IANA has allocated a non-vendor codepoint for ssh-mldsa44-ed25519,
so use it instead of the vendored "@openssh.com" name.
Note: this replaces the vendored name, which was only marked as
experimental and not enabled by default.cw
If you have ssh-mldsa44-ed25519 at openssh.com keys manually configured
in sshd, then you will need to remove them from sshd_config and
restart.
drm: apple: Switch back to drm_atomic_helper_commit_tail_rpm()
From Janne Grunau
bd8ce96f6e76b98940352b18fe735a7943471ed7 in AsahiLinux/linux
This implictly gets rid of drm_atomic_helper_wait_for_flip_done()
and makes graphical output on Apple Silicon machines noticably
snappier.
ok kettenis@ jsg@
mark net/barrier BROKEN, old software wants old devel/gtest
Their CMake goo includes bundles missing from the autogenerated tarball,
there is no knob to disable tests, we don't run them (NO_TEST=yes),
but instead nuke the CMake goo and hope for system gtest to work,
which now fails due to newer devel/gtest requiring C++17.
barrier is C++14, its last release is five years old and we're behind,
upstream's last commit was four years ago...
Update libexpat to version 2.8.4
Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
changes #1315 #1325 #1334 #1340 #1319 #1320. Library bump is not
necessary.
CVE-2026-66046CVE-2026-76641CVE-2026-76957
OK tb@
Use unveil(2) and clamp down on pledge(2).
The main() program establishes a baseline, allowing the maximum
that might ever be needed: stdio rpath and read access to the MAN_DIR.
The top level page generators (pg_show, pg_search) narrow unveil(2)
to the specific manual page tree selected by the user.
When the selected manual page file has been opened, the pledge is narrowed
to just stdio (in resp_catman, resp_format, pg_searchres, pg_index).
Except for internal errors and bad requests, which error out early,
exactly one of these narrowing codepaths is always trodden.