chore: update dependencies

[renovate]

Update Request | Renovate Bot

This PR contains the following updates:

Package	Type	Update	Change
Perl/perl5		patch	5.42.1 → 5.42.2
actions/stale	action	digest	b5d41d4 → db5d06a
git://git.savannah.gnu.org/autoconf.git		minor	2.72 → 2.73
git://git.savannah.gnu.org/libtool.git		minor	2.5.4 → 2.6.0
https://gitlab.inria.fr/mpc/mpc.git		minor	1.3.1 → 1.4.0
https://gitlab.kitware.com/cmake/cmake.git		minor	4.2.3 → 4.3.1
libbpf/libbpf		minor	v1.6.3 → v1.7.0
libexpat/libexpat		patch	2_7_4 → 2_7_5
mesonbuild/meson		patch	1.10.1 → 1.10.2
pypa/build		patch	1.4.0 → 1.4.2
pypa/installer		major	0.7.0 → 1.0.0
tukaani-project/xz		patch	v5.8.2 → v5.8.3

---

Release Notes

Perl/perl5 (Perl/perl5)

v5.42.2

Compare Source

mpc/mpc (https://gitlab.inria.fr/mpc/mpc.git)

v1.4.0

Compare Source

cmake/cmake (https://gitlab.kitware.com/cmake/cmake.git)

v4.3.1

Compare Source

v4.3.0

Compare Source

v4.2.4

Compare Source

libbpf/libbpf (libbpf/libbpf)

v1.7.0: libbpf v1.7.0

Compare Source

User space-side features

• bpf_map__set_exclusive_program() and bpf_map__exclusive_program() APIs for exclusive map creation;
• bpf_program__assoc_struct_ops() and bpf_prog_assoc_struct_ops() APIs to associate a non-struct_ops BPF program with a struct_ops map;
• btf__permute() API to rearrange BTF types in-place according to a provided mapping;
• BTF type lookup optimization: binary search for btf__find_by_name() and btf__find_by_name_kind();
• btf__add_btf() now accepts split BTF sources;
• fsession support (SEC("fsession+") / SEC("fsession.s+"));
• BPF_F_CPU and BPF_F_ALL_CPUS flags support for per-CPU map operations;
• arena globals are moved to the end of the arena mmap region if kernel supports it;
• support for LLVM-generated indirect jump tables (BPF ISA v4) via .jumptables ELF section and BPF_MAP_TYPE_INSN_ARRAY maps;
• avoid expensive kallsyms parsing when kprobe.session target is an exact function match;
• new dont_enable option in struct bpf_perf_event_opts to suppress perf event auto-enablement;

BPF-side features

• USDT SIB (Scale-Index-Base) addressing support;
• dynptr helper signatures (bpf_dynptr_from_mem, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data) widened from 32-bit to 64-bit size/offset parameters;

Bug fixes

As usual, a number of bug fixes included, see full commit log for details.

Full Changelog: libbpf/libbpf@v1.6.0...v1.7.0

libexpat/libexpat (libexpat/libexpat)

v2_7_5: 2.7.5

Compare Source

Original change log

mesonbuild/meson (mesonbuild/meson)

v1.10.2

Compare Source

pypa/build (pypa/build)

v1.4.2

Compare Source

What's Changed

• fix(uv): always pass the python to use by @​henryiii in #​996
• 🐛 fix(release): detect pre-commit environment inconsistencies by @​gaborbernat in #​1001
• 🔧 fix(towncrier): match docstrfmt RST formatting expectations by @​gaborbernat in #​1002
• Fix _has_valid_outer_pip when pip is missing by @​notatallshaw in #​1003
• fix: release changelog issue by @​henryiii in #​1006

New Contributors

• @​notatallshaw made their first contribution in #​1003

Full Changelog: pypa/build@1.4.1...1.4.2

v1.4.1

Compare Source

What's Changed

• Fix documentation grammar and typos by @​DimitriPapadopoulos in #​979
• Allow setting build constraints by @​layday in #​963
• fix: pip hack workaround by @​henryiii in #​980
• 📚 docs: reorganize using Diataxis framework by @​gaborbernat in #​988
• ✨ feat(ci): automate releases and harden workflows by @​gaborbernat in #​991
• chore: avoid template injection zizmor issue by @​henryiii in #​994
• chore: fix PR template by @​henryiii in #​995
• chore: fix fix job by @​henryiii in #​997
• 🐛 fix(ci): resolve pre-release auth failure and change detection by @​gaborbernat in #​999
• 🐛 fix(deps): add pre-commit to release dependency group by @​gaborbernat in #​1000

Full Changelog: pypa/build@1.4.0...1.4.1

pypa/installer (pypa/installer)

v1.0.0

Compare Source

v1.0.0 (Mar 28, 2025)

• Drop support for Python 3.9, 3.8, and 3.7 (#​305, #​242, #​206)
• Add support and Python 3.13 and 3.14 (#​201, #​282)
• Add --overwrite-existing CLI option (#​216)
• Add --validate-record CLI option (#​161)
• Support installing multiple wheels (#​203)
• Handle invalid hash algorithms (#​179)
• Stream-based validation instead of in-memory (#​98)
• Add validate_stream methods (#​99)
• Consolidate and refine validation APIs (#​108, #​111)
• Sort entries before writing RECORD (#​245)
• Do not install pycache from wheels (#​307)
• Fix a path traversal bug (#​317)
• Update launcher scripts and Windows behavior (#​212, #​181)
• Fix Windows relpath bug (#​286)
• Migrate to dataclasses (#​200)
• Use cached_property for memoization (#​243)
• Refactor installer.scripts (#​239)
• Decouple test modules (#​104)
• Avoid cross-module imports from .utils (#​102)
• Lazy imports for performance (#​226)
• Complete type annotations and enforce strict mypy (#​173)
• Deprecate RecordEntry.validate (#​186)
• Fix documentation typos and grammar (#​309, #​210)
• Improve docstrings and internal documentation (#​100)

tukaani-project/xz (tukaani-project/xz)

v5.8.3: XZ Utils 5.8.3 (stable)

Compare Source

IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz Git repository.

5.8.3 (2026-03-31)

    * liblzma:

        - Fix a buffer overflow in lzma_index_append(): If
          lzma_index_decoder() was used to decode an Index that
          contained no Records, the resulting lzma_index was left in
          a state where where a subsequent lzma_index_append() would
          allocate too little memory, and a buffer overflow would occur.

          The lzma_index functions are rarely used by applications
          directly. In the few applications that do use these functions,
          the combination of function calls required to trigger this bug
          are unlikely to exist, because there typically is no reason to
          append Records to a decoded lzma_index. Thus, it's likely that
          this bug cannot be triggered in any real-world application.

          The bug was reported and discovered by Cantina using their
          AppSec agent, Apex.

        - Fix the build on Windows ARM64EC.

        - Add "License: 0BSD" to liblzma.pc.

    * xz:

        - Fix invalid memory access in --files and --files0. All of
          the following must be true to trigger it:

            1. A string being read (which supposedly is a filename) is
               at least SIZE_MAX / 2 bytes long. This size is plausible
               on 32-bit platforms (2 GiB - 1 B).

            2. realloc(ptr, SIZE_MAX / 2 + 1) must succeed.
               On glibc >= 2.30 it shouldn't because the value
               exceeds PTRDIFF_MAX.

            3. An integer overflow results in a realloc(ptr, 0) call.
               If it doesn't return NULL, then invalid memory access
               will occur.

        - On QNX, don't use fsync() on directories because it fails.

    * Autotools: Enable 32-bit x86 assembler on Hurd by default.
      It was already enabled in the CMake-based build.

    * Translations: Add Arabic man page translations.

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.