BSD Commit Log Search

   lib/libc/stdio/fgetln.3: fix trivial formatting typo

   Trivial whitespace fix to turn
        getline(3), ferror(3), fgets(3), fopen(3), fparseln(3,) putc(3)
   into
        getline(3), ferror(3), fgets(3), fopen(3), fparseln(3), putc(3)

   graphics/jbigkit: fix build

   Provide a libtool tag so that libtool doesn't have to infer a source language

webhookd: Add reference to CVE-2026-59157

suricata: Add reference to recent CVEs

libks: Add reference to recent CVE

oras: Add reference to recent CVEs

hoverfly: Add reference to recent CVEs

   doc: Updated www/R-webfakes to 1.5.0

   R-webfakes: update to 1.5.0.

   Build fix.

   # webfakes 1.5.0

   * New `keep_alive_timeout_ms` option in `server_opts()` to configure the
     idle timeout of keep-alive connections. The default is 5000 ms, up from
     the underlying CivetWeb default of 500 ms (#114).

   * Handler functions may now declare a `locals` argument, in which case
     webfakes passes `app$locals` to it directly, without having to access
     it through `req$app$locals` (#112).

   * webfakes now builds on platforms where `ar` does not writes a symbol
     index by default (@barracuda156, #121).

   * webfakes now parses HTTP date headers (e.g. `Date`, `Last-Modified`,
     `Expires`) correctly regardless of the user's `LC_TIME` setting

    [20 lines not shown]

   doc: Updated math/R-XML to 3.99.0.24

   R-XML: update to 3.99.0.24.

   Fix build against libxml2 2.15.

   ============ entries from Ivan Krylov ============

   Version 3.99-0.24
        Fixed obsolete attribute names in structure() calls
        Removed links that started failing URL checks
        The DTD introspection interface is now defunct

   Version 3.99-0.23
        Fixed issues detected by 'rchk'
        Replaced the use of non-API 'Rf_findVarInFrame' with 'eval'

   Version 3.99-0.22
        Disabled DTD introspection API

   ============ entries from CRAN ============

    [4 lines not shown]

   qemu: disable the ParavirtualizedGraphics (pvg) driver on macOS 27

   The driver got broken by Apple's changes and there is no upstream fix yet.

   Side note: Claude was able to cook up a patch but it is tainted and would
   not comply with upstream's nor TNF's policy so you will not find it here.

   security/nettle: build fix

   provide the libtool tag for compile and link phases, so that libtool
   doesn't try to infer anything

   new bind

   mips membar_ops.S: Cite more evidence Octeon doesn't reorder loads.

   bump libdns

   merge changes between bind-9.20.27 and bind-9.20.29

   Import bind-9.20.29 (previous was 9.20.27)

   BIND 9.20.29
   Security Fixes
   [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC
   responses. a0a61dba9e
     A malicious authoritative server could serve a securely delegated zone
     whose DS and DNSKEY records carry many distinct key tags but no valid
     match, forcing a validating resolver into excessive key-tag matching
     and high CPU use for every query. BIND now bounds this work with the
     per-query validation limit (max-validations-per-fetch). [GL #5349]

   [CVE-2026-19033] Require a TSIG on every message of incoming zone
   transfers. 9404cd2b8c
     BIND 9 used to accept TSIG-signed zone transfers in which some messages
     were unsigned, and processed those messages before the next signature
     could vouch for them. It now requires a TSIG on every message of an
     incoming AXFR or IXFR; all modern nameserver already sign every message,
     so no change is expected in practice. [GL #6062]

    [327 lines not shown]

   mips/asm.h: Tidy typography of SYNC_PLUNGER comment block.

   And fix a misquoted register number to make it make sense.

   The CN78XX manual's typography got all screwed up; the CN50XX manual
   is clearer (and maybe we should just quote from that one instead but
   whatever).

   mips/asm.h: Add some citations for MFC0_HAZARD.

   No functional change intended, comment only.

libks: Remove +x bits

PLIST does not need to be executable.

llama.cpp: Add reference to CVE-2026-86317

gnome-tweaks: Add reference to CVE-2026-74859

   improve table load error in npf

   an EEXIST should clearly state already defined and a load failure should
   also clearly be stated. do not class all error returns under EEXIST
   since npf_table_insert can return other errors aside EEXIST.

   new unbound

   bump libunbound

   merge changes between unbound 1.25.1 and 1.26.1

   Import unbound-1.26.1 (previous was unbound-1.25.1)

   Unbound 1.26.1
   ==============
   This release has a number of security fixes.
   The release is signed with the OpenPGP software signing key that is
   in use since Jan 1st 2026:
   User ID: NLnet Labs releases signing key G2 releases at nlnetlabs.nl
   Key ID: A144 323D EAAC DF45
   Fingerprint: 2310 1869 0C4D 903E F419  146A A144 323D EAAC DF45

   The key is available from https://nlnetlabs.nl/signing-keys .
   This release consolidates security fixes for issues reported over
   a period of time. There are fixes for CVE-2026-77860, CVE-2026-77955,
   CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642,
   CVE-2026-82717, CVE-2026-82720 and CVE-2026-85501.

   Bug Fixes
   Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code

    [325 lines not shown]

   doc: Updated www/drupal11 to 11.4.7

   www/drupal11: update to 11.4.7

   This is security update.

   11.4.5 (2026-08-06)

   This is a patch (bugfix) release of Drupal 11 and is ready for use on
   production sites. Learn more about the latest version of Drupal.

        https://www.drupal.org/project/drupal/releases/11.4.5

   11.4.6 (2026-09-03)

   This is a patch (bugfix) release of Drupal 11 and is ready for use on
   production sites. Learn more about the latest version of Drupal.

        https://www.drupal.org/project/drupal/releases/11.4.6

   11.4.7 (2026-09-16)

    [12 lines not shown]