go: update to 1.25.13 and 1.26.5 (security)
These releases include 10 security fixes following the security policy:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
[117 lines not shown]
sysutils/xplr: update to 1.1.1
What's Changed
fix(search): fixed a bug that caused results to reshuffle during search.
other(search): xplr search will default to the default skim algorithm.
Others:
deps: upgraded dependencies.
docs: fix nonexistent util function in upgrade guide by @latent-9 in #777
ubuntu(snap): @mikoloism helped fix Ubuntu snap build.
sysutils/dua-cli: update to 2.42.1
v2.42.1
*the same as 2.42, and:
Starting directories with a large amount of files, like 50k, now see a 5x speedup on macOS and Windows as bulk-reading is also done there. Note also that this is still a small absolute difference, 100ms vs 500ms, but a good demonstration of how much large trees with a lot of such directories will benefit by this, as these small absolute improvements accumulate.
v2.42.0
The headline or this release is ~30% better traversal performance on macOS due to the usage of bulk-metadata APIs on supported filesytems.
Bug Fixes
sanitize control characters in marked path output
dua-cli's interactive TUI is built on ratatui, which protects the
paths it renders on screen. But marking a file for deletion and then
quitting prints that file's path directly to the terminal after the
TUI has already released terminal control, bypassing ratatui's
protective rendering entirely. A scanned file's name has no character
restrictions, so a crafted file name can inject terminal escape
sequences into the printed path.
[4 lines not shown]
resterm: Update to 1.1.0
Changelog
Path completion
Resterm now shows matching files and directories in the open and save dialogs, and while entering supported commands.
libxml2: update to 2.15.3.
From Showta Ishizaki in PR 60591.
v2.15.3: Apr 15 2026
### Security
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
### Improvements
- schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
- xmlreader: propagate reader resource loaders to validator parsers
- python: Make python bindings python2 compatible
[44 lines not shown]
www/gitea: update to 1.27.2
Changes in 1.27.2:
* SECURITY
- Fix: update collaborator access mode and httpsign
- Refactor: external render
- Fix(actions): resolve pull_request_target reusable workflows at the
base commit
- Refactor: markup render
- Fix(deps): update dependency mermaid to v11.16.1
- Fix(auth): set WebAuthn user verification per request
- Fix: render highlight language
* ENHANCEMENTS
- enhance: add missing npm package metadata properties
* BUGFIXES
- fix(actions): keep github.event.inputs as strings for
workflow_dispatch
- fix(actions): let a rerun of selected jobs read the previous
[419 lines not shown]
pkg-vulnerabilities: CVE-2025-69720 was fixed in ncurses-6.6
According upstream NEWS it was fixed in 20251213 and 6.6 was released
on 20251230.
Reported via PR pkg/60589 from Showta Ishizaki, thanks!
ca-certificates: Update to 20260601
ca-certificates (20260601) unstable; urgency=medium
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
[18 lines not shown]
