NetBSD/pkgsrc HgHog1Qdoc CHANGES-2026

   Updated multimedia/gstreamer1, net/openvpn, security/p11-kit
VersionDeltaFile
1.5038+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc wvkSrcPsecurity/p11-kit PLIST Makefile

   p11-kit: updated to 0.26.5

   0.26.5 (stable)
   * rpc: guard against overflow when decoding nested attributes (CVE-2026-18938)
VersionDeltaFile
1.37+4-4security/p11-kit/distinfo
1.17+2-2security/p11-kit/PLIST
1.46+2-2security/p11-kit/Makefile
+8-83 files

NetBSD/pkgsrc 7lieE52net/openvpn Makefile.common distinfo, net/openvpn-acct-wtmpx distinfo

   openvpn: updated to 2.7.6

   2.7.6

   Enable TCP_NODELAY by default and push it to clients
   options: make 'tun' the default for '--dev'
   Correctly calculate packet id size when epoch packet format is in use
   test_tls_crypt: Fix issue with temp file name on big endian systems
   ssl_pkt: Fix doxygen warning about read_control_auth
   t_client.sh.in: Do not run resolvectl if systemd is not running
   test_tls_crypt: Fix test failure on Windows
   ssl: Ignore hard reset packets with a non-zero packet id
   mingw: avoid C99 "hh" scanf length modifier
   interactive: forbid "--setenv opt" in startup data
   CMake: detect cmocka_version.h via include path, not by linking
   options: limit ping and keepalive values to one day
   Make --x509-username-field work with Mbed TLS
   Remove --providers from --help output for Mbed TLS
VersionDeltaFile
1.82+4-4net/openvpn/distinfo
1.54+4-4net/openvpn-nagios/distinfo
1.57+4-4net/openvpn-acct-wtmpx/distinfo
1.51+2-2net/openvpn/Makefile.common
+14-144 files

NetBSD/pkgsrc l8MqK7umultimedia/gst-plugins1-bad distinfo, multimedia/gst-plugins1-base distinfo

   gstreamer1: updated to 1.28.6

   1.28.6

   Highlighted bugfixes:

   Various security fixes and playback fixes
   playbin3, playbin: fix stalls after re-enabling previously disabled subtitles
   Fix regression in core if a pad is re-linked while changed sticky events are being pushed
   dtls/webrtc: fix some issues with OpenSSL 4.0.0
   RTP retransmission bitrate estimation fixes
   Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets
   Add H.266 muxing support to the Rust (f)mp4 muxers
   Better handling of input buffers without timestamps in Rust (f)mp4 muxers
   webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder
   SMPTE ST2038 ancillary metadata and closed caption combiner improvements
   Fix SEI insertion into H.265/HEVC streams with alpha
   Windows D3D11 WinRT screen capture element fixes
   Improved coded buffer size handling for VA encoders

    [5 lines not shown]
VersionDeltaFile
1.40+4-4net/gst-rtsp-server/distinfo
1.54+4-4multimedia/py-gstreamer1/distinfo
1.80+4-4multimedia/gstreamer1/distinfo
1.43+4-4multimedia/gst-plugins1-editing-services/distinfo
1.87+4-4multimedia/gst-plugins1-base/distinfo
1.79+4-4multimedia/gst-plugins1-bad/distinfo
+24-244 files not shown
+38-3810 files

NetBSD/pkgsrc ll6UYNFwww/firefox mozilla-common.mk distinfo, www/firefox/patches patch-third__party_rust_mtu_src_bindings_netbsd.rs

   firefox: remove target_arch=x86_64 cfg attr in patch

   Fixes aarch64 build.
   (target_pointer_width=64 should suffice here, NetBSD does not have x32
   ABI for x86_64.)
VersionDeltaFile
1.3+19-19www/firefox/patches/patch-third__party_rust_mtu_src_bindings_netbsd.rs
1.320+2-2www/firefox/mozilla-common.mk
1.589+2-2www/firefox/distinfo
+23-233 files

NetBSD/pkgsrc q0doi98doc TODO CHANGES-2026

   doc: Updated chat/ejabberd to 26.07
VersionDeltaFile
1.27697+1-2doc/TODO
1.5037+2-1doc/CHANGES-2026
+3-32 files

NetBSD/pkgsrc EwQW24Bchat/ejabberd PLIST Makefile

   chat/ejabberd: Update to 26.07

   ## Version 26.07

   #### Security fixes

   This release contains fixes for those issues:

   - It's possible to craft PLAIN auth request and authenticate as one user, but then open
     session for different one.
   - mod_caps persistent cache can be poisoned by using legacy version requests.
     This cache was only used to determine list of nodes that should trigger notifications
     in PubSub presence-based delivery.
   - SQL injection in mod_pubsub handling of paging requests.
   - Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
   - It was possible to make ejabberd send redirect response for OAuth requests to unvetted url.
     This required enabling ejabberd to act as OAuth provider (by adding request handler for
     ejabberd_oauth in http listener). As part of this fix we changed `oauth_client_id_check`
     default value to `db` - using ejabberd as OAuth provider will be only allowed by clients

    [20 lines not shown]
VersionDeltaFile
1.80+4-4chat/ejabberd/distinfo
1.119+3-3chat/ejabberd/Makefile
1.69+5-0chat/ejabberd/PLIST
+12-73 files

NetBSD/pkgsrc rF18QDgsecurity/libssh options.mk

   libssh: needs openssl 3.5.0
VersionDeltaFile
1.9+2-1security/libssh/options.mk
+2-11 files

NetBSD/pkgsrc c4gStPQchat/ejabberd Makefile

   chat/ejabberd: Partially address pkglin and improve comments

     - Improve version pattern for coreutils (textual change, NFCI)
     - Reorder CONFIGURE_ARGS after DEPENDS
     - Clarify and regularize description of build tools
     - Reorder erlang bl3 depends.

   Except for coreutils version, this is a comment-only/reordering
   change.
VersionDeltaFile
1.118+43-46chat/ejabberd/Makefile
+43-461 files

NetBSD/pkgsrc qwAeEbcdoc CHANGES-2026

   doc: Updated net/powerdns-recursor to 5.4.5
VersionDeltaFile
1.5036+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc U7HwIEZnet/powerdns-recursor cargo-depends.mk Makefile

   powerdns-recursor: Update to 5.4.5

   Released: 6th of August 2026

   Improvements
   Add ubuntu-resolute build target.
   References: #16986, pull request 17836

   Bug Fixes
   Fix disabling algo 8 also disables DS digest 2.
   References: #17786, pull request 17840
   Account for the existing content when parsing labels.
   References: #17790, #17797, pull request 17847
   Do not index past the address for byte-aligned prefixes.
   References: #17835, pull request 17850
   Fix DNAME interaction with aggressive use of NSEC3
   References: #17157, pull request 17853
   Fix DNSSEC validation of wildcard-expanded proof.
   References: #17156, pull request 17854
VersionDeltaFile
1.53+4-4net/powerdns-recursor/distinfo
1.66+2-2net/powerdns-recursor/Makefile
1.6+0-0net/powerdns-recursor/cargo-depends.mk
+6-63 files

NetBSD/pkgsrc xuQDVa4doc CHANGES-2026

   doc: Updated chat/ejabberd to 26.04
VersionDeltaFile
1.5035+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc yBrAd7jchat/ejabberd PLIST options.mk

   chat/ejabberd: Update to 26.04

   ## Version 26.04

   #### Core

   - Add new listener options for limits to xml parser accepted input
   - New predefined keyword `DATABASE_PATH` that points to the Mnesia spool dir
   - Support HOST keyword in `sql_database` toplevel option, set nice default value
   - ejabberd_config: New default_ram_db/3 clause that checks module support
VersionDeltaFile
1.79+4-4chat/ejabberd/distinfo
1.117+3-4chat/ejabberd/Makefile
1.8+2-2chat/ejabberd/options.mk
1.68+1-1chat/ejabberd/PLIST
+10-114 files

NetBSD/pkgsrc eHPrAhSdoc CHANGES-2026

   doc: Updated net/powerdns to 5.1.4
VersionDeltaFile
1.5034+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc gAm7Z4Fnet/powerdns Makefile.common distinfo

   powerdns: Update to 5.1.4

   Released: 6th of August 2026

   New Features
   Allow NAPTR additional processing to be disabled
   References: pull request 17810

   Bug Fixes
   more lmdb stability
   References: pull request 17811, pull request 17814
   Account for the existing content when parsing labels
   References: pull request 17818
   geoipbackend: create DNSSEC key files with mode 0600
   References: pull request 17839
   iputils: do not index past the address for byte-aligned prefixes
   References: pull request 17846
VersionDeltaFile
1.62+4-4net/powerdns/distinfo
1.51+2-2net/powerdns/Makefile.common
+6-62 files

NetBSD/pkgsrc e7UBsqzwww/moodle Makefile

   (www/moodle) Fix build,+REPLACE_PERL+= ...algebra2tex.pl
VersionDeltaFile
1.111+2-1www/moodle/Makefile
+2-11 files

NetBSD/pkgsrc sAzw9mPdoc CHANGES-2026

   doc: Updated net/dnsdist to 2.1.1
VersionDeltaFile
1.5033+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc vth2f1nnet/dnsdist Makefile distinfo

   dnsdist: Update to 2.1.1

   Released: 6th of August 2026

   Bug Fixes
   Account for the existing content when parsing labels
   References: #17790, #17797, pull request 17858
   Do not index past the address for byte-aligned prefixes
   References: #17835, pull request 17860
VersionDeltaFile
1.30+4-4net/dnsdist/distinfo
1.54+2-2net/dnsdist/Makefile
+6-62 files

NetBSD/pkgsrc x1igSrRlang/rexx-regina/patches patch-aa

   lang/rexx-regina: Fix checksum mismatch

   * Reported by wiz@. It does not contain all changes. Thank you.
VersionDeltaFile
1.7+16-7lang/rexx-regina/patches/patch-aa
+16-71 files

NetBSD/pkgsrc 9paCnvcdoc CHANGES-2026

   Updated devel/jj, graphics/gnuplot
VersionDeltaFile
1.5032+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc BtCD3R6graphics/gnuplot Makefile distinfo

   gnuplot: updated to 6.0.5

   6.0.5

   New features

   Full mousing support for multiplots
   all panels report mouse coordinates
   all panels respond to pan/zoom/rotate mouse movement and hotkeys
   "replot" reexecutes multiplot commands starting from current state
   "remultiplot" restores the original state before reexecuting multiplot
   interactive mousing remains active after ^C or "reset"
   Unicode escape sequences \U+xxxx are accepted in more contexts
   escape sequences are expanded in "noenhanced" strings
   escape sequences are expanded during substring evaluation
   escape sequences are expanded in string functions strstrt() and strlen()
   New built-in function prod [<var> = <start> : <end>] <expression>
   implements the sequential product operation
   prod [i=a:b] f(i) = f(a) * f(a+1) * ... * f(b)

    [10 lines not shown]
VersionDeltaFile
1.57+4-4graphics/gnuplot/distinfo
1.209+2-3graphics/gnuplot/Makefile
+6-72 files

NetBSD/pkgsrc vul7uBWdoc CHANGES-2026

   doc: Updated www/xh to 0.26.2
VersionDeltaFile
1.5031+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc qpofaNtwww/xh Makefile cargo-depends.mk

   www/xh: update to 0.26.2

   Bug fixes

    - Fix --auth ignoring credentials when the username is empty (e.g. -a :password), see #467 (@upuddu)
    - Decode all frames in concatenated zstd response bodies, see #470 (@snowyukitty)
VersionDeltaFile
1.18+277-307www/xh/distinfo
1.16+91-101www/xh/cargo-depends.mk
1.20+2-2www/xh/Makefile
+370-4103 files

NetBSD/pkgsrc GRWClX7doc CHANGES-2026

   doc: Updated sysutils/uutils-coreutils to 0.10.0
VersionDeltaFile
1.5030+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc qsa6bvqsysutils/uutils-coreutils Makefile cargo-depends.mk

   sysutils/uutils-coreutils: update to 0.10.0

   Rust Coreutils 0.10.0 Release:

   We are happy to announce the release of Rust Coreutils 0.10.0 - a release focused on GNU compatibility and robustness. The GNU test suite results improved sharply this cycle (645 passing, 29 failing, down from 56), we landed a second wave of security hardening (TOCTOU races, safe recursive descent, SELinux labeling at creation, backup guards), and we ran a broad anti-panic campaign across the utilities. On top of that: new features (mv --exchange and an OpenSSL backend for the checksum utilities), more zero-copy/read-ahead performance work, and wasm32-wasip2 support.

   Highlights:

       GNU Compatibility
           645 passing GNU tests (+20) and 27 fewer failures, the largest single-cycle drop we have had
           Dozens of behavior alignments: pr (-w/-W/-l/-e/-o, merge mode, page ranges), nproc (cgroups v2 quota, affinity mask, offline cores, OMP_* handling), date (out-of-range years, -d -, O modifier, timezone strings), numfmt, ls, du, install, od, truncate, fold, head/tail, sum, stat
           Many error messages now carry the file name and the real OS error instead of a vague or stripped message

       Security Hardening
           Continued the TOCTOU work started in 0.9.0: touch no longer uses O_TRUNC on create, mkfifo drops the path-based chmod, head checks the open fd instead of the path, split hardens the output-open path, chcon anchors recursive relabeling to the traversal dirfd
           Safe recursive descent fixes for chmod/chown (symlink cycles, --preserve-root re-checked during the descent), and cp no longer descends into a destination subdirectory that is a symlink
           SELinux labels are now applied at creation in mkdir, mkfifo and mknod instead of being applied afterwards
           mv fails closed when recreating a cross-device directory destination, compares file identity in the --backup=simple guard, and strips setuid/setgid when a cross-device copy cannot preserve ownership
           chroot chroots exactly the path --skip-chdir validated; stdbuf refuses a libstdbuf path that cannot be represented in LD_PRELOAD; install finalizes ownership before mode

    [37 lines not shown]
VersionDeltaFile
1.3+211-232sysutils/uutils-coreutils/distinfo
1.3+69-76sysutils/uutils-coreutils/cargo-depends.mk
1.3+2-2sysutils/uutils-coreutils/Makefile
+282-3103 files

NetBSD/pkgsrc ScACRAwdevel/jj Makefile cargo-depends.mk

   jj: updated to 0.44.0

   0.44.0

   Support for fetching and pushing tags has now been stabilized. Tags can be
   tracked or untracked just like bookmarks. Tracked tags are pushed by default.
VersionDeltaFile
1.37+229-199devel/jj/distinfo
1.36+75-65devel/jj/cargo-depends.mk
1.43+2-2devel/jj/Makefile
+306-2663 files

NetBSD/pkgsrc g3FWCIDdoc CHANGES-2026

   fix broken file
VersionDeltaFile
1.5029+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc CrxvHWmdoc CHANGES-2026

   Updated lang/nodejs24, lang/nodejs
VersionDeltaFile
1.5028+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc Sbusdaulang/nodejs Makefile PLIST

   nodejs: updated to 26.7.0

   26.7.0 (Current)

   Notable Changes

   - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan)
   - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot)
   - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu)
   - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing)
   - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller)
VersionDeltaFile
1.326+4-4lang/nodejs/distinfo
1.105+6-1lang/nodejs/PLIST
1.358+2-2lang/nodejs/Makefile
+12-73 files

NetBSD/pkgsrc s1i3SVashells/oh-my-posh Makefile distinfo

   shells/oh-my-posh: update to 30.6.2

   v30.6.2
   Bug Fixes

    - pwsh: keep tooltip restore redraw in UTF-8 (3d7cc27), closes #7776

   v30.6.1
   Bug Fixes

    - cache: refresh serve daemon's cache from disk each render cycle (#7774) (eda0185), closes #7758

   v30.6.0
   Bug Fixes

    - cache: accept pointer-shaped gob decodes in Get[T] (262c744), closes #7766
    - pwsh: stop repeated profile sourcing from breaking ViMode (2afd3fc), closes #7772
    - pwsh: trim ViMode restore comment (e446fdc)


    [4 lines not shown]
VersionDeltaFile
1.323+4-4shells/oh-my-posh/distinfo
1.355+2-2shells/oh-my-posh/Makefile
+6-62 files