www/anubis: Update to 1.26.2
Changelog:
1.26.2:
Automatically verify correct parsing of everything in (data). While
doing post-release checks on v1.26.1, I discovered that I incorrectly
merged (data)/services/updown.yaml in such a way that it became
syntactically invalid. This has been mended and multiple layers of
CI have been put into place to make sure that (data) entries are
syntactically and semantically valid.
What's Changed
* chore(data): fix updown stdlib entry, add CI to catch future
things by @Xe in #1771
1.62.1:
Fix support for semicolon-delimited query parameters that was
dropped when moving from net/http/httputil#ReverseProxy.Director
[272 lines not shown]
lang/konoha: Disable OpenGL/GLUT. It is not buildable.
* Use devel/cmake/build.mk instead of USE_CMAKE.
* Minimum CMake is 3.10 to suppress warnings.
* Bump PKGREVISION.
www/gitea: update to 1.26.1
This release requires Go 1.26.
I had to generate the updated frontend assets on macOS/amd64; it is not
possible to do so on NetBSD at the moment.
Changes in 1.26.1:
* BUGFIXES
- Add event.schedule context for schedule actions task
- Fix an issue where changing an organization's visibility caused problems when users had forked its repositories.
- Use modern "git update-index --cacheinfo" syntax to support more file names
- Fix URL related escaping for oauth2
- When the requested arch rpm is missing fall back to noarch
- Fix actions concurrency groups cross-branch leak
- Fix bug when accessing user badges
- Fix AppFullLink
- Fix container auth for public instance
- Enhance GetActionWorkflow to support fallback references
[408 lines not shown]
Pull up the following revisions(s) (requested by riastradh in ticket #1319):
sys/netinet/tcp_syncache.c: revision 1.8
tcp: Plug a 4-byte leak of kernel stack data through timestamps.
Addresses PR kern/60486
Pull up the following revisions(s) (requested by riastradh in ticket #1318):
sys/dist/pf/net/pf.c: revision 1.88
pf: Fix use-after-free in fragment reassembly.
PR kern/60485: pf(4): uaf in fragment reassembly
Pull up the following revisions(s) (requested by riastradh in ticket #1317):
sys/external/bsd/ipf/netinet/fil.c: revision 1.38
tests/ipf/t_filter_exec.sh: revision 1.9
tests/ipf/expected/ipv6.3: revision 1.2
tests/ipf/input/ipv6.3: revision 1.3
tests/ipf/t_filter_exec.sh: revision 1.10
ipfilter: Fix remotely triggerable null pointer dereference and
add an automatic test for it.
PR kern/60484: ipfilter: null pointer deref in icmp6 parsing
www/chromium: update to 150.0.7871.186
* 150.0.7871.186
This update includes 4 security fixes. Please see the Chrome Security Page for more information.
[N/A][518237034] High CVE-2026-16807: Out of bounds write in Codecs. Reported by Google on 2026-05-30
[N/A][522064153] High CVE-2026-16806: Use after free in WebMCP. Reported by Google on 2026-06-10
[N/A][523292588] High CVE-2026-16805: Use after free in Blink. Reported by Google on 2026-06-12
[N/A][524721670] High CVE-2026-16804: Use after free in Input. Reported by Google on 2026-06-16
* 150.0.7871.181
This update includes 12 security fixes. Below, we highlight fixes that were contributed by
external researchers. Please see the Chrome Security Page for more information.
[$500][527930356] High CVE-2026-16420: Type Confusion in WebAudio. Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt on 2026-06-26
[$500][528276487] High CVE-2026-16421: Inappropriate implementation in WebAudio. Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt on 2026-06-26
[N/A][517359779] High CVE-2026-16413: Out of bounds write in ANGLE. Reported by Google on 2026-05-28
[N/A][517651910] High CVE-2026-16414: Insufficient validation of untrusted input in Chromecast. Reported by Google on 2026-05-28
[N/A][519244446] High CVE-2026-16415: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-06-02
[7 lines not shown]
Pull up the following revisions(s) (requested by riastradh in ticket #2040):
sys/dist/pf/net/pf.c: revision 1.88
pf: Fix use-after-free in fragment reassembly.
PR kern/60485: pf(4): uaf in fragment reassembly
Pull up the following revisions(s) (requested by riastradh in ticket #2039):
sys/external/bsd/ipf/netinet/fil.c: revision 1.38
tests/ipf/t_filter_exec.sh: revision 1.9
tests/ipf/expected/ipv6.3: revision 1.2
tests/ipf/input/ipv6.3: revision 1.3
tests/ipf/t_filter_exec.sh: revision 1.10
ipfilter: Fix remotely triggerable null pointer dereference and
add an automatic test for it.
PR kern/60484: ipfilter: null pointer deref in icmp6 parsing
Add gtk3 runtime depends. Bump PKGREVISION
Without the gtk3 include arandr would fail to run unless another
package had pulled in gtk3.
Contacted MAINTAINER but no response after several weeks
Pull up the following revisions(s) (requested by riastradh in ticket #2038):
sys/dev/hdaudio/hdaudio.c: revision 1.19
hdaudio(4): Apply access checks to ioctl commands so that
unprivileged users without write permission on /dev/hdaudioN can't
change the configuration.
PR kern/60492: hdaudio(4): setconfig is allowed unprivileged
Pull up the following revisions(s) (requested by riastradh in ticket #1316):
sys/dev/hdaudio/hdaudio.c: revision 1.19
hdaudio(4): Apply access checks to ioctl commands so that
unprivileged users without write permission on /dev/hdaudioN can't
change the configuration.
PR kern/60492: hdaudio(4): setconfig is allowed unprivileged
