devel/py-importlib-metadata7: Mark DEPRECATED
- No consumers left
- Use devel/py-importlib-metadata8
- Set EXPIRATION_DATE 2026-10-01
(cherry picked from commit e3a63a09a99f51ec5b3da775acaf9541899d6c76)
devel/py-importlib-metadata6: Mark DEPRECATED
- No consumers left
- Use devel/py-importlib-metadata7
- Set EXPIRATION_DATE 2026-10-01
(cherry picked from commit 30b5640b94497d47d0c0d50a24a5837a2fb63917)
security/vuxml: Document remaining Erlang/OTP vulnerabilities
Upstream published 16 advisories alongside OTP 29.0.6, 28.5.0.6 and
27.3.4.17. CVE-2026-75538 already had an entry; add a combined one for
the other 15, which share the same affected packages and fixed versions.
Most are in the inets httpd and httpc implementations: HTTP request
smuggling, two mod_auth authentication bypasses and several denial of
service issues, plus unbounded integer conversion in stdlib, snmp and
eldap.
Also add the now-published GHSA reference to the CVE-2026-75538 entry.
databases/couchdb3: Resolve bundled OTP versions dynamically in PLIST_SUB
The release bundles erts and 13 OTP applications from
lang/erlang-runtime28, and pkg-plist pinned each of their versioned
directory names. Six of the last eight plist commits were pure OTP
rename churn, the largest touching 610 lines, while the 3.5.2 update
itself touched 23.
Derive the versions from the installed runtime at plist-generation time
instead. The package file list is unchanged: resolving the tokenized
plist with the versions this build staged reproduces the previous
pkg-plist byte for byte, so no PORTREVISION bump is needed.
An erlang-runtime28 update now needs only a PORTREVISION bump. Note
this reads ${LOCALBASE}/lib/erlang28 rather than the staged release,
because generate-plist runs before do-install; it holds as long as the
release copies erts and the OTP applications unmodified.
CouchDB's own rebar dependencies stay pinned deliberately - they move
[6 lines not shown]
