BSD Commit Log Search

   bump REVISION after the fixes in the llvm ports
   ok sthen@

   Fix orc riscv64-specific code paths

   orc previously failed to build because of inconsistent #ifdefs that
   exposed Linux-only calls.  While here hook up call to
   (__builtin)__clear_cache and correct default assumptions (the 'V'
   extension can't be assumed, on any OS).

   Prompted by a report from matthieu@, maintainer timeout, ok sthen@

   add missing build dep.  it wouldn't build without the build dep being
   available, so no need for a REVISION bump.

   noticed by myself and naddy on arm64 and amd64 bulk package builds.

   OK sthen@

   SECURITY update to openvpn-2.6.20

   fix race condition in TLS handshake that could lead to leaking of packet
   data from a previous handshake under specific circumstances
   (CVE-2026-40215)

   fix server ASSERT() on receiving a suitably malformed packet with
   a valid tls-crypt-v2 key (CVE-2026-35058)

   Other changes: https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst

   Tor Browser: update to 15.0.10

   Tor Browser: update to 15.0.10

   OK naddy@

   mail/mozilla-thunderbird: MFC update to 140.10.0

   see https://www.thunderbird.net/en-US/thunderbird/140.10.0esr/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-34/

   fix section merging for .srodata and .openbsd.randomdata

   there was a bad merge of changes and a comma was lost and with that
   section merging for .srodata and .openbsd.randomdata

   ok naddy@, sthen@

   mail/mozilla-thunderbird: update to 140.10.0.

   see https://www.thunderbird.net/en-US/thunderbird/140.10.0esr/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-34/

   ok naddy@

   MFC update to librenms-26.4.0

   update to librenms-26.4.0, ok naddy

   includes fix for cross-site scripting in alert template list, and adds
   missing escaping for a few cli commands etc

   https://github.com/librenms/librenms/releases/tag/26.4.0

   disable pipewire

   ok naddy@

   www/mozilla-firefox: MFC update to 150.0.

   see https://www.firefox.com/en-US/firefox/150.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/

   www/firefox-esr: MFC update to 140.10.0.

   see https://www.firefox.com/en-US/firefox/140.10.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/

   www/firefox-esr: update to 140.10.0.

   see https://www.firefox.com/en-US/firefox/140.10.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/

   ok naddy@

   www/mozilla-firefox: update to 150.0.

   see https://www.firefox.com/en-US/firefox/150.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/

   - disable PGO again, fixes wasm crashes seen with element-web (cf #2030583)
   - will need to move to llvm 21 or patch llvm 19 to reenable PGO
   - add workaround to avoid fetching some pip wheels during configure
     (#2026497), another workaround would be to move to ./mach configure ?

   ok naddy@

   avoid picking up doxygen during build, to avoid build failure with dpb junking
   requested by naddy

   Update to rclone-1.73.5

   CVE-2026-41176
   rc: add AuthRequired to options/set to prevent auth bypass
   rc: snapshot NoAuth at startup to prevent runtime auth bypass

   CVE-2026-41179
   operations: add AuthRequired to operations/fsinfo to prevent backend
   creation

   Changelog: https://rclone.org/changelog/#v1-73-5-2026-04-19

   OK sthen@

   graphics/lcms2: Update to 2.19rc2

   Fixes several issues, for reference see
   https://marc.info/?l=oss-security&m=177646929211758&w=2

   pointed out by and ok tb@, ok naddy@

   update to gelatod-1.7;  same fix as 029_v6daemons;  OK naddy

   geo/mapserver: security update to 8.6.2.

   see https://mapserver.org/development/changelog/changelog-8-6.html#changelog-8-6
   fixes https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x

   ok naddy@

   Update to gtk+4-4.22.3.

   ok naddy@

   Patch btop to report active CPU usage correctly

   from upstream https://github.com/aristocratos/btop/pull/1587

   This also allows building on spark64 with gcc 15.

   shells/elvish: Update to 0.21.0

   The current version in ports is broken/non-functional.

   approved by naddy@

   Update to png 1.6.58. ok deraadt@, naddy@.
   Fixes a regression introduced in 1.6.56

   Update to png 1.6.58. ok deraadt@, naddy@.
   Fixes a regression introduced in 1.6.56
   xenocara will be updated after unlock as it's not affected.

   Stop cleaning gem artifacts

   Bulk builds have seen occasional failures building
   textproc/ruby-commonmarker, which is the only reverse dependency. I'm
   not positive the cleaning of gem artifacts is the cause of the failure,
   though I suspect it is.

   Discussed with naddy@

   Update godot/pack3 to latest release 4.6.2, a stable maintenance
   release. No known incompatibilities. Tested with Road to Vostok.

   MFC: luanti 5.15.2 (security update)
   From maintainer izzy Meyer

   Update to exfetch 1.6. From author & maintainer izzy Meyer - thanks!