BSD Commit Log Search

   httpd: add custom HTTP header support

   Allow httpd.conf to set/add/remove custom HTTP response headers or Suppress
   existing ones. This enables httpd to add security headers, custom metadata,
   or remove unwanted headers without modifying app/fastcgi code.

   Three new directives are added:

   header option
           Manipulate HTTP response headers.  Multiple header statements may
           be specified.  Valid options are:

           set name value [always]
                   Set a custom HTTP response header with the specified name
                   and value.  If a header with the same name is already
                   present in the response, its value will be replaced.  The
                   header is added to successful responses (2xx and 3xx
                   status codes) by default.


    [57 lines not shown]

   Security update to borgbackup-1.4.5

   Contains a fix for CVE-2026-62268, which is s a security vulnerability
   that compromises data integrity.

   Changes:
   https://borgbackup.readthedocs.io/en/1.4.5/changes.html#version-1-4-5-2026-07-19

   databases/duckdb: update to 1.5.5

   +swival

   Initial revision

   Update to spotify-player 0.24.1.

   Update to vaultwarden-1.37.0

   This release contains security fixes for the following advisories:
   - SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g]
   - Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589]
   - Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j]
   - Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25]
   - Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345]
   - Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8]
   - Organization Import Authorization
     [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr]
   - Organization Data Enumeration via the Manager role
     [GHSA-rqf8-2568-r7mc]

   Changes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0

   Update to vaultwarden-web-2026.6.4

   Changes:
   https://github.com/dani-garcia/bw_web_builds/releases/tag/v2026.6.2
   https://github.com/dani-garcia/bw_web_builds/releases/tag/v2026.6.4

   Security update to rclone-1.74.4

   Fixes several CVE's. Changes:
   https://rclone.org/changelog/#v1-74-4-2026-07-08

   +smcroute

   Initial revision

   Disable the llvm module since it is causing intermittent failures
   in the bulk builds.

   krita-gmic-plugin: add missing builddep devel/gmake

   spotted by sthen

   fftw3: use fortran module

   configure picks up gfortran which may lead to build failures due to junking.
   Worse, when building with gfortran, additional public symbols are present
   in the fftw3_threads.

   arch-defines.mk: bump _SYSTEM_VERSION-aarch64 after fortran module changes

   garbage collect USE_NOBTCFI-aarch64 = Yes# fortran

   as suggested by sthen, instead of bumps, I'll crank _SYSTEM_VERSION-aarch64

   fortran module: stop setting USE_NOBTCFI-aarch64

   This was necessary for gcc/8 but according to testing by sthen with gcc/15
   this is no longer necessary with modern gcc.

   Update dialog to 1.3.20260721.

   update to focuswriter-1.9.1

   update to redis-8.8.1

   keep -current REVISION above -stable due to dir reorg
   add comment reminding of ^^

   update to redis-6.2.23

   update to redis-6.2.23

   "A crafted stream `RESTORE` payload can make two consumers share the
   same NACK, leading to a use-after-free that may result in Remote Code
   Execution"

   Update ansiweather to 1.19.1.

   update p5-LWP-Protocol-https to 6.17

   update to py3-wcmatch-11.0

   update to tcpreplay-4.5.5

   update to tcpreplay-4.5.5, various security-related fixes

   +p5-OPCUA-Open62541,ns0_full

   Update to dash-0.5.13.5