BSD Commit Log Search

   Update to xterm 410. Tested by kirill@ and naddy@

   update to v2.2.1

   Update to gedit-plugins-50.0.

   Update to gedit-50.0.

   Update to quadrapassel-50.1.

   Update to orca-50.1.2.

   Update to ghex-50.1.

   Update to terraform-1.15.3.

   update to coreutils-9.11

   Update to gemini-cli-0.42.0.

   Update to libxml++50-5.6.1.

   Update to netatalk-4.4.3.

   update to py3-wcwidth-0.7.0

   update to py3-tempora-5.9.0

   update to py3-test-rerunfailures-16.2

   update to py3-uharfbuzz-0.54.1

   update to py3-virtualenv-21.3.3

   update to py3-wrapt-2.1.2

   update to py3-mako-1.3.12

   update to py3-requests-2.34.1

   security update to 1.30.1;

   - HTTP/2 request injection vulnerability in the ngx_http_proxy_module
     (CVE-2026-42926)
   - buffer overflow vulnerability in the ngx_http_rewrite_module
     (CVE-2026-42945)
   - buffer overread vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module
     (CVE-2026-42946)
   - buffer overread vulnerability in the ngx_http_charset_module
     (CVE-2026-42934)
   - address spoofing vulnerability in HTTP/3
     (CVE-2026-40460)
   - use-after-free vulnerability in OCSP requests to resolver
     (CVE-2026-40701)

   Update ssh-copy-id to the version from portable OpenSSH 10.3p1

   ok sthen@ & maintainer via Mastodon (email was bouncing)

   dhcpleased: Make sure to use VIS_NL with stravis()

   Various DHCP fields could include newlines, these were written to the lease file as-is. Nothing in base reads them, but it could confuse other tools.

   ok florian@

   dhcpleased: Change rdns_count to size_t

   Potentially on a 32-bit platform a crafted imsg could make the engine read 4 bytes of stack.

   ok florian@

   dhcpleased: Validate size of imsg_dhcp.len

   If the frontend manages to write something bad to imsg (bypassing the frontend's validation), where imsg_dhcp.len is > sizeof(imsg_dhcp.packet) it is possible for an OOB read to be forced in the engine. Make this fatal.

   ok florian@

   dhcpleased: Ensure imsg is zeroed in send_routes_withdraw.

   ok florian@

   mitigate AMD Zen-2 operation cache corruption

   On Zen 2, the operation cache can be used to change instructions
   of a different privilege level.
   https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html

   The mitigation is setting a chicken bit in an MSR.  This is not documented
   publicly, even in the security bulletin.  The value comes from a patch
   submitted to Linux by AMD employees.

   ok deraadt@ brynet@

   update trac to a snapshot from the 1.6-stable branch, fixes with py314

   Prepare for poppler-26.05.

   Prepare for poppler-26.05.