NetBSD/pkgsrc ZN0zsMOdoc CHANGES-2026

   Updated lang/nodejs*
VersionDeltaFile
1.4886+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc AI6pt4Olang/nodejs22 Makefile distinfo

   nodejs22: updated to 22.23.2

   22.23.2 'Jod' (LTS)

   Notable Changes

   (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
   (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
   (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
   (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
   (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
   (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
   (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
   (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
   (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
   (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
   deps: update llhttp to 9.4.3 (Paolo Insogna)
   deps: update undici to 6.28.0 (Node.js GitHub Bot)
VersionDeltaFile
1.24+4-4lang/nodejs22/distinfo
1.26+2-2lang/nodejs22/Makefile
+6-62 files

NetBSD/pkgsrc VI3C0Ibdoc CHANGES-2026

   doc: Updated www/osticket to 1.18.4
VersionDeltaFile
1.4885+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc AEnOVuiwww/osticket Makefile distinfo

   www/osticket -- update to v1.18.4

   Upstream Changelog:

   osTicket v1.18.4
   Security

       security: Latest Patches 06/2026 (52c366f, 5afdf54, c54a6ac,
       1e39bf1, feccb6a, 6eb6b98, 078516e, 98abb05, e52e010, fd96bba,
       7bbd8ab, ba6217a, 580e1c8, b535782, 5963797, d590a97, eaebe01,
       b4cc092, d457c14, 5600f94, 5ff9795, 119cefe, b4ede88, 2a0c388,
       6558b33)

   XXX pull-up candidate
VersionDeltaFile
1.3+4-4www/osticket/distinfo
1.9+2-2www/osticket/Makefile
+6-62 files

NetBSD/pkgsrc nRAPtWMlang/nodejs24 Makefile distinfo

   nodejs24: updated to 24.18.1

   24.18.1 'Krypton' (LTS)

   Notable Changes

   (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
   (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
   (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
   (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
   (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
   (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
   (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
   (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
   (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
   (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
   (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
   deps: update llhttp to 9.4.3 (Paolo Insogna)
   deps: update undici to 7.29.0 (Node.js GitHub Bot)
VersionDeltaFile
1.14+4-4lang/nodejs24/distinfo
1.14+2-3lang/nodejs24/Makefile
+6-72 files

NetBSD/pkgsrc lMuLjiflang/nodejs Makefile distinfo

   nodejs: updated to 26.5.1

   26.5.1 (Current)

   Notable Changes

   (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
   (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
   (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
   (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
   (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
   (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
   (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
   (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
   (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
   (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
   deps: update llhttp to 9.4.3 (Paolo Insogna)
   deps: update undici to 8.9.0 (Node.js GitHub Bot)
VersionDeltaFile
1.325+4-4lang/nodejs/distinfo
1.357+2-2lang/nodejs/Makefile
+6-62 files

NetBSD/pkgsrc mhculILdoc CHANGES-2026

   Updated devel/glib2*
VersionDeltaFile
1.4884+5-1doc/CHANGES-2026
+5-11 files

NetBSD/pkgsrc mPXrtXLdevel/gdbus-codegen distinfo, devel/glib2 Makefile.common distinfo

   glib2: updated to 2.88.3

   Overview of changes in GLib 2.88.3, 2026-07-29

   * Fix potential miscompilation with GCC 17 with `G_GNUC_CONST` on `get_type()`
     functions

   * Bugs fixed:
     - G_GNUC_CONST vs get_type comes home to roost (Sam James)
     - (CVE-2026-15588) Security report: GDBusServer pre-authentication DoS
       via unbounded SASL line buffering (Philip Withnall)
     - !5225 Backport !5223 “Drop G_GNUC_CONST for *_get_type” to glib-2-88
     - !5241 Backport !5240 “gdbusauth: Limit length of lines read from client” to
       glib-2-88
     - !5242 Backport !5238 “gpoll: Correctly zero-out heap-allocated fd_sets on
       macOS” to glib-2-88
     - !5243 gdbusauth: Unmark a new string as translatable
     - !5259 Backport !5248, !5249: several Meson/gcc fixes to glib-2-88
VersionDeltaFile
1.170+9-9devel/glib2/PLIST
1.348+4-4devel/glib2/distinfo
1.63+4-4devel/gdbus-codegen/distinfo
1.133+2-2devel/glib2/Makefile.common
+19-194 files

OpenBSD/src elV9WCXusr.bin/tmux Makefile

   Pessimize compiler flags for screen-redraw.c to prevent tmux from dumping core
   upon startup on landisk.
VersionDeltaFile
1.122+6-1usr.bin/tmux/Makefile
+6-11 files

FreeBSD/ports 42dbe89graphics/openxr Makefile distinfo

graphics/openxr: Update 1.1.61 => 1.1.62

Changelog:
https://github.com/KhronosGroup/OpenXR-SDK/releases/tag/release-1.1.62

Reported by:    portscout
Sponsored by:   UNIS Labs
DeltaFile
+3-3graphics/openxr/distinfo
+1-1graphics/openxr/Makefile
+4-42 files

FreeBSD/ports bb57c40lang/kotlin distinfo pkg-plist

lang/kotlin: Update 2.3.0 => 2.4.10

The only consumer in ports tree games/lwjgl3 require version 2.4.x.

Changelogs:
https://github.com/JetBrains/kotlin/releases/tag/v2.3.10
https://github.com/JetBrains/kotlin/releases/tag/v2.3.20
https://github.com/JetBrains/kotlin/releases/tag/v2.3.21
https://github.com/JetBrains/kotlin/releases/tag/v2.4.0
https://github.com/JetBrains/kotlin/releases/tag/v2.4.10

While here improve port:
- Replace PORTVERSION with DISTVERSION.
- Replace RM in post-extract with EXTRACT_BEFORE_ARGS.
- Remove unnecessary MKDIR.
- Replace "LN -sf" with RLN.

PR:             296877
Approved by:    Michael Zhilin <mizhka at FreeBSD.org> (maintainer, timeout 2 weeks)
Sponsored by:   UNIS Labs
DeltaFile
+9-12lang/kotlin/Makefile
+3-3lang/kotlin/distinfo
+6-0lang/kotlin/pkg-plist
+18-153 files

NetBSD/pkgsrc mEJEq74doc CHANGES-2026

   Updated www/nghttp2[-tools], devel/cmake[-gui]
VersionDeltaFile
1.4883+5-1doc/CHANGES-2026
+5-11 files

NetBSD/pkgsrc xjjgrP9devel/cmake version.mk distinfo

   cmake[-gui]: updated to 4.4.2

   4.4.2
   This version made no changes to documented features or interfaces. Some
   implementation updates were made to support ecosystem changes and/or fix
   regressions.
VersionDeltaFile
1.269+4-4devel/cmake/distinfo
1.90+2-2devel/cmake/version.mk
+6-62 files

NetBSD/pkgsrc XnNXeCYwww/nghttp2 Makefile.common distinfo

   nghttp2[-tools]: updated to 1.70.0

   1.70.0

   Require C++23
   Adopt Designated initializers part1
   Adopt Designated initializers part2
   Adopt Designated initializers part3
   tests: Make const values static const
   src: Rewrite util::split_str and its variants
   src: Adopt std::string::resize_and_overwrite
   src: Pass std::chrono::{time_point,duration} by value
   Bump mruby to 4.0.0
   src: Fix warning "space between quotes and suffix is deprecated in C++23"
   lib, tests: Use C-style comment
   src: Avoid std::chrono::high_resolution_clock
   src: Add noexcept to user-defined literals
   src: Replace std::optional with std::expected
   src/util: Adopt std::expected for error handling

    [110 lines not shown]
VersionDeltaFile
1.81+4-4www/nghttp2/distinfo
1.35+2-2www/nghttp2/Makefile.common
+6-62 files

FreeBSD/ports e561a50misc/emacs-libvterm pkg-plist pkg-message, misc/emacs-libvterm/files pkg-message.in

misc/emacs-libvterm: Install etc/ under the vterm/

Previously, the shell-integration scripts (emacs-vterm-bash.sh,
emacs-vterm-zsh.sh, emacs-vterm.fish) were installed under
${EMACS_SITE_LISPDIR}/etc/, i.e. share/emacs/site-lisp/etc/.  That is a
shared, generically-named directory, and creating it cause problems for
at least one other package [0].

Install everything under ${EMACS_SITE_LISPDIR}/vterm/ instead.  This
keeps the port self-contained, no longer pollutes a directory other
ports probe, and matches ELPA package's layout.

[0]
math/ess auto-detects ess-etc-directory by probing paths relative to its
own lisp directory, one of which is ../etc.  With site-lisp/etc present,
ESS selected it instead of the correct share/emacs/etc/ess, so M-x R
failed to load ESSR with "cannot open the connection".

Approved by:    maintainer timeout

    [2 lines not shown]
DeltaFile
+26-0misc/emacs-libvterm/files/pkg-message.in
+7-9misc/emacs-libvterm/Makefile
+0-12misc/emacs-libvterm/pkg-message
+3-3misc/emacs-libvterm/pkg-plist
+36-244 files

NetBSD/pkgsrc 7tn59N9www/drupal11 Makefile

   www/drupal11: allow PHP 8.5

   No functional change.

   * mediawiki 1.46 supports from PHP 8.3 to 8.5:
     <https://www.drupal.org/docs/getting-started/system-requirements/php-requirements>.

   * php/json.mk is required when a package supports prior to PHP 8.0 and
     require php-json pacakge.
VersionDeltaFile
1.10+2-3www/drupal11/Makefile
+2-31 files

LLVM/project 6dfd733lldb/source/Plugins/Platform/Windows PlatformWindows.cpp

[lldb][Windows] Improve error messages in PlatformWindows.cpp (#213011)

The reason for the failure is known but is not in the log. Add a helper
function to map the error to a string and log it.

---------

Co-authored-by: Jonas Devlieghere <jonas at devlieghere.com>
DeltaFile
+10-2lldb/source/Plugins/Platform/Windows/PlatformWindows.cpp
+10-21 files

NetBSD/pkgsrc J6Potspwww/mediawiki Makefile

   www/mediawiki: allow PHP 8.5

   No functional change.

   * mediawiki 1.46 supports from PHP 8.3 to 8.5:
     <https://www.mediawiki.org/wiki/Compatibility>

   * php/json.mk is required when a package supports prior to PHP 8.0 and
     require php-json pacakge.
VersionDeltaFile
1.101+3-3www/mediawiki/Makefile
+3-31 files

LLVM/project 67a2074lldb/docs/resources test.md, lldb/packages/Python/lldbsuite/test skip_reason.py test_result.py

[lldb] Introduce the require decorator (#212753)

Currently, it is unclear if a test that is skipped is either:
- Unsupported because it will never run (macosx tests should not run on
Windows).
- Skipped because it's supposed to work but does not yet.
`@expectedFailure` is not always an option because a test might be
timing out and waiting 600s for it to fail is not acceptable.

This patch introduces 2 new decorators to differentiate those tests:
- `@requireX` meaning the tests require X to run (e.g `@requireDarwin`).
- `@requireNotX` meaning the tests requires anything but `X` to run (e.g
`@requireNotDarwin`).

In the tests results summary, this introduces a new category: `skipped`
tests:
- `@requireX` -> `UNSUPPORTED`
- `@skipIfX` -> `SKIPPED`


    [35 lines not shown]
DeltaFile
+121-0lldb/packages/Python/lldbsuite/test/decorators.py
+29-0lldb/docs/resources/test.md
+16-3lldb/packages/Python/lldbsuite/test/test_result.py
+17-0lldb/packages/Python/lldbsuite/test/skip_reason.py
+12-1lldb/test/API/lldbtest.py
+6-6lldb/test/API/linux/aarch64/gcs/TestAArch64LinuxGCS.py
+201-1082 files not shown
+322-12588 files

Linux/linux 2d2338cdrivers/i2c/busses i2c-jz4780.c i2c-k1.c

Merge tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

Pull i2c fixes from Andi Shyti:
 "A set of fixes across several host controller drivers. The largest
  part addresses three issues in the i.MX driver, while the remaining
  changes fix probe ordering, power management, timeout recovery and
  error handling.

  amd-mp2:
   - unregister callback if adapter registration fails

  designware:
   - defer probe until child GPIO controllers are bound

  imx:
   - mark adapter suspended while hardware is powered down
   - fix stale slave pointer and shared IRQ registration race
   - stop slave timer before clearing slave pointer


    [22 lines not shown]
DeltaFile
+80-0drivers/i2c/busses/i2c-designware-platdrv.c
+49-5drivers/i2c/busses/i2c-imx.c
+1-17drivers/i2c/busses/i2c-qcom-cci.c
+11-0drivers/i2c/busses/i2c-bcm-iproc.c
+5-5drivers/i2c/busses/i2c-k1.c
+4-1drivers/i2c/busses/i2c-jz4780.c
+150-281 files not shown
+153-297 files

NetBSD/pkgsrc 1ZKOPORcross/ppc-morphos-gcc Makefile, cross/ppc-morphos-gcc/files const-baserel.diff

   cross/ppc-morphos-gcc: Updated const-baserel.diff

   - Fix inconsistent categorization for section
   - Never reference rodata via r13
VersionDeltaFile
1.3+24-18cross/ppc-morphos-gcc/files/const-baserel.diff
1.10+2-2cross/ppc-morphos-gcc/Makefile
+26-202 files

LLVM/project bd427e7llvm/utils/gn/secondary/clang-tools-extra/include-cleaner/unittests BUILD.gn, llvm/utils/gn/secondary/clang-tools-extra/unittests BUILD.gn

[gn] add ClangIncludeCleanerTests (#213073)
DeltaFile
+32-0llvm/utils/gn/secondary/clang-tools-extra/include-cleaner/unittests/BUILD.gn
+1-0llvm/utils/gn/secondary/clang-tools-extra/unittests/BUILD.gn
+33-02 files

LLVM/project 308cb96llvm/utils/gn/secondary/llvm/unittests/Target/RISCV BUILD.gn

[gn build] Port b94b699857a5 (#213458)
DeltaFile
+1-0llvm/utils/gn/secondary/llvm/unittests/Target/RISCV/BUILD.gn
+1-01 files

NetBSD/pkgsrc-wip 40a7365sftpgo TODO

sftpgo: Add reference to CVE-2026-10031
DeltaFile
+2-0sftpgo/TODO
+2-01 files

NetBSD/pkgsrc-wip 40539b0serendipity TODO

serendipity: Add reference to recent CVEs
DeltaFile
+2-1serendipity/TODO
+2-11 files

NetBSD/pkgsrc-wip 644b427. Makefile

wip: Add muonfp
DeltaFile
+1-0Makefile
+1-01 files

NetBSD/pkgsrc-wip fb9c534muonfp TODO PLIST

muonfp: Import muonfp-1.5.0

MuonFP is an open-source passive TCP fingerprint sensor.
It observes TCP SYN and SYN-ACK packets and records a compact signature
derived from the TCP window size, option order, MSS, and window scale.

MuonFP is useful for network-security research, reconnaissance
detection, and feeding fingerprint-aware tools such as fpfw.
DeltaFile
+347-0muonfp/distinfo
+116-0muonfp/cargo-depends.mk
+20-0muonfp/Makefile
+6-0muonfp/DESCR
+2-0muonfp/TODO
+2-0muonfp/PLIST
+493-06 files

NetBSD/pkgsrc ZlW7ED1doc CHANGES-2026

   Updated archivers/libarchive, devel/catch2
VersionDeltaFile
1.4882+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc woKFi6kdevel/catch2 Makefile distinfo

   catch2: updated to 3.15.3

   3.15.3

   Fixes
   * The JSON reporter's number handling is locale-independent.
   * Removed leftover debug message from `catch_discover_tests`
   * Fixed typo in the "Could not jump to the Nth element" exception message

   Improvements
   * `catch_discover_tests` registers tests in deterministic (alphabetical) order.
   * `catch_discover_tests` has been rewritten to be massively faster.
     * Preparing the actual CTest script is significantly faster.
     * Parsing the JSON test array is significantly faster.
     * Running without `ADD_TAGS_AS_LABELS` set is 10-15% faster (as opposed to being the same speed)
     * The new implementation is about 4x-5x faster, so registering 500 tests now takes ~350ms (down from 1.1s).
   * JSON writing is faster
     * Small improvement in writing non-string values
     * ~6-40% improvement in writing string values that do not need escaping

    [2 lines not shown]
VersionDeltaFile
1.32+4-4devel/catch2/distinfo
1.31+2-2devel/catch2/Makefile
+6-62 files

NetBSD/pkgsrc OeG7s22archivers/libarchive/files Makefile.in, archivers/libarchive/files/libarchive archive_read_support_format_warc.c archive_write_set_format_warc.c

   libarchive: updated to 3.8.9

   Libarchive 3.8.9 is a security, bugfix and minor feature release.
VersionDeltaFile
1.13+559-545archivers/libarchive/files/libarchive/archive_read_support_format_rar5.c
1.29+762-324archivers/libarchive/files/Makefile.in
1.19+459-408archivers/libarchive/files/libarchive/archive_read_support_format_7zip.c
1.14+499-349archivers/libarchive/files/libarchive/archive_read_support_format_cab.c
1.6+311-264archivers/libarchive/files/libarchive/archive_write_set_format_warc.c
1.12+284-267archivers/libarchive/files/libarchive/archive_read_support_format_warc.c
+2,874-2,157226 files not shown
+9,295-6,463232 files