libxml2: update to 2.15.3.
From Showta Ishizaki in PR 60591.
v2.15.3: Apr 15 2026
### Security
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
### Improvements
- schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
- xmlreader: propagate reader resource loaders to validator parsers
- python: Make python bindings python2 compatible
[44 lines not shown]
www/gitea: update to 1.27.2
Changes in 1.27.2:
* SECURITY
- Fix: update collaborator access mode and httpsign
- Refactor: external render
- Fix(actions): resolve pull_request_target reusable workflows at the
base commit
- Refactor: markup render
- Fix(deps): update dependency mermaid to v11.16.1
- Fix(auth): set WebAuthn user verification per request
- Fix: render highlight language
* ENHANCEMENTS
- enhance: add missing npm package metadata properties
* BUGFIXES
- fix(actions): keep github.event.inputs as strings for
workflow_dispatch
- fix(actions): let a rerun of selected jobs read the previous
[419 lines not shown]
pkg-vulnerabilities: CVE-2025-69720 was fixed in ncurses-6.6
According upstream NEWS it was fixed in 20251213 and 6.6 was released
on 20251230.
Reported via PR pkg/60589 from Showta Ishizaki, thanks!
ca-certificates: Update to 20260601
ca-certificates (20260601) unstable; urgency=medium
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
[18 lines not shown]
croc: Update to 11.1.0
What's Changed
fix: --store rendering by @schollz in #1233
fix unbounded stored-transfer lock state by @abhinavgulisetty in #1238
feat: allow sending to multiple users Fixes #1130 by @schollz in #1239
chromium: update to 151.0.7922.137
* 151.0.7922.137
This update includes 5 security fixes. Please see the Chrome Security Page for more information.
[$500][535000102] High CVE-2026-19556: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-07-15
[N/A][534867485] High CVE-2026-19557: Use after free in TabStrip. Reported by Google on 2026-07-14
[N/A][536676756] High CVE-2026-19558: Use after free in Extensions. Reported by @bean5oup on 2026-07-20
[N/A][540100588] High CVE-2026-19559: Use after free in HTML. Reported by Google on 2026-07-28
[N/A][540482895] High CVE-2026-19560: Use after free in Blink. Reported by WinD39 - Huynh Dinh Vu on 2026-07-30
guile-slib: Convert to Makefile.common
Override PKGNAME to be guile-slib, instead of the guile20-slib that it
ought to be, to avoid dealing with changing it for now.
Works as well as the old package does, which is:
devel/guile22-slib: Convert to Makefile.common
Replace the guile22-slib Makefile with an include of Makefile.common.
guile30-slib: Restore load path env variable, but point it to destdir,
so that the catalog can find slib when the symlink exists in the
being-built destdir but does not exist in the system, because the
package is not yet installed.
devel/guile30-slib: Rototill installation comments
Read and explain the contradictory instructions from slib and guile,
and follow guile's instructions. Explain to future self everything
I'm likely to forget, as guided by what I forgot since I last read
guile-slib several years ago.
Slightly clean up by dropping an environment variable during catalgo
build that is not actually used.
Hoist guile's site dir to variable.
