Mk/Uses/electron.mk: Secure reproducibility of node modules tarball in case of pnpm
Formerly, node_modules directories produced by "pnpm install" were
used for node modules tarball. However, .modules.yaml file contained
in the tarball is not reliably reproducible and differs in some way
depending on the environment and/or timing where/when the tarball was
produced.
Instead of relying on node_modules directories, we use pnpm
store (produced by "pnpm fetch") for node modules tarball. We can use
the tarball later to install node modules into appropriate directories
using "pnpm install". Note that the timestamp "checkedAt" in each JSON
file in the pnpm store is reset to 0 to ensure reproducibility.
Reported by: feld (via private email)
Tested by: feld
x11/kitty: Use BUILD_DEPENDS= x11-fonts/nerd-fonts-symbols
- The build dependency x11-fonts/nerd-fonts was split into subports in
commit 5ab056a5f85f709d8a6d7eb6582a94c85df37de5. Kitty requires only
the Symbols font, so the port can switch to the more lightweight
subport.
- Don't bump PORTREVISION because the resulting package does not change.
PR: 293280
devel/lua-cjson/openresty: [NEW PORT]
Fast JSON encoding/parsing for Lua with OpenResty enhancements
This fork of mpx/lua-cjson is included in the OpenResty bundle and includes
a few bugfixes and improvements, especially to facilitate the encoding of
empty tables as JSON Arrays.
Please refer to the lua-cjson documentation for standard usage.
WWW: https://github.com/openresty/lua-cjson
net-im/folks: update to 0.15.12
Update to 0.15.12:
overview of changes from libfolks 0.15.11 to libfolks 0.15.12
=============================================================
Bugs fixed:
* CI fixes
overview of changes from libfolks 0.15.10 to libfolks 0.15.11
=============================================================
Bugs fixed:
* eds backend: Correct patch for evolution-data-server 3.59.1 API changes
* meson: Set minimum GLib version to 2.80
Overview of changes from libfolks 0.15.9 to libfolks 0.15.10
============================================================
[9 lines not shown]
editors/vim: Update to 9.2.0073, multiple security fixes
While the minor has bumped, and much has changed from 9.1 to 9.2,
we've been incrementally adopting the patches so it's not "new" to us,
per se. All the gory details are at:
https://github.com/vim/vim/blob/master/runtime/doc/version9.txt
This commit adds patches for six security issues:
patch 9.2.0073: [security]: possible command injection using netrw
Problem: [security]: Insufficient validation of hostname and port in
netrw URIs allows command injection via shell metacharacters
(ehdgks0627, un3xploitable).
Solution: Implement stricter RFC1123 hostname and IP validation.
Use shellescape() for the provided hostname and port.
Github Advisory:
GHSA-m3xh-9434-g336
[63 lines not shown]
