net/croc: Relax the Go version pin to a minimum
croc's go.mod requires go 1.27.0, above the current GO_DEFAULT of 1.26, so
this is one of the rare ports that genuinely needs a version requirement.
Use the floating go:1.27+ form instead of an exact pin so the port moves to
the default once 1.27 becomes it, rather than being removed along with
lang/go127.
Dropping the requirement entirely still built, but only because the fetch
phase downloaded golang.org/toolchain at v0.0.1-go1.27.0.freebsd-amd64 and
built with that instead of the declared go126 dependency.
net/py-google-cloud-pubsub: Update to 2.39.2
Numerous fixes and enhancements since 2.32.0
Changes: https://github.com/googleapis/google-cloud-python/commits/ \
main/packages/google-cloud-pubsub
Release to ports@ (eliminating dependence on Google APIs)
Reported by: portscout
www/phpbb3: update to 3.3.17
3.3.14 is affected by CVE-2026-29199 (CVSS 8.1): with force_server_vars
disabled, phpBB builds the password reset link from the HTTP Host
header,
so an attacker who can control that header makes reset mails point to a
domain of their choice, which may lead to account takeover.
Also fixed since 3.3.14: improper state verification in the OAuth
implementation (SECURITY-293), IDOR when composing private messages
(SECURITY-286), CSRF on report submission (SECURITY-287), cross-user
notification read state manipulation (SECURITY-290) and HTML generation
from page data (SECURITY-283).
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.17/phpBB/docs/CHANGELOG.html
Security: CVE-2026-29199
Security: 4d06b948-a323-11f1-a655-3497f65b111b
MFH: 2026Q3
[3 lines not shown]
www/phpbb3: update to 3.3.17
3.3.14 is affected by CVE-2026-29199 (CVSS 8.1): with force_server_vars
disabled, phpBB builds the password reset link from the HTTP Host
header,
so an attacker who can control that header makes reset mails point to a
domain of their choice, which may lead to account takeover.
Also fixed since 3.3.14: improper state verification in the OAuth
implementation (SECURITY-293), IDOR when composing private messages
(SECURITY-286), CSRF on report submission (SECURITY-287), cross-user
notification read state manipulation (SECURITY-290) and HTML generation
from page data (SECURITY-283).
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.17/phpBB/docs/CHANGELOG.html
Security: CVE-2026-29199
Security: 4d06b948-a323-11f1-a655-3497f65b111b
MFH: 2026Q3
Sponsored by: Netzkommune GmbH
UPDATING: Fix entry for getgroups(2)/setgroups(2)
Fix a typo, grammar, and generally rephrase for better clarity.
Fixes: 3463f02706db ("UPDATING: add an entry for [gs]etgroups")
MFC after: 1 day
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
(cherry picked from commit b7cff2a8c47eb09968430e53cab8b05cf8897d3f)
