chat/ejabberd: Update to 26.07
## Version 26.07
#### Security fixes
This release contains fixes for those issues:
- It's possible to craft PLAIN auth request and authenticate as one user, but then open
session for different one.
- mod_caps persistent cache can be poisoned by using legacy version requests.
This cache was only used to determine list of nodes that should trigger notifications
in PubSub presence-based delivery.
- SQL injection in mod_pubsub handling of paging requests.
- Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
- It was possible to make ejabberd send redirect response for OAuth requests to unvetted url.
This required enabling ejabberd to act as OAuth provider (by adding request handler for
ejabberd_oauth in http listener). As part of this fix we changed `oauth_client_id_check`
default value to `db` - using ejabberd as OAuth provider will be only allowed by clients
[20 lines not shown]
chat/ejabberd: Partially address pkglin and improve comments
- Improve version pattern for coreutils (textual change, NFCI)
- Reorder CONFIGURE_ARGS after DEPENDS
- Clarify and regularize description of build tools
- Reorder erlang bl3 depends.
Except for coreutils version, this is a comment-only/reordering
change.
chat/ejabberd: Update to 26.04
## Version 26.04
#### Core
- Add new listener options for limits to xml parser accepted input
- New predefined keyword `DATABASE_PATH` that points to the Mnesia spool dir
- Support HOST keyword in `sql_database` toplevel option, set nice default value
- ejabberd_config: New default_ram_db/3 clause that checks module support
powerdns: Update to 5.1.4
Released: 6th of August 2026
New Features
Allow NAPTR additional processing to be disabled
References: pull request 17810
Bug Fixes
more lmdb stability
References: pull request 17811, pull request 17814
Account for the existing content when parsing labels
References: pull request 17818
geoipbackend: create DNSSEC key files with mode 0600
References: pull request 17839
iputils: do not index past the address for byte-aligned prefixes
References: pull request 17846
dnsdist: Update to 2.1.1
Released: 6th of August 2026
Bug Fixes
Account for the existing content when parsing labels
References: #17790, #17797, pull request 17858
Do not index past the address for byte-aligned prefixes
References: #17835, pull request 17860
gnuplot: updated to 6.0.5
6.0.5
New features
Full mousing support for multiplots
all panels report mouse coordinates
all panels respond to pan/zoom/rotate mouse movement and hotkeys
"replot" reexecutes multiplot commands starting from current state
"remultiplot" restores the original state before reexecuting multiplot
interactive mousing remains active after ^C or "reset"
Unicode escape sequences \U+xxxx are accepted in more contexts
escape sequences are expanded in "noenhanced" strings
escape sequences are expanded during substring evaluation
escape sequences are expanded in string functions strstrt() and strlen()
New built-in function prod [<var> = <start> : <end>] <expression>
implements the sequential product operation
prod [i=a:b] f(i) = f(a) * f(a+1) * ... * f(b)
[10 lines not shown]
www/xh: update to 0.26.2
Bug fixes
- Fix --auth ignoring credentials when the username is empty (e.g. -a :password), see #467 (@upuddu)
- Decode all frames in concatenated zstd response bodies, see #470 (@snowyukitty)
sysutils/uutils-coreutils: update to 0.10.0
Rust Coreutils 0.10.0 Release:
We are happy to announce the release of Rust Coreutils 0.10.0 - a release focused on GNU compatibility and robustness. The GNU test suite results improved sharply this cycle (645 passing, 29 failing, down from 56), we landed a second wave of security hardening (TOCTOU races, safe recursive descent, SELinux labeling at creation, backup guards), and we ran a broad anti-panic campaign across the utilities. On top of that: new features (mv --exchange and an OpenSSL backend for the checksum utilities), more zero-copy/read-ahead performance work, and wasm32-wasip2 support.
Highlights:
GNU Compatibility
645 passing GNU tests (+20) and 27 fewer failures, the largest single-cycle drop we have had
Dozens of behavior alignments: pr (-w/-W/-l/-e/-o, merge mode, page ranges), nproc (cgroups v2 quota, affinity mask, offline cores, OMP_* handling), date (out-of-range years, -d -, O modifier, timezone strings), numfmt, ls, du, install, od, truncate, fold, head/tail, sum, stat
Many error messages now carry the file name and the real OS error instead of a vague or stripped message
Security Hardening
Continued the TOCTOU work started in 0.9.0: touch no longer uses O_TRUNC on create, mkfifo drops the path-based chmod, head checks the open fd instead of the path, split hardens the output-open path, chcon anchors recursive relabeling to the traversal dirfd
Safe recursive descent fixes for chmod/chown (symlink cycles, --preserve-root re-checked during the descent), and cp no longer descends into a destination subdirectory that is a symlink
SELinux labels are now applied at creation in mkdir, mkfifo and mknod instead of being applied afterwards
mv fails closed when recreating a cross-device directory destination, compares file identity in the --backup=simple guard, and strips setuid/setgid when a cross-device copy cannot preserve ownership
chroot chroots exactly the path --skip-chdir validated; stdbuf refuses a libstdbuf path that cannot be represented in LD_PRELOAD; install finalizes ownership before mode
[37 lines not shown]
jj: updated to 0.44.0
0.44.0
Support for fetching and pushing tags has now been stabilized. Tags can be
tracked or untracked just like bookmarks. Tracked tags are pushed by default.
net/sniffnet: update to 1.5.1
New features
- Show latency of connections (#1194 — fixes #845)
- Added Hungarian translation 🇭🇺 (#1197)
- Added Sinhala translation 🇱🇰 (#1239)
Improvements
- Support CIDR ranges in imported IP blacklists (#1181)
- Show number of IP addresses and CIDR ranges in imported IP blacklists (#1183)
- Add relevant keywords to the .desktop file (#1248)
- Updated some of the existing translations to v1.5:
- Ukrainian (#1039)
- German (#1122)
- French (#1123)
- Spanish (#1140)
- Indonesian (#1145)
[11 lines not shown]
