libextractor: update to 1.15.
Security fix release.
Fix pkglint.
Add test arget.
Mon Jun 29 07:58:39 PM CEST 2026
Fix potential 4 MB on-stack memory allocation that could
result in a stack-based buffer overflow in the OLE2 extractor.
Thanks to Haitam Lazaar for reporting.
Releasing GNU libextractor 1.15. -CG
Mon May 25 12:43:20 PM CEST 2026
Revive REAL plugin (fixes #2518).
Revive VLC plugin (fixes #2075).
Fix issues in ELF plugin (fixes #8514).
Fix issues in HTML plugin (fixes #8620).
Fix issues in EXIV2 plugin (fixes #8513, #9223).
Revive Applefile plugin (fixes #2517).
[3 lines not shown]
Update to version 9.2.1116.
Changes:
- patch 9.2.1116: 'tagfunc' not used for tag completion
- patch 9.2.1115: ml_updatechunk() rescans all chunks on every line update
- patch 9.2.1114: Visual selection is not highlighted at the cursor position
- runtime(nasm): move options to separate ftplugin
- patch 9.2.1113: use-after-free and memory leak in serverSendToVim()
- runtime(c,cpp): Update syntax, fix number patterns
- runtime(sh): touch does not end at curly block
- patch 9.2.1112: set_indent() adjusts text properties without any present
- patch 9.2.1111: Crash in a zero-width window with a status line
- patch 9.2.1110: regexp NFA compilation reallocates scratch buffers each time
- patch 9.2.1109: Popup image is drawn over a popup with a higher zindex
- runtime(doc): fix wrong notation of :qall in quickfix.txt
- patch 9.2.1108: Scrolling recomputes the height of every visible line
- runtime(nginx): syntax highlighting is slow on large configs
- patch 9.2.1107: getregionpos() is slow when only the region bounds are needed
- patch 9.2.1106: GTK4: cell edges are blurry with fractional scaling
[119 lines not shown]
x86/sysbeep(4): Don't detach at shutdown.
This reverts sys/arch/x86/isa/clock.c rev. 1.32, which was the first
of a spate of changes to sprinkle DVF_DETACH_SHUTDOWN for reasons
that were unclear and apparently interfere with other functionality:
> Module Name: src
> Committed By: dyoung
> Date: Tue Apr 7 17:51:46 UTC 2009
>
> Modified Files:
> src/sys/arch/x86/isa: clock.c
>
> Log Message:
> Detach sysbeep0 at shutdown.
>
>
> To generate a diff of this commit:
> cvs rdiff -u -r1.31 -r1.32 src/sys/arch/x86/isa/clock.c
[18 lines not shown]
adjtime.2 & gettimeofday.2: minor wording and style tweaks
(Various man pages can't decide between "super user", "super-user", and
"superuser"; let's at least be consistent from line to line in one
man page.)
ld.elf_so: g/c empty conditional
It was not empty for about two hours before the commit that introduced
it had been reverted. Its content was revered, but the conditional
itself was forgoten.
While here, add "compat32" in the comment for the MLIBDIR block to
make this place more easily findable.
risc-v: revert the change for generic_bs_r_4
According to the RISC-V ABI Calling Convention an integer scalars
narrower than XLEN bits are widened according to the sign of their
type up to 32 bits, then sign-extended to XLEN bits.
bind920: update to version 9.20.29.
Pkgsrc changes:
* Update version number & checksums.
Upstream changes:
Notes for BIND 9.20.29
----------------------
Security Fixes
~~~~~~~~~~~~~~
- Prevent excessive CPU use validating crafted DNSSEC responses.
:cve:`2026-19668`
A malicious authoritative server could serve a securely delegated zone
whose DS and DNSKEY records carried many distinct key tags but no valid
match, forcing a validating resolver into excessive key-tag matching
[352 lines not shown]
lang/ruby40: update to 4.0.7
This release contains fix for CVE-2026-80212 and CVE-2026-80213 in resolv
gem.
4.0.7 (2026-09-15)
* Bug #22188: addr2line doesn't find symbols when compiled with GCC LTO
* Bug #22210: Check if issue #19969 is still reproducible / re-opened in 4.0.x
* Bug #22217: Segmentation fault when resuming execution with Coverage.start
and ruby/debug
* Fix formatting in ObjectSpace._id2ref error path by eregon · Pull Request
#18206
* Bug #22200: ObjectSpace._id2ref can return a different object than the
id's owner on Ruby 4.0 (stale id2ref_tbl entry for objects with generic
[59 lines not shown]
wg(4): Assert task is nonzero before queueing work.
Prompted by (though I can't see any way it could be the source of):
PR kern/60728: workqueue panic in wg
