bup-snapshot: Updat to 0.33.71.883
This is more or less 0.34alpha1, not formally named. Upstream said:
It's time. Please test main in preparation for a 0.34 release. This is
a substantial release with a lot of change, so closer scrutiny is
warranted. See note/main.md for an overview, which may suggest changes
relevant to you that warrant closer scrutiny.
knot-resolver: Update to 6.4.1
Knot Resolver 6.4.1 (2026-07-22)
Security:
DNS-over-QUIC (DoQ) had severe issues, allowing even RCE Many people reported (some of) these issues to us.
DNSSEC correctness issues, acting mainly through the aggressive cache:
* dealing with Labels field in RRSIGs being smaller than the signer’s
* dealing with NSEC’s next-name pointing outside of the zone
Special thanks to Qifan Zhang from Palo Alto Networks.
Improvements:
docker: upgrade to Debian 13 (!1856)
update IANA’s certificate for root trust anchor bootstrapping (!1845)
Bugfixes:
/local-data/addresses*: make multiple addresses work (#808, #954)
views: fix protocol-based matching for DoQ
lang/gcc15: Add changes to make this build on NetBSD/macppc 11.0_RC6.
This pulls over changes to config/rs6000/ and gcc/config.gcc from
our in-tree gcc instance of gcc14, while preserving existing Homebrew-
related changes to gcc/config.gcc.
The most important fix is that on NetBSD/powerpc, -msecure-plt is enabled
by default, so that resulting executables can be run with PAX_MPROTECT
active. Otherwise, we end up with executables with sections which have
both "write" and "execute" turned on, which PAX_MPROTECT rejects.
Fixes PR#60439.
Bump PKGREVISION for both gcc15 and gcc15-libs, to adhere to rules in comments,
even though this *should* be a single-arch build fix, since I had to merge
the patch to gcc/config.gcc.
gotosocial: Update to 0.22.1
# Summary
This is a minor upgdate.
If you're updating to this version from v0.22.0, it's a very easy update with no db migrations.
# Changelog
Add a codeberg tag tracking variable in the Makefile, like many packages pulled from Github for consistency and easier upstream version changes tracking.
# Verifications
- pkglint
- build using pkgsrc-trunk and bob
- deployed in production
multimedia/dav1d: Update to 1.5.4
Changelog:
dav1d 1.5.4 'Sonic'
1.5.4 is a minor release of dav1d, focused on optimizations and maintenance:
Support for OS/2, including API exports and assembly
Switch to external checkasm
Add Armv9.3-A GCS (Guarded Control Stack) support
AArch64: optimize ipred_v, ipred_h and ipred_smooth_* 8bpc functions, and reduce .text size
ARM32: optimize prep_neon
RISC-V: ipred_(dc, h, v, pal) optimizations for 8 and 16bpc, generate_grain_y for 8bpc, and optimizations (prep/put_8tap, 6-tap and copy paths)
Portability improvements for non-POSIX systems (signal() fallback)
Schedule tile tasks for all passes at once, improving threading
Precompute the quantization matrix tables at build time
Move loop-invariant computations out of hot loops
ibus: add kludge to fix bulk build on NetBSD/amd64 10.0
See PR pkg/60476 for details.
XXX: still fails on builds on hosts with xserver set using official gtk3
binary package
security/pdfrip: import pdfrip-3.0.0
pdfrip is a fast multithreaded PDF password cracking utility written
in Rust with support for wordlist-based dictionary attacks, date,
number range, and alphanumeric brute-forcing, and a custom query
builder for password formats.
mail/thunderbird: Update to 152.0.1
Changelog:
152.0.1:
What's Fixed
fixed
Reply All button was missing for some EWS messages with multiple recipients
fixed
Security fixes
Security fixes:
Mozilla Foundation Security Advisory 2026-63
#CVE-2026-57962: Denial-of-service via malicious LDAP address-book server
#CVE-2026-57963: Chat UI manipulation by injection
152.0:
[182 lines not shown]
audio/tenacity: import tenacity-1.3.5
Tenacity is an easy-to-use multi-track audio editor and recorder
for Windows, macOS, Linux and other operating systems. It is built
on top of the widely popular Audacity and is being developed by a
wide, diverse group of volunteers.
ld.elf_so: Prune some dead TLS variant branches.
__lwp_settcb / __lwp_gettcb_fast are used only with TLS variant I,
never with TLS variant II.
So say `#ifdef __HAVE_TLS_VARIANT_II' instead of `#ifndef
__HAVE_TLS_VARIANT_I' to make it clearer, and prune all the
__HAVE___LWP_SETTCB / __HAVE___LWP_GETTCB_FAST branches under it
because they're unreachable.
No functional change intended: all the deleted code should be dead.
PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333
