security/linux-rl9-ca-certificates: update to 2026.2.92_v9.0.319-90.3.el9_8
Changelog:
*Thu Oct 22 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.3
- Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch
*Thu Oct 22 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.2
- Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates
*Wed Oct 21 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.1
- Removing: AAA Certificate Services root CA
- Removing: emSign ECC Root CA - G3 from Microsoft Code Signing certificates
*Wed Oct 21 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.0
- Update to CKBI 2.92_v9.0.319 from NSS 3.131.1
Removing:
- emSign Root CA - C1
Adding:
[38 lines not shown]
textproc/antiword: Deprecate
Upstream has been dead since the 0.37 release in 2005. The only
remaining fork (github.com/grobian/antiword) has no releases and does
not address security issues.
CVE-2026-111677 (heap out-of-bounds read in vGet8LstInfo) and
CVE-2026-111678 (stack out-of-bounds read in vGet8PapInfo and
vGet8ChrInfo) are unfixed upstream and in every distribution.
Set to expire on 2026-11-30.
Sponsored by: Netzkommune GmbH
(cherry picked from commit 100c915a873d51c284aa4febb506da8db7a3a440)
textproc/antiword: Deprecate
Upstream has been dead since the 0.37 release in 2005. The only
remaining fork (github.com/grobian/antiword) has no releases and does
not address security issues.
CVE-2026-111677 (heap out-of-bounds read in vGet8LstInfo) and
CVE-2026-111678 (stack out-of-bounds read in vGet8PapInfo and
vGet8ChrInfo) are unfixed upstream and in every distribution.
Set to expire on 2026-11-30.
Sponsored by: Netzkommune GmbH
www/py-django-extensions: Update 3.2.3 => 4.1
Changelog:
https://github.com/django-extensions/django-extensions/blob/4.1/CHANGELOG.md
Port changes:
- Switch to USE_PYTHON=pep517.
- Add concurrent to USE_PYTHON.
- Add mail/py-aiosmtpd to RUN_DEPENDS for mail_debug.
- Patch the PEP 639 license string for the setuptools in the tree.
- Fix portlint warnings.
PR: 299899
Approved by: Kevin Golding <ports at caomhin.org> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 1c5cc9c088aeb0d7f94c4ccab4ee0acf29d3839a)
www/py-django-extensions: Update 3.2.3 => 4.1
Changelog:
https://github.com/django-extensions/django-extensions/blob/4.1/CHANGELOG.md
Port changes:
- Switch to USE_PYTHON=pep517.
- Add concurrent to USE_PYTHON.
- Add mail/py-aiosmtpd to RUN_DEPENDS for mail_debug.
- Patch the PEP 639 license string for the setuptools in the tree.
- Fix portlint warnings.
PR: 299899
Approved by: Kevin Golding <ports at caomhin.org> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
linux: Implement PTRACE_GETREGSET NT_PRFPREG and NT_X86_XSTATE
Implement NT_PRFPREG and NT_X86_XSTATE for PTRACE_GETREGSET on amd64.
Chrome's crashpad handler uses these to collect floating-point and
extended CPU register state for crash dumps.
Other architectures retain the previous EINVAL stub behavior.
Signed-off-by: Ricardo Branco <rbranco at suse.de>
PR: 289285
Reviewed by: kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2165
(cherry picked from commit c515e6040614434a9262ee8b5ac54b81476ec7ff)
linux: Add linux_pt_fpregset and bsd_to_linux_fpregset() for amd64
Add struct linux_pt_fpregset, the amd64 Linux NT_PRFPREG payload,
corresponding to user_i387_struct in Linux. The struct describes
the 512-byte FXSAVE area as exposed by PTRACE_GETREGSET.
Add bsd_to_linux_fpregset() to translate from FreeBSD's struct fpreg
to struct linux_pt_fpregset. Fields are extracted from the fpr_env[]
array which stores the FXSAVE environment packed as four 64-bit words.
The FP and XMM register banks are bulk-copied as opaque byte arrays.
Signed-off-by: Ricardo Branco <rbranco at suse.de>
Reviewed by: kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2165
(cherry picked from commit b84d31ee74535a0026ff83f2a34c07b7557f9785)
linux: Ignore sigaction(2) flags SA_UNSUPPORTED and SA_EXPOSE_TAGBITS
SA_UNSUPPORTED was introduced in Linux 5.11 to probe support
for other flags such as SA_EXPOSE_TAGBITS, introduced
at the same time. Ignore both.
Signed-off-by: Ricardo Branco <rbranco at suse.de>
PR: 289285
Reviewed by: pouria, kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2163
(cherry picked from commit fdea83a5f63b881ade91c6cc9dfbf173137512c5)
misc/py-mmcv: Fix build on Python 3.13 and the runtime dependencies
PR: 299961
setup.py exec()s mmcv/version.py and then reads __version__ back
from locals(), which no longer works on 3.13 (PEP 667): exec into an
explicit namespace instead.
The package also could not be installed or imported on its own: the
extension links against libc10.so from py-pytorch (only a build
dependency so far), and mmcv.image imports cv2 at the top level. Add
both py-pytorch and py-opencv-python-headless to RUN_DEPENDS.
While here, follow the Python Ports Policy, add concurrent to
USE_PYTHON, fix portlint warnings and document the patches.
amd64/arm64 pmap: consistently clear PGA_WRITEABLE
We don't consistently clear PGA_WRITEABLE on fictitious, managed pages.
Some functions do, e.g., pmap_remove_all(), but several do not. At
worst, this is just a pessimization, but there is no good reason to be
inconsistent. Clear PGA_WRITEABLE in those that previously did not by
introducing (and using) the helper function pmap_page_is_mapped_locked()
that implements the correct test.
(cherry picked from commit 37321270b630d891e48851f81dd6d077ebd6b635)
x11/bhotkeys-dwm: New port
Stock dwm chords for bhotkeys. SUPERASMODKEY installs those
rows with Super as Mod, for a dwm built with that option.
Reviewed by: fuz (previous revision), jrm (previous revision)
Differential Revision: https://reviews.freebsd.org/D60934
x11/libinput: Fix the Python dependencies of the libinput tools
The Python tools in libexec/libinput (libinput-measure-*, -analyze-*,
-replay, ...) import libevdev, i.e. python-libevdev
(devel/py-libevdev), never evdev (python-evdev), yet RUN_DEPENDS lists
devel/py-evdev. Depend on the package they actually use. This also
stops pulling devel/py-evdev into every desktop installation.
libinput-analyze-recording, -analyze-per-slot-delta,
-analyze-touch-down-state, -analyze-buttons and libinput-replay import
yaml, which is not declared. Without PyYAML the analyze tools fail
with ModuleNotFoundError and libinput-replay refuses to run ("One or
more python modules are missing"). Add py-pyyaml to RUN_DEPENDS.
While here, fix portlint warnings.
PR: 299873
