opentofu112: Update to 1.12.8
pkgsrc changes:
- Do not force particular Go version, build fine with Go 1.27.x now
Changes:
1.12.8
SECURITY ADVISORIES:
- Previous versions of OpenTofu could potentially experience excessive
CPU usage if connecting to an attacker-controlled HTTP2 server while
installing dependencies in tofu init. (4700)
BUG FIXES:
- Lifecycle destroy will no longer crash when given an expression with
references (4648)
1.12.7
- When using either a remote-exec or file provisioner to connect to an
attacker-controlled SSH server, the server could previously deadlock
the connection by sending certain unexpected packet types. (4551)
am335x, am18xx: make the sdmmc drivers get along with each other
The am18xx and the am335x share a DMA controller used by the sdmmc controller. However, the am335x starts a transfer, then the DMA while the am18xx starts the DMA, then the transfer.
Currently, the DMA driver resets DMA events when starting a transfer, which breaks the am335x because it start the DMA after the transfer, so events can already accumulate. This commit rolls back the change that resets DMA events when starting a transfer.
However, this is now an issue on the am18xx, where due to a hardware quirk, it is possible for DMA events to accumulate on transfers that don't use the DMA. The fix is to always reset the DMA events on transfers with and without DMA.
libc/gen/Makefile.inc Avoid building while cleaning
Don't try and build the user version info for sysctl while
cleaning, the needed tools probably don't exist yet.
www/forgejo: import at version 16.0.6
forgejo is a forge software package for hosting software development
version control using Git as well as other collaborative features
like bug tracking, code review, continuous integration, kanban
boards, tickets, and wikis.
Tested on NetBSD/amd64.
security/sslx: import package
The modern way to work with certificates and TLS.
A fast, beautiful replacement for common openssl commands. Single binary,
zero config, pure Rust.
p5-Text-CSV_XS: update to 1.65.
1.65 - 2026-10-15, H.Merijn Brand
* CPAN.org does not forward email anymore
* parse (): report trailing lone CR, do not store EOF as 0xFF (CVE-2026-110759)
* Under allow_whitespace, do not strip beyond field start (CVE-2026-110758)
* combine (): decide quoting from the bytes, not the NV flags (CVE-2026-110757)
* Flush saved bytes in Combine () (CVE-2026-110756)
* Re-use AHEAD with \r instead of copying (CVE-2026-110755)
* getline (): free the result array when the parse fails (CVE-2026-110754)
* Do not free the bound column scalar in skip_empty_rows (CVE-2026-110753)
* fragment (): do not size memory by the selector integers (CVE-2026-110752)
p5-Cpanel-JSON-XS: update to 4.80.
4.80 2026-09-?? (rurban)
- Security fixes, reported by Stig Palmquist (CPANSec):
* CVE-2026-110672 decode: free the hash key on "Duplicate keys not
allowed" and on a missing ':' (leak).
* CVE-2026-110673 decode: charge allow_tags "(" nesting against
max_depth (stack overflow).
* CVE-2026-110674 decode: look bare keys up as UTF-8, so the
duplicate check no longer misses or crashes on non-ASCII keys.
* CVE-2026-110675 decode: validate bare hash keys as UTF-8 like
quoted keys (malformed keys).
* CVE-2026-110676 encode: compact allow_bignum Math::BigFloat
values with huge exponents (30MB from 12 bytes).
* CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference
counts (leaked every array).
* CVE-2026-110678 incr_parse: apply max_size to the buffered text
in every context.
* CVE-2026-110680 encode: bound the canonical key snapshot for
[49 lines not shown]
Eliminate very low concurrency limit in RAIDframe, improving write throughput as much as 25%.
RAIDframe maintains a per-set freelist of "emergency buffers" to ensure it can perform I/O
under heavy memory pressure. The freelist size was 10, and each I/O request can require
up to 2 buffers in some recovery conditions, so raidPtr->openings was limited to RAIDOUTSTANDING,
which was set to 6 (this was a bug; it should have been 5).
There is no need at all for this limit for RAID 0 or RAID 1 sets; they do not buffer I/O in
the relevant way. Eliminate the allocation entirely in this case; openings is set as the
configured queue length for the RAID set.
For parity RAID sets, we dynamically size two freelists of pre-allocated buffers and the
openings value so that we consume no more than 1% of system RAM per set:
openings = MIN(maxQueueDepth, MAX(RAIDOUTSTANDING, (1% of physmem), bytes_per_opening))
stripe buffers: 2 * openings
I/O buffers: openings * max_stripes_per_bp * numCol
RAIDOUTSTANDING (now used as a floor) remains 6.
[16 lines not shown]
