Pull up following revision(s) (requested by riastradh in ticket #393):
libexec/ld.elf_so/search.c: revision 1.30
libexec/ld.elf_so/xmalloc.c: revision 1.28
libexec/ld.elf_so/tls.c: revision 1.30
libexec/ld.elf_so/tls.c: revision 1.31
libexec/ld.elf_so/search.c: revision 1.29
ld.elf_so: Fix assertion: obj may be NULL _or_ OBJ_ERR (-1) here
NULL means the object wasn't found and we should keep searching;
OBJ_ERR means the object was found but loading it failed and we
should stop. Only if the object is _neither_ NULL _nor_ OBJ_ERR is
it expected to be an object with positive refcount.
Followup for
PR lib/59751: dlclose is not MT-safe depending on the libraries
unloaded
[43 lines not shown]
dpbox: update to 6.1.3
Five memory-safety fixes folded upstream: a stack over-read in truesize(),
a one-byte overflow in check_sanity(), four buffer underflows in the
filename-extension helpers, a FORTIFY abort in the FBB link-check proposal
generator, and a pointer-precedence bug that wrote through an unrelated
pointer in the low-memory buffer path. patch-bo, patch-bp, patch-bq,
patch-bs and patch-bt are removed; patch-bl is retained.
sftpgo: update to 2.7.5
Bug fixes
httpd: make sure to always close connection for shares.
Security fixes
Improper handling of malformed SSH channel requests. GHSA-q7pc-356p-hggc.
net/youtube-dl: Remove
as propose on pkgsrc-user@ on 4 July, without objections. youtube-dl
has not been maintained for 5.5 years; yt-dlp is the successor fork.
firefox140: update to 140.13
Mozilla Foundation Security Advisory 2026-70
Security Vulnerabilities fixed in Firefox ESR 140.13
Announced
July 21, 2026
Impact
critical
Products
Firefox ESR
Fixed in
Firefox ESR 140.13
#CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
Reporter
Christian Holler
[365 lines not shown]
