Recommend Xcode 5.0.1 GM on 10.9
gnupg: 1.4.15

What's New
===========

  * Fixed possible infinite recursion in the compressed packet
    parser. [CVE-2013-4402]

  * Protect against rogue keyservers sending secret keys.

  * Use 2048 bit also as default for batch key generation.

  * Minor bug fixes.

Impact of the security problem
==============================

Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations.  All systems using GPG to process incoming data are
affected.

Taylor R. Campbell invented a neat trick to generate OpenPGP packages
to force GPG to recursively parse certain parts of OpenPGP messages ad
infinitum.  As a workaround a tight "ulimit -v" setting may be used to
mitigate the problem.  Sample input data to trigger this problem has
not yet been seen in the wild.  Details of the attack will eventually
be published by its inventor.

A fixed release of the GnuPG 2.0 series has also been released.

Signed-off-by: Jack Nagel <jacknagel@gmail.com>
gnupg2: 2.0.22

What's New in 2.0.22
====================

 * Fixed possible infinite recursion in the compressed packet
   parser. [CVE-2013-4402]

 * Improved support for some card readers.

 * Prepared building with the forthcoming Libgcrypt 1.6.

 * Protect against rogue keyservers sending secret keys.

Impact of the security problem
==============================

Special crafted input data may be used to cause a denial of service
against GPG (GnuPG's OpenPGP part) and some other OpenPGP
implementations.  All systems using GPG to process incoming data are
affected.

Taylor R. Campbell invented a neat trick to generate OpenPGP packages
to force GPG to recursively parse certain parts of OpenPGP messages ad
infinitum.  As a workaround a tight "ulimit -v" setting may be used to
mitigate the problem.  Sample input data to trigger this problem has
not yet been seen in the wild.  Details of the attack will eventually
be published by its inventor.

A fixed release of the GnuPG 1.4 series has also been released.

An updated vesion of gpg4win will be released next week.

Signed-off-by: Jack Nagel <jacknagel@gmail.com>
gpg-agent 2.0.22

Signed-off-by: Jack Nagel <jacknagel@gmail.com>
gpgme 1.4.3

Closes #23063.

Signed-off-by: Jack Nagel <jacknagel@gmail.com>
yaws 1.96 plus --HEAD

Changes include:
* Update release from 1.94 to 1.96 in yaws formula using GitHub's releases URL
* Update `sha1` for new source archive
* Provide `--HEAD` option for yaws formula (needed for newer Erlang versions)
* Add `test` method with a basic tests for yaws formula
* Revert private method extraction to address method extraction from @adamv
* Use autoconf for yaws formula and specify build dependency on autoconf
* Add patches for yaws formula which is necessary for Erlang R16B01 and above
* Make tests valid for `--HEAD` builds even when the next version is bumped

Closes #23076.

Signed-off-by: Adam Vandenberg <flangy@gmail.com>
cogl 1.14.0

Signed-off-by: Jack Nagel <jacknagel@gmail.com>
clutter 1.14.4

Closes #22843.

Signed-off-by: Jack Nagel <jacknagel@gmail.com>
cogl: update configure options
clutter, cogl: add minimum XQuartz version
clutter: fix build on Snow Leopard
Only track C++ stdlibs for C++ code

After a formula is built, scan all mach-o files for dynamic links
to see if any of them point to a C++ stdlib (libc++ or libstdc++).
If one of them is linked, record that information in the formula's tab.

This replaces the old behaviour where all files were assumed to be C++
code, and stdlibs were always tracked regardless of whether they were
actually linked against.

This also modifies the way that tabs are written - now tabs are written
with the stdlib field null, and values are only written if an stdlib
is detected.
CxxStdlib: allow for nil stdlibs

A nil stdlib value represents non-C++ code.
Track the OS's default C++ stdlib
build: fix typo
cfitsio: use HTTP URL instead of FTP

The NASA HEASARC FTP server is currently not responding via FTP, but
allows HTTP indexes and downloads. SHA1 matches and doesn't need to
changed. The directy index is linked to from
http://heasarc.gsfc.nasa.gov/docs/software/fitsio/fitsio.html

Fixes #23049.
Closes #23085.

Signed-off-by: Misty De Meo <mistydemeo@gmail.com>
newlisp 10.5.4

Closes #23086.

Signed-off-by: Misty De Meo <mistydemeo@gmail.com>
maven: 3.1.1

Closes #23084.

Signed-off-by: Jack Nagel <jacknagel@gmail.com>