llvm: fix build with xcode 27
Apply commit a558d656043734cc4d02e0a0a12e4c308c28f8c7 from upstream.
I won't pretend to understand modern C++ to the extent that I can
adequately explain this change, but I guess it removes UB and does not
change code behaviour.
Update shells/bash to 5.3.20
New upstream patches:
patch 16: deal with MacOS variable pipe size (and size limit)
patch 17: readline cursor issues when invoked other than in col 0 with
multibyte chars in the prompt
patch 18: readline redisplay issues: if prompt has > 256 (wrapped) lines and
when a prompt has changed, needs redrawing, and starts with esc seq.
patch 19: deal with systems (macOS) where isalpha(128 <= c <= 255) is true.
patch 20: recompute columns correctly when SIGWINCH indicates screen resize
devel/ruby-simplecov: update to 1.3.0
pkgsrc changes:
* Add ALTERNATIVES.
* Install manpage with/without installation of ruby-manpages package.
1.3.0 (2026-09-12)
SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives
to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov
uncovered to annotate CI hosts natively, and settles what the report says
about files and groups that hold nothing.
Highlights
* Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles
Prism, so the static coverage extractor stops probing for it and the
[55 lines not shown]
firefox153: update to 153.3
Mozilla Foundation Security Advisory 2026-93
Security Vulnerabilities fixed in Firefox ESR 153.3
Announced
September 15, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.3
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component
Reporter
[689 lines not shown]
firefox140: update to 140.16
Mozilla Foundation Security Advisory 2026-92
Security Vulnerabilities fixed in Firefox ESR 140.16
Announced
September 15, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 140.16
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component
Reporter
[304 lines not shown]
tinygo: update to 0.42.0
- Support for Go 1.27 and LLVM 22
- Runtime panics (divide-by-zero, nil dereference, map and channel
failures) are now recoverable, so recover() works as expected
- Compiler generates type-specific hash and equal functions
- Many GC, scheduler, and timer fixes for more solid concurrent code
- Dynamic USB endpoint registration on RP2, SAMD21/51, and nRF52840
- Big ESP32 step forward: interrupts, ADC, flash XIP, and the new
ESP32-C6
- New targets: STM32H7, the Puya PY32F family, and UEFI
- New boards: ESP32-S3-BOX-3, M5Stack Stamp-S3A, and Pimoroni
Badger 2350
tzdata2netbsd - hg repo processing updates (mostly)
More updates to handle using mercurial as the repo, rather than cvs.
Mostly related to my gradual learning process of dealing with merges
and conflicts from the merge, correctly, using hg instead of cvs.
This also separated the merge from an attempt to update the sets list
at the same time (when an update is needed, which is rare), and (for
hg only) commit both in a single transaction, which would be ideal,
as if a rollback is needed, both parts need to be rolled back. But
it doesn't seem as if that is possible (or not without treating the
sets list as files to also be merged, which would have its own issues).
The only change here that affects usage when using a cvs repo, is that
the doc/3RDPARTY update now also updates the Date: field of the tz*
block, along with the Version (and if needed, Current-Version) field(s).
