p5-Net-OAuth: update to 0.33.
0.33 Mon 17 Aug 23:14:01 BST 2026
[Security]
- Restrict the verification algorithm to those specified in the allowed_signature_methods, which is
now required. THIS IS A BREAKING CHANGE.
See https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-c8rm-g5cm-4pf5 (CVE-2026-72889)
for more information.
- HMAC_SHA1 and HMAC_SHA256 signature keys cannot be blank.
- HMAC_SHA1, HMAC_SHA256 and PLAINTEXT signature verification now use constant-time comparison (CVE-2026-75589).
[Documentation]
- Updated the GitHub repository location, which moved before the version 0.32 release.
(The former location does redirect to the new location.)
- Removed CONTRIBUTING.md due to changes in the AI policy.
[2 lines not shown]
sun68k: avoid PROM DVMA map aliasing in sun3 bootloader
NetBSD/sun3 11.0 GENERIC fails to boot from a SCSI disk on
my Sun 3/60 with at least PROM revisions 2.8.3 and 3.0.1.
It looks sun3 PROM SCSI driver allocates internal resources
in DVMA space starting at 0xfff00000. The sun3 standalone
DVMA setup currently aliases its local address range starting
at 0x200000 to that same address.
Since the alias is created by sharing PMEGs, PTE changes made by
the PROM in its DVMA space also change the corresponding standalone
mappings. These mappings are inherited by the loaded kernel.
On Sun3, pmap_bootstrap() derives the first available PA from
(nextva - KERNBASE3), assuming that the kernel bootstrap VA range
is backed by the corresponding contiguous physical addresses.
A leaked alias can instead map part of that range to an unrelated
[14 lines not shown]
py-icalendar: update to 7.3.0.
Removals and deprecations
obj is deprecated in favor of bytes. It is retained as a lossy
string view of the value for backward compatibility, and will
be removed in icalendar 8. The
test_ical_value_rejects_non_base64_characters test was removed
because vBinary.ical_value no longer validates or decodes
Base64. @uwezkhan (Issue #1356)
Issue #1362
New features
Created an example() method for the Journal component and an
example() method for the FreeBusy component, added the RFC 5545
examples that they load, and documented their usage in both
class docstrings. AI assistance: Kiro CLI with the claude-opus-5
[182 lines not shown]
gettext-tools: do not autodetect libcurl and libjson-c
Fixes build on OpenIndiana. The libraries are shipped
with base but at least some of the headers seem absent.
ibus: regenerate tools Vala sources before build
The generated tools/main.c in the distfile may contain Wayland code
even when ibus is configured with --disable-wayland, causing the build
to fail due to missing wayland headers or libraries.
Clean the generated sources before build so they are regenerated
with the current configure options, as already done for ui/gtk3.
This should fix workaround for PR pkg/60476 on pkgsrc-2026Q2.
ibus: use common Wayland platform detection
Remove the temporary NetBSD native X11 workaround and rely on
PLATFORM_SUPPORTS_WAYLAND.
Native EGL support is now handled by graphics/MesaLib/features.mk, so
the additional libglamoregl.so check is no longer needed. PR pkg/60476
Bump PKGREVISION.
gtk3: remove NetBSD-specific Wayland workaround
MESALIB_SUPPORTS_EGL now handles native EGL support correctly on
NetBSD, so PLATFORM_SUPPORTS_WAYLAND already excludes systems where
the native libepoxy has no EGL support.
Remove the additional libglamoregl.so check added in PR pkg/60295.
The file is part of the xserver set, so checking for it incorrectly
disables Wayland on bulk build hosts where the xserver set is not
installed. PR pkg/60476
Bump PKGREVISION.
graphics/MesaLib: improve native EGL detection on NetBSD
For native X11 on NetBSD, use HAVE_XORG_EGL when it is available
instead of only checking for the EGL header.
On older NetBSD releases without HAVE_XORG_EGL, use HAVE_XORG_GLAMOR
as a fallback, since native libepoxy EGL support was conditional on
GLAMOR there.
This is a proper fix for PR pkg/60295 and makes MESALIB_SUPPORTS_EGL
reflect the actual native EGL support more accurately.
PR pkg/60476
Pull up following revision(s) (requested by skrll in ticket #417):
sys/external/bsd/dwc2/dwc2.c: revision 1.84
sys/external/bsd/dwc2/dist/dwc2_core.c: revision 1.15
PR/60021: USB-only boot: uhub0 attaches but uhub1 never appears...
Update the dwc2 intial reset sequence to more closely match the upstream
driver - it's changed a bit in the last 10 years.
This reset sequence gets the device out of the state it's left in by the
RaspberryPI firmware when booting from USB.
dwc2: Bring dwc2_wait_for_mode from upstream and use in dwc2_force_mode.
dwc2_wait_for_mode will wait upto 110milliseconds for the controller
to enter the expected mode.
[2 lines not shown]
devel/cargo-about: update to 0.9.2
0.9.2 - 2026-08-18
Fixed
PR#312 changed processing of detected license files so that they are never discarded, resolving #309.
webkit-gtk60: update to 2.52.6.
- Improve memory usage in pages that use font variations.
- The webkit://gpu page now respects the dark theme user preference.
- Fix cross compilation due to failure to pick the correct gio-unix-2.0
headers in certain configurations.
- Fix calculating data sizes of reported through WebKitWebsiteData.
- Fix the build with CMake 4.4 or newer.
- Fix several crashes and rendering issues.
evbarm/am18xx: sdmmc driver
A first version of the SD card driver for the TI am1808. The driver works fine, but the performance is lower than expected.
litestream: Update to 0.5.16
pkgsrc changes:
- Bump modernc.org/sqlite to version that brings back NetBSD/amd64
support
Changes:
Too long to include, sorry, please see:
<https://github.com/benbjohnson/litestream/releases>
evbarm/ti_edma: clear events before transfer
The sdmmc controller on the am18xx fires dma events even in PIO mode. Clear these event before starting a DMA transfer.
mk: Introduce support for ULIMIT_PRECMD.
While this has potential to run any pre-command, it is primarily useful as a
hook to insert ulimit(1) commands that will apply to shell commands, hence
the name.
In bulk builds there will occasionally be packages that end up spinning on
CPU and hanging the build until the user has a chance to kill the process.
For some builds this is desirable so that the issue can be debugged, but for
others the user may prefer to avoid having to interact with the build to get
it to complete, in which case they can set this to e.g. "ulimit -S -t 3600".
