BSD Commit Log Search

www/angie-module-njs: Security update to 1.0.1

This maintenance update of njs fixes three security issues:

- Access control bypass in js_access when an asynchronous request body
  continuation threw an exception or produced an unhandled rejection
  (CVE-2026-18329). Previously, nginx could continue processing the
  request as though the js_access check had succeeded. Affects
  0.9.9-1.0.0. Thanks to Ta Duc Thien.

- Worker process crash when reading Response.statusText after an
  upstream server returned a status line with an empty reason phrase
  (CVE-2026-78222). Affects 0.5.1-1.0.0.

- Heap buffer overflow while parsing namespace prefix lists passed to
  xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
  Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.

PR:             298637

    [5 lines not shown]

www/angie: Security update to 1.12.2

This maintenance release fixes CVE-2026-90439:

When using an OpenSSL version without native HTTP/3 support (3.5.0
or earlier), if the default server for the address that accepted a
regular HTTPS request also used HTTP/3 (the listen directive with the
quic parameter, possibly on a different port), while a server block
without HTTP/3 was selected by domain name (SNI), limited worker process
memory corruption or a worker process crash could occur
(CVE-2026-90439); the fix was ported from nginx 1.31.6.

PR:             298632
Changes:        https://en.angie.software/angie/docs/oss_changes/#angie-1-12-2
Security:       6cf2ff4b-b38c-11f1-a655-3497f65b111b
Sponsored by:   Netzkommune GmbH

(cherry picked from commit 1fa3fa28695213f50759b063a1097cc5ffdf8d83)

devel/rubygem-opentelemetry-exporter-otlp: update to 0.36.0

Changes:        https://open-telemetry.github.io/opentelemetry-ruby/opentelemetry-exporter-otlp/v0.30.0/file.CHANGELOG.html

archivers/lrzip: update to 0.7.3

games/naev: Fix build

Reported by:    pkg-fallout

games/etlegacy: Update to 2.86.0

games/alienarena*: update to 7.72.3

misc/codex: Update to 0.155.1

Changelog:
- https://github.com/openai/codex/releases/tag/rust-v0.155.0
- https://github.com/openai/codex/releases/tag/rust-v0.155.1

Reported by:    GitHub (watch releases)

graphics/R-cran-Cairo: New port

R graphics device using the cairographics library for high-quality
vector (PDF, PostScript, SVG) and bitmap (PNG, JPEG, TIFF) output,
plus X11/Win32 display backends.

Reviewed by:    fuz, mat (previous revision)
Differential Revision:  https://reviews.freebsd.org/D22681

Update R-cran-* WWW to modern URL

Old R-cran-* ports have https://cran.r-project.org/web/packages/${PORTNAME}

New R-cran-* ports have https://cran.r-project.org/package=${PORTNAME}

Replace all the old WWW URLs with new WWW URLs

Reviewed by:    fuz
Differential Revision:  https://reviews.freebsd.org/D59714

textproc/tgrep: Update to 1.0.9

Changelog: https://github.com/microsoft/tgrep/releases/tag/v1.0.9

Reported by:    GitHub (watch releases)

x11-toolkits/aquamarine: Update to 0.15.1

Changelog: https://github.com/hyprwm/aquamarine/releases/tag/v0.15.1

Reported by:    GitHub (watch releases)

misc/py-litellm-proxy-extras: Update to 0.4.99

Reported by:    portscout

multimedia/ossia-score: not broken

audio/invada-studio-plugins-lv2: fix build on arm64

databases/greptimedb: update 1.1.4 → 1.2.1

devel/catch2: update 3.15.3 → 3.16.0

security/py-google-cloud-kms: Update to 3.17.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-kms-v3.17.0/packages/google-cloud-kms/CHANGELOG.md

Reported by:    GitHub (watch releases)

devel/py-ty: Update to 0.0.82

Changelog: https://github.com/astral-sh/ty/blob/0.0.82/CHANGELOG.md

Reported by:    portscout

*/*: Chase devel/iniparser lib update

math/octave-forge-fxp: Update to 3.1.1.

math/octave-forge-devtools: Complete do-over.

- The port was simply a copy of octave-forge-llms.
- The appropriate changes were made.

PR:             298647
Reported by:    Piotr Kubaj <pkubaj at FreeBSD.org>

net-mgmt/unifi10: Update to 10.6.106

Release notes: https://community.ui.com/releases/r/network/10.6.106

textproc/py-regex: Update to 2026.9.10

PR:             298652
Approved by:    fax at nohik.ee (maintainer)

math/suitesparse: upgrade GraphBLAS to 10.5.1

This bumps SuiteSparse to v7.14.1.
Release notes at
        https://github.com/DrTimothyAldenDavis/SuiteSparse/releases/tag/v7.14.1

lang/lfortran: upgrade to v0.66.0

Release notes at
        https://github.com/lfortran/lfortran/releases/tag/v0.66.0

math/planarity: upgrade to 5.1.0.0

Release notes at
        https://github.com/graph-algorithms/edge-addition-planarity-suite/releases/tag/Version_5.1.0.0

textproc/harper: Update to 2.11.0

devel/etcd34: Deprecate

MFH:            2026Q3
(cherry picked from commit f56e3b2dd53d20bd2697854f033292d88f1cc5d1)

devel/etcd37: Update to 3.7.1

MAKE_ENV=GOWORK=off allows us to get rid of the following error:

```
go: 'go mod vendor' cannot be run in workspace mode.
Run 'go work vendor' to vendor the workspace or
set 'GOWORK=off' to exit workspace mode.
```