lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619
Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub.
Quote from security advisory announce on https://www.php.net:
Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.
Bump PKGREVISION.
archivers/libarchive: fix build on -10 / with older bmake
Avoid using $^ in the makefile. With bmake that doesn't support it,
which includes the one on -10 which is still supported, it expands to
empty and the result is that the build hangs trying to grep from
stdin.
Once -10 is EOL this change can be dropped.
Build fix, so no need to bump anything.
PR 60077
powerdns: Update to 5.1.5
Released: 21st of October 2026
This is release 5.1.5 of the Authoritative Server. It contains bug fixes, as well as a minor feature and a security fix.
Please review the Upgrade Notes before upgrading from versions < 5.1.x.
Improvements
api: allow forced update for EXTEND and DELETE zone patch operations
References: pull request 18104
report remote in “unable to get SOA” messages
References: pull request 18131
correctly stop the Lua checker thread when exiting
References: pull request 18134
Bug Fixes
SQL: stricter listSubZones operation
References: pull request 18105
rest-api: fix signedness bug in json data normalization
References: pull request 18106
[14 lines not shown]
knot: Update to 3.6.2
Improvements:
knotd: added MONOTONIC_USEC to sd_notify() for systemd's notify-reload service type
Bugfixes:
knotd: ZONEMD verification omits regular nodes that collide with NSEC3 ones (Thanks to Joshua Rogers)
knotd: catalog updates can purge non-catalog zones with conflicting names (Thanks to Joshua Rogers)
knotd: blocking transfer freeze operation returns prematurely
libknot: connection table exhaustion during QUIC sweep
libknot: uncontrolled compression-pointer traversal in DNS message parsing
libknot: unbounded write-backpressure busy-spin in the DoT send path
tests: build fails if --disable-daemon is specified
tmux: update to 3.8
* Many improvements to floating panes:
- new-pane and split-window can now set the title with -T and
border lines with -B, and new-pane -W waits for the pane command
to exit;
- dragging with Ctrl now creates a new floating pane;
- modal panes may be created with new-pane -O; a window can have
one modal pane and it prevents interaction with the other panes
while it is active. -C closes the pane when the mouse is clicked
outside it and -K sends all keys, including the prefix key, to
the pane. -D closes the modal pane with Escape or C-c. A modal
pane is now used for the editor in buffer mode;
- new-pane -A creates a floating pane which remains above a zoomed
pane; modal panes do this by default;
- move-pane and resize-pane can now move and resize floating panes,
including mouse dragging;
- split-window in a floating pane creates a new floating pane that
does not overlap the active pane, if possible;
[202 lines not shown]
net/netatalk4 -- update to v4.6.1
v4.6.1 - What's Changed
update CONTRIBUTORS.md for the v4.6 release cycle by @rdmark in #3310
revise contributors with GitHub handles by @rdmark in #3317
compat: add header so strlcpy is defined on platforms with older glibc
by @nutzman in #3318
ci: generate and publish afpd code coverage statistics
by @rdmark in #3319
distrib: fix test suite flag checks in container entrypoint
by @rdmark in #3326
doc: programmatically generate TOC index for manpages
by @rdmark in #3322
doc: Japanese localization of the fce_ev_script.8 man page
by @rdmark in #3325
docs: expand workflow environment variables in compile instructions
by @rdmark in #3323
afpd: harden legacy FinderInfo symlink handling
[78 lines not shown]
dtb: add left-out earmv7eb to update-sets
earmv7eb accidentally did not get updated when regenerating set lists, while earmv7hf got included twice.
Reported by Elias Howell.
Pull up following revision(s) (requested by riastradh in ticket #1375):
common/lib/libc/string/memmem.c: revision 1.6
memmem(3): Avoid undefined behaviour in shift.
PR lib/58906: memmem.c: sync with musl upstream that fixes UB on
signed overflow
Pull up following revision(s) (requested by riastradh in ticket #1374):
sys/dev/video.c: revision 1.46
When dropping lock around scatter_io_uiomove(), use busy flag
to serialize operations.
Hold lock while accessing video_stream and video_buffer.
