py-django: updated to 6.1.3
Django 6.1.3 fixes five security issues with severity “low”, one security issue
with severity “moderate”, and several bugs in 6.1.2. It also adds compatibility
with Python 3.15.
p5-CGI: update to 5.02.
5.02 2026-11-03
[ RELEASE NOTES ]
- this is a security release fixing a large number of vulnerabilities,
several of them exploitable by any client against any script. all
users should upgrade
- to fix them some default behaviour has changed, see BREAKING CHANGES
below - most changes only affect malicious or malformed requests, but
please read them before upgrading. where a change could reasonably
affect a legitimate application an opt out or migration path is given
- the minimum *supported* perl version is now 5.10, however the dist
will still install for 5.8 (no guarantees about tests passing however)
[ SECURITY ]
- denial of service:
- CVE-2026-120631: CGI::Cookie->parse (and so CGI->cookie) used a
client supplied cookie expires value as a regex, so a Cookie header
[123 lines not shown]
py-dns: updated to 2.9.2
2.9.2
A maliciously crafted zone file could use a WKS record to consume excessive
memory and CPU, possibly causing the process to exit due to memory exhaustion.
adguardhome: updated to 0.107.80
0.107.80
Security
Go version has been updated to mitigate the possibility of exploiting the Go vulnerabilities fixed in 1.27.3.
Support for Multipath TCP has been disabled to mitigate the possibility of exploiting the vulnerability described in CVE-2026-98432.
security/pkcs11-provider: Wire up tests to softhsm and nss softokn.
Otherwise they don't really test anything! Need at least one PKCS#11
library to test this with. softhsm and softokn from nss are the two
ones supported by the pkcs11-provider tests that I found in pkgsrc;
another, kryoptic, is not currently packaged (and pulls in Rust), so
I left it out for now.
With this, I get:
> Ok: 55
> Fail: 0
> Skipped: 71
py-msgpack: update to 1.2.4 (security)
Also allow this version in py-borgbackup, following upstream.
1.2.3
- Fix memory leaks in the C extension when map key validation or
container hooks fail. See GHSA-j586-36cw-2gc2.
- wheels: also build for pyodide using emscripten
- Support packing Python 3.15 frozentdict (PEP 814)
- Reject negative array and map header sizes
1.2.4
- fallback: pass object_pairs_hook a list of pairs
- fallback: leave the object unread when a header type does not match
- fallback: return bytes from Unpacker.read_bytes
- dependency updates
Updated sysutils/xenkernel420 to 20261103
Updated sysutils/xentools420 to 20261103
Updated sysutils/xenstoretools to 20261103
Updated sysutils/xenkernel418 to 20261103
Updated sysutils/xentools418 to 20261103
misc/libreoffice: Update to 26.8.2.2
Changelog:
26.8.2.2:
Bugs fixed compared to 26.8.1 RC1:
ofz#528260798 out-of-memory [Xisco Fauli]
tdf#106359 Support for Web Query (.iqy) files [Caolán McNamara]
tdf#144175 Remove strings from l10n in html export [Julien Nabet]
tdf#150754 GtkCheckMenuItem shows no check mark on macOS (GtkRadioMenuItem does) [Dan Williams]
tdf#154463 AutoCorrect (multiple characters => 1 character) in Text Form Field crashes Writer [Andreas Heinisch]
tdf#162752 Writer freezes when entering the menu "Character..." of a rich text or plain text control element while it is fully selected [Justin Luth]
tdf#167472 Issues with some template names [Laurent Balland]
tdf#168461 I am receiving error when calling Libre Office 25.8.1.1, (PYTHONHOME var?) [Neil Roberts]
tdf#168910 White lines across the image when scrolling [Jonathan Clark]
tdf#169219 Frame with relative size and anchored to page changes size when opening properties. [Justin Luth]
tdf#169387 Error after upgrading LibreOffice (PYTHONHOME var?) [Neil Roberts]
tdf#169697 Can't hear audio in presentations anymore (Windows) [Jonathan Clark]
tdf#170177 Add options to limit hyphenation 1) if it is too close to the right constituent boundary and 2) only at constituent boundaries [László Németh]
[69 lines not shown]
