchemy: updated to 2.0.45

   2.0.45

   orm

   [orm] [bug]

   Fixed issue where calling Mapper.add_property() within mapper event hooks such as MapperEvents.instrument_class(), MapperEvents.after_mapper_constructed(), or MapperEvents.before_mapper_configured() would raise an AttributeError because the mapper’s internal property collections were not yet initialized. The Mapper.add_property() method now handles early-stage property additions correctly, allowing properties including column properties, deferred columns, and relationships to be added during mapper initialization events. Pull request courtesy G Allajmi.

   [orm] [bug]

   Fixed issue in Python 3.14 where dataclass transformation would fail when a mapped class using MappedAsDataclass included a relationship() referencing a class that was not available at runtime (e.g., within a TYPE_CHECKING block). This occurred when using Python 3.14’s PEP 649 deferred annotations feature, which is the default behavior without a from __future__ import annotations directive.

   examples

   [examples] [bug]

   Fixed the “short_selects” performance example where the cache was being used in all the examples, making it impossible to compare performance with and without the cache. Less important comparisons like “lambdas” and “baked queries” have been removed.

    [56 lines not shown]
VersionDeltaFile
1.81+4-4databases/py-sqlalchemy/distinfo
1.94+2-2databases/py-sqlalchemy/Makefile
+6-62 files

NetBSD/pkgsrc Gt36USGdoc CHANGES-2025

   Updated devel/py-txaio, www/py-autobahn
VersionDeltaFile
1.7136+3-1doc/CHANGES-2025
+3-11 files

NetBSD/pkgsrc C95aYxbwww/py-daphne Makefile

   py-daphne: not for Python 3.10
VersionDeltaFile
1.35+3-1www/py-daphne/Makefile
+3-11 files

NetBSD/pkgsrc UAekWygwww/py-autobahn PLIST Makefile

   py-autobahn: updated to 25.12.1

   25.12.1

   **New**

   * Add vendored Flatbuffers (v25.9.23)
   * Add WAMP serdes functional and benchmark testing; WAMP-Flatbuffers; WAMP Serializer Composition (transport/payload)

   **Fix**

   * Fix 1757
   * Fix 1767
   * Fix 1771 complete
VersionDeltaFile
1.22+52-179www/py-autobahn/PLIST
1.44+15-9www/py-autobahn/Makefile
1.34+4-4www/py-autobahn/distinfo
1.3+0-2www/py-autobahn/ALTERNATIVES
+71-1944 files

NetBSD/pkgsrc LwkdY25devel/py-txaio distinfo Makefile

   py-txaio: updated to 25.12.2

   25.12.2

   **New**

   * Modernized documentation infrastructure with Furo theme, MyST Markdown support, and sphinx-autoapi for automatic API documentation generation
   * Switch from setuptools to `Hatchling <https://hatch.pypa.io/latest/>`_
   * Added standardized project badges (PyPI, Python versions, CI, Docs, License, Downloads) to README.md and docs/index.rst
   * Added comprehensive documentation sections: Installation, Getting Started, Programming Guide, Contributing, and Releases
   * Added AI assistance documentation under ``docs/ai/`` with acknowledgement and audit files

   **Fix**

   * Fixed RST badge rendering by setting ``override_image_directive=False`` in sphinxcontrib-images configuration
   * Fixed F841 linting error in sphinx_auto_section_anchors.py (unused variable)
   * Fixed Incomplete source distribution in 25.12.1: missing tests/util.py

   **Other**

    [4 lines not shown]
VersionDeltaFile
1.22+4-4devel/py-txaio/distinfo
1.21+5-3devel/py-txaio/Makefile
1.7+1-2devel/py-txaio/PLIST
+10-93 files

NetBSD/pkgsrc t6tB9A8doc CHANGES-2025

   Updated devel/lazygit, net/rclone
VersionDeltaFile
1.7135+3-1doc/CHANGES-2025
+3-11 files

NetBSD/pkgsrc 9wKHHI9net/rclone distinfo Makefile

   rclone: updated to 1.72.1

   1.72.1

   Bug Fixes
   build: update to go1.25.5 to fix CVE-2025-61729
   doc fixes (Duncan Smart, Nick Craig-Wood)
   configfile: Fix piped config support (Jonas Tingeborn)
   log
   Fix PID not included in JSON log output (Tingsong Xu)
   Fix backtrace not going to the --log-file (Nick Craig-Wood)
   Google Cloud Storage
   Improve endpoint parameter docs (Johannes Rothe)
   S3
   Add missing regions for Selectel provider (Nick Craig-Wood)
VersionDeltaFile
1.32+4-4net/rclone/distinfo
1.88+2-3net/rclone/Makefile
+6-72 files

NetBSD/pkgsrc rPSLpvIdevel/lazygit distinfo go-modules.mk

   lazygit: updated to 0.57.0

   0.57.0

   Enhancements

   Open pull requests in browser with extra leading slashes removed
   Allow using SelectedSubmodule in CustomCommands
   Don't allow empty input in most prompts
   Suppress output from background fetch (unless there were errors)
   feat: add fork remote command
   Trigger immediate background fetch when switching repos

   Fixes

   Keep cursor at top/bottom when navigating by page
   Switch to branches view when checking out a commit
   Fix deleting a remote tag when a remote branch with the same name exists, or vice versa
   Show fixup base commits in correct order in ctrl-f error message

    [25 lines not shown]
VersionDeltaFile
1.16+40-52devel/lazygit/distinfo
1.12+12-16devel/lazygit/go-modules.mk
1.62+10-11devel/lazygit/Makefile
+62-793 files

NetBSD/pkgsrc CiTZnwgdevel/php-libawl Makefile distinfo, devel/php-libawl/patches patch-inc_AWLUtilities.php.in

   Pull upstream fix for issue #29
   <https://gitlab.com/davical-project/awl/-/issues/29>

   Remove patch leftovers

   Pkglint
VersionDeltaFile
1.1+30-0devel/php-libawl/patches/patch-inc_AWLUtilities.php.in
1.22+5-4devel/php-libawl/Makefile
1.20+2-1devel/php-libawl/distinfo
+37-53 files

NetBSD/pkgsrc cBahga5doc CHANGES-2025

   doc: Updated www/firefox140-l10n to 140.6.0
VersionDeltaFile
1.7134+2-1doc/CHANGES-2025
+2-11 files

NetBSD/pkgsrc suja1Cpdoc CHANGES-2025

   doc: Updated www/firefox140 to 140.6.0
VersionDeltaFile
1.7133+2-1doc/CHANGES-2025
+2-11 files

NetBSD/pkgsrc rka6Np6doc CHANGES-2025

   doc: Updated audio/termusic to 0.12.1
VersionDeltaFile
1.7132+2-1doc/CHANGES-2025
+2-11 files

NetBSD/pkgsrc BKdZc9zaudio/termusic distinfo cargo-depends.mk

   audio/termusic: update to 0.12.1

   [V0.12.1]
   Released on: December 11, 2025.
   Change: change default log level to info (from warn).
   Change: log the termusic version used.
   Change(tui): on windows, properly spawn the server as a detached process.
   Feat(tui): allow disabling individual cover-art protocols, even if compiled-in.
   Fix: populate media title changes (like radio stream titles) to the TUI again.
   Fix(tui): update status bar (status, volume, speed, gapless) on [volume, speed, gapless] changes, not just status changes.
   Fix(tui): properly set lyric content on reload (like exiting the config editor).
   Fix(tui): populate "Stopped" state to everything instead of showing stale data.
   Fix(tui): change how progress time is displayed to now be --:-- if unavailable / stopped, and dont show total duration if unavailable.
   Fix(tui): dont show error popup if cover-ueberzug is compiled-in but ueberzug command is not available.
   Fix(tui): change the progressbar to use less-than-full blocks for smoother display.
   Fix(tui): change Database Playlist search to work on all music roots, instead of current library root.
   Fix(tui): change tokio runtime shutdown to have a timeout. This fixes infinitely stuck process on windows.
   Fix(tui): correctly kill the server on windows systems if config option behavior.quit_server_on_exit is enabled.
   Fix(tui): in Music Library, when pressing RIGHT on a non-loaded directory, will now load the directory (without having to step-into it).

    [8 lines not shown]
VersionDeltaFile
1.54+61-64audio/termusic/distinfo
1.49+19-20audio/termusic/cargo-depends.mk
1.70+2-3audio/termusic/Makefile
+82-873 files

NetBSD/pkgsrc 15g5bVZdoc CHANGES-2025

   doc: Updated devel/ast-grep to 0.40.1
VersionDeltaFile
1.7131+2-1doc/CHANGES-2025
+2-11 files

NetBSD/pkgsrc 99hQwkhdevel/ast-grep distinfo cargo-depends.mk

   devel/ast-grep: update to 0.40.1

       chore: add a link to the badges #2370
       fix: fix AST strictness check #2361
       chore(deps): update dependency @ast-grep/napi to v0.40.0 c98f0dc
       fix: use individual flag for parser 2bdcecb
       chore(deps): update dependency oxlint to v1.32.0 b058028
VersionDeltaFile
1.72+40-40devel/ast-grep/distinfo
1.67+12-12devel/ast-grep/cargo-depends.mk
1.72+2-2devel/ast-grep/Makefile
+54-543 files

NetBSD/pkgsrc Jl8MdNywww/firefox140 distinfo Makefile, www/firefox140-l10n distinfo Makefile

   firefox140{,-l10n}: Update to 140.6.0

   Changes:
   140.6.0
   - Security fixes (MFSA2025-94)

   Discussed with PMC and ok by <maya> during carefulperiod 2, thanks!
VersionDeltaFile
1.3+307-307www/firefox140-l10n/distinfo
1.3+4-4www/firefox140/distinfo
1.4+2-2www/firefox140/Makefile
1.3+2-2www/firefox140-l10n/Makefile
+315-3154 files

NetBSD/pkgsrc 1TWsPvodoc CHANGES-2025

   Updated www/py-django-polymorphic, www/py-django-modelcluster
VersionDeltaFile
1.7130+3-1doc/CHANGES-2025
+3-11 files

NetBSD/pkgsrc VY7xAyQwww/py-django-modelcluster distinfo Makefile

   py-django-modelcluster: updated to 6.4.1

   6.4.1 (04.12.2025)
   * Handle `get_prefetch_queryset` deprecation, for Django 6.0 support (Sage Abdullah)
VersionDeltaFile
1.9+4-4www/py-django-modelcluster/distinfo
1.11+3-4www/py-django-modelcluster/Makefile
+7-82 files

NetBSD/pkgsrc vlNNmgVwww/py-django-polymorphic Makefile distinfo

   py-django-polymorphic: updated to 4.3.0

   4.3.0

   Support Q expressions that contain subquery expressions
   Make related polymorphic object manager selection more robust to multiple inheritance scenarios.
   Caching in inheritance accessor functions
   update changelog
   Multi-database support in inheritance accessors.
   Include get_child_inlines() hook in stacked inline admin forms.
   upgrade uv lockfile
   fix docs errors
   Resolve primary key name correctly.
   Misc test fixes
   remove dead code
   bump version
VersionDeltaFile
1.12+5-5www/py-django-polymorphic/Makefile
1.10+4-4www/py-django-polymorphic/distinfo
1.8+1-6www/py-django-polymorphic/PLIST
+10-153 files

NetBSD/pkgsrc lK3NecNdoc CHANGES-2025

   doc: Updated devel/jj-docs to 0.36.0
VersionDeltaFile
1.7129+2-1doc/CHANGES-2025
+2-11 files

NetBSD/pkgsrc 4AKnlkadevel/jj-docs PLIST distinfo

   jj-docs: update to 0.36.0.

   Sync with jj.
VersionDeltaFile
1.3+20-6devel/jj-docs/PLIST
1.3+4-4devel/jj-docs/distinfo
1.3+2-2devel/jj-docs/Makefile
+26-123 files

NetBSD/pkgsrc mODNliAdoc CHANGES-2025

   Updated www/py-httpx-socks, graphics/py-exifread
VersionDeltaFile
1.7128+3-1doc/CHANGES-2025
+3-11 files

NetBSD/pkgsrc KBYYHCbgraphics/py-exifread distinfo PLIST

   py-exifread: updated to 3.5.1

   3.5.1 — 2025-08-23
   * Don't raise exception from decode_maker_note() if strict==False

   3.5.0 — 2025-08-23
   * Add support for JPEG XL
   * Add Image SubIFDs decoding and Nikon Z 9 sample
   * Make it easier to add new file types to testing
VersionDeltaFile
1.10+4-4graphics/py-exifread/distinfo
1.9+4-1graphics/py-exifread/PLIST
1.10+2-2graphics/py-exifread/Makefile
+10-73 files

NetBSD/pkgsrc 4dODVvGwww/py-httpx-socks Makefile distinfo

   py-httpx-socks: updated to 0.11.0

   0.11.0
   Unknown changes
VersionDeltaFile
1.26+7-4www/py-httpx-socks/Makefile
1.22+4-4www/py-httpx-socks/distinfo
+11-82 files

NetBSD/pkgsrc IidNlH1doc CHANGES-2025, shells/bash Makefile distinfo

   Update shells/bash to 5.3.9

   One new (upstream) patch added.   Fixes a SIGSEGV if a SIGINT is received
   during a reverse i-search (readline issue - to the embedded readline).
VersionDeltaFile
1.124+3-3shells/bash/Makefile
1.94+4-1shells/bash/distinfo
1.7127+2-1doc/CHANGES-2025
+9-53 files

NetBSD/pkgsrc MS9vFiadoc CHANGES-2025

   Updated security/py-acme, security/py-certbot*
VersionDeltaFile
1.7126+18-1doc/CHANGES-2025
+18-11 files

NetBSD/pkgsrc UtmUcHFsecurity/py-acme distinfo, security/py-certbot-apache distinfo

   py-acme py-certbot*: updated to 5.2.2

   5.2.2

   Fixed a regression that caused certbot to crash if multiple --webroot-path
   values were set on the command line.
VersionDeltaFile
1.72+4-4security/py-acme/distinfo
1.72+4-4security/py-certbot-apache/distinfo
1.15+4-4security/py-certbot-dns-cloudflare/distinfo
1.60+4-4security/py-certbot-dns-digitalocean/distinfo
1.67+4-4security/py-certbot-dns-dnsimple/distinfo
1.67+4-4security/py-certbot-dns-dnsmadeeasy/distinfo
+24-2412 files not shown
+70-7018 files

NetBSD/pkgsrc tcDFeEVdoc CHANGES-2025

   doc: Updated www/chromium to 143.0.7499.40
VersionDeltaFile
1.7125+2-1doc/CHANGES-2025
+2-11 files