www/anubis: Update to 1.27.0
Changelog:
1.27.0:
Anubis v1.27.0 adds Windows Server support, automatically renames
cookies based on settings to avoid infinite challenge loops, adds
two new localizations, and more.
## Breaking change: cookie names are dynamically created based on
cookie settings
Anubis tries to avoid breaking changes as much as possible, but
sometimes we have to make them for the sake of the users. This is
technically a breaking change in something that is not part of the
public API of Anubis; but some administrators rely heavily on cookie
names in advanced configurations.
It seems that browsers store cookies disambiguated with their
options. This means you can have multiple cookies named the same
[83 lines not shown]
security/acmesh: Update to 3.1.4
* Noticed by he@. Thank you.
Changelog:
3.1.4:
1. Support ACME Renewal Information (ARI, RFC 9773), enabled by
default. Renewals now follow the renewal window suggested by the
CA. Set NO_ARI=1 to disable. The installed cron job now runs every
6 hours to react to ARI renewal windows in time.
2. Support the dns-persist-01 challenge, with --dns-persist-days.
3. A negative --days schedules renewal relative to the cert expiration
date, and can be combined with --valid-to to set a renewal margin.
4. Support ACME account key rollover.
5. Support multiple account emails. --update-account now persists
the new email.
6. Retry failed install/deploy steps on the next renewal.
7. Add bash completion, installed via --install.
8. New DNS providers: Level27, CDMON, Poweradmin, IP-Projects,
[6 lines not shown]
py-imagesize: updated to 2.0.1
2.0.1
Optimize metadata parsing and HTTP range reads.
Fix JPEG2000 box parsing.
Accept single-quoted SVG dimensions.
Return positive heights for top-down BMP images.
Remove the upper Python version cap, migrate packaging to pyproject.toml,
and add Python 3.15 CI coverage.
Bump the package version to 2.0.1 and add recent feedback contributors to
the README.
openssl: updated to 3.6.4
OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed
in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
[27 lines not shown]
croc: Update to 11.3.2
Highlights
Automatically advertises and negotiates experimental-derp-attach-group-v1 in normal supported builds.
Two v11.3.2 peers use eight striped streams over four raw-direct paths with no flags.
Mixed-version peers remain compatible through one-stream legacy Attach.
Raw setup retains one-stream manager fallback, with croc relay fallback in automatic mode.
11.3.1
Highlights
Pins derphole to github.com/schollz/derphole v0.18.2-croc.1 while preserving its upstream module identity.
Adds modular AttachGroup bundle and lifecycle support for the qualified eight-stream/four-path topology.
Keeps automatic AttachGroup advertisement disabled in this release; peers continue using compatible legacy DERP Attach until activation is qualified separately.
Reduces CI cost by avoiding duplicate branch-push validation and reserving full cross-platform builds for main and manual runs.
What’s Changed
DERP transport: connection bundles, client-local providers, clean group-close handling, and safe striped-sender teardown.
Benchmarks: consolidated 8/4 qualification data and benchmark-only build tagging.
[2 lines not shown]
Stop installing psinfo.d dtrace script.
It uses `u_int` and `struct proc`, but no definitions are available.
This causes problems when dtrace is used for pkgsrc, see e.g.
wip/modular-xorg-server.
sysutils/broot: update to 1.59.0
- new shell_command verb attribute: run a command through a shell (sh -c / cmd /C) so &&, ; and pipes work, without leaving broot - Fix #1145
- fix invalid official Mac binary (duplicate linked dylib) with new build chain - Fix #1194
- Sixel graphics support for image preview, auto-detected: works in iterm2, Windows Terminal 1.22+ and Sixel-capable Unix terminals (foot, mlterm, xterm built
with Sixel, recent WezTerm). Kitty remains the preferred protocol when available. Note: this requires broot to be compiled with sixel feature
(eg cargo install broot --features sixel) - Fix #568 - Thanks @jamison-wilde
- High-Res images in Rio terminal (detect it to enable the Kitty image protocol) - Fix #1179
- fix content-exact match line number off-by-one when the match starts at the first byte of a line (broot jumped to the line above) - Thanks @YuriNachos
- new :no_action internal, doing nothing, which can be used to disable a key - Fix #328
- fix: detect a duplicate broot server name instead of silently overtaking the running server - Fix #1065 - Thanks @YuriNachos
- fix preview transformers extension matching not working with double extensions such as .tar.gz - Fix #1195
- strip escape sequences from displayed names to prevent OSC injections - Fix #1188 - Thanks @carfeii
- fall back to numeric uid/gid instead of ???? when the user or group name can't be resolved, which is always the case on statically linked musl
builds - Fix #1075
- fix panic on a content regex matching the empty string at the end of a line ending with a control char (eg cr/$/ on a CRLF file)
- fix Windows paths (containing backslashes) being mangled by the launcher's eval when using :cd and similar; also fixes escaping of paths containing
a single quote - Fix #1100 - Thanks @Cyrus580529
- fix br failing on Windows/PowerShell when the temp path contains a space (e.g. a space in the Windows username) - Fix #788 - Thanks @chinhkrb113
[3 lines not shown]
net/ttl: update to 0.22.0
What's Changed
chore(deps): bump the cargo-dependencies group across 1 directory with 12 updates by @dependabot[bot] in #125
chore(deps): bump the cargo-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #127
chore: clippy 1.98 nits (prerequisite) by @lance0 in #130
chore(deps): bump lru 0.18.0 → 0.18.2 (LAN-1114) by @lance0 in #128
perf(tui): skip snapshot+draw when idle (LAN-1222 experiment) by @lance0 in #129
chore(tui): make the render fingerprint exhaustive over its inputs by @lance0 in #131
ocaml-opam: add new package
Differences from pkgsrc's misc/ocaml-opam:
- update from 2.1.3 to 2.5.2 (fixing two CVEs in the process)
- the -full tarball is now used instead of the one autogenerated by
github
- rsync is now a runtime dependency (it is technically optional but it
helps users to have it for the moment)
- ocaml-dune is now explicitly a build dependency but no longer used
as-is. It is now used through gmake
- ocaml-cmdliner, ocaml-re, ocamlgraph, dose3, ocaml-cudf and
ocaml-opam-file-format are no longer dependencies
- the vendored versions of all the dependencies contained by the -full
archive is now used. This allows to simplify the build process
greatly and avoids having to import all the new dependencies on new opam
releases. This is also what a majority of BSD, Linux and macOS distributions
out-there do.
- The opam-solver library is no longer installed. This could not be used
on its own anyway because the OCaml build process would require other
[5 lines not shown]
