libtatsu: update to 1.1.0.
Version 1.1.0
~~~~~~~~~~~~~
Changes:
- Add tss_request_add_bora_tags() and tss_request_add_durant_tags() to the API
- Update auth client version and add Ap,Timestamp to requests
- Restrict Yonkers tag selection to SysTopPatch
Fixes:
- Handle realloc() failure in tss_write_callback()
devel/ruby-activesupport81: add version 8.1.4.1
Active Support -- Utility classes and Ruby extensions from Rails
Active Support is a collection of utility classes and standard library
extensions that were found useful for the Rails framework. These additions
reside in this package so they can be loaded as needed in Ruby projects
outside of Rails.
This is for Ruby on Rails 8.1.
libplist: update to 2.8.1.
Version 2.8.1
~~~~~~~~~~~~~
- Changes:
* bplist: Use length-based range checks for object data
* bplist: Limit the total number of parsed nodes to prevent memory
exhaustion from crafted reference expansion
* bytearray: Grow the buffer geometrically to avoid quadratic appends
(fixes a timeout when writing large plists)
* Harden allocation failure handling and size arithmetic across the
parsers, writers and containers
* Add tests for the binary plist parser behavior
- Bugfixes:
* Fix use-after-free in plist_copy_node() when the stack is reallocated
* Fix double-free in node_from_xml() error paths
* Fix memory leak in xplist when adding a node to its parent fails
[12 lines not shown]
inih: update to 63.
This release fixes a few minor bugs, adds two new minor features:
exposes INI_MAX_SECTION and INI_MAX_NAME as "public settings, and
adds a new error code (-3) for file read errors.
fzf: update to 0.75.0.
Added {change,transform,bg-transform}-info-command actions (#4951) (@casperdcl)
seq 100 | fzf --info-command 'echo "mode: A | $FZF_INFO"' \
--bind 'ctrl-a:change-info-command:echo "mode: A | $FZF_INFO"' \
--bind 'ctrl-b:change-info-command:echo "mode: B | $FZF_INFO"'
transform-nth and transform-with-nth (and their bg- variants) no longer split the output at |
Only change-nth and change-with-nth rotate through |-separated values
Fixed the bound command being replaced with the output. e.g. With transform-nth(echo '1|2'), the next key press ran 2|1 as a shell command.
A --with-nth template in the output can now contain |. e.g. {2}|{1} was cut to {2}.
change-nth and transform-nth now handle empty and invalid values the same way as change-with-nth and transform-with-nth
An empty value restores the default --nth. Previously, change-nth() and an empty transform-nth output searched all fields. Use change-nth(..) for that.
A non-empty invalid value is ignored. Previously, it restored the default --nth.
[33 lines not shown]
devel/openvdb: import openvdb-13.0.0
OpenVDB is an open source C++ library comprising a novel hierarchical
data structure and a large suite of tools for the efficient storage
and manipulation of sparse volumetric data discretized on
three-dimensional grids. It was developed by DreamWorks Animation
for use in volumetric applications typically encountered in feature
film production.
aklomp-base64: update to 0.5.3.
A point release that mainly fixes issues with codec selection. Most important changes:
#135: bin/base64: add command line options
#139: bin/base64: set active codepage to UTF-8 on Windows
#136: force inline functions that need to be inlined for performance
#143: fix a bug in AVX512 platform detection
#150: add NEON support on Windows ARM64
#162: fix OpenMP detection with CMake for static builds
#163: fix a bug when forcing the AVX512 decoder
OpenJPH: update to 0.33.0.
What's Changed
Fix ends of the encoding LUT of LUT-style NLTs by @palemieux in #376
Fix comment on ft_min and ft_max in nlt_rec by @michaeldsmith in #378
Group CodeQL GitHub Actions bumps in Dependabot by @cary-ilm in #385
Bump github/codeql-action/autobuild from 4.38.0 to 4.38.1 by @dependabot[bot] in #382
Bump github/codeql-action/init from 4.38.0 to 4.38.1 by @dependabot[bot] in #381
Bump github/codeql-action/analyze from 4.38.0 to 4.38.1 by @dependabot[bot] in #380
Bump the codeql group with 2 updates by @dependabot[bot] in #386
Issues/0377 implement nonuniformly sampled inverse lut by @michaeldsmith in #379
Fix heap buffer overflow in OpenJPH NLT marker parsing by @cary-ilm in #384
Fix null-pointer dereference in DFS-index lookup by @cary-ilm in #383
Bump the codeql group with 3 updates by @dependabot[bot] in #387
Bump uraimo/run-on-arch-action from 3.2.0 to 3.2.1 by @dependabot[bot] in #394
Bump msys2/setup-msys2 from 2.32.0 to 2.33.0 by @dependabot[bot] in #393
Work around MSVC x86 internal compiler error in the AVX2 encoder by @Kiptoo-Deus in #395
Revert "Bump msys2/setup-msys2 from 2.32.0 to 2.33.0" by @aous72 in #400
[13 lines not shown]
www/ruby-rails80: update to 8.0.5.2
Update Ruby on Rails 8.0.x to 8.0.5.2.
8.0.5.2 (2026-11-04)
Including these security fixes.
* GHSA-f3w6-w445-fwh9 Possible arbitrary file write and read in Active
Storage image analysis (Critical)
* GHSA-v924-7rp8-4mxh Possible arbitrary file read and remote code execution
in Active Storage video previews, analysis and image processing (High)
* GHSA-wm3x-v3qw-4jh3 Possible Strong Parameters bypass in
Parameters#each_key in Action Pack (High)
* GHSA-8474-xrp6-wh69 Possible DoS vulnerability in Active Support
safe_constantize (High)
[45 lines not shown]
chromium: update to 157.0.8103.38
* 157.0.8103.38
This update includes 213 security fixes. Please see the Chrome Security Page for more information.
[$10,000][567735302] Critical CVE-2026-121156: Buffer overflow in Dawn. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-09-30
[$1,000][562777838] Critical CVE-2026-121229: Memory corruption in ANGLE. Reported by @mfx on 2026-09-17
[N/A][558870371] Critical CVE-2026-121246: Use after free in WebGL. Reported by Google on 2026-09-08
[N/A][567216197] Critical CVE-2026-121035: Use after free in Prerender. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28
[N/A][569161611] Critical CVE-2026-121247: Buffer overflow in Dawn. Reported by Google on 2026-10-03
[N/A][571065824] Critical CVE-2026-121203: Use after free in Geometry. Reported by Xinyang Ge on 2026-10-07
[N/A][571284308] Critical CVE-2026-121126: Use after free in Core. Reported by Wenbin Liu on 2026-10-08
[$10,000][485855931] High CVE-2026-121107: Incorrect authorization in BackgroundFetch. Reported by Johan Carlsson on 2026-02-19
[$2,000][566398391] High CVE-2026-121197: Out of bounds read in ANGLE. Reported by Arni Hardarson (Neonix Security) on 2026-09-26
[N/A][40063728] High CVE-2026-121112: Out of bounds read in Permissions. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2023-03-22
[N/A][496008447] High CVE-2026-121174: Missing authorization in BackgroundFetch. Reported by Google on 2026-03-25
[N/A][516958782] High CVE-2026-121098: Improper state validation in GPU. Reported by Google on 2026-05-27
[N/A][536617330] High CVE-2026-121074: Memory corruption in GPU. Reported by Google on 2026-07-19
[200 lines not shown]
graphics/opensubdiv: import opensubdiv-3.7_0
OpenSubdiv is a set of open source libraries that implement high
performance subdivision surface (subdiv) evaluation on massively
parallel CPU and GPU architectures. This codepath is optimized for
drawing deforming subdivs with static topology at interactive
framerates. The resulting limit surface matches Pixar's Renderman
to numerical precision.
