ptrace/procfs: Take lwp lock around process_read/write_(fp)regs(32).
And verify that the lwp is in LSSTOP state before trying to read.
Otherwise, we might catch an lwp while it's still running on the CPU,
with all FPU state active, making the result unstable and tripping
assertions on some architectures.
PR port-amd64/60556: panic in process_read_fpregs_xmm
grep(1): Nix xfail on new test for PR 60552 screw case.
I was planning to do this in the same commit that fixes it, to keep
the history of bugs and fixes tidy, but gutteridge@ beat me to
committing the fix.
PR bin/60552: /usr/bin/grep failure under AMD64
nfs: Avoid UB in integer shift amounts.
Just use ilog2 explicitly here, instead of writing out a loop with
shifts and increments to compute it more slowly and buggily. Note
the confusing fencepost adjustment. Clamp _PC_FILESIZEBITS at the
actual size of off_t since we can't go beyond that.
PR kern/60554: nfs: integer shift UB in pathconf(_PC_FILESIZEBITS)
Make console input on virt68k 8-bit clean.
On signed-char ports you can't feed a "char *" to the tty layer. A cursory
glance for more instances of this didn't find any but it's possible.
Simplify the interface between the timers and the clock infrastructure,
and allow the clock infrastructure to select clock roles without having
netbsd,hardclock or netbsd,statclock properties in /chosen (they're now
optional).
java-netty: Stop tracking vulnerabilities
It is getting more and more time consuming and it seems that this
package was not updated since it was packaged and so probably not worth
to continue keep track of all the CVEs since then.
py-greenlet: updated to 3.5.4
3.5.4 (2026-07-22)
- Fix a crash (segfault) on free-threaded builds of Python 3.14 and
later when the garbage collector runs while a greenlet that was
started from a non-empty C-stack-reference state is active.
See `issue 515
<https://github.com/python-greenlet/greenlet/issues/515>`_.
Thanks to ddorian and Kumar Aditya.
- Fix a potential use-after-free on free-threaded builds of Python 3.14
and later when the garbage collector runs while a greenlet is
suspended holding a ``_PyCStackRef`` (for example, mid attribute
resolution). See
`issue 515 <https://github.com/python-greenlet/greenlet/issues/515>`_.
Thanks to ddorian and Kumar Aditya.
- Fix a deadlock on free-threaded builds when a greenlet switch happened
[10 lines not shown]
py-typer: updated to 0.27.1
0.27.1
Features
Make epilog formatting consistent with other parts of the help string.
Docs
Add Library Skills documentation.
Prevent scroll-to-top on restart/fast buttons in the documentation.
Recommend uv projects by default in docs.
Update help docs.
Internal
Upgrade latest-changes to 0.7.1.
p5-Imager: update to 1.034.
Imager 1.034 - 7 August 2026
============
- EXIF: fix decoding of ASCII fields with zero size.
thanks to Arpit Jain for the report
GHSA-hx46-55wp-hv6m
CVE-2026-19082
- JPEG: depend on Imager 1.034 for the EXIF decoding fix.
- include bundled module Changes files in the main Imager distribution
- TIFF: sizeproc could potentiallly ignore a seek error when finding
the current position (but then should fail later trying to restore
it.) Revealed by a signed comparison warning.
- warning fix pass, testing with -Wall -Wextra -Werror:
[41 lines not shown]
crush: Update to 0.88.1
Changelog
New!
* bdad0f1: feat(mcp): don't hold callback port open permanently (#3481) (@taciturnaxolotl)
Fixed
* cfad814: fix(dialog): add clear alias to summarize (#3464) (@joestump)
* 1134a5d: fix(dialog): raise permission-guard quiet period to survive natural typing pauses (#3393) (@albatrossflyon-coder)
* 768ffad: fix(hyper): keep working cache when provider cache can't be written (@meowgorithm)
* 9efc08c: fix(hyper): render error messages from back-end (#3513) (@andreynering)
* 42f3ce0: fix(lsp): handle window/workDoneProgress/create to prevent server crash (#3445) (@piakdev)
* 604a7e3: fix(providers): swap the provider cache instead of rewriting it (@meowgorithm)
* 85d83ce: fix(server): keep concurrent sessions from killing each other (@meowgorithm)
* ebd1857: fix(server): mcp auth in client-server mode (@meowgorithm)
* 71fa577: fix(server): release test DB before Windows temp-dir cleanup (@meowgorithm)
* 390ee36: fix(server): replace stale servers that predate shutdown_if_idle (@meowgorithm)
* 7cdef9e: fix(server): typing lag over TCP in client/server mode (@meowgorithm)
[19 lines not shown]
net/coturn: Update to 4.17.1
Drop patch for ginstall problem, following upstream fix.
Upstream NEWS content, less bugfixes and minor improvements:
Release 4.17.1
Changelist:
- Flash before socket close (#2041) (Pavel Punsky <eakraly at users.noreply.github.com>)
- build: Drop ginstall detection in configure (#2038) (Pavel Punsky <eakraly at users.noreply.github.com>)
print/qpdfview: Update to 0.5
* Convert to use Qt6. Requested by pin@. Thank you.
Changelog:
Release 0.5:
* Added support for Qt version 6 while keeping compatibility with Qt version 4 and 5 intact.
* Changed required language version from C++98 to C++11.
* Added context menu item to add selected text to bookmark comment. Thanks to S. Razi Alavizadeh.
* Imported various new and updated translations from Launchpad. Thanks to all Launchpad translators!
net/icann-rdap: Update icann-rdap to version 0.0.30
This repository contains open source code written by the Internet Corporation
for Assigned Names and Numbers (ICANN) (https://www.icann.org). for use with
the Registry Data Access Protocol (RDAP). RDAP is standard of the
IETF (https://ietf.org/), and extensions to RDAP are a current work activity
of the IETF's REGEXT working group
(https://datatracker.ietf.org/wg/regext/documents/). More information on
ICANN's role in RDAP can be found at https://www.icann.org/rdap. General
information on RDAP can be found at https://rdap.rcode3.com/.
Add fdtbus_get_reg_shift() to get the "reg-shift" property and provide
a default value, rather than open-coding it everywhere it's used. It's
common enough in various device bindings, and ePAPR describes it as a
generic device property.
