mail/exim: 4.100 -> 4.100.1
Security: GCVE-25-2026-09-50-1, GCVE-25-2026-09-51-1,
GCVE-25-2026-09-55-1, GCVE-25-2026-09-56-1
Requested-by: The Doctor <doctor at doctor.nl2k.ab.ca>
net/pimd: update to 3.1.0
troglobit/pimd, the upstream this port tracked, has not seen a commit since
August 2022 and its last release, 2.3.2, is from 2016. The port was pinned
to an unreleased master snapshot (2.3.2b, commit 17ae62f) because there was
nothing newer to move to.
This new fork continues the tree and releases from it. 3.1.0 brings
Anycast-RP (RFC 4610), accept-nbr-from and register-accept-from, and rescans
interfaces at runtime so a link that comes up after the daemon started becomes
a vif without a restart.
Revert "virtual_oss(8): Fix cuse.ko check"
parse_options() was moved above cuse_init(), which makes every single
regular virtual_oss invocation which uses cuse_dev_create() fail.
This reverts commit f014795ec3bd5efb88dfc249599e9665dc10a59e.
www/angie-module-jwt: Update to 3.4.6
This bugfix release fixes the module's test suite:
test_conf forwarded an unquoted $@, so the expected message was split
on spaces and only its first word was ever grepped. Two expectations
were pointing at the wrong configuration file, unnoticed.
PR: 298635
Changes: https://github.com/max-lt/nginx-jwt-module/releases/tag/v3.4.6
Sponsored by: Netzkommune GmbH
www/angie-module-auth-jwt: Update to 0.15.0
This new release adds the nxe-phase submodule and bumps the version of
nxe-jwx from 0.2.0 to 0.4.0.
PR: 298634
Changes: https://github.com/kjdev/nginx-auth-jwt/releases
Sponsored by: Netzkommune GmbH
www/angie-module-njs: Security update to 1.0.1
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body
continuation threw an exception or produced an unhandled rejection
(CVE-2026-18329). Previously, nginx could continue processing the
request as though the js_access check had succeeded. Affects
0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an
upstream server returned a status line with an empty reason phrase
(CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to
xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
[3 lines not shown]
www/angie: Security update to 1.12.2
This maintenance release fixes CVE-2026-90439:
When using an OpenSSL version without native HTTP/3 support (3.5.0
or earlier), if the default server for the address that accepted a
regular HTTPS request also used HTTP/3 (the listen directive with the
quic parameter, possibly on a different port), while a server block
without HTTP/3 was selected by domain name (SNI), limited worker process
memory corruption or a worker process crash could occur
(CVE-2026-90439); the fix was ported from nginx 1.31.6.
PR: 298632
Changes: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-2
Security: 6cf2ff4b-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
sound: Lock around mixer_set*() in mixer_init() for consistency
Sponsored by: The FreeBSD Foundation
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D59110
sound: Remove unncessary locking in sysctl_hw_snd_hwvol_mixer()
The locking around strlcpy() was because of m->hwvol_mixer, but this is
just an int, so we don't need to lock in this case. Instead lock only
when m->hwvol_mixer is written.
While here, add parentheses around the returns.
Sponsored by: The FreeBSD Foundation
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D59109
sound: Improve some mixer return values and their handling
Sponsored by: The FreeBSD Foundation
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D59078
sound: Do not set a recording source in mixer_uninit()
We currently set the recording source to SOUND_MIXER_MIC during mixer
deletion. Apart from the fact that this control might not be present on
all devices, it is unnecessary to do that, plus we already set all the
volumes to 0 in the mixer_set() call above.
Sponsored by: The FreeBSD Foundation
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D59076
sound: Retire mixer_hwvol locked variants
Prior to 9a00e0b8ca56 ("snd_uaudio: Do not use snd_mixer->lock as
mixer_lock"), there was a need for mixer_hwvol_mute_locked() and
mixer_hwvol_step_locked(), because the unlocked variants would acquire
the lock, but uaudio_hid_rx_callback() would also hold the lock, so this
was a measure to avoid recursion on snd_mixer->lock. Now that
snd_uaudio(4) has a private mixer lock, the locked variants are not only
unnecessary, but wrong, because we now lock the private lock and not the
snd_mixer one, which is what mixer_hwvol_mute_locked() and
mixer_hwvol_step_locked() expect. Retire the locked variants and call
the regular functions instead.
The unlocked variants take the mixer lock, which is now the PCM lock,
and reach uaudio_mixer_ctl_set(), which takes mixer_lock. Calling them
straight from uaudio_hid_rx_callback() would therefore take mixer_lock
and the PCM lock in the opposite order to the mixer ioctl path, so
record what the HID report asked for and perform the volume change at
the end of the callback, with mixer_lock dropped. The USB stack allows a
[5 lines not shown]
sound: Use snddev_info->lock in place of snd_mixer->lock
snd_mixer and snddev_info have a 1:1 relationship. Now that snd_mixer is
embedded into snddev_info, it makes even more sense for both to share
the PCM lock. The only exceptions to this are MIXER_TYPE_SECONDARY
mixers, which still retain a private lock (snd_mixer->priv_lock),
because they are attached to the device driver, and not snddev_info.
Only snd_emu10kx(4) uses a secondary mixer.
A side-effect of this is that the MIXER_SET_LOCK()/MIXER_SET_UNLOCK()
mess goes away. These macros were used in the mixer_set*() functions to
drop the mixer lock if the driver is Giant-locked and the function can
sleep inside MIXER_SET*() methods, and to avoid an LOR before locking
PCM to guard channel list traversal.
Since mixers now use the PCM lock, drop the channel lock in
chn_syncstate() before calling mix_get(), to avoid an LOR. These lines
were actually already commented out for years.
[3 lines not shown]
