sparc: Stop exposing default KERNBASE to modules
Otherwise, on kernels with non-standard KERNBASE, modules reference
illegal addresses when using curcpu(), curlwp, and so on.
Unfortunately, this cannot be pulled-up to release branches, as
this changes module ABI.
Ride on 11.99.10 version bump.
nodejs: bump libuv BUILDLINK_API_DEPENDS minimum to 1.52
Recent releases expect the following feature in libuv, or builds will
fail due to the missing field.
* unix,win: add f_frsize field to uv_statfs_t (Ben Noordhuis)
struct proc: Move p_pgrp out of p_startcopy/endcopy region.
It cannot be safely copied with the current memcpy logic that logic
uses happens without holding proc_lock, so we have to copy it
separately anyway. Leave a comment emphasizing this aspect of the
locking rules so we don't have this bug again.
Looks like p_mqueue_cnt may need similar treatment.
As a result of this kernel ABI change, welcome to 11.99.10!
PR kern/60962: fork and spawn read p_pgrp without proc_lock
shader-slang: update to 2026.21
- Document how to install Metal Developer Tools
- Return the parse result from
IGlobalSession::parseCommandLineArguments
- Allow global constant inlining with shader debug information
- Keep a global-scope call whose callee needs a local variable out of
force inlining
- Add optional slang-standard-modules embedding library
- git-worktree-add.sh: add --force to replace an existing branch and
worktree
- Fix MSVC 2019 internal compiler error in unit-test-string.cpp
- SPIR-V: emit pointer-to-signed-int casts through an unsigned
integer
- Fix CUDA Gather on combined samplers and reject GatherCmp on CUDA
- Make abs of an unsigned integer the identity on SPIR-V, LLVM and
GLSL
- render-test: create an untyped object input in the program's
session
[133 lines not shown]
security/pkcs11-provider: Do revbump after all with base openssl fix.
Previously it would build _by default_ with pkgsrc openssl; revbump
is needed because this default changes.
victorialogs*: Update to 1.53.0
Breaking changes:
Update note 1: the /internal/force_merge, /internal/force_flush,
/internal/log_new_streams and /internal/partition/* HTTP endpoints now
require the POST method for security reasons, in order to prevent
GET-based SSRF attacks. Update any scripts or automation calling
these endpoints via GET to use POST. See #1635.
Update note 2: requests to /select/vmalert/-/reload and other
/select/vmalert/* paths ending with /config or /reload now require the
-httpAuth.* credentials for security reasons. Previously, such requests
were proxied to vmalert without checking the credentials. Add the
credentials to any scripts calling these paths. See #11548.
Rest of changes, see full release notes at:
https://github.com/VictoriaMetrics/VictoriaLogs/releases/tag/v1.53.0
ggml: update to 0.29.0.
ggml v0.29.0 adds an OCP FP8 E4M3 tensor type, a new
ggml_flash_attn_ext_rows op where each query slice attends to its
own list of K/V rows, a batched tensor copy API, and initial support
for multi-node tensor parallelism through a new multi-process
communicator interface. Core improvements include bounding tensor
views by the bytes their strides reach, zero-copy GGUF export of
host-buffer tensors, and vm_allocate-based allocations on Apple
platforms. Performance work spans all major backends: new SVE
kernels in the CPU backend, DPAS flash attention for quantized KV
in SYCL, fused MoE MMQ in CUDA, faster MXFP4 mat-vec in Metal,
split-K tuning in Vulkan, and a large expansion of quantized
GEMM/GEMV coverage in OpenCL. The Hexagon backend gains support
for several new ops, including the lightning indexer, top-k mask,
conv2d and upscale.
fd-find: update to 10.5.1.
Bugfixes
Fix --absolute-path turning verbatim (\\?\) search paths into relative paths on Windows: \\?\UNC\server\share is now reported as \\server\share, and \\?\Volume{...} paths are kept intact, see #2207 (@Duo-ee)
Make --ignore and --no-hidden after -u override only their half of -u, see #2192 (@NavpreetSSidhu)
Fix inline case-insensitive regex flags incorrectly making other --and patterns case-sensitive, see #2184 (@mabunemeh)
Accept --format templates that start with - when passed as a separate argument, see #2126 (@vulragrag-star)
Don't incorrectly escape newlines in error messages, see #2104
Restore jemalloc as default allocator on supported systems
Fix the cargo binstall release URL, which named the crate (fd-find) instead of the binary (fd) and fell back to a third-party mirror
Fix integer overflow when parsing size constraints, rejecting values that exceed u64::MAX instead of panicking, see #2196 (@parneetsingh022).
Various fixes and updates to zsh completion
Fix --glob patterns when using --full-path on windows. See #2067.
proc-cli: Update to version 2.3.0
Changes since 2.2.0:
- on, info, for and why show the same card for a process
- process tables show the user, uptime and command
- ports says if each port is reachable from the network
- values proc cannot read show as "-", not 0
- JSON adds parent name, child count, CPU time, open files
rsync: update to 3.5.2.
# NEWS for rsync 3.5.2 (4 Nov 2026)
## Changes in this version:
### BUG FIXES:
- Fixed interrupted `--append` and `--inplace` transfers writing the final
256 KiB buffer twice. An interrupted destination now remains a clean prefix
which the next transfer can resume or repair.
- Fixed uploads through `rrsync` when the destination file already exists.
Existing files are now reached beneath a pinned parent directory instead of
being passed as an unwritable `/proc/self/fd/N` destination.
- Fixed poor matching performance on large sparse and repeated-block files
when duplicate checksum chains exhausted the search limit. Valid basis
blocks are no longer hidden behind duplicate entries.
- Bounded strong-checksum work when a malicious receiver supplies weak
checksums that collide with consecutive rolling windows
(CVE-2026-119741).
[46 lines not shown]
