resterm: Update to 1.16.0
New RestermScript helpers
Standard library names without rts.
Stricter null handling
+ on lists and dictionaries
@use and @setting stay in their request
Clearer error messages
tailscale: update to 1.104.2
Go is updated to version 1.27.3, to explicitly distrust compromised
TLS intermediate certificates as described in security bulletin
TS-2026-013.
www/viewvc -- update to v1.3.0
ChangeLog:
updated dependency requirements
minimum Python version is now 3.10 (#138,#400)
minimum Subversion version now 1.14.0 with py3 bindings
minimum Pygments version now 1.1
minimum MySQL version now MySQL 5.7/MariaDB 10.2 (#213)
now using passlib (instead of fcrypt) for standalone authn
support (#361)
removed support for mod_python-based deployments (#234)
removed support for ASP-based deployments (#235)
removed support for the command-line blame script (#381)
make-database now requires --force to destroy existing DB (#212)
removed deprecated checkout_magic option/behavior (#215)
new 'allow_mojibake' option (#216)
require explicit match for web-friendly images in
'binary_mime_types' (#216)
[11 lines not shown]
lang/php84: update to 8.5.12
PHP 8.5.12 (2026-10-22)
- Core:
. Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
ndossche, Nicolas Grekas)
. Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison
unfolded, crashing the VM in zval_undefined_cv). (ndossche)
. Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)
. Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)
. Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
comparison. (Arnaud)
. Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
(ndossche)
. Fixed AVX being reported as supported when the OS has not enabled AVX
state. (Ilia Alshanetsky)
. Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
[231 lines not shown]
lang/php84: update to 8.4.27
PHP 8.4.27 (2026-10-22)
- Core:
. Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
ndossche, Nicolas Grekas)
. Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object
comparison. (Arnaud)
. Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
(ndossche)
. Fixed AVX being reported as supported when the OS has not enabled AVX
state. (Ilia Alshanetsky)
. Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)
. Fixed bug GH-23896 (Assertion failure in zend_call_function() after a
throwing deprecation). (lazerg)
. Fixed use-after-free when a dl()-loaded extension declares a frameless
function and a later request calls it. (Ilia Alshanetsky)
[229 lines not shown]
*: add LDFLAGS overide that was previously in mk
This is a workaround and should be fixed properly per-package - they
should use the pkgsrc LDFLAGS, but this restores what happened
before the mk/ cleanup.
Fixes relro build for packages that do not honor LDFLAGS.
