editors/openoffice-devel: switch to upstream trunk
Switch to following the upstream trunk branch. The AOO42X is likely a
dead end, and the next major release will propably be 5.0.0.
bhyveload: do not hang on EOF from console input
Currently, when bhyveload(8) fails to boot the guest,
it drops into the loader prompt waiting for user input.
This behaviour is inconvenient when using bhyveload(8) from
scripts.
Make it exit when it receives EOF from console input.
PR: 286289
Reviewed by: markj
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59226
bhyve: fix byte order for manually set NVMe eui64
Manually specified eui64 value gets converted to big endian twice:
first using htobe64() and then using be64enc(). On little-endian hosts
that results in a little-endian value instead of a big-endian.
Fix by removing htobe64() for a user submitted value.
Fixes: 409a80e5a434 ("bhyve: Create EUI64 for NVMe namespaces")
Reviewed by: chuck
Relnotes: yes
Sponsored by: The FreeBSD Foundation
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D59080
(cherry picked from commit 8bd30a72e7012126a1c8d52b3ba32f844a88f8dc)
www/angie-module-njs: Security update to 1.0.1
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body
continuation threw an exception or produced an unhandled rejection
(CVE-2026-18329). Previously, nginx could continue processing the
request as though the js_access check had succeeded. Affects
0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an
upstream server returned a status line with an empty reason phrase
(CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to
xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
[5 lines not shown]
www/angie: Security update to 1.12.2
This maintenance release fixes CVE-2026-90439:
When using an OpenSSL version without native HTTP/3 support (3.5.0
or earlier), if the default server for the address that accepted a
regular HTTPS request also used HTTP/3 (the listen directive with the
quic parameter, possibly on a different port), while a server block
without HTTP/3 was selected by domain name (SNI), limited worker process
memory corruption or a worker process crash could occur
(CVE-2026-90439); the fix was ported from nginx 1.31.6.
PR: 298632
Changes: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-2
Security: 6cf2ff4b-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
(cherry picked from commit 1fa3fa28695213f50759b063a1097cc5ffdf8d83)
graphics/R-cran-Cairo: New port
R graphics device using the cairographics library for high-quality
vector (PDF, PostScript, SVG) and bitmap (PNG, JPEG, TIFF) output,
plus X11/Win32 display backends.
Reviewed by: fuz, mat (previous revision)
Differential Revision: https://reviews.freebsd.org/D22681
