rumdl: update to 0.3.4.
0.3.4
Breaking Changes
Rust library API: Removed unused helpers and deprecated compatibility wrappers.
Use warning_to_code_actions instead of warning_to_code_action. See the
cleanup commit
for the complete list of removals.
Added
MD013: check and reflow frontmatter values (#998) (c40744c)
schema: describe rule sections and option types (#997) (da0faf7)
Fixed
MD013: measure frontmatter before Markdown exemptions (45841ff)
[47 lines not shown]
consolekit: update to 1.2.7.
New Features:
Implement sd_session_is_remote() and sd_session_get_display()
Export Seat's CanGraphical property on the D-Bus
Bug Fixes:
Only remove the inhibit lock if the event list is empty
Misc Changes:
Don't manage XDG_RUNTIME_DIR on OpenBSD,
the OS takes care of it.
Fix documentation and tests
Remove workaround to sleep before calling zzz
utf8-cpp: update to 5.0.0.
Finally caught up on support for UTF-16, which warrants a major bump in the version, IMHO.
In addition, a Clang warning fix is included - thanks @LanderlYoung
In case anybody cares, all the code in the source directory is being hand-written. Tests and CMake changes are all AI nowadays.
openexr: update to 3.5.4.
## Version 3.5.4 (November 11, 2026)
Patch release that addresses several build and security issues, and
also fixes a regression introduced in v3.3.0 that leads to excessive
memory usage during write, especially with DWA compression (Issue
[#2791](https://github.com/AcademySoftwareFoundation/openexr/issues/2791)).
* Fix a configuration issue with OpenJPH 0.33.0 that caused it to
silently and incorrectly fall back to the vendored version (PR
[#2813](https://github.com/AcademySoftwareFoundation/openexr/pull/2813))
* The vendored OpenJPH is now built in a custom namespace to avoid
symbol collision with other versions when built statically ([2811](https://github.com/AcademySoftwareFoundation/openexr/pull/2811))
built statically,
* The vendored OpenJPH version is now 0.33.0.
* Fix `exrmultipart -convert` on tiled and deep single-part files
* `OPENEXR_USE_INTERNAL_IMATH/OPENJPH` are are now included in
`OpenEXRConfig.h` alongside `OPENEXR_USE_INTERNAL_DEFLATE/ZSTD`.
[69 lines not shown]
libxmlb: update to 0.3.30.
Version 0.3.30
~~~~~~~~~~~~~~
Released: 2026-11-10
New Features:
- Add support for the XPath normalize-space() function (Richard Hughes)
- Increase the maximum number of node attributes and tokens (Richard Hughes)
- Record in the silo if the node was added as external info (Richard Hughes)
Bugfixes:
- Convert xml:lang tags to POSIX form when required (Richard Hughes)
- Fix OR branches still being evaluated after the limit is reached (Richard Hughes)
- Fix XbLzmaDecompressor reset leaving the stream unusable (Richard Hughes)
- Fix a bound value losing its level inside a tuple (Richard Hughes)
- Fix a crash when a query value was never bound (Richard Hughes)
- Fix a crash when searching one silo from several threads (car12o)
- Fix comma-separated function arguments being parsed in reverse (Richard Hughes)
[9 lines not shown]
libffi: update to 3.8.1.
Security fixes
Each issue is local and high-complexity, and is limited to the target noted
in bold. See the linked advisory for full details and CVSS.
AArch64 — ffi_call placed the pointer to a by-value composite larger
than 16 bytes at the wrong stack offset, and homogeneous-aggregate
(HFA/HVA) detection did not match AAPCS64, so a callee or closure could use
the wrong pointer. (GHSA-h52h-3759-xqm4, GHSA-vg77-j273-647r)
macOS on Apple Silicon (Darwin arm64) — heap use-after-free in the
trampoline-table closure allocator once a process used more than one
trampoline table (over 1024 live closures). (GHSA-23hx-9rxv-9qfp)
Linux and Cygwin (static trampolines) — the /proc/self/maps path was
truncated at the first space and the reopened file was never verified, so a
file at a truncated or replaced path could be mapped as trampoline code.
(GHSA-fq46-69xf-x5gf)
s390x — closures mishandled 128-bit integer arguments, passing an
[40 lines not shown]
libcbor: update to 0.15.0.
Minor release with several breaking changes, marked BREAKING and
ABI BREAKING below: read them before upgrading. Binaries must be
rebuilt against the new headers, since cbor_incref and cbor_decref
are no longer exported. Also includes the cbor_stream_decode security
fixes released in 0.14.1.
grafana-prometheus-datasource: update to 13.2.6.
🐛 Enable publish-and-deployed (#426)
🐛 Fix config editor crash when exemplarTraceIdDestinations is provisioned as a non-array value. The value is now ignored, matching the backend, and a warning is shown. (#418)
🐛 Fix query editor crash when incrementalQueryOverlapWindow is provisioned as a non-string value. (#417)
🐛 resource path backend allowlist (#426)
🐛 Fix label-value suggestions returning HTTP 405 for data sources configured to use POST. (#406)
⚙️ Chore: dependency updates
🐛 Always send ad hoc group by keys to the backend. They were gated on the removed groupByVariable and dashboardUnifiedDrilldownControls feature toggles, so group by stopped applying to Prometheus queries. (#404)
🐛 Fix a connection freeze between Grafana and the plugin under heavy query load by updating google.golang.org/grpc to v1.85.0 (grpc/grpc-go#9330) (#405)
ast-grep: update to 0.51.2.
chore(deps): update rust crate tree-sitter-scala to v0.26.10 #3085
feat(language): define feature-gated languages with macros #3081
docs: fix dead wasm-pack installer link in the wasm crate README #3084
chore(deps): update dependency oxlint to v1.93.0 #3082
fix(config): do not split words at digits in convert transform #3070
chore(deps): update dependency web-tree-sitter to v0.27.2 #3075
chore(deps): update dependency node to v26 #3069
chore(deps): update rust crate toml_edit to v0.25.19 #3071
chore(deps): update rust crate tree-sitter-scala to v0.26.9 #3072
chore(deps): update dependency oxlint to v1.92.0 #3074
chore(deps): update rust crate smallvec to v1.16.5 #3073
chore(deps): update rust crate tree-sitter to v0.27.2 #3076
test(cli): verify npm packages on all platforms daily #3068
feat(cli): distribute musl Linux binaries #3067
Fail ast-grep test for unmatched IDs or when no tests run #3065
chore(deps): update dependency @napi-rs/cli to v3.10.12 #3057
chore(deps): update rust crate serde-saphyr to v2.1.1 #3062
[4 lines not shown]
aspell: update to 0.60.8.3.
Changes from 0.60.8.2 to 0.60.8.3 (October 28, 2026)
Fix CVE-2026-75818, CVE-2026-75819, and CVE-2026-75820, all of which were identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.
Fix CVE-2026-103658 identified by Anthropic and validated by Ada Logics.
Fix various other memory problems, most of which were found and fixed by Arshiya Tabasum.
Fix various typos in documentation.
Remove unused MySpell example code.
shells/oh-my-posh: update to 32.1.0
Bug Fixes
cache: keep the prompt count for the whole session (c89f7d4)
fish: preserve multiline buffers in Enter handler (#7941) (3c03ebf)
Features
segment: add sshagent (70c1db6)
