buf: updated to 1.74.0
v1.74.0 - 2026-10-14
- Improve the performance of the `PROTOVALIDATE` lint rule, which is now up to 3x faster
and allocates less memory on modules using `cel` rules or `example` values.
- Send the module name of each file to check plugins, which is available as
`FileDescriptor.ModuleName()` in bufplugin-go v0.11.0 and later.
- Update `buf curl` to automatically use HTTP/2 prior knowledge for `http` URLs when server
reflection, the gRPC protocol, or a bidirectional streaming method is used, since all of these
require HTTP/2. The `--http2-prior-knowledge` flag is no longer required in these cases.
- Add `--stdin-filepath` flag to `buf format`, which reads a single `.proto` file from
stdin and writes the formatted result to stdout. The path is not read from disk, and is
only used to report parse errors and diffs.
- Fix `buf convert` panic when converting images that contain files without a `syntax`
declaration or with unused imports.
- Fix `buf generate` with `strategy: directory` and `include_imports: true` adding imports
to the `CodeGeneratorRequest` of the directory that imports them. Imports are now split
by directory into their own requests, the same as non-imports.
[15 lines not shown]
py-apsw: updated to 3.54.1.0
3.54.1.0
Fixed build failure on recent gcc, due to using header that was included by other headers. (APSW issue 640)
Fixed reference count leak due to incorrect reference count handling. The main symptom would be connections not automatically being garbage collected. (APSW issue 641)
sqlite3: updated to 3.54.1
3.54.1 (2026-10-16):
Fix a possible heap-buffer overflow on 32-bit builds. (64-bit builds are not affected by this problem.)
Fixes other problems in 3.54.0 reported by users. See the check-in timeline for details.
x11/xterm: update to 412
Patch #412 - 2026/10/11
improve fix for regex-selection of a wrapped line (adapted from patch by Albert Flügel, Redhat #2479962).
fix some cppcheck warnings.
improve a special case where an exposure event happens to cause a hidden character to be drawn at the beginning of a string.
correct limits for a partial screen clear operation (Debian #1149533).
amend response for DECRQM 1046 to return “set” when titeInhibit is set rather than the reverse (report by Vladislav Korikhin).
update tables in wcwidth.c based on Unicode 18.0.0
update config.guess, config.sub
textproc/xan: update to 0.61.0
Features
Support for .mtx (Matrix Market) files.
Adding geometric_mean & harmonic_mean aggregation functions.
Fixes
Fixing xan rename with non-comma delimiters.
Fixing xan from -f=parquet not converting timestamp columns.
Fixing open-ended moonblade slicing.
Fixing xan parallel (cat|map) not working with -R/--run.
Fixing xan parallel -R/--run not spawning checker thread.
Fixing xan cat rows (-I|-U) -S/--source-column.
Performance
Improving performance of xan freq & xan p freq.
[5 lines not shown]
sysutils/xplr: update to 1.1.2
What's Changed
fix: use portable mkdir for create_file mode by @mmustafasenoglu in #780
fix: return Permissions::default() on Windows instead of panicking (#781) by @mmustafasenoglu in #782
fix: detach silent commands into their own process group by @mmustafasenoglu in #783
misc/rozi: update to 0.0.31
v0.0.31
No user-facing changes since v0.0.30.
v0.0.30
Added
Extensions can run commands, services, and sidebar tabs on the host of a session. Set the manifest's placement key to choose where each contribution runs. (#135)
Add configurable actions for terminal links and hints, including pane or popup launch, client commands, and configured or extension commands. A file handler supports path hints with optional line and column context. Installed extensions can also contribute link handlers. (#145)
New Agents and Projects sidebar tabs show coding agents across sessions and connected hosts, and Git checkouts grouped by repository, checkout, and session. Extensions can provide hierarchical JSON command tabs and live stream tabs. (#164, #173)
Programs that emit OSC 7501 revision 0.4 appear in the Activity sidebar with their state, title, message, and progress. (#159)
Changed
Left Alt with j or k moves through picker rows, and left Alt with h or l switches tabs. Other Alt sides do not trigger these shortcuts. (#131)
The Sessions picker now uses tabs for Local, connected hosts, and All. Search stays within the selected tab, and All lists the union of the available tabs. Opening a host from Remote hosts takes you to that host's Sessions tab. Settings → Sessions → Open Sessions on lets you choose Current host or All sessions. (#136, #137, #150)
Worktrees now identifies the repository in its picker, can load pull request updates in both the picker and sidebar, and offers a searchable local-branch chooser when creating a worktree. (#141)
Sidebars now have independent left and right docks, each with one to three panels. Configure Left panels…, Right panels…, and Open sidebars at startup in Settings. Tabs can move between panels and docks. (#143)
[36 lines not shown]
grafana: update to 13.2.4.
Security
Security: Fix CVE-2026-15577
Security: Fix CVE-2026-33374
Security: Fix CVE-2026-93294
Security: Fix CVE-2026-95502
Features and enhancements
Alerting: Strip sensitive headers from oauth2 cross-host redirects #134433, @JacobsonMT
Dashboard: Fall back when collection deletion is unsupported #134224, @bestend
Git Sync: Clarify repository links for pure Git #134253, @ferruvich
Provisioning: Allow resource previews in unsynced folders #134391, @grafana-writer[bot]
Provisioning: Reject invalid resource names before API calls #133776, @grafana-writer[bot]
Provisioning: Show last checked time in Pull status #134483, @ferruvich
Provisioning: Skip previews for pull requests from forks #133799, @ferruvich
Provisioning: Stop PR previews when refs disappear #133855, @ferruvich
[6 lines not shown]
py-uv*: update to 0.13.1
Enhancements
Ignore Requires-Python upper bounds in uv pip check and uv pip install --strict, consistent with resolution (#22500)
Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable (#22463)
Report missing trusted hashes in resolution errors (#22241)
Python
Add CPython 3.16.0a1 (#22527)
Preview features
Allow uv tool upgrade to upgrade installed tools when tool-install-locks is enabled (#22498)
Add preliminary support for parsing PEP 825 variant labels in wheel filenames with wheel-variants (#22039)
Performance
[25 lines not shown]
py-tomlkit: update to 0.15.2.
Changed
Write the ESC control character as \u001b instead of \e, which is only valid in TOML 1.1, so the output stays readable by TOML 1.0 parsers such as tomllib. (#641)
key_value() now raises UnexpectedCharError on anything other than whitespace or a comment after the pair, instead of silently discarding it (e.g. key_value("a = 1 b = 2")), matching parse(). (#594)
integer() given a string now validates it against the TOML integer grammar and keeps the original text, so grouping underscores (e.g. integer("1_000")) survive dumps(); strings that are not valid TOML integers (e.g. "010") now raise ValueError. (#336)
Add a fold argument to DateTime and Time, mirroring the stdlib, and carry fold through item(), arithmetic (including datetime subtraction) and unwrap(), so a folded local time no longer converts an hour off. (#619, #623, #626)
Declare the project metadata in the PEP 621 [project] table; building from source now requires poetry-core>=2.2.0. (#607, #609)
Fixed
Fix valid TOML being rejected when an out-of-order table reopens an implicit super-table with a dotted key: [a.b.c] then [a] with b.z = 1 extends the implicit a.b super-table rather than redefining it (stdlib tomllib accepts it), so it now parses and round-trips instead of raising Redefinition of an existing table. The concrete-table case ([a.b] then [a] b.z = 1) stays rejected. (#565)
Fix uppercase E exponent after a leading-zero mantissa (e.g. 0E2) being rejected as an invalid number while 0e2 parsed fine. (#586)
Fix non-lowercase special floats (e.g. Inf, NaN, -INF) being accepted; TOML only allows lowercase inf and nan, so they now raise ParseError. (#628)
Fix parse errors reporting the wrong line and column in documents with CRLF or mixed line endings. (#642)
Fix item() reordering the keys of an inline table (dict-valued keys were forced last) under the default sort_keys=False. (#546)
Fix unwrap() moving a key to the end after its value was replaced (e.g. doc["b"] = 9), while dumps() and keys() kept the original order. (#591)
Fix appending a key to a parsed inline table that uses ", " separators emitting a bare "," for the new entry, leaving the table inconsistently spaced (e.g. {x = 1, y = 2,z = 3}). (#595)
[9 lines not shown]
py-pymdown-extensions: update to 12.3.
NEW: BetterEm: Expose a way to disable CommonMark punctuation rules in BetterEm if desired via a new
punctuation option.
py-pluggy: update to 1.7.0.
Deprecations and Removals
#632: Hookspec methods defined without self as the first parameter now emit a :class:`DeprecationWarning`. Add self as the first parameter or use @staticmethod.
Features
#170: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:`hookspec_arg_default` for details.
#729: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().
A value spanning several lines is now displayed as a block instead of running into the surrounding trace.
Bug Fixes
#629: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.
#315: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.
[36 lines not shown]
