postgresql1[4-8]: updated to 18.7, 17.12, 16.16, 15.20, 14.25
18.7, 17.12, 16.16, 15.20, 14.25
Security Issues
The following security vulnerabilities are closed in this update release. You can find more details about the vulnerabilities and their affected versions in the links below:
CVE-2026-6460: Type confusion after ALTER ... SET DATA TYPE executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-6467: Extension script schema mishandling executes arbitrary SQL (CVSS v3.1: 7.2)
CVE-2026-14661: dblink and subscriptions can append to arbitrary files (CVSS v3.1: 8.1)
CVE-2026-16237: INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition (CVSS v3.1: 5.4)
CVE-2026-16240: pg_basebackup can use backup manifest content as a format string (CVSS v3.1: 3.7)
CVE-2026-18447: Output parameter type confusion executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116303: Foreign key and JSON conversions bypass EXECUTE privilege on cast functions (CVSS v3.1: 3.1)
CVE-2026-116304: Parallel RECORD typmod use-after-free executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116306: Composite-type change during field assignment executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116307: plperl prepared-query use-after-free executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-116308: dict_int reads beyond zero-length tokens (CVSS v3.1: 4.3)
[68 lines not shown]
py-xdis: updated to 6.3.1
6.3.1 2026-09-11
Update minor versions released recent versions Python from 3.10 to 3.15
SakayanagiYuna:
For Python 2 interned strings Honor the per-read bytes_for_s flag for Python 2 TYPE_INTERNED and
TYPE_STRINGREF records. Previously, these records were always
decoded as UTF-8 with errors ignored, silently dropping non-UTF-8
bytes. Cache the original bytes alongside the existing text representation
so references can be read in either context without losing data,
preserving identity for repeated references within each
representation. Include both representations in code reference
metadata to preserve interned tags when re-marshalling. Keep existing text decoding and Python 3 Unicode behavior unchanged. Add synthetic regression tests for binary strings, mixed-context
references, interned bytecode in a Python 2.7 pyc, and marshal round
trips.
[7 lines not shown]
py-wcmatch: updated to 12.0.1
12.0.1
- **FIX**: Require `bracex` 3.2.2 for bug fixes.
- **FIX**: Fix a non-terminal globstar consuming the final filename when the following extended group can match
nothing, e.g. `**/?(a)` matching `b`. This also affects the implicit globstar used by `MATCHBASE` and
`pathlib.match`.
- **FIX**: Fix `globmatch` with `REALPATH` rejecting a symlinked file when it is matched by a trailing `**`
(e.g. `**` or `dir/**`), disagreeing with `glob` and Bash, which both return such files.
- **FIX**: Preserve directory symlink traversal when collapsing adjacent `**` and `***` components with
`GLOBSTARLONG`, regardless of their order.
12.0
- **BREAK**: Various fixes to `!(...)` patterns to more closely align to Bash. 100% Bash behavior is impossible with
regular expression, but behavior in many ways was improved, but there may be some surprising behavior changes.
- **FIX**: Fix an `EXTGLOB`/`EXTMATCH` inverse group, `!(...)`, inside another group ignoring the rest of its
[58 lines not shown]
py-zensical: updated to 0.1.1
0.1.1
This release adds support for the meta-descriptions plugin and fixes issues with llms.txt references and table-reader indentation.
The user interface includes fixes for instant previews, search, code copying, scrolling, and navigation, along with 182 new icons.
The development server has received security improvements covering request validation, redirects, symlinks, and connection limits. It remains a preview server and is not intended for production use.
py-ruff: updated to 0.17.5
0.17.5
Preview features
Redirect renamed rules
[flake8-async] Implement pytest-raises-exception-group (ASYNC401)
[flake8-logging-format] Mark G004 fix as unsafe
[pylint] Implement no-method-argument (PLE0211)
[refurb] Do not offer fix when write is nested in an expression (FURB103)
[ruff] Add renamed-rule (RUF202)
[ruff] Expand redirected-noqa to other suppression comments (RUF101)
Bug fixes
Avoid crashing when Ruff logs to a closed stderr pipe
Fix fixes that add or remove a keyword argument with a parenthesized value
[flake8-import-conventions] Avoid shadowing names when fixing import aliases (ICN001)
[15 lines not shown]
dbus: comment out Solaris-only flag
not supported on Illumos, says meson; I don't know how to check for
that in particular, but we have Illumos bulk builds and none for Solaris,
so let's fix these.
py-acme py-certbot*: updated to 5.10.0
5.10.0
Fixed
Fixes a race condition in the webroot plugin where, if the webroot could be modified by a less privileged user while Certbot ran, the ownership and mode of an unintended file could be changed instead of those of the challenge directory Certbot had just created.
Rejects invalid ARI suggested renewal windows whose end time is not after their start time.
py-awscli: updated to 1.46.3
1.46.3
* bugfix:alias: Pass Windows external alias args to cmd.exe as literals
* bugfix:codedeploy: Tighten file permissions for the on-premises instance configuration file written by ``aws deploy install``
py-boto3: updated to 1.44.2
1.44.2
* api-change:``autoscaling``: [``botocore``] Amazon EC2 Auto Scaling now supports ASGAverageCPUUtilizationHighResolution as a predefined metric type for target tracking scaling policies.
* api-change:``backup``: [``botocore``] Adding new notification types for SNS notifications
* api-change:``cleanrooms``: [``botocore``] Adds a retry signal to protected query and protected job errors that indicates whether running the same request again might succeed, and defines error codes that identify the category of the failure.
* api-change:``cloudwatch``: [``botocore``] Adds support for saving, retrieving, listing, and deleting CloudWatch metric data query definitions.
* api-change:``cloudwatchomni``: [``botocore``] Add aggregationTemporality and monotonicity to GetContextGraph MetricMetadata
* api-change:``connect``: [``botocore``] This release adds a LastModifiedTime and LastModifiedRegion field to ListIntegrationAssociations so customers can see at what time and in which Region an IntegrationAssociation was last modified in.
* api-change:``ec2``: [``botocore``] This release adds support for multiple features, including EC2 Image Builder image recipes and container recipes in AMI usage reports, Amazon EC2 Detailed Monitoring adds opt-in metrics, and Global Accelerator and API Gateway V2 as resource exclusions for VPC Encryption Control.
* api-change:``emr-containers``: [``botocore``] This release updates range of maxInQueueDepth and maxConcurrency limit from 10000 to 1000.
* api-change:``gameliftstreams``: [``botocore``] Adds support for ApplicationStartedAt on stream sessions, a timestamp that indicates when the application launched for the stream session, returned by GetStreamSession and StartStreamSession. Also added streamingStartedAt and streamingEndedAt.
* api-change:``guardduty``: [``botocore``] Adds the ListInvestigationRecords API, which returns the step-by-step records of a completed investigation. Adds investigation scope details and an optional structured summary to GetInvestigation. Adds filter criteria and investigation type to ListInvestigations.
* api-change:``lightsail``: [``botocore``] Amazon Lightsail now offers web addresses, so you can quickly make a website or application reachable at a name like mysite.amazonlightsail.com. A web address is free while attached to a Lightsail CDN, with no domain to register and no SSL TLS certificate to create or renew.
* api-change:``mediaconnect``: [``botocore``] MediaConnect adds four features. (1) RTMP Push on Router Input and Flows (RTMP, RTMPS, eRTMP). (2) PID Remapping on Router rewrites PIDs inline without transcoding. (3) Key Frame Switching transitions router inputs on video boundaries. (4) SRT Merge Input bonds redundant SRT streams.
* api-change:``medialive``: [``botocore``] AWS Elemental MediaLive now adds a caption language setting for MediaPackage V2 output groups that signals a stream carries no closed captions.
* api-change:``mediatailor``: [``botocore``] Add post origin manifest hook, add HLS tag processor
* api-change:``mwaa``: [``botocore``] Amazon MWAA now supports Airflow environments with IAM Identity Center (IDC) integration and exposes OSS Airflow Multi-Team feature. Users can configure individual IDC-backed identities and fine-grained authorization, and define Dags on per-team basis.
[7 lines not shown]
py-botocore: updated to 1.44.2
1.44.2
* api-change:``autoscaling``: Amazon EC2 Auto Scaling now supports ASGAverageCPUUtilizationHighResolution as a predefined metric type for target tracking scaling policies.
* api-change:``backup``: Adding new notification types for SNS notifications
* api-change:``cleanrooms``: Adds a retry signal to protected query and protected job errors that indicates whether running the same request again might succeed, and defines error codes that identify the category of the failure.
* api-change:``cloudwatch``: Adds support for saving, retrieving, listing, and deleting CloudWatch metric data query definitions.
* api-change:``cloudwatchomni``: Add aggregationTemporality and monotonicity to GetContextGraph MetricMetadata
* api-change:``connect``: This release adds a LastModifiedTime and LastModifiedRegion field to ListIntegrationAssociations so customers can see at what time and in which Region an IntegrationAssociation was last modified in.
* api-change:``ec2``: This release adds support for multiple features, including EC2 Image Builder image recipes and container recipes in AMI usage reports, Amazon EC2 Detailed Monitoring adds opt-in metrics, and Global Accelerator and API Gateway V2 as resource exclusions for VPC Encryption Control.
* api-change:``emr-containers``: This release updates range of maxInQueueDepth and maxConcurrency limit from 10000 to 1000.
* api-change:``gameliftstreams``: Adds support for ApplicationStartedAt on stream sessions, a timestamp that indicates when the application launched for the stream session, returned by GetStreamSession and StartStreamSession. Also added streamingStartedAt and streamingEndedAt.
* api-change:``guardduty``: Adds the ListInvestigationRecords API, which returns the step-by-step records of a completed investigation. Adds investigation scope details and an optional structured summary to GetInvestigation. Adds filter criteria and investigation type to ListInvestigations.
* api-change:``lightsail``: Amazon Lightsail now offers web addresses, so you can quickly make a website or application reachable at a name like mysite.amazonlightsail.com. A web address is free while attached to a Lightsail CDN, with no domain to register and no SSL TLS certificate to create or renew.
* api-change:``mediaconnect``: MediaConnect adds four features. (1) RTMP Push on Router Input and Flows (RTMP, RTMPS, eRTMP). (2) PID Remapping on Router rewrites PIDs inline without transcoding. (3) Key Frame Switching transitions router inputs on video boundaries. (4) SRT Merge Input bonds redundant SRT streams.
* api-change:``medialive``: AWS Elemental MediaLive now adds a caption language setting for MediaPackage V2 output groups that signals a stream carries no closed captions.
* api-change:``mediatailor``: Add post origin manifest hook, add HLS tag processor
* api-change:``mwaa``: Amazon MWAA now supports Airflow environments with IAM Identity Center (IDC) integration and exposes OSS Airflow Multi-Team feature. Users can configure individual IDC-backed identities and fine-grained authorization, and define Dags on per-team basis.
[7 lines not shown]
py-cloudflare: updated to 5.10.0
5.10.0
This release adds the K2 streaming, Monetization, Zero Trust CWS, and Billing
Spend Policies APIs, plus Zero Trust Access user populations and MFA catalog
resources. It also removes the Magic Cloud Networking and Tenant Custom
Nameservers resources and changes several pagination and response types. Review
the breaking changes before upgrading.
