luanti: update to 5.17.0
Client / Audiovisuals
- Dropdowns now accept selection by (Mouse) Down -> Drag -> Release
- Formspecs no longer close when focusing the window
- Fix: Formspec model[] elements are again animated
- Implement basic gamepad support for in-game actions (not formspecs)
- Support multi-track animations (glTF models)
- Fixed an case where the held item stack (e.g. when dragging) size
was no longer displayed correctly
- The mouse cursor is no longer clamped to window bounds
- Shaders: Fix plants flickering when visual_scale > 1
- Chat: Pressing the Tab key now autocompletes to the next common
part of the player name
- The (main menu) progress bar now shows more media download details
- Formspec: Inventory slots and buttons now stay hovered on update
- Main menu: Mods are now sorted by their technical name (before:
directory name)
- Mostly fix the appearance of waving liquids (shader) below solid
[38 lines not shown]
chromium: update to 151.0.7922.173
* 151.0.7922.173
This update includes 7 security fixes. Please see the Chrome Security Page for more information.
[N/A][522819252] Critical CVE-2026-76017: Use after free in Chromoting. Reported by Google on 2026-06-11
[N/A][513757918] High CVE-2026-76018: Privilege elevation in Import. Reported by Google on 2026-05-16
[TBD][539032888] High CVE-2026-76019: Incorrect authorization in Workers. Reported by Anonymous on 2026-07-26
[TBD][541837151] High CVE-2026-76020: Race condition in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-03
[N/A][541854084] High CVE-2026-76021: Use after free in DOM. Reported by Google BigSleep at Grape on 2026-08-02
[TBD][543798025] High CVE-2026-76022: Buffer overflow in Network. Reported by 0xAlessandro on 2026-08-07
[TBD][545124048] High CVE-2026-76023: Improper resource control in Linux Toolkit Theming. Reported by Keita Sode and Daisuke Hatakeyama of SYZD Research on 2026-08-11
* 151.0.7922.169
This update includes 15 security fixes. Please see the Chrome Security Page for more information.
[N/A][534923522] Critical CVE-2026-76034: Buffer overflow in WebGL. Reported by Google on 2026-07-15
[N/A][540087398] Critical CVE-2026-76036: Buffer overflow in Dawn. Reported by Google on 2026-07-28
[N/A][516715010] High CVE-2026-76033: Inappropriate implementation in CORS. Reported by Google on 2026-05-26
[12 lines not shown]
lang/nodejs: revert fix
After a discussion with wiz@ and some extended testing, it turns out
that the build fix for {macOS,NetBSD}/amd64 related to c-ares appears to
no longer be necessary. The pull-up request #7242 issued for lang/nodejs
version 26.3.1 (as per pkgsrc-2026Q2) remains relevant and correct
though, per my analysis of the issue.
Tested on NetBSD/amd64 (11.0_RC6)
py-ruff: updated to 0.16.4
0.16.4
Preview features
[flake8-use-pathlib] Add autofix for PTH116
[refurb] Restrict delete-full-slice to lists (FURB131)
[refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor
Bug fixes
Fix InvalidInstruction on Windows CPUs that do not support POPCNT
[pyflakes] Emit semantic syntax errors in string type definitions as F722
[pylint] Allow os._exit imports in import-private-name (PLC2701)
Rule changes
[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14
[13 lines not shown]
py-zmq: updated to 27.2.0
27.2 is a small release, mostly updating the build process and typing.
Lots of new type coverage.
- Add `python3 -m zmq.curve_keygen` entrypoint for creating curve key pairs
- Require Python 3.9 (drops Python 3.8)
- Stop building wheels for free-threaded CPython 3.13 (cp313t)
- Add wheels for free-threaded CPython 3.15 (cp315t)
- Fix builds on Windows with Visual Studio 2026
- Fix builds with upcoming Cython release
- Add more type coverage, fix some typing, typing compatibility with mypy 2.1
py-mcomix: update to 3.2.0.
### Bug fixes
- Adapt keybinding handling to changed API of Gtk.accelerator_parse
in newer versions of Gtk. This fixes broken keybindings.
- The pytest package needed for running MComix' unit tests is now
installed when installing the `dev` dependency group.
### Features
- MComix now respects the XDG Thumbnail Directory specification (again),
and will store thumbnails relative to XDG_CACHE_HOME instead of
relative to the home directory on UNIX systems. Nothing changes
on Windows. Note: Existing thumbnails in the former cache directory
($HOME/.thumbnails) are not moved automatically by this update.
- Added new sort order option (GLib order) that uses GTK collate keys
when computing file order.
filezilla: update to 3.71.0.
3.71.0 (2026-08-19)
+ FTP(S), SFTP: Entering an empty path in the remote path edit field now returns back to the initial home directory
- FTP(S): Fix parsing of permissions for chmod dialog on servers that include both perms and unix.mode facts in MLSD output
- SFTP: Updated fzssh to 1.4.0 to support additional algorithms and key file formats
- Official binaries are now linked against wxWidgets 3.2.11
- FTP(S): Fixed parsing of paths on servers with the server type set to DOS. Some malformed paths were wrongly accepted, confusing the engine; such paths are now rejected early.
- Refactored engine internals to remove influences from FTP-specific concepts that were permeating into other protocols
fzssh: update to 1.4.0.
1.4.0 (2026-08-18)
+ Added auth_password_change_request_event
+ Added support for ssh-ed448 keys
+ Added support for umac-128-etm at openssh.com and umac-64-etm at openssh.com MAC algorithms
+ Added support for aes128-gcm at openssh.com encryption algorithm
+ Support additional algorithms for encrypted private key files
+ Support loading of private keys from pkcs#7 (.pfx) files
- Fix building fzssh with Nettle >= 4.0
- Fixed an issue where the channel input buffer could grow without bounds
- Added compatibility flag to suppress agent connection error message due to sandboxing on macOS
libfilezilla: update to 0.57.0.
0.57.0 (2026-08-18)
+ Added support for creating impersonation_token from either user names or user ids
+ Added APIs to check whether impersonation is available before trying to create a token
+ Added fz::get_user_id() and fz::get_user_name()
+ MSW: Added passwordless impersonation tokens
+ MSW: Added desktop selection for processes spawned under impersonation
+ MSW: Process spawning under impersonation can now report setup failures through a logger
+ Improved the impersonation demo with user id, passwordless, desktop and custom command support
+ Added fz::secure_buffer that wipes memory on deallocation
+ Added fz::pbkd2 function taking hmac algorithm as argument
- MSW: Loading impersonated user profiles no longer changes caller process privileges
- MSW: Fixed EOF handling when reading redirected process output after the child process exits
coccinelle: update to 1.3.2.
* 1.3.2
** Language:
- Minor tweaks to improve accuracy
** Features:
- Add --c-internals and --cocci-internals flags for debugging
- Use pcre2 instead of pcre
** Bugfixes:
- Fix performance regression introduced in 1.2 resulting in >2x improvement
gammu: updated to 1.44.1
1.44.1
Harden SMS PDU parsing and encoding against malformed or oversized data.
Fix buffer overflows and size calculations in Unicode conversion.
Accept bare SMS prompts from AT modems.
Fix building the MySQL SMSD backend against MariaDB Connector/C.
qtcreator: updated to 20.0.1
20.0.1
The release improves tool detection and the default session directory for chats in the AI Agent Client Protocol integration, fixes various issues with CMake Presets as well as some crashes, and contains various other improvements.
dialog: updated to 1.3.20260721
2026/07/21
+ correct order of sprintf parameters for token-count error messages
(patch by Xinting Zhou).
+ updated cs.po, zh_CN.po from
https://translationproject.org/latest/dialog/
