mikmod: updated to 3.2.10
3.2.10
- Fix a few spelling mistakes (thanks to Stephen Kitt.)
- Updated OS2 EMX makefile for KLIBC environment (build tested with
cross-os2emx toolchain at https://github.com/komh/cross-os2emx)
- Added a few OpenWatcom/DOS bits (needs further work.)
- A few minor fixes and clean-ups.
libmikmod: updated to 3.3.14
3.3.14
- Fix out-of-bounds writes in unimod v6 loader with crafted files.
- Add bounding checks for DSMI AMF channel remap table.
- Add limit check to numchan in DSM loader.
- Fix IT pattern loader allocation to match maximum allowed row count
- Fix ULT loader numchn, numpat, numtrk calculations corner cases.
- Fix DSM and OKT loaders numtrk integer overflow with crafted files
- Added Windows WASAPI output driver.
- Added Playstation Vita output driver.
- Updated webaudio driver with stereo output support.
- Fixed Windows XAudio2 driver build using MinGW-w64.
- Revised SDL output driver for MikMod_Reset() issue.
- Updated OS2 EMX makefile for KLIBC environment (build tested with
cross-os2emx toolchain at https://github.com/komh/cross-os2emx )
- Cmake build system now installs documentation and the autoconf macro.
- Minor cmake build system fixes.
- A few other minor fixes and clean-ups.
py-dulwich: updated to 1.2.15
1.2.15 2026-09-14
* Detect delta cycles in ``Pack.resolve_object``: a crafted pack with
REF_DELTA objects that name each other sent ``get_raw`` into an
unbounded loop. Such chains now raise ``DeltaCycle``.
* Fix ``porcelain.clean`` when the target directory and the repository path
are spelled differently, such as via a relative path or a symlink.
(Jelmer Vernooij)
* Memoize tag peeling on the object store, so refs sharing an annotated tag
chain no longer re-walk it once per ref. ``show_ref --dereference`` and the
ref advertisement were quadratic.
* Give a ``.gitignore`` in a subdirectory precedence over one closer to the
root, matching git. A negation in a deeper file no longer loses to a rule
at the root, and a nested negation no longer re-includes a path whose
[38 lines not shown]
jemalloc: updated to 5.4.0
5.4.0 (Sep 17, 2026)
This release contains over 160 commits, focusing on the technical debts
cleaning including refactorings, bug fixes, test coverage improvement, and
option cleanups. The release also includes portability improvements per
upstream issues report.
New features:
- Add `EXTENT_ALLOC_FLAG_PINNED` so custom extent-allocation hooks can
mark non-reclaimable mappings, such as HugeTLB pages, for preferential
reuse outside the decay and purge pipeline. Add the mallctl interfaces
`stats.pinned`, `stats.arenas.<i>.pinned`,
`stats.arenas.<i>.extents.<j>.npinned`,
`stats.arenas.<i>.extents.<j>.pinned_bytes`, and
`stats.arenas.<i>.mutexes.extents_pinned.{counter}` to report
pinned-memory usage and mutex statistics. (@binliu19: be2de8cc)
- Allow resuming per-CPU arena selection via `thread.arena`.
[86 lines not shown]
py-unidiff: updated to 1.0.1
1.0.1 - 2026-09-14
* Exposed git submodule (gitlink) entries through the file mode and the new
PatchedFile.is_submodule property
* Fixed parsing of patches that add multiple files in a row sharing the
/dev/null source, such as quilt-generated patches
* Fixed metadata_only parsing of empty (including DOS "\r\n") context lines.
* Fixed an UnboundLocalError on malformed patches with a target file header
and no preceding source header; UnidiffParseError is now raised
* Fixed a TypeError on binary diffs without a target filename, such as
Mercurial's "Binary file X has changed".
py-urwid: updated to 4.1.5
Urwid 4.1.5
New features
* Support async callbacks set via MainLoop if backend support
* Support async callbacks in ZMQEventLoop, make ZMQEventLoop async
* Add full palette and AttrSpec support for WEB display
* Add capital letters to thin 4x3 font
Deprecations
* Announce removal of old display import aliases
Bug fixes
* Fix screen redraw on window resize for curses display
* Implement nested popups support
Refactoring
* Optimise code and extend test coverage for Canvas classes
* Optimise BarGraph logic
py-threadpoolctl: updated to 3.7.0
3.7.0 (2026-09-15)
Fixed an intermittent OSError on Windows when DLLs are loaded or unloaded concurrently during library discovery (for example when importing conda-forge OpenCV). On Python 3.14+, discovery uses ctypes.util.dllist when available. If dllist raises OSError, threadpoolctl emits a RuntimeWarning instead of crashing so the failure can be reported upstream with a minimal reproducer. Older Pythons use a Toolhelp snapshot enumerator, with graceful per-module fallbacks.
Added the ability to check whether a limiting API affects just the current thread or the whole process. Mainly aimed at debugging and diagnostics, and somewhat unreliable, it is therefore enabled by default only for command-line usage.
Only warn about simultaneous libomp and libiomp usage on Linux, where the incompatibility is known to cause crashes.
Fixed a deadlock triggered by getting or setting MKL's number of threads from parallel threads when using MKL with libiomp (Intel threading) on Linux.
Going forward, setting the number of threads will only have a thread-local impact if feasible (for example, at minimum the underlying library must support this option, and many don't.)
For MKL, setting the number of threads is now thread-local, i.e. limiting the number of threads won't impact MKL's thread pool size when using MKL in other Python threads.
For OpenBLAS compiled with OpenMP on Linux and macOS, setting the number of threads is now thread-local, i.e. won't impact OpenBLAS thread pool size in other Python threads. On Windows behavior is likely process-wide, but this may depend on how OpenBLAS was compiled with OpenMP.
Fix OpenBLAS detection for conda package on Windows
[10 lines not shown]
py-url-normalize: updated to 3.0.1
3.0.1
Fixed
Preserve invalid UTF-8 percent-encoded octets instead of replacing them with U+FFFD; valid UTF-8 still normalizes to NFC.
Preserve percent-encoded reserved characters in paths, keeping values such as a%2Fb distinct from a/b.
Preserve encoded plus signs (%2B) in query parameters and explicit empty values such as flag=.
Normalize Unicode and unsafe characters in URL credentials while preserving encoded delimiters; correctly separate credentials containing @ from the host.
Correctly parse bracketed IPv6 hosts and ports, lowercase IPv6 addresses, and preserve zone identifier case.
Recognize long and custom URL schemes, protocol-relative URLs, and bare domains or localhost with numeric ports.
Remove leading whitespace and parser-ignored control characters before applying default domains and detecting URL schemes, preserving the intended destination.
Trim trailing authority whitespace without discarding trailing spaces or punctuation belonging to paths, query values, or fragments.
Convert hashbang fragments (#!) into a single escaped query parameter, preserving existing parameters and leaving ordinary fragments intact.
Match query parameter allowlists against normalized hosts and equivalent custom domain keys, including Unicode/Punycode aliases, case variants, and trailing dots. Exact canonical keys take precedence over aliases.
Decode IDNA host output as ASCII regardless of the charset argument.
Keep encoded backslashes and C0/C1 control characters encoded in url_humanize() output, and retain the normalized URL when a decoding candidate cannot be parsed.
Resolve query parameter allowlists once per URL to avoid repeated domain alias scans for each parameter.
[8 lines not shown]
py-curl: updated to 7.48.0
PycURL 7.48.0 - 2026-09-15
This release adds a CurlUrl object wrapping libcurl's URL API (with
CURLOPT_CURLU support), adds support for Python 3.15, adds CURL_LOCK_DATA_HSTS
as a CurlShare option, and adds support for several new libcurl options.
This release also fixes several crashes, a memory leak, and other minor
issues.
snallygaster: updated to 0.0.15
0.0.15
This release avoids the use of the beautifulsoup library.
It comes with quite regular API changes and a bunch of warnings that require complexity to deal with if one also wants to support older versions.
All HTML parsing is now done with lxml.
Furthermore, this release reworks the 404 checks and does detection of django and symfony debugging in a separate test.
py-xdg-base-dirs: updated to 6.0.3
6.0.3
Bump mypy from 1.11.2 to 1.13.0
Bump ruff from 0.7.0 to 0.7.2
Bump pytest-cov from 5.0.0 to 6.0.0
Bump codecov/codecov-action from 4.6.0 to 5.0.7
Bump ruff from 0.7.2 to 0.8.1
Bump poethepoet from 0.29.0 to 0.31.1
Bump pytest from 8.3.3 to 8.3.4
Bump mypy from 1.13.0 to 1.14.1
Bump poethepoet from 0.31.1 to 0.32.0
Bump ruff from 0.8.1 to 0.8.4
Bump codecov/codecov-action from 5.0.7 to 5.1.2
Bump ruff from 0.8.4 to 0.9.4
Bump poethepoet from 0.32.0 to 0.32.2
Bump codecov/codecov-action from 5.1.2 to 5.3.1
Migrate from Poetry to uv
[39 lines not shown]
py-propcache: updated to 0.5.4
0.5.4
Packaging updates and notes for downstreams
- Fixed the release wheels being compiled without optimization since
version 0.5.0. The build backend set ``CFLAGS`` to add
``-ffile-prefix-map``, which replaced the interpreter's own compiler
flags instead of extending them, so ``-O3`` and ``-DNDEBUG`` were
dropped; the extra flags now go through ``CPPFLAGS``, which is
appended. Cached property reads are about 1.5x faster than in 0.5.3
py-boltons: updated to 26.2.0
26.2.0
- Added [`statsutils.mode`][statsutils.mode] to return the most common value, breaking ties by first appearance
- Fixed [`setutils.IndexedSet.update`][setutils.IndexedSet.update] adding the iterables themselves instead of their elements when given multiple inputs
- Fixed [`strutils.iter_splitlines`][strutils.iter_splitlines] and [`strutils.indent`][strutils.indent] splitting dates containing ` 28` or ` 29` instead of recognizing Unicode line separators
- Added [`strutils.ellipsize`][strutils.ellipsize] for word-boundary-aware text truncation with an ellipsis
- Fixed [`funcutils.wraps`][funcutils.wraps] passing arguments positionally to wrappers that only accept them as keywords
- Fixed [`tableutils.Table.to_text`][tableutils.Table] crashes on empty tables, `None` headers, and short header rows; empty headers now render no header row, matching `to_html`
- Fixed [`timeutils.isoparse`][timeutils.isoparse] misreading fractional seconds (`.851` parsed as 851µs instead of 851000µs); >6-digit fractions now truncate instead of raising
- Fixed [`timeutils.daterange`][timeutils.daterange] looping forever on non-advancing steps: zero and self-cancelling month/day steps now raise `ValueError`, wrong-direction steps yield nothing like `range()`
- Fixed [`strutils.MultiReplace`][strutils.MultiReplace] raising `KeyError` on empty substitution maps (now a no-op)
- Fixed [`jsonutils.JSONLIterator`][jsonutils.JSONLIterator] hanging when a seek lands past the last newline, and negative `rel_seek` values seeking past EOF (sign bug)
- Fixed [`iterutils.xfrange`][iterutils.xfrange] yielding nothing for descending ranges; now shares [`frange`][iterutils.frange]'s count-based semantics, so both agree at inexact float boundaries
- Fixed [`urlutils.parse_qsl`][urlutils.parse_qsl] ignoring its `encoding` argument when decoding keys and values
- Fixed [`dictutils.OrderedMultiDict.addlist`][dictutils.OrderedMultiDict.addlist] dropping values from one-shot iterables, including the vendored copy in `urlutils`
- Fixed [`ecoutils.get_profile`][ecoutils.get_profile] looking up identifying host, username, and working-directory information when `scrub=True`
- Fixed [`namedutils.namedtuple`][namedutils.namedtuple] and [`namedutils.namedlist`][namedutils.namedlist] raising `IndexError` instead of `ValueError` for empty type and field names
[29 lines not shown]
librsvg: updated to 2.26.4
2.62.4
librsvg crate version 2.62.4
librsvg-rebind crate version 0.3.0
- Fix use-after-free when there are duplicate XML entities in
nested Xinclude documents. Thanks to Rafael B. Dias for reporting
this in detail.
- Dependency updates: lopdf for RUSTSEC-2026-0187, crossbeam-epoch for
RUSTSEC-2026-0204.
xxhash: updated to 0.8.4
v0.8.4
- perf : added RISC-V Vector extension (RVV) implementation,
- perf : added LoongArch LASX implementation and improved LSX,
- perf : prefer NEON over SVE on AArch64, improving XXH3 speed by 25-40%,
- perf : improved XXH3 streaming speed for very small updates, suggested
- api : `XXH_memcpy()`, `XXH_memset()` and `XXH_memcmp()` can be redirected at compile time
- api : new `XXH_NO_EXTERNC_GUARD` build macro for complex C++ integration
- cli : added 64-bit seed support (`-s`, `--seed`),
- cli : options can appear after filenames; `--` terminates option parsing
- cli : continue processing subsequent files after read errors,
- cli : support long and special Windows paths,
- cli : improved benchmark accuracy, error handling and unit labels,
- fix : unaligned reads could be miscompiled by GCC under strict aliasing,
- fix : `XXH_INLINE_ALL` compatibility with `XXH_NAMESPACE` and x86 runtime dispatch,
- fix : avoid including system headers inside an `extern "C"` block,
- fix : compilation with MSVC link-time optimization and warnings as errors,
- build: improved runtime dispatch detection for cross-compilation and non-x86 targets, with help from @eworm-de,
[9 lines not shown]
devel/ocamlbuild: Fix latent bug of not depending on ocamlfind
This package, probably unique among ocaml-foo, not only uses ocamlfind
(more or less ocaml's pkg-config): at build time, but, being a build
tool, also offers a way for callers to use it at run time. There was
no explicit dependency on ocamlfind, and correct operation was riding
on the happenstance full dep on ocamlfind recently removed in general
from ocaml modules.
py-coverage: updated to 7.16.1
7.16.1 — 2026-09-13
- Fix: when the body of an irrefutable ``case`` (like ``case _:``) is entirely
excluded, the ``case`` line is now excluded too, just as an excluded
``else:`` body removes the ``else:`` line. Previously the ``case`` line was
left behind and reported as missing. Closes `issue 1563`_ with `pull 2269`_.
- Fix: using :meth:`.CoverageData.update` twice on an in-memory database would
fail, as described in `issue 2279`_. This is now fixed.
py-flake8: updated to 7.4.0
7.4.0
Drop support for python 3.10
pycodestyle has been updated to >= 2.15.0, < 2.16.0
Pyflakes has been updated to >= 4.0.0, < 4.1.0
Added support for python 3.15
py-flakes: updated to 4.0.0
4.0.0 (2026-09-22)
Add support for python 3.15
Drop support for EOL python 3.9
Add new errors for lazy imports:
lazy import is eagerly used at module scope
lazy from ... import * is invalid syntax
lazy from __future__ import ... is invalid syntax
lazy import must be at module scope
Improve typing specialization:
Handle cast(...) with named arguments
Fix duplicate errors in first argument of cast(...)
Handle TypeVar(... default='...')
Fix missing error for first argument of TypeVar(...) call
Update handling of NamedTuple(...) for python 3.15 changes
Update handling of TypedDict(...) for python 3.13 changes
Add handling of assert_type(...)
[8 lines not shown]
