security/libdecaf: Update to v1.0.5
Changes since v1.0.3:
September 21, 2026:
* Fix a git snafu. Tagged as v1.0.4a. But on second thought (and
thoughts by Johan Pascal) maybe this version number will confuse
version control tools. Let's call it v1.0.5.
September 20, 2026:
* Fix an RFC compliance mistake reported by Ryan Culpepper.
RFC 7748 mandates that the last bit of an x25519 public key
u-coordinate be masked off, in case the protocol is using this for
something else. I have fixed this bug and added a test to verify
that it is fixed.
* Release v1.0.4.
py-setproctitle: updated to 1.3.8
1.3.8
- Add support for Python 3.15.
- Fix segfault calling setproctitle() after clearenv() on Python 3.15.
- Add support for riscv64.
py-meson_python: updated to 0.22.1
0.22.1
- Do not remove absolute build RPATH entries, unless pointing within the
build directory. Fixes an issue when using system compilers in a conda
environment.
patchelf: updated to 0.19.2
0.19.2
A bug fix release for rewriting executables after stripping.
Bug fixes
Fix executable corruption when patching again after strip removes padding between load segments, as seen when bootstrapping GHC. Rewritten sections and program headers now use the address mapping of the load segment covering the ELF header.
Avoid allocating an unnecessary extra page when growing executable sections, while keeping split load segments from overlapping after page alignment.
lang/hare: New package
Hare is a systems programming language designed to be simple, stable, and
robust. Hare uses a static type system, manual memory management, and a
minimal runtime. It is well-suited to writing operating systems, system
tools, compilers, networking software, and other low-level, high performance
tasks.
www/apache24: update to 2.4.69
Apache 2.4.69 (2026-10-01)
*) Fix the tar icon in the documentation so that its background is
transparent. #70238. [Jeffery To <jeffery.to gmail.com>]
*) mod_ssl: Fix OpenSSL compatibility macros for X509_get0_notBefore,
X509_get0_notAfter, and X509_get0_serialNumber with OpenSSL < 1.1.
#70205. [Craig Lorentzen <crlorent amazon.com>]
*) mod_cgid, mod_ssl, mod_md: Various hardening fixes. [Various authors]
*) mod_md: MDServerStatus is now disabled by default. [Joe Orton]
*) mod_auth_digest: Fix compatibility with expression-based AuthName.
#59039. [Eric Covener]
*) mod_auth_digest.c: Drop RFC 2069 support; rewrite shared memory
[29 lines not shown]
databases/postgresql-postgis2: Drop explicit ACCEPTED
postgis builds with all versions in the default value of
PGSQL_VERSIONS_ACCEPTED. It's generally not difficult about pgsql
versions, and likely to continue to work with all pkgsrc versions.
Drop the explicit redundant setting as unnecessary, as well as
confounding for those adjusting mk/pgsql.mk to only build one version.
knot-resolver: Update to 6.5.0
Thursday, October 1, 2026
Bugfixes
views: fix "unused tags" error when repeating a tag in views (!1883)
watchdog: detect file-changes done via rename*() syscall (!1895) This is relevant for RPZ files and TLS certs+keys.
DoH fixes for sharing connections among different users (!1844)
TCP-based connections used Nagle's algorithm since 6.2.0 (!1903) This mistake significantly increased latencies of such transports.
local-data: process upper-case names correctly (!1915)
Packaging
deb: migrate to sysusers and update packaging (!1857)
rpm: fix source build against libknot >= 3.6 (!1907)
python: 3.9+ (!1886), migrated to setuptools (!1889), removed typing-extensions (!1910)
Debian 11 is no longer supported
Debian,Ubuntu: i386 and armhf architectures no longer supported
Improvements
[12 lines not shown]
powerdns-recursor: Update to 5.4.7
Released: 1st of October 2026
Bug Fixes
Rec: Fix Lua to YAML conversion of custom RPZ policies
References: pull request 18029
Rec: retrieve DNSSEC data with RPZ processing disabled
References: pull request 18035
Rec: Catch exception thrown by parsing system resolver result
References: pull request 18068
Fix(rec): Wipe caches when wiping all NTA’s
References: pull request 18070
Rec and auth: fix axfr failure to invalidate fd on close in all cases.
References: pull request 18084
[2 lines not shown]
py-cbor2: updated to 6.1.5
6.1.5
- Fixed :class:`CBORSimpleValue` hashing inconsistently with the integer it compares equal to
- Fixed canonical encoding with value sharing enabled emitting shared references to container
keys that were never written to the stream, because the throwaway encoding used to sort the keys
registered them as shared values; the output then failed to decode, or decoded with the wrong
keys substituted in
- Fixed shared references (tag 29) to a map or an unhandled tag resolving to the raw
:class:`dict` or :class:`CBORTag` instead of the value returned by ``object_hook`` or
``tag_hook``, a regression from 5.x
- Fixed the encoder not giving a nested stringref namespace (tag 256) its own index space
- Fixed the decoder returning its internal break marker as a value when a break stop code
appeared where a data item was expected
- Fixed a ``PanicException`` when trying to decode an epoch-form date (tag 100) with a payload near
``i32::MAX`` which then overflowed the addition instead of raising a clean decode error
- Fixed the decoder accepting a string-form datetime (tag 0) without a UTC offset and returning
a naive :class:`~datetime.datetime` instead of rejecting it
[2 lines not shown]
py-ruff: updated to 0.16.10
0.16.10
Preview features
Add a migration guide for categories
[pyupgrade] Add rule for context manager iterator annotations (UP052)
Performance
Reduce memory used by diagnostics
Server
Avoid running uv format in untrusted workspaces
Documentation
[7 lines not shown]
