math/octave-forge-llms: fix build on non-x86
/usr/local/bin/mkoctfile -march=native -O2 fig2base64.cc fpng.cpp
c++: error: unsupported option '-march=' for target 'powerpc64le-unknown-freebsd15.0'
Also use __BYTE_ORDER__ instead of __BYTE_ORDER (which is undefined).
Reduce number of external symbols in libllvm, libclang and liblldb
In commit 2e47f35be5dc libllvm, libclang and liblldb were converted into
private shared libraries. This allowed clang, lld, lldb, and other llvm
tools to be linked against these shared libraries, which makes them
smaller and avoids duplication.
However, upstream builds the shared libraries using several visibility
options, which reduces the number of external symbols, and makes the
libraries a bit smaller.
On my test machine:
* libprivatellvm.so goes from 75643 to 34706 symbols (~54% reduction)
* libprivateclang.so goes from 53250 to 33531 symbols (~37% reduction)
* libprivatelldb.so goes from 27242 to 18798 symbols (~31% reduction)
Note: to get the full benefit, a clean build is required. Incremental
builds should still work, but I didn't want to force a full rebuild on
everybody.
[2 lines not shown]
devel/electron38: Update to 38.7.2
While here:
- switch to use USE_ELECTRON features of electron.mk for specifying
node package manager, pre-fetching necessary node modules, and
extracting the node modules into appropriate directories
- use USES=display for starting/stopping display server on testing
- specify TEST_ENV instead of listing env vars in test target
Changelog: https://github.com/electron/electron/releases/tag/v38.7.2
security/dropbear: update to 2025.89
Changelog:
- Security: Avoid privilege escalation via unix stream forwarding in Dropbear
server. Other programs on a system may authenticate unix sockets via
SO_PEERCRED, which would be root user for Dropbear forwarded connections,
allowing root privilege escalation.
Reported by Turistu, and thanks for advice on the fix.
This is tracked as CVE-2025-14282, and affects 2024.84 to 2025.88.
It is fixed by dropping privileges of the dropbear process after
authentication. Unix stream sockets are now disallowed when a
forced command is used, either with authorized_key restrictions or
"dropbear -c command".
In previous affected releases running with "dropbear -j" (will also disable
TCP fowarding) or building with localoptions.h/distrooptions.h
"#define DROPBEAR_SVR_LOCALSTREAMFWD 0" is a mitigation.
[38 lines not shown]
Fix remaining zgrep(1) wrapper script regressions
Summary:
Fix short flags without whitespace, e.g:
zgrep -wefoo test
Fix multiple -e flags:
zgrep -e foo -e xxx test
Previously only the last pattern would be used.
Clean up possible leading blank in ${grep_args}.
Update comment: 2.51 -> 2.6.0
Add a test case for the last known zgrep wrapper issue: recursion
(-r) not implemented.
[6 lines not shown]
libpcap: fix resource leaks and set error messages
In finddevs_bpf() close the BPF device descriptor and free the device list
buffer before returning.
For ioctl() and malloc() errors, use pcapint_fmt_errmsg_for_errno() to
generate an error message.
Fix some comments.
(cherry picked from commit 6870404f35da32d63a0a8789edb010842dd6b208)
net: add ifnet_rename_event EVENTHANDLER(9) for interface renaming
and don't trigger ifnet_arrival_event and ifnet_departure_event for a
rename, as the interface isn't being detached from any protocol. The
consumers of the arrival/departure events are divided into a few
categories:
- which indeed need to do the same actions as if interface was fully
detached and attached: routing socket and netlink notifications to
userland and the Linux sysfs. All addressed by this commit.
- which build their logic based on an interface name, but should actually
update their database on rename: packet filters. This commit leaves
them with the old behavior - emulate full detach & attach, but this
should be improved.
- which shouldn't do anything on rename, not touched by the commit.
- ng_ether and if_tuntap, that are special and will be addressed by
separate commits.
net: on interface detach purge multicast addresses after protocols
We first want to give a chance to all owners of multicast addresses to
free them and only then run through the list of remaining ones. It might
be that no addresses remain there normally, but this needs to be analyzed
deeper. For now restore the sequence that was before 0d469d23715d to fix
a possible use after free.
Fixes: 0d469d23715d690b863787ebfa51529e1f6a9092
ipfw: fix bpf tap point lookup
The trick I blindly used works for pointers to structs, but not for rule
numbers that can differ only by 1.
PR: 291854
Fixes: 3daae1ac1d82ecdcd855101bab5206e914b12350
