resterm: Update to 1.18.0
Secret masking in resterm run
Include responses in JSON reports
History
A skill for coding agents
Safer collection --force
OAuth
Cleaner error messages
TUI fixes
Documentation fixes
fd-find: update to 10.5.2.
Fix invalid syntax in zsh completions. See #2216
Write raw bytes instead of replacing them with U+FFFD when --format output goes to a pipe, so filenames that are not valid UTF-8 reach downstream tools unchanged; see #2189.
p5-Sereal*: update to 7.001
7.001
* Read protocol versions 1 through 7. Decode portable little-endian
v7 floats, including IEEE binary128 on Perl builds without
quadmath, converting values to the local NV type.
* Validate v7 native long-double declarations and reject known
format, byte-order and size mismatches. Add
allow_unknown_long_double for explicitly trusted same-build reads
of unidentified layouts; storage sizes must still match.
* Preserve native floating-point behavior for protocol v1-v6 input.
Add legacy_float_byteorder for older data with a known source byte
order.
* Include protocol v6 v-string and negative-integer support, keyed
SipHash verification, checksum keys, modes, policies and defaults.
Add prepare_checksum_key(), get_sereal_checksum() and
validate_sereal_checksum().
* Restore regexp character-set modifiers, /n and /xx, and report the
required Perl version for unsupported modifiers.
[15 lines not shown]
p5-Mozilla-CA: update to 20261105.
20261105
- Include metadata with certificates in bundle file
- Update from Mozilla repository to 2026-11-05
- Removed certificates:
- emSign ECC Root CA - C3
sha256: bc4d809b15189d78db3e1d8cf4f9726a795da1643ca5f1358e1ddb0edc0d7eb3
- emSign Root CA - C1
sha256: 125609aa301da0a249b97a8239cb6a34216f44dcac9f3954b14292f2e8c8608f
sysutils/psmisc: Fix a PLIST issue that happens when po4a is installed
When textproc/po4a is installed, psmisc generates and installs a bunch of
translated man pages, and our PLIST isn't happy with that.
p5-SQL-Abstract: update to 2.000003.
2.000003 - 2026-11-06
- SECURITY, CVE-2026-121265: generate() (and so AUTOLOAD with
allow_autoload) also treats an arrayref in its hashref or arrayref
as one bind value. 2.000002 fixed only insert(), update() and
values(): generate('update t', { name => [ "(SELECT ...)" ] })
still gave UPDATE T SET name = (SELECT ...). \[ $sql, @bind ] is
literal SQL in generate() too; array_datatypes => 0 restores the
old behaviour.
- every module has a $VERSION, the same as SQL::Abstract
2.000002 - 2026-11-05
- SECURITY, CVE-2026-121265: array_datatypes is on by default, so an
arrayref as a column value in insert() or update() (and values())
is one bind value. Before, it was literal SQL and its first element
went into the SQL text: a JSON array or a repeated form field like
{ name => [ "x, is_admin = 1" ] } gave
UPDATE t SET name = x, is_admin = 1. Literal SQL is
[170 lines not shown]
qt6: update comment
qt6 needs recursive bumps for _every_ version change, not only major
versions, otherwise we see
/usr/pkg/qt6/lib/libQt6Svg.so.6: Undefined PLT symbol "_ZN14QObjectPrivateC2E16QtPrivate_6_11_2" (symnum = 958)
www/ruby-rack-test: update to 2.3.0
2.3.0 (2026-10-21)
Bug fixes:
* Do not mutate arguments given to Rack::Utils.build_multipart (Oskar
Eichler #361)
* Rewind tempfile if there are errors when appending in
UploadedFile#append_to (Oskar Eichler #363)
* Preserve request method and params for 308 redirects (requires Rack 2+)
(Oskar Eichler #364)
* Reuse rack.input in 307/308 redirect request if it is rewindable, fixing
cases that use application/json and other content types (Oskar Eichler
#367)
[8 lines not shown]
www/ruby-rack2: update to 2.2.25
2.2.25 (2026-10-30)
Security
* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
buffer, allowing denial of service via memory exhaustion.
* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
unnormalized path, allowing dot segments to bypass them.
* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
parameter were accepted when the first value was empty or began with a
quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
Fixed
* Multipart parser: scan boundary lines with a literal newline search
[3 lines not shown]
www/ruby-rack: update to 3.2.8
3.2.8 (2026-10-30)
Security
* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
buffer, allowing denial of service via memory exhaustion.
* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
unnormalized path, allowing dot segments to bypass them.
* GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url
returned the raw authority when it was invalid; host_with_port now returns
nil in that case.
* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
parameter were accepted when the first value was empty or began with a
quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
[6 lines not shown]
