Remove multimedia/sickgear for catastrophic security issues (backdoor?)
It is doing the equivalent of downloading code from a wiki page and
executing it. But even if this would not be editable by everybody by
leaking the deploy token, it would still be a potential backdoor for the
developers.
See https://github.com/SickGear/SickGear/issues/1517 for details.
The patches in pkgsrc neutered this a bit, but I still urge everybody
who has this installed to *immediately* uninstall it.
expat: update to 2.8.4.
Release 2.8.4 Mon August 31 2026
Security fixes:
#1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service
attacks through moderately sized crafted XML input
(CWE-407).
The vulnerability is closely related to past CVE-2026-45186
that was fixed with Expat 2.8.1.
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote.)
#1322 CVE-2026-76957 -- Protect custom encoding callbacks from
parser re-entry. The vulnerability is closely related to
past issues CVE-2026-50219, CVE-2026-56131 and
CVE-2026-56412 that were all fixed with Expat 2.8.2.
[47 lines not shown]
gcc16*: when ld supports --as-needed, gcc uses it
However, this is not fully working in NetBSD's ld.
Disable it for now until this is fixed.
Bump PKGREVISION.
devel/got: update to 0.127
# changes
* got 0.127; 2026-07-20
- re-add cmdline tests to 'make regress' target (regression from 0.126)
- add version flag (-V, --version) to gotd, gotwebd, and gotsysd
- make 'got merge' accept tags as merge source argument
- do not raise errors when unversioned files are found during got rm -k
- add rm -s ? option for deleting unversioned files from the work tree
- add rm -I option for also deleting ignored unversioned files with rm -s ?
- make 'tog log' reload the work tree's base-commit info during Ctrl-L refresh
- fix failures due to trailing slashes in checkout -p path-prefix argument
- gotwebd: use <meta http-equiv="refresh"> tag to redirect browser after login
- gotwebd.conf: add option which restores legacy redirect using http status 307
sysutils/fastfetch: update to 2.67.1
# pkgsrc changes
Requires GCC14 for C23 standard.
# upstream changes
# 2.67.1
Bugfixes:
* Fixed a `Symbol not found` error when running on macOS 10.15. (#2499, Codec, macOS)
* Fixed Alacritty font size never being parsed from the TOML config. (#2501, TerminalFont)
* Fixed bright colors incorrectly being active when the terminal uses a light theme. (#2509, Display)
* Fixed Ghostty terminal font detection (TerminalFont)
* Now tries to load the config with the `.ghostty` extension. (#2500)
* Fixed `font-family` fallback order. (#2510)
* Some internal cleanups and optimizations.
[139 lines not shown]
archivers/ruby-zip: update to 3.5.0
3.5.0 (2026-08-18)
* Fix the link to Ruby doc in README to the latest version. #670
* Support passing decrypter to encrypted entry via get_input_stream. #667
net/openrsync: update to openrsync-0.20260730
Sync with upstream, pulling another year of commits.
Noteworthy changes:
* Many portability fixes (with specific regard to NetBSD)
* Various bug fixes.
* Several improvents merged from Apple.
Refer to the github history for more details.
py-nbclient: updated to 0.11.0
0.11.0
Maintenance and upkeep improvements
Minor cleanup and bump minimal versions.
Other merged PRs
no-numfocus funding + Zizmor
ignore parallel closing error
Remove out of date badges about Python version.
Ignore new warning from ipykernel about encryption
drop leftover ref. to async_generator
Replace @flaky.flaky decorate with pytest marker
py-nbformat: updated to 5.11.1
5.11.1
Merged PRs
- Try to skip publishing to NPM to be able to publish a patch version on PYPI
- disable pendingdeprecationWarnings for now
- Bump github/codeql-action from 4.37.3 to 4.37.5 in the actions group
- Clarify normalize guidance in the changelog
- fix steps to skip