devel/sem: update to 0.23.0
[0.23.0] - 2026-08-22
Changed
C++ and Python's precomputed-facts fast paths are now opt-in (SEM_MUL_CPP=1, SEM_MUL_PYTHON=1), and Rust's stays opt-in (SEM_MUL_RUST=1). These fast paths trade memory for speed by skipping a second parse of files whose facts are already known. Re-measuring peak memory footprint (the metric that actually tracks memory pressure and swap risk, as opposed to resident-set size, which can look artificially low once memory has been compressed) found C++ costing ~25-28% more than a default build on llvm-project and Python ~22-25% more on home-assistant/core — both above the project's +15% admission ceiling, even after a follow-up trim narrowed the gap. Rust independently re-measured at ~33% over. Cold builds on large C++/Python repos are correspondingly slower by default than in 0.22.1, but use less memory; set the relevant env var if you have RAM headroom and want the speed.
Go's fast path is now on by default, no configuration needed. It cleared the same ceiling (+6.8% to +8.5% peak memory footprint on Kubernetes, well under +15%) once the correctness fixes below landed, and delivers a 12-17% faster cold build on Kubernetes as a result.
Fixed
Go call resolution no longer merges same-named packages from different API groups. Kubernetes has dozens of packages literally named v1 — one per API group (kubeadm, bootstraptoken, pod-security-admission, and more) — and import resolution used to key packages only by their bare directory name, so a call like DeepCopyInto from one API group's type could resolve to a same-named method in a completely unrelated package. Packages are now disambiguated by their full import path. This alone removes roughly 32,000 false cross-package edges on Kubernetes, and (combined with the fix below) makes Kubernetes cold builds 28-30% faster.
Go resolution no longer confuses a source file's own name with a standard-library package it happens to share a name with. Large Go codebases routinely contain files literally named os.go or time.go; a secondary lookup route used to treat a file's own bare filename as if it were an importable package, so calls like os.Stat() or time.Now() could resolve to the local file instead of the real standard-library package. That route has been removed entirely — only the correct, directory-based lookup remains.
Rust call resolution no longer confuses an external standard-library import with a same-named local module. use std::cmp; followed by cmp::max(...) could previously resolve to an unrelated local cmp.rs instead of the real standard-library function. Imports rooted at std/core/alloc are now excluded from local-module matching outright (an external import can never legitimately resolve to a file in your own repo), and a genuine same-named local-module collision is now disambiguated per the specific item being called rather than per whole-file bucket, falling back to an honest miss instead of guessing when it can't be told apart.
Fixed a scope-resolution precedence bug affecting every supported language: a nested closure or sibling function could resolve a call to the wrong same-named target — for example, a TypeScript call landing on a sibling closure's function of the same name instead of the one actually being called. A function's own locally declared bindings now always take precedence over an outer scope's binding of the same name, and nested locals inside a plain function (not just a class or module) are now registered for lookup at all, closing a gap where they were invisible to their own siblings.
Go's cross-file method resolution is now internally consistent when the fast path is enabled. Rewriting a method's identity to reflect its true cross-file package location left other places that cache that identity out of date, which could push a call through an unrelated fallback path instead of the correct local lookup. Every place an entity's identity is cached is now kept in sync with the rewrite, and the fast-path build is now bit-identical to the default build on Kubernetes.
Multi-document YAML files (----separated) no longer lose entities to id collisions. Top-level keys sharing a name across different documents in the same file used to collapse onto one generated id, silently dropping all but one from the graph — including whether it was a test. Each document is now part of the generated id whenever a real collision exists; ordinary single-document files are unaffected.
sem entities's index-backed listings no longer come back empty on Windows. An absolute path built by ordinary path-joining wasn't normalized the same way as the repository root before comparison, and Windows always prepends its extended-path marker during normalization, so the two could never match. Two related normalization gaps in the MCP server and the index reader were fixed alongside it.
Fixed a parse-cache test flake caused by tests sharing global cache state under parallel execution; the cache is now injectable per test/thread, with no change to production behavior.
sem setup no longer installs a SessionStart hook that forks mcp --resident. That resident server was deleted in 0.22.0 (--resident is kept only as a no-op flag for old installs), so every fresh sem setup was forking a process that does nothing, once per Claude Code session. sem setup now installs only the UserPromptSubmit hook (sem hook prompt-submit); sem unsetup still recognizes and removes a legacy mcp --resident SessionStart hook from an older install.
[20 lines not shown]
go: update to 1.26.7 and 1.25.4
These minor releases include a fix to address a breakage affecting unencrypted
HTTP/2 (h2c) connections caused by a security patch included in last week’s
release. See go.dev/issue/80876 for details.
ed: Update to 1.22.6
2026-08-20 Antonio Diaz Diaz <antonio at gnu.org>
* Version 1.22.6 released.
* Pacify gcc's static analyzer. (Reported by Mikel Olasagasti Uranga).
main.c: (show_help): Print "*See also* regex(7)" for man page.
(print_escaped): Don't escape backslashes.
* ed.texi: Document that 'e' and 'E' delete the cut buffer.
(Reported by Tim Chase).
Document the use of REs inside the command-list of a global command.
(Reported by Artyom Bologov).
www/grafana-prometheus-datasource: import grafana-prometheus-datasource-13.1.7
Grafana no longer bundles this plugin since 3.2.0 and the upstream
plugin catalog only distributes Darwin, Linux and Windows binaries,
so we need a pkgsrc package for it.
mimir: update to 3.2
3.2:
- Remote execution on by default; upgrade all queriers to 3.1 first.
- Removed: -query-frontend.enable-multiple-node-remote-execution-
requests, MQE projection-pushdown and prune-toggles flags.
3.1:
- TSDB blocks must use index v2; no index-headers built from v1.
- Removed: -target=flusher (use /ingester/flush), ring heartbeat
disabling, -querier.response-streaming-enabled.
- Per-step stats unsupported under MQE.
3.0 (major; plan the upgrade):
- Query-scheduler is REQUIRED; embedded one gone, so -querier.frontend-
address, -querier.max-outstanding-requests-per-tenant and
-query-frontend.querier-forget-delay are removed.
- MQE also default in query-frontend; queriers no longer serve the
Prometheus HTTP API (go via query-frontend).
- Removed: read-write deploy mode, Redis cache, memcached addresses-
provider, instant query splitting, -query-frontend.downstream-url,
[8 lines not shown]
resterm: Update to 1.2.2
New
Warnings for unknown and misplaced directives
Fixed
Ignored or unknown directives no longer close an active workflow or interrupt an open workflow branch.
Invalid directives cannot accidentally create or modify a request while the parser determines whether they apply.
devel/task: update to 3.53.1
Features
* Remote Taskfiles are now generally available! This has been an
experimental feature for 3 years, but is now enabled by default. Massive
thanks to all those that contributed and gave feedback (too many to list
here). We've also given the Remote Taskfiles documentation a bit of a
polish.
* Added a per-command timeout that terminates a command once it exceeds the
given duration (Go duration syntax). It covers shell commands, task
calls, deferred commands, deps and the if condition, obeys ignore_error,
and reports exit code 124. Callers that join a run: once or when_changed
task already running now honor their own timeout, and inherit that task's
failure instead of being told it succeeded.
* Considerably improve performance of fingerprinting on large repositories
(monorepos). Fingerprinting is up to 86% faster and make up to 70% fewer
memory allocations on the more advanced scenarios. Benchmarks were added
as well. We're basically skipping work when not needed.
[46 lines not shown]
grafana: update to 13.2.0
CVE-2026-17183
An authenticated organization user who can create or edit alert rules
in a folder can query a datasource for which they do not have
datasources:query permission.
grafana: update to 13.1.3
pkgsrc change:
This update disables support for sqlite as storage backend on most
platforms because grafana has switched to a sqlite driver that is
very difficult to support in a generic manner in pkgsrc.
(It needs transpiled code shipped by the upstream for every
MACHINE_PLATFORM.)
On such a platform you can use PostgreSQL instead.
Other major breaking changes since 11.x:
Angular plugin support is fully removed
Data source UID enforcement
Upgrading rewrites the whole annotation table; budget 2–3x its size
React 19. Update all plugins before upgrading, or they may break
Folders and dashboards migrate off legacy SQL tables on startup
grafana-cli and grafana-server are removed (use grafana cli / grafana server)
Image Renderer no longer supported as a plugin (run it as a separate service)
Dashboards migrate to schema v2 automatically when opened
