Some 201x AMI-bios machines have a weird option to limit the CPUID level,
and figuring that requires way too many people. Look specifically for
this weird (unworkable and unfixable) condition, and panic with a clear
message recommending BIOS changes.
Most of this figured out by mlarkin, on a machine jbg has.
iked: Reject malformed and out-of-state IKEv2 messages
A malicious or malformed IKEv2 peer could crash iked, or cause a
certificate validation verdict to be applied to the wrong peer
identity. Reject malformed DELETE payloads and EAP responses for
which no matching server state exists, and bind CA and OCSP verdicts
to the identity they were computed for.
Reported by Stefan Rinkes and acts1631kjv at proton me.
ok markus@
x509/x509_ncons: More checking for embedded NULs in name constraints
NAME_CONSTRAINTS_check() accepts an out-of-subtree DNS subjectAltName
when the IA5String contains an embedded NUL.
Based on a patch by Frank Denis
tweak/ok beck
Modernize the sndio bits which haven't been reviewed against recent Gstreamer
changes.
Fix a random crash when setting volume/mute.
Keep mute and volume settings from the user.
Match the alsa module and use a mutex to serialize calls.
Update openscad to 2026.09.17 snapshot
While here, remove shell script / libexec dance no longer needed
due to boost understanding getexecpath(3)
ok ian@
Clear NEXTHOP_CONNECTED in nexthop_update() if msg->connected is false.
Until now nexthop_update() only set but never reset NEXTHOP_CONNECTED.
As a result once the connected flag was set it remained set even if the
nexthop was no longer directly connected.
Reported by N0zoM1z0
OK tb@
Kill old compat code to parse aspa-set tables that include an AFI per
provider ASnum. Rpki-client stopped issuing those with the 8.5 release
in July 2023.
OK tb@
Remove gnome secrets; updating to a maintained release is not possible
right now because of dependencies we don't provide and are painful to port.
Considering the security aspect of this port, better use another front-end
to handle your KeyPass DB.
devel/dub: update to 1.40.0
We have gdc everywhere and it can be linked back.
Plus fixed missed gcc-11 dependency to gcc-16, and updated coment in gcc-16