graphics/R-cran-patchwork: New port: The Composer of Plots
patchwork expands the ggplot2 API to allow arbitrarily complex
composition of plots by providing mathematical operators for combining
multiple plots.
PR: 296816
Reviewed by: jrm
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D60942
security/vuxml: Document phpMyAdmin vulnerabilities
Seven issues in phpMyAdmin up to and including 5.2.3 were published on
2026-10-30, with VulnCheck as the assigning CNA. The worst of them is
an authentication bypass in the WebAuthn second factor, and the
request forgery in setup/validate.php needs no authentication at all.
There is no fixed release and no announcement from the project, so the
entry carries an open range for both ports.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
[7 lines not shown]
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
[8 lines not shown]
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
(cherry picked from commit 9ed8b30188ce739e2fcae47fc2e516ead668a97c)
security/vuxml: Document MySQL vulnerabilities of October 2026
Four entries: 8.4 and 9.7, fixed in 8.4.13 and 9.7.4; 26.7, which is
end of life and has no fix, with an open range; and the connectors,
fixed in 26.10.0. mysql-shell is listed with 9.7, it bundles and
statically links the MySQL client code.
The two issues in the bundled curl and OpenSSL copies are left out,
these ports build against the libraries of the system.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
[5 lines not shown]
databases/mysql267-{server|client}: Deprecate and set an expiration date
MySQL 26.7 reached its end of life on 2026-10-20 with the release of
26.10. An Innovation release is maintained only until the next one
appears, so there will be no further 26.7 release.
79 of the 80 MySQL server issues of the Oracle Critical Patch Update
of October 2026 apply to 26.7, five of them only to 26.7, plus five in
the MySQL Router built from this port. None of them will be fixed.
Switch to databases/mysql2610-server. The expiration date is a week
out and not the usual months: the port entered the tree on 2026-10-12
and ships unfixed vulnerabilities.
Security: 24aaad94-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
[6 lines not shown]
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
databases/mysql2610-{server|client}: Add New Port
Welcome MySQL 26.10
MySQL 26.10 is the Innovation release following 26.7, which reached its
end of life with this release.
What is new in MySQL 26.10:
https://dev.mysql.com/doc/relnotes/mysql/26.10/en/news-26-10-0.html
Compared to mysql267:
- Drop seven LibreSSL guards, LibreSSL 4.4.0 has everything they
worked around
- Keep two: SSL_COMP_get_compression_methods() returns void * and
there is no SSL_COMP_get_id() or SSL_COMP_get0_name()
- Add traits to ut0prefix_cache.h and log0parsed_index_lru_cache.h,
libc++ has no character traits for a byte type
- Do not install the client-side authentication plug-ins
- Declare libfido2 and install the WebAuthn plug-in
[7 lines not shown]
devel/subversion{,-lts}: make apr_memcache opt-out explicit
configure otherwise silently autodetects a standalone apr_memcache installation
on the build host for fs_fs caching (server-side only FSFS repository caching);
this was never actually supported. Pass --without-apr_memcache explicitly
instead of leaving it to autodetection.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
www/mod_dav_svn: rename to www/mod_subversion
The port has always built and installed three Apache modules (mod_dav_svn,
mod_authz_svn, mod_dontdothat), not just DAV support, so a name promising
only one of the three was misleading. Add PKGNAMEPREFIX=${APACHE_PKGNAMEPREFIX},
matching other modules.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
finance/odoo: Update to 20261023
- devel/py-setuptools and devel/py-wheel are added to BUILD_DEPENDS
- SHEBANG_LANG=python is dropped; USES=shebangfix already handles python
- odoo.conf.sample is installed with INSTALL_DATA instead of
INSTALL_SCRIPT, and is generated through SUB_FILES, so its commented
addons_path names the right site-packages (it said python3.11)
- odoo.conf.sample sets http_interface = 0.0.0.0, the 19.0 default, with
a note that 127.0.0.1 fits behind a local proxy and becomes the
default in Odoo 20.0; 19.0 warned at start that the option was
missing. Existing etc/odoo/odoo.conf files are not changed
- the rc script passes --without-demo=True instead of
--without-demo=all, which 19.0 no longer accepts as a boolean (it
logged "invalid boolean value: 'all', assume True"); the meaning, no
demo data, is the same
- portclippy and portfmt warnings are fixed
PR: 300224
Reported by: Patrick Crandol <patrick ___at__ crandol.com>
finance/py-ofxparse: Drop the unused py-nose dependency
- the port switches to USE_PYTHON=pep517 (the package metadata becomes
dist-info)
- concurrent is added to USE_PYTHON
- portlint warnings are fixed
PR: 300225
Reported by: Patrick Crandol <patrick _at__ crandol.com>
net-mgmt/py-pdagent: Fix on Python 3.12+
- The vendored six 1.13.0 only implements the find_module() import
protocol, which Python 3.12 no longer uses, so every
pdagent.thirdparty.six.moves import failed and the agent and pd-*
tools could not start. Add find_spec(), create_module() and
exec_module() as in six 1.16.
- pdagent.config used SafeConfigParser, removed in Python 3.12; use
ConfigParser, its equivalent.
While here, fix portlint warnings and document the patches.
PR: 300277
www/py-selenium-wire: Deprecate
The vendored mitmproxy imports blinker._saferef, which blinker 1.8
removed, so seleniumwire.webdriver no longer imports. Its certs.py
also uses pyOpenSSL crypto.X509Extension/X509Req, which pyOpenSSL 26.4
no longer has, so the TLS interception core would need porting to
cryptography. Upstream is archived; 5.1.0 (2022) is the last release.
PR: 299851
devel/py-naiveBayesClassifier: Fix import on Python 3
classifier and trainedData do a Python 2 implicit relative import of
ExceptionNotSeen, so the Classifier and Trainer API fails to import on
Python 3. Use the absolute import, as upstream master does.
While here, set NO_ARCH (the port installs only pure-Python files),
add concurrent to USE_PYTHON, fix portlint warnings and document the
patches.
Switch to USE_PYTHON=pep517 (the package metadata becomes dist-info).
PR: 299850
devel/py-apache_conf_parser: Fix import on Python 3.10+
The collections ABC aliases (collections.MutableSequence etc.) were
removed in Python 3.10, so importing apache_conf_parser fails with an
AttributeError. Import collections.abc instead; the change is folded
into the existing files/patch-indent.
While here:
- set NO_ARCH: the port installs only pure-Python files;
- point WWW at PyPI (the Bitbucket repository is gone) and expand
pkg-descr;
- add concurrent to USE_PYTHON, fix portlint warnings and document
the patch.
Switch to USE_PYTHON=pep517 (the package metadata becomes dist-info).
PR: 299849
devel/py-daemon-runner: Replace pipes with shlex for Python 3.13
The pipes module was removed in Python 3.13. daemon_runner imports it
for pipes.quote, so daemon-runner fails to start. Use shlex.quote
(added to the existing patch-2to3).
While here, add concurrent to USE_PYTHON (bin/daemon-runner), fix
portlint warnings and document the patch.
Switch to USE_PYTHON=pep517 (the package metadata becomes dist-info).
PR: 299725
devel/py-tendo: Fix tendo.tee on Python 3.13
tendo.tee imports pipes, which was removed in Python 3.13; use
shlex.quote() (the same function), as upstream main does.
Add the missing py-six dependency (install_requires; tee, unicode,
colorer and ansiterm import it).
While here, document the patch.
Switch to USE_PYTHON=pep517 (the package metadata becomes dist-info).
PR: 299726
security/py-flask-kerberos: Fix with Flask 3.x and Python 3
Flask 3.0 removed _request_ctx_stack, so importing flask_kerberos
fails with an ImportError. Store the per-request GSSAPI state on
flask.g instead of on the request context. Also take the KrbError
message from exc.args instead of the Python 2 only exc.message: the
old code made init_kerberos() crash at application start-up when the
keytab lacks the principal. Use logger.warning() instead of the
deprecated warn().
While here, add concurrent to USE_PYTHON, expand pkg-descr and
document the patch.
Switch to USE_PYTHON=pep517 (the package metadata becomes dist-info).
PR: 300271
java/java-subversion: move to devel/java-subversion
All other Subversion language bindings (py-/ruby-/p5-subversion)
already live under devel/; java-subversion was the odd one out.
Bump PORTREVISION to signal the move.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
