NetBSD/pkgsrc 1nLoWfYdoc CHANGES-2026

   Updated lang/python31[012], lang/py31[012]-html-docs
VersionDeltaFile
1.5254+7-1doc/CHANGES-2026
+7-11 files

NetBSD/pkgsrc 8ObfnDPlang/py312-html-docs Makefile distinfo, lang/python312 dist.mk distinfo

   python312 py312-html-docs: updated to 3.12.14

   3.12.14

   macOS
   gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
   Tests
   gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
   Security
   gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE 2026-72522.
   gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
   gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
   gh-152216: Update bundled libexpat to version 2.8.2.
   gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
   gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
   gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
   gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 2025-4330.
   gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
   gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.

    [31 lines not shown]
VersionDeltaFile
1.18+4-4lang/python312/distinfo
1.15+4-4lang/py312-html-docs/distinfo
1.15+2-2lang/python312/dist.mk
1.15+2-2lang/py312-html-docs/Makefile
+12-124 files

NetBSD/pkgsrc uK5mcbHlang/py311-html-docs Makefile distinfo, lang/python311 dist.mk distinfo

   python311 py311-html-docs: updated to 3.11.16

   3.11.16

   macOS
   gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
   Tests
   gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
   Security
   gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522.
   gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
   gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
   gh-152216: Update bundled libexpat to version 2.8.2.
   gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
   gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
   gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
   gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
   gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
   gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.

    [28 lines not shown]
VersionDeltaFile
1.25+4-4lang/python311/distinfo
1.17+4-4lang/py311-html-docs/distinfo
1.17+2-2lang/python311/dist.mk
1.17+2-2lang/py311-html-docs/Makefile
+12-124 files

NetBSD/pkgsrc AaWUr7Hlang/py310-html-docs Makefile distinfo, lang/python310 dist.mk distinfo

   python310 py310-html-docs: updated to 3.10.21

   3.10.21

   macOS
   gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
   Tests
   gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
   Security
   gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
   gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
   gh-152216: Update bundled libexpat to version 2.8.2.
   gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
   gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
   gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
   gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
   gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
   gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186.
   gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.

    [23 lines not shown]
VersionDeltaFile
1.37+4-4lang/python310/distinfo
1.24+4-4lang/py310-html-docs/distinfo
1.22+2-2lang/python310/dist.mk
1.22+2-2lang/py310-html-docs/Makefile
+12-124 files

NetBSD/pkgsrc-wip d3fc4d0chromium Makefile distinfo

chromium: update to 151.0.7922.137
DeltaFile
+9-9chromium/distinfo
+2-2chromium/Makefile
+11-112 files

NetBSD/pkgsrc LG38zlCdoc TODO CHANGES-2026

   Updated www/nginx-devel, sysutils/py-ansible-compat, sysutils/ansible-lint
VersionDeltaFile
1.5253+4-1doc/CHANGES-2026
1.27742+1-2doc/TODO
+5-32 files

NetBSD/pkgsrc EJKRBjOsysutils/ansible-lint Makefile distinfo

   ansible-lint: updated to 26.8.0

   26.8.0

   Fix/sonarcloud unbounded recursion complexity
   feat: honor ANSIBLE_VAULT_PASSWORD_FILE for vault decryption
   fix: jinja[spacing] rule creating invalid syntax for minus modifiers
   chore(deps): update all dependencies
   chore(deps): update all dependencies pep621
   fix: remove stale words from cspell dictionary
   chore(deps): bump schemas npm packages for Dependabot CVEs
   fix(security): update dependencies [SECURITY]
   fix: address SonarCloud new code violations
   chore(deps): update all dependencies
   chore(deps): update all dependencies pep621
   fix(deps): exclude ansible-core 2.17.x (CVE-2026-11332)
   fix: expose ansible-galaxy on the uv tool-install path
   fix: var-naming for register projections
   chore: Adding OpenWrt 25.12 as platform

    [10 lines not shown]
VersionDeltaFile
1.77+4-4sysutils/ansible-lint/distinfo
1.86+3-3sysutils/ansible-lint/Makefile
+7-72 files

NetBSD/pkgsrc 29vJVwMsysutils/py-ansible-compat Makefile distinfo

   py-ansible-compat: updated to 26.8.0

   26.8.0

   fix: reduce cognitive complexity of 5 functions in runtime.py
   chore(deps): update all dependencies
   Sonar/s3776 s1172 src
   fix: annotate mutable class defaults with ClassVar
   chore(deps): update pep621
   fix(deps): exclude ansible-core 2.17.x (CVE-2026-11332)
   fix: skip collection modules in ANSIBLE_LIBRARY
   fix(CI): strip tox-local Ansible env vars in smoke tests
VersionDeltaFile
1.40+4-4sysutils/py-ansible-compat/distinfo
1.48+3-3sysutils/py-ansible-compat/Makefile
+7-72 files

NetBSD/pkgsrc sCt0UUQwww/nginx-devel Makefile options.mk

   nginx-devel: updated to 1.31.3

   1.31.3

   fixes for buffer overflow vulnerability when using map with regex
   (CVE-2026-42533), memory disclosure vulnerability when using
   ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when
   using ngx_http_ssi_module (CVE-2026-56434)
VersionDeltaFile
1.133+19-19www/nginx-devel/distinfo
1.50+6-6www/nginx-devel/options.mk
1.169+2-3www/nginx-devel/Makefile
+27-283 files

NetBSD/pkgsrc-wip ef247abvictorialogs-vlagent Makefile, victorialogs-vlogscli Makefile

victorialogs-*: use PKGBASE

Factor out the name of the program by using PKGBASE.
More resistant to copypastos for packaging of other VictoriaLogs
components.
DeltaFile
+2-2victorialogs-vlogscli/Makefile
+2-2victorialogs-vlagent/Makefile
+4-42 files

NetBSD/pkgsrc-wip 8c6fba9victorialogs DESCR

victorialogs: Describe what victoria-logs is
DeltaFile
+1-1victorialogs/DESCR
+1-11 files

NetBSD/pkgsrc-wip f0c45c4victorialogs DESCR, victorialogs-vlagent DESCR

victorialogs: Extend description

Based on README.md.
DeltaFile
+4-2victorialogs/DESCR
+4-2victorialogs-vlogscli/DESCR
+4-2victorialogs-vlagent/DESCR
+12-63 files

NetBSD/pkgsrc-wip 981d170victorialogs Makefile.common

victorialogs: vlagent uses Makefile.common too
DeltaFile
+1-0victorialogs/Makefile.common
+1-01 files

NetBSD/pkgsrc-wip 3e9ea48victorialogs-vlagent PLIST DESCR

victorialogs-vlagent: Import vlagent-1.52.0

VictoriaLogs is open source user-friendly database for logs from
VictoriaMetrics.

This package contains vlagent, an agent for collecting logs from
various sources and storing them in VictoriaLogs.
DeltaFile
+13-0victorialogs-vlagent/Makefile
+5-0victorialogs-vlagent/DESCR
+2-0victorialogs-vlagent/PLIST
+20-03 files

NetBSD/pkgsrc-wip f66b575py-mkdocs-material TODO

py-mkdocs-material: Add reference to CVE-2026-73295
DeltaFile
+2-0py-mkdocs-material/TODO
+2-01 files

NetBSD/pkgsrc-wip a998e05victorialogs-vlogscli DESCR

victorialogs-vlogscli: Improve description

Explain what vlogscli is. Based on
<https://docs.victoriametrics.com/victorialogs/querying/vlogscli/>.
DeltaFile
+2-1victorialogs-vlogscli/DESCR
+2-11 files

NetBSD/pkgsrc 5Wxk0khdoc TODO CHANGES-2026

   Updated net/unbound, net/wireshark
VersionDeltaFile
1.5252+3-1doc/CHANGES-2026
1.27741+1-2doc/TODO
+4-32 files

NetBSD/pkgsrc 7i4x6z9net/wireshark Makefile PLIST

   wireshark: updated to 4.6.8

   4.6.8

   The following bugs have been fixed:

   Fuzz job crash: randpkt-2026-05-22-14496207576.pcap. Issue 21266.

   Wireshark Version 4.6.6 - File Capture Properties is excessively slow and hangs Wireshark on Windows. Issue 21337.

   TCP Preference 'Analyze TCP sequence numbers' SEGFAULTs when toggled. Issue 21380.

   Wireshark misdecodes S-NSSAI location validity information IE (5G NAS) Issue 21411.

   Wireshark misdecodes NSAG information IE (5G NAS) Issue 21412.

   Fuzz job UTF-8 encoding issue: fuzz-2026-07-17-15393056954.pcap. Issue 21419.

   Wireshark misdecodes UE security capability IE (5G NAS) Issue 21431.

    [36 lines not shown]
VersionDeltaFile
1.194+4-4net/wireshark/distinfo
1.113+3-3net/wireshark/PLIST
1.353+2-3net/wireshark/Makefile
+9-103 files

NetBSD/pkgsrc 3plM2YKnet/unbound distinfo Makefile, net/unbound/patches patch-configure

   unbound: updated to 1.26.0

   1.26.0

   Features

   Update icannbundle.pem certificates in unbound-anchor. It has the public keys for 2009 to 2029 and for 2025 to 2045.
   Fix to add `max-transfer-size` and `max-transfer-time` that limit auth-zone and rpz transfer amount and time taken. Default is disabled. This hardens against unbounded transfers. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
   Merge 1087: Overload `local_data_remove` to support removing specific records.
   Merge 1433 from jisakiel: Add new static zone type block_aaaa to suppress AAAA queries.
   Fix 1477: respip + dns64: dns64 uses A records modified by respip instead of original A records. Adds local-zone types block_a_wdata and block_aaaa_wdata, that are like block_a and block_aaaa, and uses local-data if present.
VersionDeltaFile
1.137+16-17net/unbound/Makefile
1.9+13-4net/unbound/patches/patch-configure
1.92+5-5net/unbound/distinfo
+34-263 files

NetBSD/pkgsrc-wip 0d83878pnpm DESCR Makefile, pnpm/patches patch-pnpm_crates_config_src_defaults.rs patch-pnpm_crates_cli_src_cli__args_docs.rs

pnpm: import pnpm-12.0.0-rc.2 as wip/pnpm

This is a Rust port version of pnpm, called pacquet.

---

Fast, disk space efficient package manager:

* Fast. Up to 2x faster than the alternatives (see benchmark).
* Efficient. Files inside node_modules are linked from a single
  content-addressable storage.
* Great for monorepos.
* Strict. A package can access only dependencies that are specified in its
  package.json.
* Deterministic. Has a lockfile called pnpm-lock.yaml.
* Works as a Node.js version manager. See pnpm runtime.
* Works everywhere. Supports Windows, Linux, and macOS.
* Battle-tested. Used in production by teams of all sizes since 2016.
* Experimental Rust port. Includes pacquet, an experimental port of the CLI
  written in Rust.
DeltaFile
+2,167-0pnpm/distinfo
+722-0pnpm/cargo-depends.mk
+34-0pnpm/Makefile
+24-0pnpm/patches/patch-pnpm_crates_cli_src_cli__args_docs.rs
+18-0pnpm/DESCR
+15-0pnpm/patches/patch-pnpm_crates_config_src_defaults.rs
+2,980-03 files not shown
+2,991-09 files

NetBSD/pkgsrc WcuZNq5doc CHANGES-2026

   doc: Updated net/p5-Net-CIDR-Set to 0.23
VersionDeltaFile
1.5251+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc NjXAZbCnet/p5-Net-CIDR-Set Makefile distinfo

   p5-Net-CIDR-Set: update to 0.23.

   0.23      2026-08-11 20:08:42+01:00 Europe/London
     [Security]
     - Fix an unbounded IPv6 netmask prefix length (CVE-2026-19566)

   0.22      2026-06-13 14:44:25+01:00 Europe/London
     [Toolchain]
     - Set the static install flag

     - Adjusted build prerequisites to be recommended instead of required.

     - Sign distribution with SigStore.

     [Tests]
     - Added author tests.

     - Update minimum prereqs for some tests.
VersionDeltaFile
1.8+4-4net/p5-Net-CIDR-Set/distinfo
1.24+2-3net/p5-Net-CIDR-Set/Makefile
+6-72 files

NetBSD/pkgsrc j0Zf0JDdoc CHANGES-2026

   Updated textproc/py-Levenshtein, net/py-dnsdiag
VersionDeltaFile
1.5250+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc VDveYQknet/py-dnsdiag distinfo Makefile

   py-dnsdiag: updated to 2.9.4

   2.9.4

   Fixed

   fix: reset shutdown flag at the start of each CLI invocation
   fix(dnsping): validate source IP address family against -4/-6 flag
   fix(dnsping): fix variable shadowing and div-by-zero in stats
   fix(dnsping): reuse TCP connection for fixed source port queries
VersionDeltaFile
1.16+3-7net/py-dnsdiag/Makefile
1.13+4-4net/py-dnsdiag/distinfo
+7-112 files

NetBSD/pkgsrc 9gymNPSdoc TODO

   doc/TODO: + rumdl-0.2.55, wireshark-4.6.8.
VersionDeltaFile
1.27740+3-1doc/TODO
+3-11 files

NetBSD/pkgsrc YIBxhlgtextproc/py-Levenshtein Makefile distinfo

   py-Levenshtein: updated to 0.27.4

   0.27.4
   Added
   - add type hints for StringMatcher
VersionDeltaFile
1.18+4-4textproc/py-Levenshtein/distinfo
1.25+2-2textproc/py-Levenshtein/Makefile
+6-62 files

NetBSD/src dt7xyyBsys/dev/pci pciconf.c

   pciconf: Fix round-up logics for total sizes of bridge resources

   The previous ones are valid only if alignments are 4K or 1M,
   for I/O or memory, respectively.
VersionDeltaFile
1.58+6-6sys/dev/pci/pciconf.c
+6-61 files

NetBSD/src X7G74Mwsys/dev/pci pciconf.c

   pciconf: Fix alignments of device memory and I/O resources

   Resources must be their-size-aligned. While here:

   - Switch *align variable from int to more suitable integer types.
   - Make some conditions clearer (NFC).
VersionDeltaFile
1.57+19-22sys/dev/pci/pciconf.c
+19-221 files

NetBSD/pkgsrc g5OwRg3databases/py-duckdb Makefile

   py-duckdb: Pass CMAKE_BUILD_PARALLEL_LEVEL.

   Any package that uses py-scikit-build-core to build does not honour MAKE_JOBS.
   Some packages use make and so are single threaded, but some like duckdb use
   ninja, and that defaults to ncores+2(!) per build.

   On my 72-core build host, building 3 py-duckdb packages simultaneously, this is
   enough to completely swamp things and cause knock-on failures that effectively
   kill the bulk build.

   Ideally this needs to be done in a build.mk or similar for py-scikit-build-core
   but this gets us past this for now.
VersionDeltaFile
1.10+5-1databases/py-duckdb/Makefile
+5-11 files

NetBSD/src 5G1fwt8sys/external/bsd/dwc2 dwc2.c dwc2.h

   Spaces to tabs
VersionDeltaFile
1.13+7-7sys/external/bsd/dwc2/dwc2.h
1.83+3-3sys/external/bsd/dwc2/dwc2.c
+10-102 files