grafana: update to 13.2.0
CVE-2026-17183
An authenticated organization user who can create or edit alert rules
in a folder can query a datasource for which they do not have
datasources:query permission.
grafana: update to 13.1.3
pkgsrc change:
This update disables support for sqlite as storage backend on most
platforms because grafana has switched to a sqlite driver that is
very difficult to support in a generic manner in pkgsrc.
(It needs transpiled code shipped by the upstream for every
MACHINE_PLATFORM.)
On such a platform you can use PostgreSQL instead.
Other major breaking changes since 11.x:
Angular plugin support is fully removed
Data source UID enforcement
Upgrading rewrites the whole annotation table; budget 2–3x its size
React 19. Update all plugins before upgrading, or they may break
Folders and dashboards migrate off legacy SQL tables on startup
grafana-cli and grafana-server are removed (use grafana cli / grafana server)
Image Renderer no longer supported as a plugin (run it as a separate service)
Dashboards migrate to schema v2 automatically when opened
rumdl: update to 0.2.58.
0.2.58
Added
wasm: load extends chains from embedder-supplied config files (e7c7d8f)
0.2.57
Fixed
MD013: let a sentence open with a number under require-sentence-capital (5060333)
lsp: keep a CRLF document's line endings through fixes and code actions (c88a7da)
py-json-logger: updated to 4.2.0
4.2.0
Changed
Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict.
Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735).
Fixed
$ style formats now support unbraced $name fields, not just ${name}
py-flask-security: updated to 5.8.2
5.8.2
Fixes
- (:pr:`1265`) Fix for GHSA-f66q-9rf6-8795 - WebAuthn reauthentication freshness bypass. (tonghuaroot)
- (:issue:`1263`) :py:data:`SECURITY_CACHE_CONTROL` directives were added to every
application response instead of just responses from Flask-Security endpoints
as documented. (Ceirced)
- (:issue:`1212`) Newly introduced :py:meth:`.UserMixin.is_locked` logic is inverted.
- (:issue:`1244`) Fix login form remember me checkbox.
Backwards Compatibility Concerns
- The fix for the inverted `is_locked` logic will require any application using it
to invert their logic.
luanti: update to 5.17.0
Client / Audiovisuals
- Dropdowns now accept selection by (Mouse) Down -> Drag -> Release
- Formspecs no longer close when focusing the window
- Fix: Formspec model[] elements are again animated
- Implement basic gamepad support for in-game actions (not formspecs)
- Support multi-track animations (glTF models)
- Fixed an case where the held item stack (e.g. when dragging) size
was no longer displayed correctly
- The mouse cursor is no longer clamped to window bounds
- Shaders: Fix plants flickering when visual_scale > 1
- Chat: Pressing the Tab key now autocompletes to the next common
part of the player name
- The (main menu) progress bar now shows more media download details
- Formspec: Inventory slots and buttons now stay hovered on update
- Main menu: Mods are now sorted by their technical name (before:
directory name)
- Mostly fix the appearance of waving liquids (shader) below solid
[38 lines not shown]
chromium: update to 151.0.7922.173
* 151.0.7922.173
This update includes 7 security fixes. Please see the Chrome Security Page for more information.
[N/A][522819252] Critical CVE-2026-76017: Use after free in Chromoting. Reported by Google on 2026-06-11
[N/A][513757918] High CVE-2026-76018: Privilege elevation in Import. Reported by Google on 2026-05-16
[TBD][539032888] High CVE-2026-76019: Incorrect authorization in Workers. Reported by Anonymous on 2026-07-26
[TBD][541837151] High CVE-2026-76020: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-03
[N/A][541854084] High CVE-2026-76021: Use after free in DOM. Reported by Google BigSleep at Grape on 2026-08-02
[TBD][543798025] High CVE-2026-76022: Buffer overflow in Network. Reported by 0xAlessandro on 2026-08-07
[TBD][545124048] High CVE-2026-76023: Improper resource control in Linux Toolkit Theming. Reported by Keita Sode and Daisuke Hatakeyama of SYZD Research on 2026-08-11
* 151.0.7922.169
This update includes 15 security fixes. Please see the Chrome Security Page for more information.
[N/A][534923522] Critical CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15
[N/A][540087398] Critical CVE-2026-76036: Buffer overflow in Dawn. Reported by Google on 2026-07-28
[N/A][516715010] High CVE-2026-76033: Inappropriate implementation in CORS. Reported by Google on 2026-05-26
[12 lines not shown]
lang/nodejs: revert fix
After a discussion with wiz@ and some extended testing, it turns out
that the build fix for {macOS,NetBSD}/amd64 related to c-ares appears to
no longer be necessary. The pull-up request #7242 issued for lang/nodejs
version 26.3.1 (as per pkgsrc-2026Q2) remains relevant and correct
though, per my analysis of the issue.
Tested on NetBSD/amd64 (11.0_RC6)
py-ruff: updated to 0.16.4
0.16.4
Preview features
[flake8-use-pathlib] Add autofix for PTH116
[refurb] Restrict delete-full-slice to lists (FURB131)
[refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor
Bug fixes
Fix InvalidInstruction on Windows CPUs that do not support POPCNT
[pyflakes] Emit semantic syntax errors in string type definitions as F722
[pylint] Allow os._exit imports in import-private-name (PLC2701)
Rule changes
[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14
[13 lines not shown]
py-zmq: updated to 27.2.0
27.2 is a small release, mostly updating the build process and typing.
Lots of new type coverage.
- Add `python3 -m zmq.curve_keygen` entrypoint for creating curve key pairs
- Require Python 3.9 (drops Python 3.8)
- Stop building wheels for free-threaded CPython 3.13 (cp313t)
- Add wheels for free-threaded CPython 3.15 (cp315t)
- Fix builds on Windows with Visual Studio 2026
- Fix builds with upcoming Cython release
- Add more type coverage, fix some typing, typing compatibility with mypy 2.1
py-mcomix: update to 3.2.0.
### Bug fixes
- Adapt keybinding handling to changed API of Gtk.accelerator_parse
in newer versions of Gtk. This fixes broken keybindings.
- The pytest package needed for running MComix' unit tests is now
installed when installing the `dev` dependency group.
### Features
- MComix now respects the XDG Thumbnail Directory specification (again),
and will store thumbnails relative to XDG_CACHE_HOME instead of
relative to the home directory on UNIX systems. Nothing changes
on Windows. Note: Existing thumbnails in the former cache directory
($HOME/.thumbnails) are not moved automatically by this update.
- Added new sort order option (GLib order) that uses GTK collate keys
when computing file order.
filezilla: update to 3.71.0.
3.71.0 (2026-08-19)
+ FTP(S), SFTP: Entering an empty path in the remote path edit field now returns back to the initial home directory
- FTP(S): Fix parsing of permissions for chmod dialog on servers that include both perms and unix.mode facts in MLSD output
- SFTP: Updated fzssh to 1.4.0 to support additional algorithms and key file formats
- Official binaries are now linked against wxWidgets 3.2.11
- FTP(S): Fixed parsing of paths on servers with the server type set to DOS. Some malformed paths were wrongly accepted, confusing the engine; such paths are now rejected early.
- Refactored engine internals to remove influences from FTP-specific concepts that were permeating into other protocols
