update to 1.28.3; from Mark Patruck
- buffer overflow vulnerability in the ngx_http_dav_module
(CVE-2026-27654)
- buffer overflow vulnerabilities in the ngx_http_mp4_module
(CVE-2026-27784, CVE-2026-32647)
- mail session authentication vulnerabilities
(CVE-2026-27651, CVE-2026-28753)
- OCSP result bypass vulnerability in stream
(CVE-2026-28755)
Use \- for hyphens in tmux.1 to cause newer groff versions to render
them correctly (ASCII hyphen rather than Unicode) which aids copy and
paste. From Keith Thompson in GitHub issue 4948.
MFC: build ruby 3.x with USE_NOBTCFI on aarch64 due to crashes at runtime
when using FFI on machines which enforce BTI. (4.0 seems ok).
ok tb jca kn
(I left this as just 3.3/3.4 since we didn't provide a ruby32-ffi
package)
In the namei callback for __pledge_open() invert the logic of checking
pledge/namei modes and then checking for the path. Now, first
identify the path with array bsearch then check the pledge/namei modes.
Since this is __pledge_open(), if the path is not known, terminate with
an EACCES abort. If the path is known but the pledge/namei modes don't
suggest an unveil bypass, allow the code to fallthrough to the rpath/wpath
checks, and then back into namei for unveil validation.
ok dgl
fix build by not trying to statically link sdl3
libSDL3.a does not exist but meson still tries to statically link
everything in the Requires.private part of the sdl3.pc pkgconfig file.
In the case of gbm libgbm.a had unresolved symbols.
build failure reported by tb@ who tracked this back to a change in the
devel/sdl3 port to build with -DSDL_DEPS_SHARED=OFF
ok tb@
