BSD Commit Log Search

   doc: Removed multimedia/sickgear

   Remove multimedia/sickgear for catastrophic security issues (backdoor?)

   It is doing the equivalent of downloading code from a wiki page and
   executing it. But even if this would not be editable by everybody by
   leaking the deploy token, it would still be a potential backdoor for the
   developers.

   See https://github.com/SickGear/SickGear/issues/1517 for details.

   The patches in pkgsrc neutered this a bit, but I still urge everybody
   who has this installed to *immediately* uninstall it.

   sun4v: Add mpii(4) to sparc64 GENERIC config.

   Symbios Logic SAS3008 storage controller is present in SPARC S7-2 servers.

   Not tested yet.

   Undo rev. 1.252 - mfii(4) is not the corect driver to use

   Revbump all Go packages after go127 became the default

   go: build with 1.27 by default

   gotosocial: requires Go 1.26

   Build fails with Go 1.27.

   opentofu, scaleway-cli: need Go 1.26

   Build fails with Go 1.27.

   doc: Updated textproc/expat to 2.8.4

   expat: update to 2.8.4.

   Release 2.8.4 Mon August 31 2026
           Security fixes:
        #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
                       "attribute isCdata lookups" that allowed denial of service
                       attacks through moderately sized crafted XML input
                       (CWE-407).
                       The vulnerability is closely related to past CVE-2026-45186
                       that was fixed with Expat 2.8.1.
                       Please note that a layer of compression around XML can
                       significantly reduce the minimum attack payload size.
                       Upstream CVSS 3.1 vector:
                       AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                       (Note the "AV:N" for network/remote.)
              #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
                       parser re-entry. The vulnerability is closely related to
                       past issues CVE-2026-50219, CVE-2026-56131 and
                       CVE-2026-56412 that were all fixed with Expat 2.8.2.

    [47 lines not shown]

   expat 2.8.4 is out

emacs-git: switch to gcc16-libjit

   doc: Updated editors/emacs31 to 31.1nb1

   emacs31: switch to gcc16-libjit

   Bump PKGREVISION.

   doc: note gcc16* updates

   gcc16*: when ld supports --as-needed, gcc uses it

   However, this is not fully working in NetBSD's ld.
   Disable it for now until this is fixed.

   Bump PKGREVISION.

libopeninput: update to 1.31.3

libopeninput: sync with devel/libopeninput

   doc: Updated devel/got to 0.127

   devel/got: update to 0.127

   # changes

   * got 0.127; 2026-07-20
   - re-add cmdline tests to 'make regress' target (regression from 0.126)
   - add version flag (-V, --version) to gotd, gotwebd, and gotsysd
   - make 'got merge' accept tags as merge source argument
   - do not raise errors when unversioned files are found during got rm -k
   - add rm -s ? option for deleting unversioned files from the work tree
   - add rm -I option for also deleting ignored unversioned files with rm -s ?
   - make 'tog log' reload the work tree's base-commit info during Ctrl-L refresh
   - fix failures due to trailing slashes in checkout -p path-prefix argument
   - gotwebd: use <meta http-equiv="refresh"> tag to redirect browser after login
   - gotwebd.conf: add option which restores legacy redirect using http status 307

   doc: Updated sysutils/fastfetch to 2.67.1

   sysutils/fastfetch: update to 2.67.1

   # pkgsrc changes

   Requires GCC14 for C23 standard.

   # upstream changes

   # 2.67.1

   Bugfixes:
   * Fixed a `Symbol not found` error when running on macOS 10.15. (#2499, Codec, macOS)
   * Fixed Alacritty font size never being parsed from the TOML config. (#2501, TerminalFont)
   * Fixed bright colors incorrectly being active when the terminal uses a light theme. (#2509, Display)
   * Fixed Ghostty terminal font detection (TerminalFont)
       * Now tries to load the config with the `.ghostty` extension. (#2500)
       * Fixed `font-family` fallback order. (#2510)
   * Some internal cleanups and optimizations.


    [139 lines not shown]

   doc: Updated archivers/ruby-zip to 3.5.0

   archivers/ruby-zip: update to 3.5.0

   3.5.0 (2026-08-18)

   * Fix the link to Ruby doc in README to the latest version. #670
   * Support passing decrypter to encrypted entry via get_input_stream. #667

   doc: Updated net/openrsync to 0.20260730

   net/openrsync: update to openrsync-0.20260730

   Sync with upstream, pulling another year of commits.
   Noteworthy changes:
   * Many portability fixes (with specific regard to NetBSD)
   * Various bug fixes.
   * Several improvents merged from Apple.
   Refer to the github history for more details.

rust-beta: update to 1.99.0-beta.3

   Updated www/py-nbformat, www/py-nbclient

   py-nbclient: updated to 0.11.0

   0.11.0

   Maintenance and upkeep improvements

   Minor cleanup and bump minimal versions.

   Other merged PRs

   no-numfocus funding + Zizmor
   ignore parallel closing error
   Remove out of date badges about Python version.
   Ignore new warning from ipykernel about encryption
   drop leftover ref. to async_generator
   Replace @flaky.flaky decorate with pytest marker

   py-nbformat: updated to 5.11.1

   5.11.1

   Merged PRs

   - Try to skip publishing to NPM to be able to publish a patch version on PYPI
   - disable pendingdeprecationWarnings for now
   - Bump github/codeql-action from 4.37.3 to 4.37.5 in the actions group
   - Clarify normalize guidance in the changelog
   - fix steps to skip