BSD Commit Log Search

   mail/mozilla-thunderbird: update to 153.5.1.

   see https://www.thunderbird.net/en-US/thunderbird/153.5.1esr/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/

   kdesu: add _permit_setugid

   kdesu: add _permit_setugid and fix missing sgid

   lang/nim: update to 2.2.12

   from Alfred Morgan (MAINTAINER) plus small tweak from me

   sysutils/docker-buildx: update 0.38.1

   sysutils/docker-cli: update to 29.9.2

   mediainfo: update to 26.10

   This includes many fixes resulting from security audits.

   archivers/libarchive: update to 3.8.10

   Unspecified security and bug fixes.

   mediainfo: update to 26.10

   This includes many fixes resulting from security audits.

   MFC php changes from -current, to make tomorrow's RCE CVEs easier to handle

   net/curl: update to 8.23.0

   Includes fixes for
   CVE-2026-87863: HSTS response erases persisted entries
   CVE-2026-87862: HSTS cache import drops longer-lived child
   CVE-2026-87861: cross-origin reuse of a Negotiate connection
   CVE-2026-86414: leaking host credentials to HTTP proxy
   CVE-2026-86413: Negotiate credentials sent to redirected origin
   CVE-2026-86412: server-set cookie erases cookie jar
   CVE-2026-92392: HTTP/2 upload Use-After-Free
   CVE-2026-92391: curl_mime_free stack overflow by recursion
   CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
   CVE-2026-92389: TFTP direction confusion
   CVE-2026-92388: FTP wildcard write callback mixup
   CVE-2026-92387: never-ending loop via server response omission
   CVE-2026-92386: server-set cookie aborts cookie jar load
   CVE-2026-94265: Authorization: Negotiate sent to foreign origin
   CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
   CVE-2026-107929: local interface connection reuse mixup

   the clock applet should only monitor /etc/localtime

   in additional monitor /etc with kqueue and filter for /etc/localtime
   because the symlink can change and that will not be picked up by
   monitoring /etc/localtime itself

   update p5-URI to 5.40

   do not check or touch files that are non-existent on openbsd

   games/love/mime: bump after MAINTAINER change

   Rename GCC49_ARCHS -> PORTSGCC_ARCHS

   OK: rsadowski@, sthen@

   bump utils too

   bump utils too

   drop MAINTAINER; not using it for a while

   drop ONLY_FOR_ARCHS = ${GCC49_ARCHS}, it's doing nothing because COMPILER
   already sets it

   move COMPILER lines to subdirs so that it's included before bsd.port.mk,
   drop the ONLY_FOR_ARCHS in Makefile.inc.

   www/hugo: 0.168.0

   mention that the h3 flavour includes YAML config support too (both need rust)
   prompted by a mail from Russell Sutherland, ok otto

   devel/sbt: update to 2.0.11

   security/nss: backport the diff from 3.131 & 3.131.1

   Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS
   Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS

   i'd gladly backport the 3.131 update but it added symbols..

   discussed with/requested by tb@

   deve/sbt: update to 2.0.10

   drop the RDEP on clamav on !rust archs

   drop the RDEP on clamav for !rust archs

   add OpenBSD to #ifdefs for parse_mount_entries

   Update to yosys-0.70 from Thomas Dettbarn.