OpenBSD/src UNEhDaQusr.bin/ssh packet.c

   use sshpkt_fatal instead of plain fatal() for errors in the packet
   code as this provides context of the failing peer (address, port,
   user, etc). Based on patch from Dag-Erling Smørgrav
VersionDeltaFile
1.341+3-3usr.bin/ssh/packet.c
+3-31 files

OpenBSD/ports W4Cru9Ogeo/gdal distinfo Makefile

   geo/gdal: update to 3.13.2.

   see https://raw.githubusercontent.com/OSGeo/gdal/refs/tags/v3.13.2/NEWS.md
VersionDeltaFile
1.91+4-4geo/gdal/distinfo
1.177+2-3geo/gdal/Makefile
+6-72 files

OpenBSD/src 6Db7mPklib/libfuse fuse.c

   Don't attempt to validate the mount directory during option parsing.
   Instead, check the result of realpath(3) before calling mount(2)
   and rely on this to confirm that it is indeed a directory.

   File systems like ntfs-3g that don't call fuse_parse_cmdline(3)
   will now print an error message if the directory doesn't exist
   rather than silently failing.

   OK claudio@
VersionDeltaFile
1.61+11-26lib/libfuse/fuse.c
+11-261 files

OpenBSD/src zCdQ7G2gnu/usr.bin/perl/dist/Storable Storable.xs

   Fix signed integer overflow in Storable

   Storable for Perl has a signed integer overflow when deserializing
   a crafted SX_HOOK record

   CVE-2026-57433

   https://lists.security.metacpan.org/cve-announce/msg/41780100/
VersionDeltaFile
1.10+4-1gnu/usr.bin/perl/dist/Storable/Storable.xs
+4-11 files

OpenBSD/src 9XG8fqggnu/usr.bin/perl pp_pack.c, gnu/usr.bin/perl/pod perldiag.pod

   Fix integer overflow in perl pack and unpack

   Perl has an integer overflow in S_measure_struct leading to an
   out-of-bounds heap read in pack and unpack.

   CVE-2026-57432

   https://lists.security.metacpan.org/cve-announce/msg/41780102/
VersionDeltaFile
1.12+6-2gnu/usr.bin/perl/pp_pack.c
1.31+6-0gnu/usr.bin/perl/pod/perldiag.pod
+12-22 files

OpenBSD/src xFAZ61wgnu/usr.bin/perl regcomp_study.c

   Fix for incorrect regular expression matches

   Perl produce silently incorrect regular expression matches when an
   alternation of more than 65535 fixed string branches is compiled
   into a trie in Perl_study_chunk

   CVE-2026-13221

   https://lists.security.metacpan.org/cve-announce/msg/41780104/
VersionDeltaFile
1.3+10-0gnu/usr.bin/perl/regcomp_study.c
+10-01 files

OpenBSD/ports gDbEWpmnet/wstunnel distinfo crates.inc, net/wstunnel/patches patch-Cargo_lock

   Update to wstunnel-10.6.2

   Changes: https://github.com/erebe/wstunnel/releases/tag/v10.6.2

   From  Christoph Liebender (maintainer)
VersionDeltaFile
1.13+102-106net/wstunnel/distinfo
1.13+50-52net/wstunnel/crates.inc
1.7+2-2net/wstunnel/patches/patch-Cargo_lock
1.13+2-2net/wstunnel/Makefile
+156-1624 files

OpenBSD/src 7Io3a1Tdistrib/sets/lists/comp md.armv7

   sync
VersionDeltaFile
1.38+0-1distrib/sets/lists/comp/md.armv7
+0-11 files

OpenBSD/ports VaUCfBndevel/py-rich distinfo Makefile, devel/py-rich/pkg PLIST

   update py-rich to 15.0.0
VersionDeltaFile
1.9+71-3devel/py-rich/pkg/PLIST
1.14+2-2devel/py-rich/distinfo
1.22+1-2devel/py-rich/Makefile
+74-73 files

OpenBSD/src baI1jOvsys/uvm uvm_object.c

   sys/uvm: fix uao_dropswap() index typo

   The loop variable indexes the current pgs[] batch, not the page within
   the object. Pass the fetched page's object offset to uao_dropswap(), as
   the other resident page callers do.

   OK: kettenis@
VersionDeltaFile
1.29+2-2sys/uvm/uvm_object.c
+2-21 files

OpenBSD/src khwkc6Gsys/arch/riscv64/dev smtpmic.c

   Unconditionally set cpuresetfn and powerdownfn.  The K3 firmware that I'm
   currently working with claims to implement the System Reset Extension,
   but the reset doesn't actually work.  Looking at the K1/K3 firmware
   code reveals that the firmware would do the same thing as this driver,
   so overriding these functions should be fine.

   ok jsg@
VersionDeltaFile
1.2+3-5sys/arch/riscv64/dev/smtpmic.c
+3-51 files

OpenBSD/src FmfcDvhusr.bin/tmux cmd-show-options.c tmux.1

   Switch show-options over to using a format and add -F.
VersionDeltaFile
1.75+157-94usr.bin/tmux/cmd-show-options.c
1.1148+25-2usr.bin/tmux/tmux.1
1.15+16-1usr.bin/tmux/hooks.c
1.1414+3-1usr.bin/tmux/tmux.h
+201-984 files

OpenBSD/src R41I0s7sys/arch/riscv64/dev smtclock.c

   Add support for the Spacemit K3 SoC.  Fix a pasto in most of the
   Spacemit K1 UART reset control definitions spotted while working
   on this code.

   ok jsg@
VersionDeltaFile
1.5+216-20sys/arch/riscv64/dev/smtclock.c
+216-201 files

OpenBSD/src fIhjACVusr.bin/tmux key-bindings.c

   Add a menu on empty areas to allow a new pane to be created.
VersionDeltaFile
1.190+6-1usr.bin/tmux/key-bindings.c
+6-11 files

OpenBSD/src mVBris7usr.bin/tmux cmd-show-options.c

   Show user hooks correctly with show-hooks.
VersionDeltaFile
1.74+10-6usr.bin/tmux/cmd-show-options.c
+10-61 files

OpenBSD/ports FLUGEiWdevel/bats distinfo Makefile

   Update to bats-1.14.0

   Changes: https://github.com/bats-core/bats-core/releases/tag/v1.14.0
VersionDeltaFile
1.15+2-2devel/bats/distinfo
1.16+1-1devel/bats/Makefile
+3-32 files

OpenBSD/ports bkq4JVDshells/fish/main distinfo Makefile, shells/fish/main/pkg PLIST

   shells/fish: Update to 4.8.1

   from Florian Viehweger (Maintainer), with a tweak to avoid troubles with
   the re-rolled fluent-ftl-tools tarball from me. discussed with naddy@
VersionDeltaFile
1.14+4-4shells/fish/main/distinfo
1.15+5-2shells/fish/main/Makefile
1.12+2-0shells/fish/main/pkg/PLIST
+11-63 files

OpenBSD/src lICvhk2usr.sbin/ospf6d interface.c parse.y

   ospf6d: preserve configured interface type on link update

   When an interface undergoes a link state change (RTM_IFINFO),
   if_update() unconditionally overwrites iface->type based on current
   interface flags. This causes interfaces explicitly configured with "type
   p2p" in ospf6d.conf to revert to broadcast (IF_TYPE_BROADCAST) on link
   bounce.

   Introduce F_IFACE_TYPE to track whether the interface type was set by
   configuration, and only auto-derive the type from interface flags when
   this flag is not set.

   Reported and tested by Atanas Vladimirov.

   OK claudio@
VersionDeltaFile
1.31+8-6usr.sbin/ospf6d/interface.c
1.54+4-2usr.sbin/ospf6d/parse.y
1.53+2-1usr.sbin/ospf6d/ospf6d.h
+14-93 files

OpenBSD/src fDmHtdwusr.sbin/vmd virtio.c

   vmd(8): guard synchronous imsg channel with a mutex.

   Serialize vcpu access to the synchronous imsg channel for communicating
   PCI register access to virtio device child processes. If vmd ever
   becomes MP, VCPUs could interleave during the io emulation on the imsg
   channel.

   Report and original diff by Andrew Griffiths. Modified to move the
   mutex into the global state of the vm process instead of per-device.

   ok hshoexer@
VersionDeltaFile
1.142+27-8usr.sbin/vmd/virtio.c
+27-81 files

OpenBSD/src h3janBfsys/dev/pci if_ice.c if_icevar.h

   ice(4): enable use of 128 DMA segments for TSO packets again

   This diff contains two fixes for the ice_tso_detect_sparse()
   function to prevent the 'Too many data commands' error:

    1. Replace wrong computation of nsegs with already
       specified map->dm_nsegs from the DMA layer.

    2. Reinstate ICE_MAX_TX_SEGS for max. No. of Segments
       per MSS section.

   Tested by bluhm

   OK bluhm@, stsp@
VersionDeltaFile
1.71+10-17sys/dev/pci/if_ice.c
1.12+2-2sys/dev/pci/if_icevar.h
+12-192 files

OpenBSD/ports U5QV8uZnet/isc-bind distinfo Makefile, net/isc-bind/patches patch-bin_dig_nslookup_c

   update to isc-bind-9.20.26
   https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/notes.html#notes-for-bind-9-20-26
VersionDeltaFile
1.146.2.3+2-2net/isc-bind/distinfo
1.25.2.1+2-2net/isc-bind/patches/patch-bin_dig_nslookup_c
1.218.2.3+1-1net/isc-bind/Makefile
1.46.2.1+0-1net/isc-bind/pkg/PLIST
+5-64 files

OpenBSD/ports iQiUhd4net/isc-bind distinfo Makefile, net/isc-bind/patches patch-bin_dig_nslookup_c

   update to isc-bind-9.20.26
   https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/notes.html#notes-for-bind-9-20-26
VersionDeltaFile
1.149+2-2net/isc-bind/distinfo
1.26+2-2net/isc-bind/patches/patch-bin_dig_nslookup_c
1.221+1-1net/isc-bind/Makefile
1.47+0-1net/isc-bind/pkg/PLIST
+5-64 files

OpenBSD/src lcpi2Rslib/libcrypto/sha sha3.c

   Improve SHA-3 performance.

   Replace the tiny-sha3 keccakf implementation with an unrolled and
   interleaved algorithm, that is hidden away in an obsolete reference
   implementation.

   This gets us 3.3x speed up on arm64 (Apple M2), a 1.3x speed up on amd64
   (Intel i7-1165G7) and 6x speed up on sparc64 (M3000).

   ok tb@
VersionDeltaFile
1.21+286-42lib/libcrypto/sha/sha3.c
+286-421 files

OpenBSD/src wjwUXznlib/libc/hash sha512.c

   Correctly handle bit count for SHA-512.

   The SHA-512 bit counter is 128 bits - as such, we need to handle overflow
   and increment the second 64 bit field.

   Reported by claudio@

   ok claudio@ tb@
VersionDeltaFile
1.2+6-2lib/libc/hash/sha512.c
+6-21 files

OpenBSD/ports mYAbv8lconverters/p5-Sereal distinfo Makefile, converters/p5-Sereal-Decoder distinfo Makefile

   update p5-Sereal-Decoder p5-Sereal-Encoder p5-Sereal to 5.009
   changes not relevant for OpenBSD
VersionDeltaFile
1.15+2-2converters/p5-Sereal-Decoder/distinfo
1.15+2-2converters/p5-Sereal-Encoder/distinfo
1.5+2-2converters/p5-Sereal/distinfo
1.20+1-1converters/p5-Sereal-Decoder/Makefile
1.20+1-1converters/p5-Sereal-Encoder/Makefile
1.5+1-1converters/p5-Sereal/Makefile
+9-96 files

OpenBSD/ports 4PK6toPmultimedia/libass Makefile

   fix build on other archs without asm support
   from Brad (maintainer)
VersionDeltaFile
1.37+2-1multimedia/libass/Makefile
+2-11 files

OpenBSD/ports EjLPOqAgeo/qgis Makefile

   geo/qgis: enable support for geo/geographiclib
VersionDeltaFile
1.234+4-1geo/qgis/Makefile
+4-11 files

OpenBSD/ports M6USwx6net/powerdns_recursor distinfo Makefile

   update to powerdns-recursor-5.4.4
VersionDeltaFile
1.61.2.4+2-2net/powerdns_recursor/distinfo
1.72.2.4+1-1net/powerdns_recursor/Makefile
+3-32 files

OpenBSD/ports 8xydGZ1net/sslh/pkg PLIST

   unbreak previous, my tree had a local test change in.
VersionDeltaFile
1.9+2-2net/sslh/pkg/PLIST
+2-21 files

OpenBSD/ports HydZhaZnet/powerdns_recursor distinfo Makefile

   UPdate to PowerDNS Recursor 5.4.4

   See https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html
VersionDeltaFile
1.65+2-2net/powerdns_recursor/distinfo
1.76+1-1net/powerdns_recursor/Makefile
+3-32 files