BSD Commit Log Search

security/vuxml: Document Nginx vulnerabilities

add entry for www/nginx-devel

Sponsored by:   Netzkommune GmbH

sysutils/osquery: Fix build on FreeBSD < 15

Reported by:    pkg-fallout

science/v_sim: fix plist

It seems that Python files are not always installed at the same location
depending on the platform.

Since I’m there register missing dependencies with minor improvements.

PR:             295393
Reported by:    D. Engberg

www/nginx-devel: Update to 1.31.0

Changes with nginx 1.31.0                                        13 May
2026

    *) Security: when using the "proxy_set_body" directive, an attacker
       might inject data in the proxied request to an HTTP/2 backend
       (CVE-2026-42926).
       Thanks to Mufeed VH of Winfunc Research.

    *) Security: a heap memory buffer overflow might occur in a worker
       process while handling a specially crafted request by
       ngx_http_rewrite_module, potentially resulting in arbitrary code
       execution (CVE-2026-42945).
       Thanks to Leo Lin.

    *) Security: a heap memory buffer overread might occur in a worker
       process while handling a specially crafted response by
       ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an

    [69 lines not shown]

net/netatalk4: Update to 4.4.3

See https://github.com/Netatalk/netatalk/releases/tag/netatalk-4-4-3 for
a list of changes in this release.

accessibility/at-spi2-core: update to 2.60.3

PR:             294998

science/py-pymatgen-core: update 2026.4.16 → 2026.5.18

math/py-daqp: update 0.6.0 → 0.8.7

math/ignition-math: update 6.16.0 → 9.0.0

devel/ignition-msgs: update 3.2.0 → 12.0.0

devel/ignition-utils: New port: General-purpose classes and functions for Gazebo projects

devel/ignition-tools: update 1.5.0 → 2.0.3

math/py-cvxpy: update 1.6.4 → 1.9.0

devel/ignition-plugin: update 1.4.0 → 4.0.0

devel/ignition-common: update 3.17.1 → 7.0.0

devel/ignition-cmake: update 2.18.0 → 5.0.0

misc/py-gguf: update 0.18.0.8913 → 0.19.0.9222

security/cowrie: update 2.9.17 → 2.9.19

misc/llama-cpp: update 9159 → 9222

math/py-sparsediffpy: New port: Python bindings for SparseDiffEngine algorithmic differentiation

devel/py-monty: update 2026.2.18 → 2026.5.18

science/libcifpp: update 10.0.3 → 10.0.4

math/py-osqp: update 0.6.2.post5 → 1.1.1

misc/py-comfy-aimdo: update 0.4.2 → 0.4.3

misc/comfy-cli: update 1.8.0 → 1.10.0

math/R-cran-GPArotation: Update to 2026.4-1

Changelog: https://cran.r-project.org/web/packages/GPArotation/NEWS

www/freenginx-acme: update freenginx distibution version

Bump PORTREVISION.

Sponsored by:   tipi.work

www/freenginx-devel: update: 1.31.0 -> 1.31.1

Sponsored by:   tipi.work

<ChangeLog>

*) Feature: the "off" parameter of the "index" directive.
   Thanks to Fabiano Furtado.

*) Bugfix: a segmentation fault might occur in a worker process if the
   "rewrite" directive was used to change request arguments and other
   directives of the ngx_http_rewrite_module were executed afterwards.

*) Bugfix: in the "set" directive.

*) Bugfix: a segmentation fault might occur in a worker process if the
   ngx_http_charset_module was used to convert responses from UTF-8.

*) Bugfix: in the ngx_http_charset_module.

    [12 lines not shown]

www/freenginx-devel: update njs 0.9.8 -> 0.9.9 (+)

Bump PORTREVISION.

<ChangeLog>

nginx modules:

*) Security: a heap buffer overflow might occur in a worker process
   when the "js_fetch_proxy" directive value contains nginx
   variables derived from the client request ($http_*, $arg_*,
   $cookie_*, etc.) and the location's JS handler invokes
   ngx.fetch(). The issue was introduced in dea83189 (0.9.4).

*) Feature: added js_access directive.

*) Feature: added r.readRequestText(), r.readRequestArrayBuffer(),
   and r.readRequestJSON() - async methods that read the request
   body, available in js_access and js_content directives.

    [19 lines not shown]

www/nginx-devel: Update to 1.31.0

Changes with nginx 1.31.0                                        13 May
2026

    *) Security: when using the "proxy_set_body" directive, an attacker
       might inject data in the proxied request to an HTTP/2 backend
       (CVE-2026-42926).
       Thanks to Mufeed VH of Winfunc Research.

    *) Security: a heap memory buffer overflow might occur in a worker
       process while handling a specially crafted request by
       ngx_http_rewrite_module, potentially resulting in arbitrary code
       execution (CVE-2026-42945).
       Thanks to Leo Lin.

    *) Security: a heap memory buffer overread might occur in a worker
       process while handling a specially crafted response by
       ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an

    [69 lines not shown]