tailscale: 1.104.6
All:
- A rare connectivity issue that affected dormant connections has
been resolved.
Darwin:
- Error handling has been improved when multiple network extensions
are present.
- An issue where MagicDNS could select a suffix-scoped DNS resolver
during network transitions has been resolved.
- A DNS configuration race condition that could occur during network
transitions has been resolved.
www/freenginx: update: 1.30.1 -> 1.30.2
While I'm here fix fetch echo third-party module.
Sponsored by: tipi.work
<ChangeLog>
*) Security: one of the keys was left uninitialized when using automatic
rotation of TLS session ticket keys, making it possible to forge a
session and bypass client certificate verification (CVE-2026-97629);
</ChangeLog>
www/freenginx-devel: update from 1.31.4 to 1.31.5
While I'm here fix fetching for echo third-party module.
Sponsored by: tipi.work
<ChangeLog>
*) Security: one of the keys was left uninitialized when using automatic
rotation of TLS session ticket keys, making it possible to forge a
session and bypass client certificate verification (CVE-2026-97629);
*) Bugfix: a segmentation fault might occur in a worker process if AIO
was used in subrequests.
*) Bugfix: in HTTP/3.
</ChangeLog>
awesome: (smallest ever) recursive revbump for devel/lua-gi
The real dependency for glib2-introspection lies there, and this will
fail during the configure stage when the tooling finds it can't call
lua-gi as it expects.
lua-gi: mark runtime dependency on glib2-introspection
This package exports objects provided by glib2-introspection to Lua
runtime environments (in pkgsrc's case, anyway, just wm/awesome).
Runtime failure of awesome noted by Fekete Zoltán on pkgsrc-users@.
foot: update to 1.28.0
Added
+ Command line option --class, an alias for --app-id. Intended to be used
by scripts and similar that wants to launch terminal instances in a
terminal agnostic way
+ Support for terminal visibility reports, using the Wayland xdg_toplevel
suspended state.
+ Support for wl_fixes::ack_global_remove().
Changed
+ Do not allow codepoints to be merged into grapheme clusters directly
after a cursor move
+ Dracula theme updated to latest official, and light theme alucard
added.
+ Sixels: pan/pad clamped to 5
+ Default URL regex changed to:
[49 lines not shown]
lang/rust-bin: Fix rust-bin-1.98.1 not building/installing on Darwin
Some of the executables that previously didn't have relative rpaths, now
have ones. Turn them into absolute paths as well.
go: update to 1.27.4 and 1.26.11 (security)
These releases include 12 security fixes following the security policy <https://go.dev/doc/security/policy>:
- net/http: HTTP/1 server crash due to MaxBytesReader header race
For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
"Connection: close" header is automatically set without synchronization,
which might race with another header being set explicitly in the server
handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
MaxBytesHandler can crash due to runtime panic if its handler reads the
request body concurrently with writing the response header.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.
- cmd/go: unexpected code execution via --sysroot, -target, -isysroot,
-Wl,-syslibroot, and -x cgo flags
[279 lines not shown]
mail/thunderbird: Disable debug symbols for non-debug builds
Turns out debug symbols are enabled by default even when --disable-debug is
given, which are thrown away at installation time due to
--enable-install-strip. We must pass a separate option
--disable-debug-symbols to ${WRKSRC}/configure. This massively reduces the
memory requirements from >32 GiB to ~3 GiB, as well as disk usage from
several tens of GiB to just 9.8 GiB.
libmatheval: update to 1.1.12.
Version 1.1.12
* Updated build system to work with current GNU autotools. Guile is
needed for test suite only, which now works with Guile 2.0 and later.
* Fixed buffer overflows in the Fortran interface and in handling of
very long strings (reported by Hongduo Zhao).
* Fixed memory leaks on parsing error, and in Flex generated scanner.
* Characters not part of the notation are now reported as error,
instead of being echoed to standard output.
* Fixed wrong simplification of 0^x.
* Fixed wrong derivatives of asinh() and acoth() functions.
* Inverse hyperbolic functions are calculated by C library, fixing
inaccurate results for very small or very large arguments.
* Added min(), max() and select() functions. Note that min, max and
select therefore can not be used as variable names any more.
* Library exports its interface only, so that its internal symbols
(including these of Lex and Yacc generated code) do not clash with
[3 lines not shown]
lang/rust/cargo.mk: Make cargo-vendor-crates recipe more robust.
1. Fail if digest command fails for any reason.
2. Don't leave each final .json file around if interrupted.
No functional change intended in the success case.
