chat/element-web: Update to 1.12.24
Note that upstream does not publish NEWS in a file in the sources,
making it unreasonably awkward to extract. Thus, this commit message
includes items that appeared particularly notable during a quick scan.
Upstream NEWS content since 1.12.12
- Call Tile spiffage
- Deprecation, to some extent, of classic calls
suitesparse: update to 7.12.3
* CHOLMOD 5.3.5: typo in user guide; minor revision to API in
cholmod.h
* ParU 1.1.1: MATLAB mexFunction does not #include mkl.h on Intel
systems
* GraphBLAS 10.3.2: minor update for recent clang compilers
* LAGraph 1.2.2: minor update for MSVC compiler (with no stdalign.h)
* SuiteSparse_config 7.12.3: version update to match SuiteSparse.
* CSparse 4.4.2: minor fix to build system; sync version with
CXSparse
* UMFPACK 6.3.8: sync definition and declaration of umf_row_search.
www/anubis: Update to 1.26.2
Changelog:
1.26.2:
Automatically verify correct parsing of everything in (data). While
doing post-release checks on v1.26.1, I discovered that I incorrectly
merged (data)/services/updown.yaml in such a way that it became
syntactically invalid. This has been mended and multiple layers of
CI have been put into place to make sure that (data) entries are
syntactically and semantically valid.
What's Changed
* chore(data): fix updown stdlib entry, add CI to catch future
things by @Xe in #1771
1.62.1:
Fix support for semicolon-delimited query parameters that was
dropped when moving from net/http/httputil#ReverseProxy.Director
[272 lines not shown]
lang/konoha: Disable OpenGL/GLUT. It is not buildable.
* Use devel/cmake/build.mk instead of USE_CMAKE.
* Minimum CMake is 3.10 to suppress warnings.
* Bump PKGREVISION.
www/gitea: update to 1.26.1
This release requires Go 1.26.
I had to generate the updated frontend assets on macOS/amd64; it is not
possible to do so on NetBSD at the moment.
Changes in 1.26.1:
* BUGFIXES
- Add event.schedule context for schedule actions task
- Fix an issue where changing an organization's visibility caused problems when users had forked its repositories.
- Use modern "git update-index --cacheinfo" syntax to support more file names
- Fix URL related escaping for oauth2
- When the requested arch rpm is missing fall back to noarch
- Fix actions concurrency groups cross-branch leak
- Fix bug when accessing user badges
- Fix AppFullLink
- Fix container auth for public instance
- Enhance GetActionWorkflow to support fallback references
[408 lines not shown]
Pull up the following revisions(s) (requested by riastradh in ticket #1319):
sys/netinet/tcp_syncache.c: revision 1.8
tcp: Plug a 4-byte leak of kernel stack data through timestamps.
Addresses PR kern/60486
Pull up the following revisions(s) (requested by riastradh in ticket #1318):
sys/dist/pf/net/pf.c: revision 1.88
pf: Fix use-after-free in fragment reassembly.
PR kern/60485: pf(4): uaf in fragment reassembly
Pull up the following revisions(s) (requested by riastradh in ticket #1317):
sys/external/bsd/ipf/netinet/fil.c: revision 1.38
tests/ipf/t_filter_exec.sh: revision 1.9
tests/ipf/expected/ipv6.3: revision 1.2
tests/ipf/input/ipv6.3: revision 1.3
tests/ipf/t_filter_exec.sh: revision 1.10
ipfilter: Fix remotely triggerable null pointer dereference and
add an automatic test for it.
PR kern/60484: ipfilter: null pointer deref in icmp6 parsing
www/chromium: update to 150.0.7871.186
* 150.0.7871.186
This update includes 4 security fixes. Please see the Chrome Security Page for more information.
[N/A][518237034] High CVE-2026-16807: Out of bounds write in Codecs. Reported by Google on 2026-05-30
[N/A][522064153] High CVE-2026-16806: Use after free in WebMCP. Reported by Google on 2026-06-10
[N/A][523292588] High CVE-2026-16805: Use after free in Blink. Reported by Google on 2026-06-12
[N/A][524721670] High CVE-2026-16804: Use after free in Input. Reported by Google on 2026-06-16
* 150.0.7871.181
This update includes 12 security fixes. Below, we highlight fixes that were contributed by
external researchers. Please see the Chrome Security Page for more information.
[$500][527930356] High CVE-2026-16420: Type Confusion in WebAudio. Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt on 2026-06-26
[$500][528276487] High CVE-2026-16421: Inappropriate implementation in WebAudio. Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt on 2026-06-26
[N/A][517359779] High CVE-2026-16413: Out of bounds write in ANGLE. Reported by Google on 2026-05-28
[N/A][517651910] High CVE-2026-16414: Insufficient validation of untrusted input in Chromecast. Reported by Google on 2026-05-28
[N/A][519244446] High CVE-2026-16415: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-06-02
[7 lines not shown]
Pull up the following revisions(s) (requested by riastradh in ticket #2040):
sys/dist/pf/net/pf.c: revision 1.88
pf: Fix use-after-free in fragment reassembly.
PR kern/60485: pf(4): uaf in fragment reassembly
Pull up the following revisions(s) (requested by riastradh in ticket #2039):
sys/external/bsd/ipf/netinet/fil.c: revision 1.38
tests/ipf/t_filter_exec.sh: revision 1.9
tests/ipf/expected/ipv6.3: revision 1.2
tests/ipf/input/ipv6.3: revision 1.3
tests/ipf/t_filter_exec.sh: revision 1.10
ipfilter: Fix remotely triggerable null pointer dereference and
add an automatic test for it.
PR kern/60484: ipfilter: null pointer deref in icmp6 parsing
