weechat: Update to 4.10.0
This is a new feature and security release that includes a deluge
of fixes, some of which might be security relevant (e.g. in irc
and relay protocol support).
lazygit: updated to 0.64.1
0.64.1
Fix transitions of entering and exiting filtering mode (e.g. by path or author)
Fix race in "Stash staged changes" on git versions before 2.35.0
Fix several problems with repos whose git dir lives outside the working tree
Update the UI after stash operations in a single frame
Honor the conflict-marker-size gitattribute
Fix hang on quit when confirmOnQuit is true
Fix pull requests silently disappearing until lazygit is restarted
shells/oh-my-posh: update to 30.6.5
Bug Fixes
pwsh: emit ASCII-safe init output for non-ASCII paths (e458c6e)
serve: forward the full environment to the streaming daemon (4709f3e), closes #7792
status: end segments correctly (3c2976d)
devel/gitpane: update to 0.10.4
[0.10.4] - 2026-08-12
Added
A repository focus mode, toggled with f, dims repositories other than the selected one while keeping the selected repository's worktree and stash rows bright. The help overlay now stays within the terminal when showing the additional command.
Fixed
A–Z and Z–A sorting now remains stable when watcher-driven discovery runs. Pinned and nested repositories no longer jump back to scanner basename order several seconds after an explicit sort.
Repository discovery now preserves the selected repository when the discovered set changes instead of moving the selection to the first row.
Stash messages remain readable in focus mode instead of using the same hardcoded gray appearance as dimmed rows.
Updated lru to 0.18.2 to address RUSTSEC-2026-0253, a potential use-after-free in LruCache::pop() inherited through ratatui.
py-unearth: updated to 0.18.3
0.18.3
Features
cli: Download packages without unpacking
Bug Fixes
Update actions/checkout and setup actions to v6
Support packaging 26.0 changes
Prevent tar-slip via path traversal and symlink escape in _untar_archive
Complete path traversal protection by replacing os.makedirs with safe_makedirs
py-progressbar2: updated to 4.6.0
4.6.0
Performance
progressbar.progressbar() now auto-dispatches to a lean fast path for the common wrap-a-loop case, and an integer update gate keeps gated iterations to an increment, a compare and a store
Optional native iterator accelerator: pip install 'progressbar2[fast]'. See benchmarks/report.md for the numbers against tqdm, rich, alive-progress and click.
Features
tqdm-style arguments on progressbar(): desc, total, unit, unit_scale and postfix.
MultiBar(join_timeout=...) bounds the wait for unfinished bars on with-block exit.
TERM-based color detection generalized beyond xterm variants
AttributeDict is generic over its value type.
Fixes
28 bugs found in a full audit of the bar, widgets, MultiBar and the CLI
[12 lines not shown]
py-zensical: updated to 0.0.54
0.0.54
This version reduces peak memory usage by 8–10x, making builds of large
documentation projects substantially more efficient. It also improves reference
validation by preventing false positives for links successfully resolved
through autorefs.
Additionally, the user interface is updated to v0.0.25, fixing instant
navigation for inline scripts and version aliases created with mike. This
release also corrects mike configuration defaults and updates webbrowser to
address a security vulnerability.
py-pyphen: updated to 0.18.0
0.18.0
Update Spanish, Hungarian, Lithuanian and Danish dictionaries.
Keep README files updated with dictionaries.
Include __init__ method in Pyphen API documentation.
Support Python 3.14, drop Python 3.9 support.
py-ruff: updated to 0.16.3
0.16.3
Preview features
[pylint] Fix false negatives on negative numbers (PLR6104)
[pyupgrade] Add rule to replace while 1 with while True (UP048)
Bug fixes
[flake8-bandit] Also check keyword arguments (S602, S603, S607, S609)
[pylint] Allow continue in finally on Python 3.8
[pylint] Fix PLE1307 false positive with bools
[pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307)
[pylint] Improve handling of concatenated strings (PLE1300)
Rule changes
[21 lines not shown]
libgit2: updated to 1.9.7
v1.9.7
This is an security release with one change.
* Escape remote repository paths in libssh2
In v1.9.2, we started escaping repository paths in the OpenSSH-based
exec ssh transport. Bring the same escaping to the libssh2 transport
to avoid any potential command injection.
resterm: Update to 1.0.0
Changelog
Within the 1.x line:
* Request file directives keep their names, arguments and meaning.
* Existing CLI flags keep their meaning.
* Headless output keeps its JSON field names, JUnit structure and exit codes.
* Configuration keys (bindings, themes, settings) keep working.
* The headless Go package keeps its exported API.
* RestermScript keeps its syntax, builtins and host objects.
More information: https://github.com/unkn0wn-root/resterm/releases/tag/v1.0.0
devel/scons4: Add request not to update to 4.11
pending scons/gpsd figuring out between them why 4.11 breaks the gpsd
build -- with an inscrutable stack trace, the gold standard for python
errors!
devel/guile30-slib: Catch up with slib version in variable
This is kind of pointless, but choose consistency over thinking about
the real problem for now.
privoxy: update to 4.2.0.
Provided by Stepan Ipatov in pkgsrc-wip.
Privoxy 4.2.0 fixes a couple of bugs and brings general improvements
such as support for elliptic-curve keys.
Two potential security problems have been reported and addressed.
