NetBSD/src vSgWREGsys/kern sys_process_lwpstatus.c

   ptrace/procfs: Take lwp lock around process_read/write_(fp)regs(32).

   And verify that the lwp is in LSSTOP state before trying to read.
   Otherwise, we might catch an lwp while it's still running on the CPU,
   with all FPU state active, making the result unstable and tripping
   assertions on some architectures.

   PR port-amd64/60556: panic in process_read_fpregs_xmm
VersionDeltaFile
1.6+10-3sys/kern/sys_process_lwpstatus.c
+10-31 files

NetBSD/src J3Il7PJtests/usr.bin/grep t_grep.sh

   grep(1): Nix xfail on new test for PR 60552 screw case.

   I was planning to do this in the same commit that fixes it, to keep
   the history of bugs and fixes tidy, but gutteridge@ beat me to
   committing the fix.

   PR bin/60552: /usr/bin/grep failure under AMD64
VersionDeltaFile
1.11+1-11tests/usr.bin/grep/t_grep.sh
+1-111 files

NetBSD/src 7jDlD5ksys/nfs nfs_vnops.c

   nfs: Avoid UB in integer shift amounts.

   Just use ilog2 explicitly here, instead of writing out a loop with
   shifts and increments to compute it more slowly and buggily.  Note
   the confusing fencepost adjustment.  Clamp _PC_FILESIZEBITS at the
   actual size of off_t since we can't go beyond that.

   PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)
VersionDeltaFile
1.329+23-12sys/nfs/nfs_vnops.c
+23-121 files

NetBSD/src cmbaSaPsys/nfs nfs_vnops.c

   nfs_vnops.c: Sort includes.

   No functional change intended.  Preparation for:

   PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)
VersionDeltaFile
1.328+22-20sys/nfs/nfs_vnops.c
+22-201 files

NetBSD/src v4YSIxgdistrib/sets/lists/tests mi, tests/usr.bin/grep d_pr60552 Makefile

   grep(1): Test screw case of case-insensitive match with colour.

   PR bin/60552: /usr/bin/grep failure under AMD64
VersionDeltaFile
1.10+31-1tests/usr.bin/grep/t_grep.sh
1.3+2-1tests/usr.bin/grep/Makefile
1.1425+2-1distrib/sets/lists/tests/mi
1.1+1-0tests/usr.bin/grep/d_pr60552
+36-34 files

NetBSD/src 5FBsglKsys/dev/goldfish gftty.c

   Make console input on virt68k 8-bit clean.
   On signed-char ports you can't feed a "char *" to the tty layer.  A cursory
   glance for more instances of this didn't find any but it's possible.
VersionDeltaFile
1.6+3-3sys/dev/goldfish/gftty.c
+3-31 files

NetBSD/src pD9BqbOsys/arch/hb68k/hb68k clock.c, sys/arch/hb68k/include clockvar.h

   Simplify the interface between the timers and the clock infrastructure,
   and allow the clock infrastructure to select clock roles without having
   netbsd,hardclock or netbsd,statclock properties in /chosen (they're now
   optional).
VersionDeltaFile
1.2+98-47sys/arch/hb68k/hb68k/clock.c
1.2+56-64sys/arch/hb68k/pg68k/pgtimer.c
1.2+56-54sys/arch/hb68k/wrap030/wrap030_timer.c
1.2+18-16sys/arch/hb68k/include/clockvar.h
1.2+0-1sys/arch/hb68k/wrap030/wrap030.dts
+228-1825 files

NetBSD/src uKWh9oKtests/usr.bin/grep t_grep.sh

   t_grep.sh: fix grammar in a comment
VersionDeltaFile
1.9+2-2tests/usr.bin/grep/t_grep.sh
+2-21 files

NetBSD/src u1BUhQ3external/gpl2/grep/dist/src grep.c

   grep.c: fix ctype(3) issue leading to segfault

   Addresses PR bin/60552 from Chavdar Ivanov, fix supplied by RVP.
VersionDeltaFile
1.6+2-2external/gpl2/grep/dist/src/grep.c
+2-21 files

NetBSD/pkgsrc-wip a89cb00llama.cpp TODO

llama.cpp: Add references to recent CVEs
DeltaFile
+3-1llama.cpp/TODO
+3-11 files

NetBSD/pkgsrc-wip f8adca0py-anki2 TODO

py-anki2: Add reference to CVE-2026-64677
DeltaFile
+1-1py-anki2/TODO
+1-11 files

NetBSD/pkgsrc-wip 7f095d0java-netty TODO

java-netty: Stop tracking vulnerabilities

It is getting more and more time consuming and it seems that this
package was not updated since it was packaged and so probably not worth
to continue keep track of all the CVEs since then.
DeltaFile
+2-1java-netty/TODO
+2-11 files

NetBSD/pkgsrc 2IH62TBdoc CHANGES-2026

   Updated devel/py-ruff, devel/py-typer, devel/py-greenlet
VersionDeltaFile
1.5062+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc XOMujN0devel/py-greenlet Makefile distinfo

   py-greenlet: updated to 3.5.4

   3.5.4 (2026-07-22)

   - Fix a crash (segfault) on free-threaded builds of Python 3.14 and
     later when the garbage collector runs while a greenlet that was
     started from a non-empty C-stack-reference state is active.
     See `issue 515
     <https://github.com/python-greenlet/greenlet/issues/515>`_.
     Thanks to ddorian and Kumar Aditya.

   - Fix a potential use-after-free on free-threaded builds of Python 3.14
     and later when the garbage collector runs while a greenlet is
     suspended holding a ``_PyCStackRef`` (for example, mid attribute
     resolution). See
     `issue 515 <https://github.com/python-greenlet/greenlet/issues/515>`_.
     Thanks to ddorian and Kumar Aditya.

   - Fix a deadlock on free-threaded builds when a greenlet switch happened

    [10 lines not shown]
VersionDeltaFile
1.11+10-1devel/py-greenlet/PLIST
1.42+4-4devel/py-greenlet/distinfo
1.44+2-2devel/py-greenlet/Makefile
+16-73 files

NetBSD/pkgsrc dVuqnbBdevel/py-typer Makefile distinfo

   py-typer: updated to 0.27.1

   0.27.1

   Features

   Make epilog formatting consistent with other parts of the help string.

   Docs

   Add Library Skills documentation.
   Prevent scroll-to-top on restart/fast buttons in the documentation.
   Recommend uv projects by default in docs.
   Update help docs.

   Internal

   Upgrade latest-changes to 0.7.1.
VersionDeltaFile
1.12+4-4devel/py-typer/distinfo
1.12+2-2devel/py-typer/Makefile
+6-62 files

NetBSD/pkgsrc 6OKUrxkdevel/py-ruff Makefile cargo-depends.mk

   py-ruff: updated to 0.16.2

   0.16.2

   Bug fixes

   [flake8-pyi] Avoid false positives on singledispatch functions (PYI041)

   Server

   Register formatting capabilities dynamically to exclude TOML files
VersionDeltaFile
1.116+40-40devel/py-ruff/distinfo
1.110+12-12devel/py-ruff/cargo-depends.mk
1.119+2-2devel/py-ruff/Makefile
+54-543 files

NetBSD/pkgsrc-wip dbb531cp5-Imager Makefile distinfo

p5-Imager: update to 1.034.

Imager 1.034 - 7 August 2026
============

 - EXIF: fix decoding of ASCII fields with zero size.
   thanks to Arpit Jain for the report
   GHSA-hx46-55wp-hv6m
   CVE-2026-19082

 - JPEG: depend on Imager 1.034 for the EXIF decoding fix.

 - include bundled module Changes files in the main Imager distribution

 - TIFF: sizeproc could potentiallly ignore a seek error when finding
   the current position (but then should fail later trying to restore
   it.)  Revealed by a signed comparison warning.

 - warning fix pass, testing with -Wall -Wextra -Werror:

    [41 lines not shown]
DeltaFile
+3-3p5-Imager/distinfo
+1-1p5-Imager/Makefile
+4-42 files

NetBSD/pkgsrc-wip 69c968ccrush Makefile distinfo

crush: Update to 0.88.1

Changelog

New!
* bdad0f1: feat(mcp): don't hold callback port open permanently (#3481) (@taciturnaxolotl)

Fixed
* cfad814: fix(dialog): add clear alias to summarize (#3464) (@joestump)
* 1134a5d: fix(dialog): raise permission-guard quiet period to survive natural typing pauses (#3393) (@albatrossflyon-coder)
* 768ffad: fix(hyper): keep working cache when provider cache can't be written (@meowgorithm)
*       9efc08c: fix(hyper): render error messages from back-end (#3513) (@andreynering)
*       42f3ce0: fix(lsp): handle window/workDoneProgress/create to prevent server crash (#3445) (@piakdev)
*       604a7e3: fix(providers): swap the provider cache instead of rewriting it (@meowgorithm)
* 85d83ce: fix(server): keep concurrent sessions from killing each other (@meowgorithm)
*       ebd1857: fix(server): mcp auth in client-server mode (@meowgorithm)
*       71fa577: fix(server): release test DB before Windows temp-dir cleanup (@meowgorithm)
*       390ee36: fix(server): replace stale servers that predate shutdown_if_idle (@meowgorithm)
*       7cdef9e: fix(server): typing lag over TCP in client/server mode (@meowgorithm)

    [19 lines not shown]
DeltaFile
+33-91crush/COMMIT_MSG
+3-3crush/distinfo
+1-1crush/Makefile
+37-953 files

NetBSD/pkgsrc 85PHhBCwww/libkiwix Makefile

   www/libkiwix: add atomic64.mk, fixes build problem for macppc.
VersionDeltaFile
1.10+2-1www/libkiwix/Makefile
+2-11 files

NetBSD/pkgsrc uLgK2Aldoc CHANGES-2026

   doc: Updated net/coturn to 4.17.1
VersionDeltaFile
1.5061+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc h4B9Sggnet/coturn Makefile distinfo, net/coturn/patches patch-configure

   net/coturn: Update to 4.17.1

   Drop patch for ginstall problem, following upstream fix.

   Upstream NEWS content, less bugfixes and minor improvements:

   Release 4.17.1

   Changelist:
   - Flash before socket close (#2041) (Pavel Punsky <eakraly at users.noreply.github.com>)
   - build: Drop ginstall detection in configure (#2038) (Pavel Punsky <eakraly at users.noreply.github.com>)
VersionDeltaFile
1.9+4-5net/coturn/distinfo
1.19+2-3net/coturn/Makefile
1.2+1-1net/coturn/patches/patch-configure
+7-93 files

NetBSD/pkgsrc PG9yqgfdoc CHANGES-2026

   doc: Updated print/qpdfview to 0.5
VersionDeltaFile
1.5060+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc yoRAac9print/qpdfview distinfo Makefile, print/qpdfview/patches patch-sources_model.h patch-qpdfview.pri

   print/qpdfview: Update to 0.5

   * Convert to use Qt6. Requested by pin@. Thank you.

   Changelog:
   Release 0.5:
     * Added support for Qt version 6 while keeping compatibility with Qt version 4 and 5 intact.
     * Changed required language version from C++98 to C++11.
     * Added context menu item to add selected text to bookmark comment. Thanks to S. Razi Alavizadeh.
     * Imported various new and updated translations from Launchpad. Thanks to all Launchpad translators!
VersionDeltaFile
1.6+21-15print/qpdfview/PLIST
1.3+11-9print/qpdfview/patches/patch-application.pro
1.6+8-8print/qpdfview/patches/patch-qpdfview.pri
1.10+6-7print/qpdfview/distinfo
1.147+6-7print/qpdfview/Makefile
1.2+1-1print/qpdfview/patches/patch-sources_model.h
+53-476 files

NetBSD/pkgsrc 5GQzG7Bsysutils/ups-nut Makefile

   ups-nut: Fix hardcoded TOOLS_DIR reference.
VersionDeltaFile
1.85+8-1sysutils/ups-nut/Makefile
+8-11 files

NetBSD/pkgsrc-wip fa4ef1aicann-rdap COMMIT_MSG PLIST

net/icann-rdap: Update icann-rdap to version 0.0.30

This repository contains open source code written by the Internet Corporation
for Assigned Names and Numbers (ICANN) (https://www.icann.org). for use with
the Registry Data Access Protocol (RDAP). RDAP is standard of the
IETF (https://ietf.org/), and extensions to RDAP are a current work activity
of the IETF's REGEXT working group
(https://datatracker.ietf.org/wg/regext/documents/). More information on
ICANN's role in RDAP can be found at https://www.icann.org/rdap. General
information on RDAP can be found at https://rdap.rcode3.com/.
DeltaFile
+1,038-906icann-rdap/distinfo
+345-301icann-rdap/cargo-depends.mk
+48-2icann-rdap/Makefile
+6-5icann-rdap/PLIST
+1-1icann-rdap/COMMIT_MSG
+1,438-1,2155 files

NetBSD/src j4jWVxlsys/dev/fdt fdtvar.h wdc_fdt.c

   Add fdtbus_get_reg_shift() to get the "reg-shift" property and provide
   a default value, rather than open-coding it everywhere it's used.  It's
   common enough in various device bindings, and ePAPR describes it as a
   generic device property.
VersionDeltaFile
1.14+6-10sys/dev/fdt/dw_apb_uart.c
1.9+4-10sys/dev/fdt/ns8250_uart.c
1.43+8-2sys/dev/fdt/fdt_subr.c
1.2+3-6sys/dev/fdt/wdc_fdt.c
1.2+3-6sys/dev/fdt/pcfiic_fdt.c
1.87+2-1sys/dev/fdt/fdtvar.h
+26-356 files

NetBSD/src XQNKc2Jsys/dev/fdt fdt_subr.c

   Re-factor fdtbus_get_addr_cells() and fdtbus_get_size_cells() into
   fdtbus_get_u32prop_with_default().
VersionDeltaFile
1.42+16-14sys/dev/fdt/fdt_subr.c
+16-141 files

NetBSD/pkgsrc Tt0wpxZdoc TODO

   doc/TODO: + grafana-13.1.3, quodlibet-4.7.1.
VersionDeltaFile
1.27700+3-2doc/TODO
+3-21 files

NetBSD/src V9fuPbFsys/kern subr_disk_4bsd.c

   If a 4.4BSD disklabel is not found in the "native" location (by
   specifical label sector / offset), then scan the first 3 sectors
   of the disk for one.
VersionDeltaFile
1.3+88-37sys/kern/subr_disk_4bsd.c
+88-371 files

NetBSD/src bGL7jxesys/dev/i2c i2c.c

   i2c module does not depend on the i2c_bitbang module.  That's the
   responsibility of individual back-end drivers.
VersionDeltaFile
1.108+3-3sys/dev/i2c/i2c.c
+3-31 files