databases/mysql97-{client,server}: Update to 9.7.2
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 43 of the 54 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
Drop patch-libs_mysql_gtid_tag__plain.h, the type_traits include
is upstream as of 9.7.2.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html
Security: 10f5f76e-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
(cherry picked from commit e04b81ba66c8f185ffc21337c18161ac69bff145)
databases/mysql97-{client,server}: Update to 9.7.2
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 43 of the 54 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
Drop patch-libs_mysql_gtid_tag__plain.h, the type_traits include
is upstream as of 9.7.2.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html
Security: 10f5f76e-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql84-{client,server}: Update to 8.4.11
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 31 of the 54 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-11.html
Security: 10f5d195-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026
The Oracle Critical Patch Update of July 2026 fixes 54 issues in
Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series,
including the MySQL Router shipped with the server ports.
Three issues require no credentials: one in the X Plugin and two in
MySQL Router, the latter of which allows unauthorized read and write
access. The remaining ones mostly need a privileged account and lead
to a denial of service.
Fixed in 8.4.11 and 9.7.2 respectively.
Sponsored by: Netzkommune GmbH
ctl.4: Document the assumption that CTL HA runs only on trusted networks
The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover. The implementation uses a TCP
connection to exchange messages. There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts. This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.
Provide a warning to this effect in the CTL man page.
Reported by: Ryan of Calif.io
Reviewed by: ziaee, ken, mav
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58622
rawip: Fix handling of checksums in rip6_input()
A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet. If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.
Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.
Fixes: de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by: pouria, glebius
Reported by: Yunzhi Ke
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58559
games/anki: Update to 26.08
* Switch to USES=npm and adjust/remove the relevant parts.
Although Yarn v4 is already being used according to "package.json",
stick with Yarn v1 for now to complete a 1:1 migration from the before
to the after state with respect to the used tools during build.
Changelog:
https://github.com/ankitects/anki/releases/tag/26.08
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
(cherry picked from commit 87d11fd7305cb245dff284e34be3a5c0c423aa60)
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
pseudofs: Don't purge the cache on shutdown
This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.
MFC after: 1 week
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58359
lang/ldc: add new bootstrap for powerpc64le after long double switch
Two new patches:
1. Don't use glibc's dual long double mechanism - we don't support
IBM long double.
2. Use proper mangling.
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Fix build and loading of the 3rd party gridfs module after the
devel/mongo-c-driver 2.x update.
The module config now obtains include and linker flags from
pkg-config instead of deriving them from the ports tree's
DISTVERSION. The previous approach ran a recursive make into
devel/mongo-c-driver on every make invocation, even with GRIDFS
unset, and derived the libbson include path from the mongo-c-driver
version although devel/libbson is a separate port with its own
DISTVERSION. Both directories happen to carry the same version
today, so the mismatch was not visible yet.
While here, add the missing assert.h include. The module calls
assert() without declaring it, which left an unresolvable symbol
"assert" in the shared object -- libc only exports __assert. Since
nginx dlopen()s modules with RTLD_NOW, load_module refused to load
the module at runtime.
[5 lines not shown]
