lang/go127: Update to 1.27.4
Changes:
go1.27.4 (released 2026-11-10) includes security fixes to cgo, the go
command, the compiler, the linker, and the net/http package, as well
as bug fixes to the assembler, the compiler, the runtime, toolchain
bootstrapping, and the crypto/fips140, crypto/hkdf, crypto/rsa,
crypto/tls, and net packages.
MFH: 2026Q4
(cherry picked from commit d385e2920918ef942585f9955d9e31f0a0c22f05)
lang/go126: Update to 1.26.11
Changes:
go1.26.11 (released 2026-11-10) includes security fixes to cgo, the go
command, the compiler, the linker, and the net/http package, as well
as bug fixes to the assembler, the compiler, the runtime, toolchain
bootstrapping, and the crypto/fips140, crypto/hkdf, crypto/rsa,
crypto/tls, net, and net/http packages.
MFH: 2026Q4
(cherry picked from commit c112de9e568feddaf7644108f547d3e1e52ce24b)
acpi_cpu: No longer disable idle during suspend
This had been introduced in 3331373ce733 ("Disable CPU idle states
during suspend and reenable them during resume.") to work around C-state
selection logic which would skip C-states which returned immediately,
considering them "broken".
This workaround is incompatible with suspend-to-idle however, which
requires CPUs to be in their idle states, and is no longer relevant
either way since b0baaaaecf1a ("Avoid comparing negative signed to
positive unsignad values.") removed the C-state skipping logic the
previous change was working around.
Reviewed by: olce
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/71
Differential Revision: https://reviews.freebsd.org/D60649
libfetch: Prepare for OpenSSL 4
* Always use libmd's MD5 since it's deprecated in OpenSSL.
* Use ASN1_STRING_get_length() instead of ASN1_STRING_length().
security/py-social-auth-core5: New port
This is the core component of the python-social-auth ecosystem, it
implements the common interface to define new authentication backends
to third parties services, implement integrations with web frameworks
and storage solutions.
Note: This port is primarily intended for use with net-mgmt/netbox,
which currently does not support newer versions of py-social-auth-core.
net-mgmt/netbox: Add Django 6.1 consumers
* Django 5.2 is currently the "default" version in the ports tree due
its long term support until April 2028. Thus ports that are assigned
to that version will exist until then.
The following ports are required to make the upgrade of
net-mgmt/netbox to the 4.7 release possible because it requires
Django 6.1.
All of the ports listed below were created on the basis of their
respective original ports:
- devel/py-dj61-django-rq
- devel/py-dj61-strawberry-graphql
- graphics/py-dj61-sorl-thumbnail
- www/py-dj61-channels
- www/py-dj61-django-auth-ldap
- www/py-dj61-django-choices-field
[16 lines not shown]
net-mgmt/netbox: Update to 4.7.5
* Remove no longer required workaround for DRF 3.18.3.
* Sort some dependencies and prune update instructions for NetBox
releases older than 3.7 while I'm here.
Netbox 4.7 contains many bugfixes/enhancements and the following new
features:
* Cooling Infrastructure Modeling
* Channelized Subinterfaces
* Multi-Protocol Application Services
* Module Bay Types
* Relocating Installed Modules
* Background Processing for REST API Requests
* Per-Object Errors for Bulk Operations
* Pre-Rendered Config Context Data
* Snapshot-Aware Event Rule Conditions
[4 lines not shown]
security/py-social-auth-core: Update to 5.2.0
* Adjust testsuite accordingly so that the results are successful
depending on the configuration.
* Note: This is an interim update to create a py-social-auth-core5 port
based on this, which is limited to the 5.x release series and adjust
CONFLICTS_INSTALL for future variants of py-social-auth-core.
Changelog since 5.0.1:
https://github.com/python-social-auth/social-core/blob/5.2.0/CHANGELOG.md
Approved by: ultima (maintainer, implicit)
MFH: 2026Q4
lang/go127: Update to 1.27.4
Changes:
go1.27.4 (released 2026-11-10) includes security fixes to cgo, the go
command, the compiler, the linker, and the net/http package, as well
as bug fixes to the assembler, the compiler, the runtime, toolchain
bootstrapping, and the crypto/fips140, crypto/hkdf, crypto/rsa,
crypto/tls, and net packages.
MFH: 2026Q4
lang/go126: Update to 1.26.11
Changes:
go1.26.11 (released 2026-11-10) includes security fixes to cgo, the go
command, the compiler, the linker, and the net/http package, as well
as bug fixes to the assembler, the compiler, the runtime, toolchain
bootstrapping, and the crypto/fips140, crypto/hkdf, crypto/rsa,
crypto/tls, net, and net/http packages.
MFH: 2026Q4
modstat: avoid copying from freed memory
If a module is unloaded after the module is looked up in kern_modstat,
but before one of the copyout's occurs, then the memory being copied
might be freed and reused leading to an information disclosure.
The LLM was particularly concerned about a TOCTOU issue in the length
of the name, but it seems likely that there are issues with all the
copyout's. As such, hold the shared lock throughout.
Reviewed by: markj
Reported by: llm-postcr
MFC after: 3 days
Sponsored by: Innovate UK
Fixes: 9b3851e9e3b1 ("- Lock down the ``module'' structure...")
Differential Revision: https://reviews.freebsd.org/D61398
www/linux-chrome: Security update to 157.0.8103.50
Fixes an out of bounds write in GPU that lets a crafted page run code
outside the sandbox, a buffer overflow in Compositing that does the
same once the renderer is compromised, and type confusion in V8 and
use after free in XML inside the sandbox.
Chrome now ships as an rpm 6 package whose payload libarchive cannot
read, so extract through rpm2archive.
Changelog: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Security: a18ffa98-dd42-11f1-8816-a0369f7f7be0
Sponsored by: Netzkommune GmbH
(cherry picked from commit 6b96fd5c3ab4e2f310e9201a6e146e7ee7d98ad3)
www/linux-chrome: Security update to 157.0.8103.50
Fixes an out of bounds write in GPU that lets a crafted page run code
outside the sandbox, a buffer overflow in Compositing that does the
same once the renderer is compromised, and type confusion in V8 and
use after free in XML inside the sandbox.
Chrome now ships as an rpm 6 package whose payload libarchive cannot
read, so extract through rpm2archive.
Changelog: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Security: a18ffa98-dd42-11f1-8816-a0369f7f7be0
Sponsored by: Netzkommune GmbH
