nodejs: bump libuv BUILDLINK_API_DEPENDS minimum to 1.52
Recent releases expect the following feature in libuv, or builds will
fail due to the missing field.
* unix,win: add f_frsize field to uv_statfs_t (Ben Noordhuis)
shader-slang: update to 2026.21
- Document how to install Metal Developer Tools
- Return the parse result from
IGlobalSession::parseCommandLineArguments
- Allow global constant inlining with shader debug information
- Keep a global-scope call whose callee needs a local variable out of
force inlining
- Add optional slang-standard-modules embedding library
- git-worktree-add.sh: add --force to replace an existing branch and
worktree
- Fix MSVC 2019 internal compiler error in unit-test-string.cpp
- SPIR-V: emit pointer-to-signed-int casts through an unsigned
integer
- Fix CUDA Gather on combined samplers and reject GatherCmp on CUDA
- Make abs of an unsigned integer the identity on SPIR-V, LLVM and
GLSL
- render-test: create an untyped object input in the program's
session
[133 lines not shown]
security/pkcs11-provider: Do revbump after all with base openssl fix.
Previously it would build _by default_ with pkgsrc openssl; revbump
is needed because this default changes.
ggml: update to 0.29.0.
ggml v0.29.0 adds an OCP FP8 E4M3 tensor type, a new
ggml_flash_attn_ext_rows op where each query slice attends to its
own list of K/V rows, a batched tensor copy API, and initial support
for multi-node tensor parallelism through a new multi-process
communicator interface. Core improvements include bounding tensor
views by the bytes their strides reach, zero-copy GGUF export of
host-buffer tensors, and vm_allocate-based allocations on Apple
platforms. Performance work spans all major backends: new SVE
kernels in the CPU backend, DPAS flash attention for quantized KV
in SYCL, fused MoE MMQ in CUDA, faster MXFP4 mat-vec in Metal,
split-K tuning in Vulkan, and a large expansion of quantized
GEMM/GEMV coverage in OpenCL. The Hexagon backend gains support
for several new ops, including the lightning indexer, top-k mask,
conv2d and upscale.
fd-find: update to 10.5.1.
Bugfixes
Fix --absolute-path turning verbatim (\\?\) search paths into relative paths on Windows: \\?\UNC\server\share is now reported as \\server\share, and \\?\Volume{...} paths are kept intact, see #2207 (@Duo-ee)
Make --ignore and --no-hidden after -u override only their half of -u, see #2192 (@NavpreetSSidhu)
Fix inline case-insensitive regex flags incorrectly making other --and patterns case-sensitive, see #2184 (@mabunemeh)
Accept --format templates that start with - when passed as a separate argument, see #2126 (@vulragrag-star)
Don't incorrectly escape newlines in error messages, see #2104
Restore jemalloc as default allocator on supported systems
Fix the cargo binstall release URL, which named the crate (fd-find) instead of the binary (fd) and fell back to a third-party mirror
Fix integer overflow when parsing size constraints, rejecting values that exceed u64::MAX instead of panicking, see #2196 (@parneetsingh022).
Various fixes and updates to zsh completion
Fix --glob patterns when using --full-path on windows. See #2067.
proc-cli: Update to version 2.3.0
Changes since 2.2.0:
- on, info, for and why show the same card for a process
- process tables show the user, uptime and command
- ports says if each port is reachable from the network
- values proc cannot read show as "-", not 0
- JSON adds parent name, child count, CPU time, open files
rsync: update to 3.5.2.
# NEWS for rsync 3.5.2 (4 Nov 2026)
## Changes in this version:
### BUG FIXES:
- Fixed interrupted `--append` and `--inplace` transfers writing the final
256 KiB buffer twice. An interrupted destination now remains a clean prefix
which the next transfer can resume or repair.
- Fixed uploads through `rrsync` when the destination file already exists.
Existing files are now reached beneath a pinned parent directory instead of
being passed as an unwritable `/proc/self/fd/N` destination.
- Fixed poor matching performance on large sparse and repeated-block files
when duplicate checksum chains exhausted the search limit. Valid basis
blocks are no longer hidden behind duplicate entries.
- Bounded strong-checksum work when a malicious receiver supplies weak
checksums that collide with consecutive rolling windows
(CVE-2026-119741).
[46 lines not shown]
www/typo3-14: update to 14.3.10
14.3.8 (2026-10-09)
This version is a bugfix and maintenance release.
It also updates the third-party dependency "enshrined/svg-sanitize" for
cleaning up external references in SVG files.
14.3.9 (2026-10-13)
This release is a combined bug fix and security release.
Find more details in the security bulletin:
TYPO3-CORE-SA-2026-024 / CVE-2026-109162: Security Misconfiguration
in Form Framework
[10 lines not shown]
www/typo3-13: update to 13.4.37
13.4.36 (2026-10-09)
This version is a bugfix and maintenance release.
This version contains security related updates for the third-party package
enshrined/svg-sanitize. The SVG sanitization got stricter and removes
external URL references in embedded links and style definitions.
13.4.37 (2026-10-22)
This version is a bugfix and maintenance release.
It also updates the third-party dependency "enshrined/svg-sanitize" to the
security release 1.1.1 and fixes an incompatibility with version 1.1 when
sanitizing HTML with embedded SVG, for example via . In addition,
"symfony/expression-language", "symfony/http-foundation" and "symfony/yaml"
are updated to address security advisories.
www/php-concrete-cms: update to 9.5.7
9.5.5 (2026-10-06)
New Features
* Enhanced Thumbnail Editor: Crop Controls, Live Preview, and Dialog Improvements (#13016) (thanks katalysis)
* Add an option to exclude system pages from the Remove Old Page Versions task (thanks digitmaster)
Behavioral Improvements
* Bug: Completed tasks can remain shown as running (#418) (thanks digitmaster)
* The Home Folder is not pre-selected when uploading files from blocks (#12794) (thanks broreece)
* Add date_public to the Page API transformer (#13125) (thanks broreece)
* Fixed: File dialogs throw a fatal error instead of "Invalid file" when fID is empty or non-numeric (#13152) (thanks janscarton)
* Better breadcrumb support in the Dashboard Express pages (thanks mlocati)
* Persist Dashboard panel visibility preference (#12994) (thanks digitmaster)
* Dashboard panel now will stay closed for much longer if the user manually closes it.
* Express Entry List block: check the classes when reading its settings back (#13237) (thanks mlocati)
[100 lines not shown]
www/drupal11: update to 11.4.10
11.4.8 (2026-09-26)
This is a patch (bugfix) release of Drupal 11.
11.4.9 (2026-10-09)
This is a patch (bugfix) release of Drupal 11.
11.4.10 (2026-10-14)
Security issues fixed
This release fixes security vulnerabilities. Sites are urged to update
immediately after reading the following security announcements and release
notes:
* Drupal core - Critical - Remote code execution - SA-CORE-2026-014
[15 lines not shown]
www/php-ja-wordpress: update to 7.0.8
7.0.8 (2026-10-28)
* An Editor+ stored cross-site scripting (XSS) issue in the personal data
erasure requests screen reported by Anthropic
* A Contributor+ stored cross-site scripting (XSS) issue via whitespace in
block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)
* An information disclosure issue exposing unpublished Customizer changes to
unauthenticated visitors reported by Antonio Lorensius Silaban
* A hardening fix for unescaped usernames on the multisite Network Users
screens reported by Anthropic
* A permissions issue letting custom roles that moderate comments read, edit
and delete notes on posts they can’t edit reported by Ramon of the
WordPress Security Team
[41 lines not shown]
www/wordpress: update to 7.0.8
7.0.8 (2026-10-28)
* An Editor+ stored cross-site scripting (XSS) issue in the personal data
erasure requests screen reported by Anthropic
* A Contributor+ stored cross-site scripting (XSS) issue via whitespace in
block delimiters reported by Rafie Muhammad (Awesome Motive, Inc.)
* An information disclosure issue exposing unpublished Customizer changes to
unauthenticated visitors reported by Antonio Lorensius Silaban
* A hardening fix for unescaped usernames on the multisite Network Users
screens reported by Anthropic
* A permissions issue letting custom roles that moderate comments read, edit
and delete notes on posts they can’t edit reported by Ramon of the
WordPress Security Team
[41 lines not shown]
