BSD Commit Log Search

   mediainfo: update to 26.10

   This includes many fixes resulting from security audits.

   Handle the Emudhra intermediate cert compromise.

   See https://emudhra.we-have-a-problem.com/

   While likely all of Emudrha will be distrusted soon, currently
   a lot of India is using them. 8 intermediates under their CA3
   have publicly discoverable keys. the 9 others sign many sites.

   For now, remove CA3 from the trust store, thus distrusting all
   the intermediates it has signed, then add back the remaining
   9 uncompromised intermediates by "promoting" to a root, the
   usual intermediate elision technique.

   This enables real sites in india using these intermediates
   to still work. Assuming Emudhra ends up widely distrusted
   soon, we can remove these and the other roots after sites
   have had time to get new certificates.

   ok tb@ sthen@

   archivers/libarchive: update to 3.8.10

   Unspecified security and bug fixes.

   mediainfo: update to 26.10

   This includes many fixes resulting from security audits.

   MFC php changes from -current, to make tomorrow's RCE CVEs easier to handle

   net/curl: update to 8.23.0

   Includes fixes for
   CVE-2026-87863: HSTS response erases persisted entries
   CVE-2026-87862: HSTS cache import drops longer-lived child
   CVE-2026-87861: cross-origin reuse of a Negotiate connection
   CVE-2026-86414: leaking host credentials to HTTP proxy
   CVE-2026-86413: Negotiate credentials sent to redirected origin
   CVE-2026-86412: server-set cookie erases cookie jar
   CVE-2026-92392: HTTP/2 upload Use-After-Free
   CVE-2026-92391: curl_mime_free stack overflow by recursion
   CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
   CVE-2026-92389: TFTP direction confusion
   CVE-2026-92388: FTP wildcard write callback mixup
   CVE-2026-92387: never-ending loop via server response omission
   CVE-2026-92386: server-set cookie aborts cookie jar load
   CVE-2026-94265: Authorization: Negotiate sent to foreign origin
   CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
   CVE-2026-107929: local interface connection reuse mixup

   the clock applet should only monitor /etc/localtime

   in additional monitor /etc with kqueue and filter for /etc/localtime
   because the symlink can change and that will not be picked up by
   monitoring /etc/localtime itself

   update p5-URI to 5.40

   do not check or touch files that are non-existent on openbsd

   games/love/mime: bump after MAINTAINER change

   Rename GCC49_ARCHS -> PORTSGCC_ARCHS

   OK: rsadowski@, sthen@

   Rename GCC49_ARCHS -> PORTSGCC_ARCHS

   OK: rsadowski@, sthen@

   bump utils too

   bump utils too

   drop MAINTAINER; not using it for a while

   drop ONLY_FOR_ARCHS = ${GCC49_ARCHS}, it's doing nothing because COMPILER
   already sets it

   move COMPILER lines to subdirs so that it's included before bsd.port.mk,
   drop the ONLY_FOR_ARCHS in Makefile.inc.

   www/hugo: 0.168.0

   mention that the h3 flavour includes YAML config support too (both need rust)
   prompted by a mail from Russell Sutherland, ok otto

   ... In programs compiled with reduced visibility, this variable may need
   visibility forced using __attribute__((visibility("default"))).

   devel/sbt: update to 2.0.11

   security/nss: backport the diff from 3.131 & 3.131.1

   Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS
   Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS

   i'd gladly backport the 3.131 update but it added symbols..

   discussed with/requested by tb@

   deve/sbt: update to 2.0.10

   drop the RDEP on clamav on !rust archs

   drop the RDEP on clamav for !rust archs

   add OpenBSD to #ifdefs for parse_mount_entries

   Update to yosys-0.70 from Thomas Dettbarn.

   security/nss: update to 3.131.1, prodded by tb@.

   - Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS.
   - Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS.
   see https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131_1.html

   add missing python BDEP, and switch from pandoc to lowdown to allow
   building on archs that aren't amd64/aarch64.

   add missing python BDEP, and switch from pandoc to lowdown to allow
   building on archs that aren't amd64/aarch64.