openvpn: updated to 2.7.6
2.7.6
Enable TCP_NODELAY by default and push it to clients
options: make 'tun' the default for '--dev'
Correctly calculate packet id size when epoch packet format is in use
test_tls_crypt: Fix issue with temp file name on big endian systems
ssl_pkt: Fix doxygen warning about read_control_auth
t_client.sh.in: Do not run resolvectl if systemd is not running
test_tls_crypt: Fix test failure on Windows
ssl: Ignore hard reset packets with a non-zero packet id
mingw: avoid C99 "hh" scanf length modifier
interactive: forbid "--setenv opt" in startup data
CMake: detect cmocka_version.h via include path, not by linking
options: limit ping and keepalive values to one day
Make --x509-username-field work with Mbed TLS
Remove --providers from --help output for Mbed TLS
gstreamer1: updated to 1.28.6
1.28.6
Highlighted bugfixes:
Various security fixes and playback fixes
playbin3, playbin: fix stalls after re-enabling previously disabled subtitles
Fix regression in core if a pad is re-linked while changed sticky events are being pushed
dtls/webrtc: fix some issues with OpenSSL 4.0.0
RTP retransmission bitrate estimation fixes
Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets
Add H.266 muxing support to the Rust (f)mp4 muxers
Better handling of input buffers without timestamps in Rust (f)mp4 muxers
webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder
SMPTE ST2038 ancillary metadata and closed caption combiner improvements
Fix SEI insertion into H.265/HEVC streams with alpha
Windows D3D11 WinRT screen capture element fixes
Improved coded buffer size handling for VA encoders
[5 lines not shown]
firefox: remove target_arch=x86_64 cfg attr in patch
Fixes aarch64 build.
(target_pointer_width=64 should suffice here, NetBSD does not have x32
ABI for x86_64.)
chat/ejabberd: Update to 26.07
## Version 26.07
#### Security fixes
This release contains fixes for those issues:
- It's possible to craft PLAIN auth request and authenticate as one user, but then open
session for different one.
- mod_caps persistent cache can be poisoned by using legacy version requests.
This cache was only used to determine list of nodes that should trigger notifications
in PubSub presence-based delivery.
- SQL injection in mod_pubsub handling of paging requests.
- Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
- It was possible to make ejabberd send redirect response for OAuth requests to unvetted url.
This required enabling ejabberd to act as OAuth provider (by adding request handler for
ejabberd_oauth in http listener). As part of this fix we changed `oauth_client_id_check`
default value to `db` - using ejabberd as OAuth provider will be only allowed by clients
[20 lines not shown]
chat/ejabberd: Partially address pkglin and improve comments
- Improve version pattern for coreutils (textual change, NFCI)
- Reorder CONFIGURE_ARGS after DEPENDS
- Clarify and regularize description of build tools
- Reorder erlang bl3 depends.
Except for coreutils version, this is a comment-only/reordering
change.
chat/ejabberd: Update to 26.04
## Version 26.04
#### Core
- Add new listener options for limits to xml parser accepted input
- New predefined keyword `DATABASE_PATH` that points to the Mnesia spool dir
- Support HOST keyword in `sql_database` toplevel option, set nice default value
- ejabberd_config: New default_ram_db/3 clause that checks module support
powerdns: Update to 5.1.4
Released: 6th of August 2026
New Features
Allow NAPTR additional processing to be disabled
References: pull request 17810
Bug Fixes
more lmdb stability
References: pull request 17811, pull request 17814
Account for the existing content when parsing labels
References: pull request 17818
geoipbackend: create DNSSEC key files with mode 0600
References: pull request 17839
iputils: do not index past the address for byte-aligned prefixes
References: pull request 17846
dnsdist: Update to 2.1.1
Released: 6th of August 2026
Bug Fixes
Account for the existing content when parsing labels
References: #17790, #17797, pull request 17858
Do not index past the address for byte-aligned prefixes
References: #17835, pull request 17860
gnuplot: updated to 6.0.5
6.0.5
New features
Full mousing support for multiplots
all panels report mouse coordinates
all panels respond to pan/zoom/rotate mouse movement and hotkeys
"replot" reexecutes multiplot commands starting from current state
"remultiplot" restores the original state before reexecuting multiplot
interactive mousing remains active after ^C or "reset"
Unicode escape sequences \U+xxxx are accepted in more contexts
escape sequences are expanded in "noenhanced" strings
escape sequences are expanded during substring evaluation
escape sequences are expanded in string functions strstrt() and strlen()
New built-in function prod [<var> = <start> : <end>] <expression>
implements the sequential product operation
prod [i=a:b] f(i) = f(a) * f(a+1) * ... * f(b)
[10 lines not shown]
www/xh: update to 0.26.2
Bug fixes
- Fix --auth ignoring credentials when the username is empty (e.g. -a :password), see #467 (@upuddu)
- Decode all frames in concatenated zstd response bodies, see #470 (@snowyukitty)
sysutils/uutils-coreutils: update to 0.10.0
Rust Coreutils 0.10.0 Release:
We are happy to announce the release of Rust Coreutils 0.10.0 - a release focused on GNU compatibility and robustness. The GNU test suite results improved sharply this cycle (645 passing, 29 failing, down from 56), we landed a second wave of security hardening (TOCTOU races, safe recursive descent, SELinux labeling at creation, backup guards), and we ran a broad anti-panic campaign across the utilities. On top of that: new features (mv --exchange and an OpenSSL backend for the checksum utilities), more zero-copy/read-ahead performance work, and wasm32-wasip2 support.
Highlights:
GNU Compatibility
645 passing GNU tests (+20) and 27 fewer failures, the largest single-cycle drop we have had
Dozens of behavior alignments: pr (-w/-W/-l/-e/-o, merge mode, page ranges), nproc (cgroups v2 quota, affinity mask, offline cores, OMP_* handling), date (out-of-range years, -d -, O modifier, timezone strings), numfmt, ls, du, install, od, truncate, fold, head/tail, sum, stat
Many error messages now carry the file name and the real OS error instead of a vague or stripped message
Security Hardening
Continued the TOCTOU work started in 0.9.0: touch no longer uses O_TRUNC on create, mkfifo drops the path-based chmod, head checks the open fd instead of the path, split hardens the output-open path, chcon anchors recursive relabeling to the traversal dirfd
Safe recursive descent fixes for chmod/chown (symlink cycles, --preserve-root re-checked during the descent), and cp no longer descends into a destination subdirectory that is a symlink
SELinux labels are now applied at creation in mkdir, mkfifo and mknod instead of being applied afterwards
mv fails closed when recreating a cross-device directory destination, compares file identity in the --backup=simple guard, and strips setuid/setgid when a cross-device copy cannot preserve ownership
chroot chroots exactly the path --skip-chdir validated; stdbuf refuses a libstdbuf path that cannot be represented in LD_PRELOAD; install finalizes ownership before mode
[37 lines not shown]
jj: updated to 0.44.0
0.44.0
Support for fetching and pushing tags has now been stabilized. Tags can be
tracked or untracked just like bookmarks. Tracked tags are pushed by default.
