OpenBSD/ports EoVBMQl — devel/codex Makefile, devel/codex/patches patch-codex-rs_app-server-daemon_src_prepare_install_rs patch-codex-rs_app-server-daemon_src_lib_rs

   devel/codex: add support of codex daemon

   By default it won't autostart but codex app-server daemon start/stop works
VersionDeltaFile
1.1+25-0devel/codex/patches/patch-codex-rs_app-server-daemon_src_lib_rs
1.1+16-0devel/codex/patches/patch-codex-rs_app-server-daemon_src_prepare_install_rs
1.60+1-0devel/codex/Makefile
+42-03 files

OpenBSD/ports quauqmC — net/curl Makefile distinfo, net/curl/pkg DESCR

   net/curl: update to 8.23.0

   Includes fixes for
   CVE-2026-87863: HSTS response erases persisted entries
   CVE-2026-87862: HSTS cache import drops longer-lived child
   CVE-2026-87861: cross-origin reuse of a Negotiate connection
   CVE-2026-86414: leaking host credentials to HTTP proxy
   CVE-2026-86413: Negotiate credentials sent to redirected origin
   CVE-2026-86412: server-set cookie erases cookie jar
   CVE-2026-92392: HTTP/2 upload Use-After-Free
   CVE-2026-92391: curl_mime_free stack overflow by recursion
   CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
   CVE-2026-92389: TFTP direction confusion
   CVE-2026-92388: FTP wildcard write callback mixup
   CVE-2026-92387: never-ending loop via server response omission
   CVE-2026-92386: server-set cookie aborts cookie jar load
   CVE-2026-94265: Authorization: Negotiate sent to foreign origin
   CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
   CVE-2026-107929: local interface connection reuse mixup
VersionDeltaFile
1.217+1-3net/curl/Makefile
1.149+2-2net/curl/distinfo
1.9+1-1net/curl/pkg/DESCR
+4-63 files

OpenBSD/ports eIjxj3x — devel/qt-creator Makefile distinfo, devel/qt-creator/pkg PLIST

   Update qt-creator to 20.0.2
VersionDeltaFile
1.60+2-2devel/qt-creator/distinfo
1.51+2-1devel/qt-creator/pkg/PLIST
1.125+1-1devel/qt-creator/Makefile
+5-43 files

OpenBSD/ports GkUwepU — graphics/krita distinfo Makefile, graphics/krita/pkg PLIST

   Update krita to 6.0.4.1
VersionDeltaFile
1.98+4-6graphics/krita/Makefile
1.59+2-2graphics/krita/distinfo
1.35+0-3graphics/krita/pkg/PLIST
+6-113 files

OpenBSD/ports O8cA0sy — lang/erlang/27 distinfo Makefile, lang/erlang/28 distinfo Makefile

   lang/erlang: Update to 27.3.4.19, 28.5.0.8 and 29.1.2

   Fixes
   CVE-2026-105236
   CVE-2026-42789
   CVE-2026-48856
   CVE-2026-94200
   CVE-2026-96596
VersionDeltaFile
1.10.2.1+12-12lang/erlang/29/Makefile
1.27.2.1+11-11lang/erlang/28/Makefile
1.37.2.1+10-10lang/erlang/27/Makefile
1.9.2.1+4-4lang/erlang/29/distinfo
1.23.2.1+4-4lang/erlang/28/distinfo
1.31.2.1+4-4lang/erlang/27/distinfo
+45-456 files

OpenBSD/ports LvOlFkz — net/lagrange Makefile distinfo

   net/lagrange: Update to 1.21.2

   From Maintainer Florian Viehweger, thanks
VersionDeltaFile
1.72+2-2net/lagrange/distinfo
1.87+2-1net/lagrange/Makefile
+4-32 files

OpenBSD/ports IilcyPG — lang/erlang/27 distinfo Makefile, lang/erlang/28 distinfo Makefile

   lang/erlang: Update to 27.3.4.19, 28.5.0.8 and 29.1.2

   Fixes
   CVE-2026-105236
   CVE-2026-42789
   CVE-2026-48856
   CVE-2026-94200
   CVE-2026-96596
VersionDeltaFile
1.11+12-12lang/erlang/29/Makefile
1.28+11-11lang/erlang/28/Makefile
1.38+10-10lang/erlang/27/Makefile
1.10+4-4lang/erlang/29/distinfo
1.24+4-4lang/erlang/28/distinfo
1.32+4-4lang/erlang/27/distinfo
+45-456 files

OpenBSD/ports iI4koKg — mail/kopano/core Makefile, net/nagios/nagios Makefile

   bump ports with MODPHP_VERSION=8.3 deps
VersionDeltaFile
1.99+2-2mail/kopano/core/Makefile
1.9+3-1www/nextcloud/34/Makefile
1.3+3-0www/nextcloud/35/Makefile
1.34+1-1www/racktables/Makefile
1.40+1-1www/phppgadmin/Makefile
1.99+1-1net/nagios/nagios/Makefile
+11-646 files not shown
+57-2952 files

OpenBSD/ports hZv6aep — www/pear distinfo Makefile, www/pear/pkg PLIST-main

   update to pear-1.10.18, from go-pear-1.10.26.phar
   switch versioning to the pear version rather than the go-pear version
   (the repo used for this is now archived so will need a new method for
   further updates, that can happen later)
VersionDeltaFile
1.45+7-6www/pear/Makefile
1.10+2-2www/pear/distinfo
1.11+0-1www/pear/pkg/PLIST-main
+9-93 files

OpenBSD/ports L4EF2I9 — lang/php php.port.mk, lang/php/8.3 Makefile

   switch php ports default to 8.4, bumps etc to follow
VersionDeltaFile
1.4+1-7lang/php/8.3/pkg/PLIST-main
1.2+8-0lang/php/8.4/pkg/PLIST-main
1.66+1-4lang/php/8.3/Makefile
1.47+3-1lang/php/8.4/Makefile
1.51+1-1lang/php/php.port.mk
1.39+1-1lang/php/pecl/pecl.port.mk
+15-1429 files not shown
+44-1435 files

OpenBSD/ports YzabYbP — multimedia/shotcut Makefile distinfo, multimedia/shotcut/patches patch-src_util_cpp patch-src_mainwindow_cpp

   update to shotcut-26.9.27
VersionDeltaFile
1.22.2.1+2-2multimedia/shotcut/distinfo
1.10.2.1+1-1multimedia/shotcut/patches/patch-src_util_cpp
1.15.2.1+1-1multimedia/shotcut/patches/patch-src_mainwindow_cpp
1.11.2.1+1-1multimedia/shotcut/patches/patch-src_CMakeLists_txt
1.29.2.1+1-1multimedia/shotcut/Makefile
+6-65 files

OpenBSD/ports kUjNIcS — multimedia/shotcut Makefile distinfo, multimedia/shotcut/patches patch-src_util_cpp patch-src_mainwindow_cpp

   update to shotcut-26.9.27, from Josh Grosse (maintainer)

   "This release fixes flaws in Shotcut's network downloads:

   A failed HTTPS fetch was retried over cleartext HTTP.
   Shotcut offered to ignore certificate errors.
   An upgrade URL was accepted from a host other than shotcut.org.
   A Whisper model was kept even when its SHA-256 did not match the digest shipped with Shotcut.
   Refresh Models loaded a downloaded descriptor as QML."
VersionDeltaFile
1.23+2-2multimedia/shotcut/distinfo
1.11+1-1multimedia/shotcut/patches/patch-src_util_cpp
1.16+1-1multimedia/shotcut/patches/patch-src_mainwindow_cpp
1.12+1-1multimedia/shotcut/patches/patch-src_CMakeLists_txt
1.30+1-1multimedia/shotcut/Makefile
+6-65 files

OpenBSD/ports lKsOOQ8 — astro/kstars distinfo Makefile, astro/kstars/patches patch-kstars_indi_servermanager_cpp

   Update kstars to 3.8.5
VersionDeltaFile
1.67+15-11astro/kstars/Makefile
1.44+2-2astro/kstars/distinfo
1.36+1-1astro/kstars/pkg/PLIST
1.5+1-1astro/kstars/patches/patch-kstars_indi_servermanager_cpp
+19-154 files

OpenBSD/ports J7mSVu0 — sysutils/firmware/arm64-qcom-dtb Makefile, sysutils/firmware/arm64-qcom-dtb/patches patch-src_arm64_qcom_x1e80100-honor-magicbook-art-14_dts

   sysutils/firmware/arm64-qcom-dtb: update DTS for Honor MagicBook

   1. Enabel dma-coherent for ufshci

   2. Define actually used panel as edo1455
VersionDeltaFile
1.4+6-6sysutils/firmware/arm64-qcom-dtb/patches/patch-src_arm64_qcom_x1e80100-honor-magicbook-art-14_dts
1.34+1-1sysutils/firmware/arm64-qcom-dtb/Makefile
+7-72 files

OpenBSD/ports 1NdKz8n — graphics/png distinfo Makefile

   switch to the proper uploaded tarball now that it's available.
   no contents/pkg change.
VersionDeltaFile
1.152+2-5graphics/png/Makefile
1.81+2-2graphics/png/distinfo
+4-72 files

OpenBSD/ports tGWXeQq — www/caddy Makefile modules.inc, www/caddy/pkg MESSAGE DESCR

   update to caddy-2.11.7, shorten DESCR a bit, add a very short MESSAGE
   mentioning the "tcp4/" / "tcp6/" syntax in binds, which pvpdmail at
   gmail found necessary in order to get it to bind to v6 (though I don't
   see the same here for some reason..)
VersionDeltaFile
1.7+1,408-990www/caddy/distinfo
1.4+530-370www/caddy/modules.inc
1.2+6-36www/caddy/pkg/DESCR
1.12+3-6www/caddy/Makefile
1.1+2-0www/caddy/pkg/MESSAGE
+1,949-1,4025 files

OpenBSD/ports 5q36fxw — devel/catch2 Makefile distinfo

   Update catch2 to 3.16.1
VersionDeltaFile
1.56+2-2devel/catch2/distinfo
1.63+1-1devel/catch2/Makefile
+3-32 files

OpenBSD/ports gKrHNc9 — games/legendary distinfo Makefile, games/legendary/patches patch-pyproject_toml

   Update legendary to 0.21.1, the latest release. Tested with numerous
   Epic Games Store games.
VersionDeltaFile
1.1+10-0games/legendary/patches/patch-pyproject_toml
1.7+3-4games/legendary/Makefile
1.3+2-2games/legendary/distinfo
1.5+0-1games/legendary/pkg/PLIST
+15-74 files

OpenBSD/ports OvSL6Wl — textproc/ktextaddons distinfo Makefile, textproc/ktextaddons/pkg PLIST

   Update ktextaddons to 2.2.0
VersionDeltaFile
1.17+33-25textproc/ktextaddons/Makefile
1.16+41-3textproc/ktextaddons/pkg/PLIST
1.16+2-2textproc/ktextaddons/distinfo
+76-303 files

OpenBSD/ports 64CJNXc — archivers/innoextract distinfo Makefile, archivers/innoextract/patches patch-src_stream_slice_cpp patch-cmake_VersionScript_cmake

   Update to innoextract 1.13.0. Upstream has moved to an actively
   developed fork. Needed for GOG Galaxy client... (hold your horses).

   from fabien@, thanks
VersionDeltaFile
1.25+11-10archivers/innoextract/Makefile
1.1+11-0archivers/innoextract/patches/patch-VERSION
1.8+2-2archivers/innoextract/distinfo
1.2+0-0archivers/innoextract/patches/patch-src_stream_slice_cpp
1.2+0-0archivers/innoextract/patches/patch-cmake_VersionScript_cmake
1.2+0-0archivers/innoextract/patches/patch-CMakeLists_txt
+24-126 files

OpenBSD/ports uHAyFIM — graphics/kirigami-addons distinfo Makefile, graphics/kirigami-addons/pkg PLIST

   Update kirigami-addons to 1.15.0
VersionDeltaFile
1.21+2-2graphics/kirigami-addons/distinfo
1.23+2-2graphics/kirigami-addons/Makefile
1.19+4-0graphics/kirigami-addons/pkg/PLIST
+8-43 files

OpenBSD/ports HCdDXM2 — graphics/kirigami-app-components distinfo Makefile, graphics/kirigami-app-components/pkg PLIST

   Update kirigami-app-components to 1.1.1
VersionDeltaFile
1.2+24-0graphics/kirigami-app-components/pkg/PLIST
1.2+4-3graphics/kirigami-app-components/Makefile
1.2+2-2graphics/kirigami-app-components/distinfo
+30-53 files

OpenBSD/ports B0zTq3M — devel/got Makefile distinfo

   update to got 0.130

   - default to using SHA256 object IDs in newly created repositories
   - add SHA256 repository support to gotd, gotsysd, and gotsys.conf
   - add an example for scheduled invocations of gotadmin cleanup to gotadmin(1)
   - clear any previously buffered data when receiving Git protocol packets
   - move buffers of size GOT_PKT_MAX off the stack to fix build on OpenBSD/alpha
   - use realpath(p, NULL) instead of realpath(p, buf) to avoid wrong buffer size
   - use PATH_MAX instead of _POSIX_PATH_MAX because the latter is too small
VersionDeltaFile
1.131+2-2devel/got/distinfo
1.150+1-1devel/got/Makefile
+3-32 files

OpenBSD/ports cxxyWuo — graphics/blender Makefile distinfo, graphics/blender/patches patch-source_blender_python_intern_bpy_driver_cc

   Update blender to 4.5.14
VersionDeltaFile
1.1+11-0graphics/blender/patches/patch-source_blender_python_intern_bpy_driver_cc
1.41+2-2graphics/blender/distinfo
1.159+1-2graphics/blender/Makefile
+14-43 files

OpenBSD/ports MJ5INc4 — graphics/openjfx/21 Makefile, graphics/openjfx/21/files openbsd.gradle

   Some adjustments:
   * Doesn't build on i386. Linking fails with out of memory.
   * Add WANTLIB for hidden shared libs in jar files
   * Remove some debug complile flags
   okay sebsastia@
VersionDeltaFile
1.2+10-4graphics/openjfx/21/Makefile
1.2+1-1graphics/openjfx/21/files/openbsd.gradle
+11-52 files

OpenBSD/ports 105x9VI — games/xonix Makefile, games/xonix/patches patch-x11_c

   add _permit_setugid S_ISGID marker

   i will now need to do some testing to make sure that this critical port
   is properly functional
VersionDeltaFile
1.4+20-2games/xonix/patches/patch-x11_c
1.40+1-1games/xonix/Makefile
+21-32 files

OpenBSD/ports Wa3TxYB — games/xonix Makefile, games/xonix/patches patch-Imakefile

   regen
VersionDeltaFile
1.3+4-3games/xonix/patches/patch-Imakefile
1.39+1-1games/xonix/Makefile
+5-42 files

OpenBSD/ports JZRAmQG — mail/postfix/stable Makefile, mail/postfix/stable/patches patch-src_postqueue_postqueue_c patch-src_postdrop_postdrop_c

   add _permit_setugid S_ISGID markers for postdrop/postqueue
   (btw, these commits are related to lib/libc/dlfcn/init.c r1.31)
VersionDeltaFile
1.1+13-0mail/postfix/stable35/patches/patch-src_postqueue_postqueue_c
1.1+13-0mail/postfix/stable35/patches/patch-src_postdrop_postdrop_c
1.1+13-0mail/postfix/stable/patches/patch-src_postqueue_postqueue_c
1.1+13-0mail/postfix/stable/patches/patch-src_postdrop_postdrop_c
1.290+1-1mail/postfix/stable/Makefile
1.17+1-0mail/postfix/stable35/Makefile
+54-16 files

OpenBSD/ports n7q5awS — textproc/py-python-json-logger Makefile, textproc/py-python-json-logger/pkg PLIST

   missed PLIST regen; fixes jupyter notebook
VersionDeltaFile
1.5+21-0textproc/py-python-json-logger/pkg/PLIST
1.6+1-0textproc/py-python-json-logger/Makefile
+22-02 files

OpenBSD/ports AukuXk6 — devel/py-jupyter_events Makefile distinfo

   update to py3-jupyter_events-0.12.1
VersionDeltaFile
1.4+2-2devel/py-jupyter_events/distinfo
1.8+1-2devel/py-jupyter_events/Makefile
+3-42 files