www/viewvc -- update to v1.3.0
ChangeLog:
updated dependency requirements
minimum Python version is now 3.10 (#138,#400)
minimum Subversion version now 1.14.0 with py3 bindings
minimum Pygments version now 1.1
minimum MySQL version now MySQL 5.7/MariaDB 10.2 (#213)
now using passlib (instead of fcrypt) for standalone authn
support (#361)
removed support for mod_python-based deployments (#234)
removed support for ASP-based deployments (#235)
removed support for the command-line blame script (#381)
make-database now requires --force to destroy existing DB (#212)
removed deprecated checkout_magic option/behavior (#215)
new 'allow_mojibake' option (#216)
require explicit match for web-friendly images in
'binary_mime_types' (#216)
[11 lines not shown]
lang/php84: update to 8.5.12
PHP 8.5.12 (2026-10-22)
- Core:
. Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
ndossche, Nicolas Grekas)
. Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison
unfolded, crashing the VM in zval_undefined_cv). (ndossche)
. Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
. Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
. Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
comparison. (Arnaud)
. Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
(ndossche)
. Fixed AVX being reported as supported when the OS has not enabled AVX
state. (Ilia Alshanetsky)
. Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
[231 lines not shown]
lang/php84: update to 8.4.27
PHP 8.4.27 (2026-10-22)
- Core:
. Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
ndossche, Nicolas Grekas)
. Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
comparison. (Arnaud)
. Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
(ndossche)
. Fixed AVX being reported as supported when the OS has not enabled AVX
state. (Ilia Alshanetsky)
. Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
. Fixed bug GH-23896 (Assertion failure in zend_call_function() after a
throwing deprecation). (lazerg)
. Fixed use-after-free when a dl()-loaded extension declares a frameless
function and a later request calls it. (Ilia Alshanetsky)
[229 lines not shown]
*: add LDFLAGS overide that was previously in mk
This is a workaround and should be fixed properly per-package - they
should use the pkgsrc LDFLAGS, but this restores what happened
before the mk/ cleanup.
Fixes relro build for packages that do not honor LDFLAGS.
wtype: update to 0.5
What's Changed
- Avoid control-key collisions when typing literal text by @tijszwinkels in #77
- Add additional modifier keys by @tmccombs in #57
p5-Mozilla-CA: update to 20261020.
20261020
- Update from Mozilla repository to 2026-10-20
- Denylisted certificates:
- emSign ECC Root CA - G3
sha256: 86a1ecba089c4a8d3bbe2734c612ba341d813e043cf9e8a862cd5c57a36bbe6b
Additionally apply patch to pullup the following, requested by
riastradh in ticket #1383:
distrib/sets/lists/base/mi 1.1394
mark two removed certs as obsolete
Pull up following revision(s) (requested by riastradh in ticket #537):
distrib/sets/lists/base/mi: revision 1.1394
mozilla-certdata: Mark two nixed certs as obsolete.
Missed a spot, must not have had a clean destdir somehow.
PR security/60908: mozilla-certdata: update for compromised CA
