tailscale: 1.104.6
All:
- A rare connectivity issue that affected dormant connections has
been resolved.
Darwin:
- Error handling has been improved when multiple network extensions
are present.
- An issue where MagicDNS could select a suffix-scoped DNS resolver
during network transitions has been resolved.
- A DNS configuration race condition that could occur during network
transitions has been resolved.
monetary.h: Adjust exposure for strfmon_l() and locale_t
In Posix Issue 7 (2008), strfmon_l() was added to the standard,
and is intended to be declared in <monetary.h>, as is locale_t
required to be defined by it (as strfmon_l() uses it).
As usual, we're running just a little late... but we're up to date now!
Adjust fontconfig's default preference order to prefer Bitstream Vera
and Liberation fonts over the Luxi Type1 fonts, which freetype struggles
to render. Helps make the default text rendering better in e.g.
GTK applications and web browsers.
XXX this change also needs to happen in pkgsrc.
PR xsrc/60991: fontconfig prefers Luxi Type1 fonts for Latin text, which
are extremely ugly
www/freenginx: update: 1.30.1 -> 1.30.2
While I'm here fix fetch echo third-party module.
Sponsored by: tipi.work
<ChangeLog>
*) Security: one of the keys was left uninitialized when using automatic
rotation of TLS session ticket keys, making it possible to forge a
session and bypass client certificate verification (CVE-2026-97629);
</ChangeLog>
www/freenginx-devel: update from 1.31.4 to 1.31.5
While I'm here fix fetching for echo third-party module.
Sponsored by: tipi.work
<ChangeLog>
*) Security: one of the keys was left uninitialized when using automatic
rotation of TLS session ticket keys, making it possible to forge a
session and bypass client certificate verification (CVE-2026-97629);
*) Bugfix: a segmentation fault might occur in a worker process if AIO
was used in subrequests.
*) Bugfix: in HTTP/3.
</ChangeLog>
awesome: (smallest ever) recursive revbump for devel/lua-gi
The real dependency for glib2-introspection lies there, and this will
fail during the configure stage when the tooling finds it can't call
lua-gi as it expects.
lua-gi: mark runtime dependency on glib2-introspection
This package exports objects provided by glib2-introspection to Lua
runtime environments (in pkgsrc's case, anyway, just wm/awesome).
Runtime failure of awesome noted by Fekete Zoltán on pkgsrc-users@.
foot: update to 1.28.0
Added
+ Command line option --class, an alias for --app-id. Intended to be used
by scripts and similar that wants to launch terminal instances in a
terminal agnostic way
+ Support for terminal visibility reports, using the Wayland xdg_toplevel
suspended state.
+ Support for wl_fixes::ack_global_remove().
Changed
+ Do not allow codepoints to be merged into grapheme clusters directly
after a cursor move
+ Dracula theme updated to latest official, and light theme alucard
added.
+ Sixels: pan/pad clamped to 5
+ Default URL regex changed to:
[49 lines not shown]
lang/rust-bin: Fix rust-bin-1.98.1 not building/installing on Darwin
Some of the executables that previously didn't have relative rpaths, now
have ones. Turn them into absolute paths as well.
go: update to 1.27.4 and 1.26.11 (security)
These releases include 12 security fixes following the security policy <https://go.dev/doc/security/policy>:
- net/http: HTTP/1 server crash due to MaxBytesReader header race
For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
"Connection: close" header is automatically set without synchronization,
which might race with another header being set explicitly in the server
handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
MaxBytesHandler can crash due to runtime panic if its handler reads the
request body concurrently with writing the response header.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.
- cmd/go: unexpected code execution via --sysroot, -target, -isysroot,
-Wl,-syslibroot, and -x cgo flags
[279 lines not shown]
