OpenBSD/src mQnjuf2sys/net rtsock.c

   route_output() can not use the info struct late in its function
   since the rtm struct that populated it was freed around the
   rtm_report() call. In that case access to info.rti_info[RTAX_DST]
   is a use-after-free.  Cache the address family before handling the
   route message so that the route_input call can use this value instead.

   Report from Bruce Dang of Calif.io
   OK deraadt@
VersionDeltaFile
1.391+6-3sys/net/rtsock.c
+6-31 files

OpenBSD/src DRnhoQTusr.bin/mandoc main.c

   oops, fix a one-byte mishap in the previous commit
VersionDeltaFile
1.270+2-2usr.bin/mandoc/main.c
+2-21 files

OpenBSD/src TZo2qLKusr.bin/mandoc main.c

   Refine unveil(2) usage.

   * Process man.conf(5) early before unveil(2) because it needs realpath(3).
   * Rather than unveiling the whole file system for reading and execution,
   only reveal the manpaths actually needed for reading, and /usr/share/locale/
   if needed, and only reveal the pager binary for execution.
   * Only reveal the whole file system for reading if input file names
   are listed individually on the command line.
   * Rather than unveiling /tmp unconditionally, only do so when it is
   actually needed for the pager.
   * When -O outfilename or -O tagfilename is specified, rather than
   unveiling the current working directory for writing, only unveil
   the specific filenames needed.

   Using some feedback from deraadt@, in particular reducing the number
   of vnodes that are held, and avoiding use of the "unveil" pledge(2).
VersionDeltaFile
1.269+212-105usr.bin/mandoc/main.c
+212-1051 files

OpenBSD/ports rSOupvgsecurity/gopass Makefile, security/gopass/patches patch-main_go

   add missing pledge, 'unix' needed for "gopass age agent"
   https://github.com/gopasspw/gopass/commit/d9b731ce1e1590539516828a44cf02daba759801
VersionDeltaFile
1.8+13-29security/gopass/patches/patch-main_go
1.44+1-0security/gopass/Makefile
+14-292 files

OpenBSD/src xTcc3nDusr.bin/mandoc manpath.c manconf.h

   Prepare for refining unveil(2) usage by providing a function manpath_unveil()
   that makes the manpath directories accessible.  Soon to be used by man(1),
   spropos(1), and makewhatis(8).
VersionDeltaFile
1.33+45-5usr.bin/mandoc/manpath.c
1.10+5-2usr.bin/mandoc/manconf.h
1.226+3-1usr.bin/mandoc/mandoc.h
1.20+3-1usr.bin/mandoc/mandoc_msg.c
+56-94 files

OpenBSD/ports Axnqvkmx11/xscreensaver Makefile, x11/xscreensaver/pkg PLIST

   xscreensaver: disable "worldpieces", xft_word_wrap segfaults (fails when
   trying to wrap an empty string)
VersionDeltaFile
1.60+1-1x11/xscreensaver/pkg/PLIST
1.125+1-1x11/xscreensaver/Makefile
+2-22 files

OpenBSD/ports yAxn7M1wayland/waybar/patches patch-src_main_cpp patch-resources_config_jsonc

   wayland/waybar: Unbreak USR1/USR2 signal handling

   https://github.com/Alexays/Waybar/pull/4278 inadvertently broke handling
   SIGUSR1/SIGUSR2 on OpenBSD. This reverts the offending bit.

   + replace sndio module in the default configuration with a custom module
   using sndioctl(1)
VersionDeltaFile
1.1+30-0wayland/waybar/patches/patch-src_main_cpp
1.4+9-7wayland/waybar/patches/patch-resources_config_jsonc
1.1+15-0wayland/waybar/patches/patch-src_modules_image_cpp
1.1+15-0wayland/waybar/patches/patch-include_util_SafeSignal_hpp
1.1+15-0wayland/waybar/patches/patch-src_modules_custom_cpp
1.3+4-3wayland/waybar/patches/patch-resources_style_css
+88-101 files not shown
+89-117 files

OpenBSD/src bMgNbJEusr.bin/mandoc mansearch.c

   Delete the pointless logic that remembers the original working directory.
   It was never needed because manpath_add() in manpath.c has always been
   using realpath(3) since the very beginning in 2011, so struct manpaths
   only ever contains absolute paths.
   The only exception is man.cgi(8), but that chdir(2)s to the right
   directory beforehand and only ever uses one single manpath, ".".

   This simplifies the code with no functional change.
VersionDeltaFile
1.68+3-33usr.bin/mandoc/mansearch.c
+3-331 files

OpenBSD/ports OmfIVooeditors/vim distinfo Makefile, editors/vim/patches patch-runtime_autoload_tar_vim

   update to vim-9.2.357
VersionDeltaFile
1.159+2-2editors/vim/distinfo
1.306+1-1editors/vim/Makefile
1.15+1-1editors/vim/patches/patch-runtime_autoload_tar_vim
+4-43 files

OpenBSD/ports ughlnN4x11/xscreensaver Makefile

   xscreensaver: fix #! line for xshadertoy-based scripts, RDEP on bash (they
   use exec -a, unsupported by base sh). noticed by lists at y42 dotorg
VersionDeltaFile
1.124+9-1x11/xscreensaver/Makefile
+9-11 files

OpenBSD/ports ppdYh9Ftextproc/lowdown Makefile

   lowdown: use ports-gcc on base-gcc

   base-gcc doesn't support deprecated attributes with deprecation message.
   ports-gcc is lower friction than patching the header:

   lowdown.h:460: error: wrong number of arguments specified for 'deprecated' attribute
VersionDeltaFile
1.39+4-0textproc/lowdown/Makefile
+4-01 files

OpenBSD/ports vMhfFIssecurity/mitmproxy distinfo Makefile, security/mitmproxy/pkg PLIST

   security/mitmproxy: update to 12.2.2
VersionDeltaFile
1.11+4-4security/mitmproxy/pkg/PLIST
1.13+2-2security/mitmproxy/distinfo
1.17+1-1security/mitmproxy/Makefile
+7-73 files

OpenBSD/ports 4JEP0DQsecurity/py-mitmproxy_rs distinfo crates.inc

   security/py-mitmproxy_rs: update to 0.12.9
VersionDeltaFile
1.9+436-408security/py-mitmproxy_rs/distinfo
1.9+217-203security/py-mitmproxy_rs/crates.inc
1.12+1-1security/py-mitmproxy_rs/Makefile
+654-6123 files

OpenBSD/ports tIex3YLsysutils/prometheus distinfo Makefile, sysutils/prometheus/patches patch-mmap_openbsd

   Update prometheus to 3.5.2 (latest LTS release):
   * [SECURITY] UI: Fix stored XSS via unescaped metric names and labels.
         CVE-2026-40179. #18507
   * [PERF] Regex: Stop calling Simplify. #17908

   OK sthen@
VersionDeltaFile
1.5+14-11sysutils/prometheus/patches/patch-mmap_openbsd
1.14+6-6sysutils/prometheus/distinfo
1.25+1-1sysutils/prometheus/Makefile
+21-183 files

OpenBSD/ports edp006edevel/sbt distinfo Makefile, devel/sbt/patches patch-bin_sbt

   devel/sbt: update to 1.12.9
VersionDeltaFile
1.26+2-2devel/sbt/distinfo
1.19+2-2devel/sbt/patches/patch-bin_sbt
1.26+1-1devel/sbt/Makefile
+5-53 files

OpenBSD/ports PPY7INHdevel/maven distinfo Makefile, devel/maven/pkg PLIST

   devel/maven: update to 3.9.15
VersionDeltaFile
1.24+15-15devel/maven/pkg/PLIST
1.22+2-2devel/maven/distinfo
1.50+1-1devel/maven/Makefile
+18-183 files

OpenBSD/ports 9S2pxVKwww/webkitgtk4 distinfo Makefile

   Update to webkitgtk{41,60}-2.52.3.
VersionDeltaFile
1.146+2-2www/webkitgtk4/distinfo
1.257+1-1www/webkitgtk4/Makefile
+3-32 files

OpenBSD/ports kpsZj4Aeditors/libreoffice distinfo Makefile, editors/libreoffice/patches patch-sdext_source_pdfimport_xpdfwrapper_pdfioutdev_gpl_cxx patch-sdext_source_pdfimport_xpdfwrapper_pdfioutdev_gpl_hxx

   update to 26.2.2.2
VersionDeltaFile
1.23+2-72editors/libreoffice/patches/patch-sdext_source_pdfimport_xpdfwrapper_pdfioutdev_gpl_cxx
1.14+2-59editors/libreoffice/patches/patch-sdext_source_pdfimport_xpdfwrapper_pdfioutdev_gpl_hxx
1.136+8-8editors/libreoffice/distinfo
1.8+2-2editors/libreoffice/patches/patch-external_skia_UnpackedTarball_skia_mk
1.341+1-1editors/libreoffice/Makefile
+15-1425 files

OpenBSD/ports JaOHwuBdevel/glib2 Makefile distinfo, devel/glib2/pkg PLIST

   Update to glib2-2.86.5.
VersionDeltaFile
1.412+7-7devel/glib2/Makefile
1.189+2-2devel/glib2/distinfo
1.143+2-2devel/glib2/pkg/PLIST
+11-113 files

OpenBSD/ports Ocgz6pVx11/gnome/at-spi2-core Makefile distinfo

   Update to at-spi2-core-2.58.5.
VersionDeltaFile
1.98+2-2x11/gnome/at-spi2-core/Makefile
1.71+2-2x11/gnome/at-spi2-core/distinfo
+4-42 files

OpenBSD/ports 54VdmWZx11/gnome/decibels/patches patch-tsconfig_json

   Unbreak build, I had a non committed version of typescript installed.
VersionDeltaFile
1.2+0-0x11/gnome/decibels/patches/patch-tsconfig_json
+0-01 files

OpenBSD/ports zON1rWUsysutils/gemini-cli distinfo Makefile, sysutils/gemini-cli/patches patch-lib_node_modules_@google_gemini-cli_bundle_gemini_js

   Update to gemini-cli-0.38.1.
VersionDeltaFile
1.18+30-30sysutils/gemini-cli/pkg/PLIST
1.19+2-2sysutils/gemini-cli/distinfo
1.2+2-2sysutils/gemini-cli/patches/patch-lib_node_modules_@google_gemini-cli_bundle_gemini_js
1.21+1-1sysutils/gemini-cli/Makefile
+35-354 files

OpenBSD/ports CZgRNBksysutils/polkit Makefile, sysutils/polkit/patches patch-src_polkitagent_polkitagenthelperprivate_c

   Merge upstream fix for CVE-2026-4897 - getline() string overflow.
VersionDeltaFile
1.106.2.1+1-1sysutils/polkit/Makefile
1.4.2.1+0-0sysutils/polkit/patches/patch-src_polkitagent_polkitagenthelperprivate_c
+1-12 files

OpenBSD/ports jTwOEo5sysutils/polkit Makefile, sysutils/polkit/patches patch-src_polkitagent_polkitagenthelperprivate_c

   Merge upstream fix for CVE-2026-4897 - getline() string overflow.
VersionDeltaFile
1.4+50-12sysutils/polkit/patches/patch-src_polkitagent_polkitagenthelperprivate_c
1.109+1-0sysutils/polkit/Makefile
+51-122 files

OpenBSD/ports Raaxj4etextproc/libxml distinfo Makefile, textproc/libxml/patches patch-runtest_c

   SECURITY update to libxml-2.15.3.
VersionDeltaFile
1.4+2-2textproc/libxml/patches/patch-runtest_c
1.92+2-2textproc/libxml/distinfo
1.247+1-2textproc/libxml/Makefile
1.45+1-1textproc/libxml/pkg/PLIST
+6-74 files

OpenBSD/ports OQF76rLsysutils/google-cloud-sdk distinfo Makefile, sysutils/google-cloud-sdk/pkg PLIST

   Update to google-cloud-sdk-565.0.0.
VersionDeltaFile
1.418+235-25sysutils/google-cloud-sdk/pkg/PLIST
1.435+2-2sysutils/google-cloud-sdk/distinfo
1.455+1-1sysutils/google-cloud-sdk/Makefile
+238-283 files

OpenBSD/ports 5E61dafwww/epiphany distinfo Makefile, www/epiphany/pkg PLIST

   Update to epiphany-49.8.1.
VersionDeltaFile
1.66+30-0www/epiphany/pkg/PLIST
1.125+2-2www/epiphany/distinfo
1.254+1-1www/epiphany/Makefile
+33-33 files

OpenBSD/ports jmxdVN6net/py-libcloud distinfo Makefile, net/py-libcloud/patches patch-pyproject_toml

   Update to py3-libcloud-3.9.1.
VersionDeltaFile
1.40+2-2net/py-libcloud/distinfo
1.57+1-1net/py-libcloud/Makefile
1.3+1-1net/py-libcloud/patches/patch-pyproject_toml
+4-43 files

OpenBSD/src 9sGDTW3usr.bin/rpcgen rpc_util.c

   locase() in usr.bin/rpcgen/rpc_util.c copies an identifier into
   a static buffer without bounds checking

   OK deraadt@
VersionDeltaFile
1.18+3-1usr.bin/rpcgen/rpc_util.c
+3-11 files

OpenBSD/src tu8NutHlib/libc/gen getcap.c

   cgetnext() in lib/libc/gen/getcap.c copies a record name into a
   stack buffer without bounds checking

   OK deraadt@
VersionDeltaFile
1.39+5-1lib/libc/gen/getcap.c
+5-11 files