LLVM/project 86f5613clang/lib/Format CMakeLists.txt

Apply suggestions from code review

Co-authored-by: owenca <owenpiano at gmail.com>
Co-authored-by: Reid Kleckner <rkleckner at nvidia.com>
DeltaFile
+2-2clang/lib/Format/CMakeLists.txt
+2-21 files

LLVM/project e3d5041llvm/lib/Target/AMDGPU SIInstructions.td AMDGPUAssignIdxToM0.cpp, llvm/test/CodeGen/AMDGPU/AddressSpaceVGPR as-vgpr-copy.ll as-vgpr-basic.ll

Address review: subarch triples, required pass mixin, legalizer predicates, redundant VALU
DeltaFile
+10-11llvm/lib/Target/AMDGPU/AMDGPULegalizerInfo.cpp
+4-4llvm/test/CodeGen/AMDGPU/AddressSpaceVGPR/as-vgpr-gpr-idx-mode.ll
+3-2llvm/lib/Target/AMDGPU/AMDGPUAssignIdxToM0.cpp
+1-3llvm/lib/Target/AMDGPU/SIInstructions.td
+2-2llvm/test/CodeGen/AMDGPU/AddressSpaceVGPR/as-vgpr-copy.ll
+2-2llvm/test/CodeGen/AMDGPU/AddressSpaceVGPR/as-vgpr-basic.ll
+22-246 files not shown
+34-3512 files

FreeBSD/src 6880edblibexec/rtld-elf rtld.c

rtld: fix indentation of multiline conditional

Fixes:          7e2f38311e62 ("rtld-elf/rtld.c: apply clang-format")
Sponsored by:   Innovate UK
DeltaFile
+2-2libexec/rtld-elf/rtld.c
+2-21 files

LLVM/project 073f2a2llvm/test/Transforms/SLPVectorizer/RISCV external.ll

[SLP] Add additional test for deferred rematerialization (#213400)

More tests for #211680.

Also cleaned up some commented out code that slipped through with the
old test.

New test stresses the scheduling updates.
DeltaFile
+102-39llvm/test/Transforms/SLPVectorizer/RISCV/external.ll
+102-391 files

FreeBSD/ports c8a6d8ax11/sddm Makefile, x11/sddm/files patch-src_common_VirtualTerminal.cpp patch-src_helper_UserSession.cpp

x11/sddm: Wayland session fixes

PR:             286592, 296052
DeltaFile
+84-0x11/sddm/files/patch-src_helper_UserSession.cpp
+0-20x11/sddm/files/patch-src_common_VirtualTerminal.cpp
+1-1x11/sddm/Makefile
+85-213 files

LLVM/project 5ab6b42clang/docs ClangTransformerTutorial.md ClangRepl.md

[docs] Rewrite selected Clang docs to Markdown (#210843)

Tracking issue: #201242
See the [migration guide] for more information. 

[migration guide]:
https://llvm.org/docs/SphinxQuickstartTemplate.html#markdown-migration-guidelines
This is a stacked PR based on #210842 , which will be a standalone
commit that
renames *.rst -> *.md before this PR lands for history preservation
purposes.

This was prepared with rst2myst plus LLM-assisted cleanup. I paged
through all the generated HTML looking for migration artifacts, and all
of the differences I could find appear to be formatting error
corrections.
DeltaFile
+2,000-2,021clang/docs/InternalsManual.md
+436-446clang/docs/LibASTImporter.md
+349-318clang/docs/ClangOffloadBundler.md
+325-336clang/docs/LibASTMatchersTutorial.md
+272-309clang/docs/ClangRepl.md
+187-207clang/docs/ClangTransformerTutorial.md
+3,569-3,63712 files not shown
+4,635-4,83918 files

LLVM/project 9cb3a6elld/ELF Driver.cpp, lld/test/ELF aarch64-feature-bti.s riscv-feature-zicfiss.s

[ELF] Quote the value in "unknown -z" diagnostics (#213572)

To make stray whitespace more visible (see #212523)
```
$ echo end > tmp.f90 &&  flang -fuse-ld=lld  -Wl,"-z execstack" tmp.f90
ld.lld: warning: unknown -z value:  execstack
```

Drop the colon (colon is typically used without quotes in lld/ELF
diagnostics).

Change ErrAlways to Err so that --noinhibit-exec downgrades the errors
to warnings. Read --noinhibit-exec before readConfigs, as Err depends on
it.
DeltaFile
+10-10lld/ELF/Driver.cpp
+5-3lld/test/ELF/aarch64-feature-gcs.s
+2-2lld/test/ELF/riscv-feature-zicfiss.s
+2-2lld/test/ELF/riscv-feature-zicfilp-unlabeled.s
+2-2lld/test/ELF/driver.test
+1-1lld/test/ELF/aarch64-feature-bti.s
+22-208 files not shown
+30-2814 files

LLVM/project 6f15201llvm/lib/Target/AMDGPU SIISelLowering.cpp AMDGPUInstructionSelector.cpp, llvm/test/CodeGen/AMDGPU llvm.amdgcn.ballot.i32.wave64.err.ll

Revert "Reland "[AMDGPU] Fix llvm.amdgcn.ballot with return width != wavefron…"

This reverts commit fe41b737af5229a22313ac18b760fa5984c4afb1.
DeltaFile
+0-15llvm/test/CodeGen/AMDGPU/llvm.amdgcn.ballot.i32.wave64.err.ll
+2-9llvm/lib/Target/AMDGPU/AMDGPUInstructionSelector.cpp
+0-9llvm/lib/Target/AMDGPU/SIISelLowering.cpp
+2-333 files

LLVM/project 1789918llvm/include/llvm/ProfileData InstrProf.h InstrProfWriter.h, llvm/lib/ProfileData InstrProf.cpp

[llvm-profdata] Reject merging single-byte-coverage with count profiles (#213177)

llvm-profdata merge previously silently merged single-byte-coverage
profiles with count profiles. We should reject this, because
SingleByteCoverage will always be set to true in the merged profile, and
mess up the PGO pipeline.

mergeProfileKind now errors with cannot merge single-byte-coverage
profiles with count (non-coverage) profiles when exactly one side has
InstrProfKind::SingleByteCoverage set.

Note: Used AI to generate the code

---------

Co-authored-by: Sharon Xu <sharonxu at fb.com>
DeltaFile
+19-1llvm/test/tools/llvm-profdata/merge-incompatible.test
+8-1llvm/include/llvm/ProfileData/InstrProfWriter.h
+1-6llvm/tools/llvm-profdata/llvm-profdata.cpp
+4-0llvm/lib/ProfileData/InstrProf.cpp
+1-0llvm/include/llvm/ProfileData/InstrProf.h
+33-85 files

OpenBSD/ports 4xOZXW2sysutils/salt/3008/patches patch-salt_modules_openbsd_sysctl_py patch-salt_modules_openbsdrcctl_service_py, sysutils/salt/3008/pkg PLIST

   import salt-3008.2;

   this is now a separate port because of the 'The great Salt module migration'

   https://salt.tips/the-great-salt-module-migration/

   ok aja@
VersionDeltaFile
1.1+3,223-0sysutils/salt/3008/pkg/PLIST
1.1+414-0sysutils/salt/3008/patches/patch-salt_modules_openbsdpkg_py
1.1+402-0sysutils/salt/3008/patches/patch-salt_modules_vmctl_py
1.1+334-0sysutils/salt/3008/patches/patch-salt_modules_openbsdservice_py
1.1+293-0sysutils/salt/3008/patches/patch-salt_modules_openbsdrcctl_service_py
1.1+149-0sysutils/salt/3008/patches/patch-salt_modules_openbsd_sysctl_py
+4,815-036 files not shown
+4,984-042 files

LLVM/project 2a00912clang/docs LibASTMatchers.md ClangTransformerTutorial.md

Address review comments, mostly to do with wrapping

- use list-table
- reflow egregious instances
- apply some backticks.
DeltaFile
+125-42clang/docs/ClangOffloadBundler.md
+67-48clang/docs/InternalsManual.md
+12-15clang/docs/LibASTMatchersTutorial.md
+9-2clang/docs/ClangRepl.md
+3-3clang/docs/ClangTransformerTutorial.md
+0-2clang/docs/LibASTMatchers.md
+216-1126 files

LLVM/project 8e9b520clang/docs ClangTransformerTutorial.md InternalsManual.md

[docs] Clean up migrated Clang InternalsManual markup

Replace migrated blockquote markup in InternalsManual.md with MyST definition lists where the surrounding text is semantically a term-and-definition list.
DeltaFile
+108-108clang/docs/InternalsManual.md
+1-1clang/docs/ClangTransformerTutorial.md
+109-1092 files

LLVM/project 7d6fda7clang/docs LibASTMatchersTutorial.md InternalsManual.md

[docs] Finish MyST migration for selected docs
DeltaFile
+88-137clang/docs/ClangOffloadBundler.md
+15-18clang/docs/ClangRepl.md
+14-14clang/docs/LibASTImporter.md
+11-11clang/docs/RAVFrontendAction.md
+4-4clang/docs/InternalsManual.md
+3-3clang/docs/LibASTMatchersTutorial.md
+135-1877 files not shown
+145-20413 files

LLVM/project cdf72b6clang/docs ClangTransformerTutorial.md ClangRepl.md

[docs] Convert selected rst docs with rst2myst
DeltaFile
+1,992-2,032clang/docs/InternalsManual.md
+436-446clang/docs/LibASTImporter.md
+321-329clang/docs/LibASTMatchersTutorial.md
+290-293clang/docs/ClangOffloadBundler.md
+260-301clang/docs/ClangRepl.md
+188-208clang/docs/ClangTransformerTutorial.md
+3,487-3,60912 files not shown
+4,555-4,80418 files

LLVM/project cc30c65clang/docs LibASTImporter.rst LibASTImporter.md

[docs] Rename selected Clang docs to Markdown (#210842)

Tracking issue: #201242
See the [migration guide] for more information. 

[migration guide]:
https://llvm.org/docs/SphinxQuickstartTemplate.html#markdown-migration-guidelines

This is the initial straight rename commit. It will probably break the
docs build, but it has to be a separate PR for blame preservation
purposes.
DeltaFile
+0-3,941clang/docs/InternalsManual.rst
+3,941-0clang/docs/InternalsManual.md
+0-658clang/docs/ClangRepl.rst
+658-0clang/docs/ClangRepl.md
+0-613clang/docs/LibASTImporter.rst
+613-0clang/docs/LibASTImporter.md
+5,212-5,21230 files not shown
+9,110-9,11036 files

OpenZFS/src 845cd96tests/runfiles linux.run, tests/zfs-tests/tests Makefile.am

ZTS: add coverage for the MMP claim on a degraded mirror

Add mmp_degraded_import, which verifies the uberblock claim requires a
write only to those mirror legs the pool configuration still expects to
be present.  A healthy mirror is claimed, a mirror with an offlined leg
is claimed and imports degraded, and a mirror with a leg this host
cannot open, and which the configuration does not mark absent, is
refused.  The degraded and unreachable cases repeat on a three-way
mirror, where the number of legs the configuration expects and the
number this host can reach come apart.

Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Michael Heller <michael.heller at gmail.com>
Closes #18855
DeltaFile
+163-0tests/zfs-tests/tests/functional/mmp/mmp_degraded_import.ksh
+1-0tests/zfs-tests/tests/Makefile.am
+1-0tests/runfiles/linux.run
+165-03 files

OpenZFS/src 8cdd9b2module/zfs mmp.c

mmp: do not require writes to mirror legs the config marks absent

The MMP uberblock claim requires one good write per configured leaf of
each top-level vdev.  For a mirror it required two writes
unconditionally (MIN(MAX(children, 1), 2)), so a mirror with a leg that
is persistently offline, faulted, or removed could produce only one good
write and the activity-check claim failed with EIO.  A degraded mirror
could therefore not be imported with multihost=on, blocking HA failover.

Count only the legs the pool config still expects to be present, and
require a write to every one of them.  A leg taken out of service is
recorded persistently in the config and is seen the same way by every
host, so it is not required.  A leg merely unreachable from the
importing host keeps none of those states and stays required, so a host
that can see only some of the legs of an otherwise healthy mirror still
fails the claim and cannot split the pool.

The previous cap of two writes was a compromise made because requiring
every child was too strict for wide mirrors, in particular where a leg

    [9 lines not shown]
DeltaFile
+28-4module/zfs/mmp.c
+28-41 files

OpenBSD/ports oM8A0Bvsysutils/salt distinfo

   remove distinfo as well
VersionDeltaFile
1.77+0-0sysutils/salt/distinfo
+0-01 files

OpenBSD/ports zDPXqcesysutils/salt Makefile.inc Makefile, sysutils/salt/3007/patches patch-salt_scripts_py patch-salt_modules_vmctl_py

   split the salt port per major version

   version 3008 will bring huge changes so keep the older 3007 version
   around as well
VersionDeltaFile
1.1+5,249-0sysutils/salt/3007/pkg/PLIST
1.203+3-95sysutils/salt/Makefile
1.1+95-0sysutils/salt/Makefile.inc
1.1+73-0sysutils/salt/3007/patches/patch-salt_utils_pycrypto_py
1.1+45-0sysutils/salt/3007/patches/patch-salt_modules_vmctl_py
1.1+33-0sysutils/salt/3007/patches/patch-salt_scripts_py
+5,498-9532 files not shown
+5,678-9538 files

LLVM/project 621f550flang/include/flang/Parser parse-tree.h, flang/lib/Parser openmp-parsers.cpp

[flang][OpenMP] Version-dependent parsing of map-type-modifier (#213473)

Up until 5.2, ALWAYS, CLOSE, and PRESENT were keywords of the
map-type-modifier. Starting from 6.0 they all became their own
single-keyword modifiers. This allowed specifying them together,
unlike in the past where map-type-modifier was unique.

To avoid using a single representation of the modifiers, and be
able to validate them through non-conditional properties, the
AST was rewritten back to the older form in canonicalization
when the spec version was set to 5.2 or earlier.

Now that the parser is version-aware, it can generate the desired
AST from the start.

Additionally, extract the OMPX_HOLD modifier out of the map-type-
modifier into its own AST node regardless of version.
DeltaFile
+62-19flang/lib/Parser/openmp-parsers.cpp
+1-45flang/lib/Semantics/canonicalize-omp.cpp
+7-7flang/test/Parser/OpenMP/map-modifiers-v60.f90
+4-4flang/test/Parser/OpenMP/map-modifiers.f90
+8-0flang/test/Semantics/OpenMP/map-modifiers.f90
+1-2flang/include/flang/Parser/parse-tree.h
+83-771 files not shown
+83-787 files

LLVM/project 8014bffflang/include/flang/Parser parsing.h user-state.h, flang/lib/Frontend FrontendAction.cpp ParserActions.cpp

[flang] Pass LangOptions to parser via UserState (#213472)

This will help deal with syntax changes across different versions of
OpenMP. There are certain cases where being able to generate different
AST for the same source code depending on the version of the OpenMP
spec makes semantic analysis easier.

---------

Co-authored-by: Michael Kruse <llvm-project at meinersbur.de>
DeltaFile
+8-0flang/include/flang/Parser/user-state.h
+4-2flang/lib/Parser/parsing.cpp
+4-2flang/lib/Frontend/ParserActions.cpp
+3-1flang/include/flang/Parser/parsing.h
+2-1flang/lib/Frontend/FrontendAction.cpp
+1-1flang/tools/f18-parse-demo/f18-parse-demo.cpp
+22-72 files not shown
+24-98 files

LLVM/project ab130aallvm/include/llvm/CodeGen/GlobalISel LegalizerInfo.h, llvm/lib/CodeGen/GlobalISel LegalityPredicates.cpp LegalizerInfo.cpp

[GlobalISel] Add immediates to `LegalizerQuery` (#211101)

Expands `LegalityQuery` to include instruction immediates in the query.

This allows instructions with immediates to be handled more fully with
legalization rules/predicates (e.g. `G_SEXT_INREG` based on its sext
width) rather than having to resort to custom legalizer logic.

Split from #198979
DeltaFile
+72-0llvm/unittests/CodeGen/GlobalISel/LegalizerInfoTest.cpp
+12-18llvm/lib/Target/WebAssembly/GISel/WebAssemblyLegalizerInfo.cpp
+18-12llvm/lib/CodeGen/GlobalISel/LegalizerInfo.cpp
+12-17llvm/lib/Target/RISCV/GISel/RISCVLegalizerInfo.cpp
+21-0llvm/lib/CodeGen/GlobalISel/LegalityPredicates.cpp
+14-2llvm/include/llvm/CodeGen/GlobalISel/LegalizerInfo.h
+149-494 files not shown
+171-5910 files

OpenBSD/ports 7TKEoiQdevel/zizmor Makefile crates.inc

   Update to zizmor 1.29.0

   https://github.com/zizmorcore/zizmor/releases/tag/v1.29.0
VersionDeltaFile
1.8+72-62devel/zizmor/distinfo
1.7+35-30devel/zizmor/crates.inc
1.11+2-2devel/zizmor/Makefile
+109-943 files

pkgng/pkgng 2282f1dlibpkg pkg_repo.c

pkg_repo: Fix incompatible pointer

Fix incompatible variable pointer which causes compile to fail in Linux
systems.

Fix variable clevel_buf that was 'char **'' which is corrected type to 'char *'
DeltaFile
+1-1libpkg/pkg_repo.c
+1-11 files

LLVM/project 25d130flld/MachO BPSectionOrderer.cpp, lld/test/MachO bp-section-orderer-safe-thunks.s

[lld-macho] Include ICF safe thunks in balanced partitioning (#212096)

Mach-O balanced partitioning currently discovers candidate sections by
walking the input-file section graph. In `--icf=safe_thunks` mode,
address-significant functions can instead be emitted as linker-created
thunk sections after that graph has been built. A temporal-profile name
then resolves to the dead folded input while the callable section
present in the final binary is never eligible for BP ordering.

Factor candidate collection into a helper, then inspect the final
`inputSections` set for sections containing a `Defined` symbol marked
`ICFFoldKind::Thunk`. This makes emitted ICF safe thunks visible while
keeping unrelated synthetic metadata outside BP.

The new arm64 regression folds a profiled address-significant function
into a 4-byte safe thunk and verifies both the BP startup count and
final symbol order. Without the change, BP orders zero startup sections
for that profile; with the change it orders the emitted thunk first.
DeltaFile
+83-0lld/test/MachO/bp-section-orderer-safe-thunks.s
+54-23lld/MachO/BPSectionOrderer.cpp
+137-232 files

LLVM/project 33a20fcllvm/lib/Target/AMDGPU SIInsertWaitcnts.cpp, llvm/test/CodeGen/AMDGPU asyncmark-gfx12plus.ll asyncmark-pregfx12.ll

[AMDGPU] Do not reset AsyncScore when recording an async mark (#213144)

AsyncScore is a snapshot of the counter scores used by async operations,
which recordAsyncMark stores into AsyncMarks. Like the other scores
tracked by the brackets, these snapshots need to be monotonically
increasing: determineAsyncWait indexes into AsyncMarks and uses the
selected entry directly to compute the wait, so each mark has to
describe the state of every async operation issued before it, not just
those issued since the previous mark.
DeltaFile
+108-0llvm/test/CodeGen/AMDGPU/asyncmark-pregfx12.ll
+98-0llvm/test/CodeGen/AMDGPU/asyncmark-gfx12plus.ll
+0-1llvm/lib/Target/AMDGPU/SIInsertWaitcnts.cpp
+206-13 files

LLVM/project 86c1a9eclang/lib/Sema SemaSwift.cpp, clang/test/APINotes swift-name-raw-identifiers.m

[Sema] Add support for Swift raw identifiers in the `swift_name` attribute and APINotes. (#199531)

This is the upstream version of
https://github.com/swiftlang/llvm-project/pull/12995 from the swiftlang
fork.

**Motivation:** Swift 6.2 added support for [raw
identifiers](https://github.com/swiftlang/swift-evolution/blob/main/proposals/0451-escaped-identifiers.md),
which are backtick-delimited identifiers that can contain non-identifier
characters like `` let `hello world` = `foo/bar:baz` ``. This change
ensures that those identifiers can be used when setting Swift names for
C decls in APINotes and the `swift_name` attribute.
DeltaFile
+78-13clang/lib/Sema/SemaSwift.cpp
+27-0clang/test/SemaObjC/attr-swift_name.m
+23-0clang/test/APINotes/swift-name-raw-identifiers.m
+14-0clang/test/APINotes/Inputs/Frameworks/RawIdentifiers.framework/Headers/RawIdentifiers.h
+14-0clang/test/APINotes/Inputs/Frameworks/RawIdentifiers.framework/Headers/RawIdentifiers.apinotes
+5-0clang/test/APINotes/Inputs/Frameworks/RawIdentifiers.framework/Modules/module.modulemap
+161-136 files

LLVM/project 414b4a9lldb/source/ValueObject DILEval.cpp, lldb/test/API/commands/frame/var-dil/basics/BitFieldExtraction TestFrameVarDILBitFieldExtraction.py

[lldb][DIL] Validate bitfield extraction ranges (#213055)

The DIL bitfield extraction operator `base[high:low]` creates a
synthetic bitfield child without validating the requested range.  Three
malformed ranges reach the data layer and either return nonsense or
crash.  Reproduced with a 32-bit `int value` and DIL enabled:

```
(lldb) settings set target.experimental.use-DIL true
(lldb) frame variable 'value[-1:0]'
(int:2) value[-1:0] = 2
```

A negative index is accepted and produces a meaningless child.
`first_index`/`last_index` are signed `int64_t`, but
`GetSyntheticBitFieldChild` takes `uint32_t`, so `-1` silently wraps to
a huge unsigned offset.

```

    [36 lines not shown]
DeltaFile
+39-0lldb/source/ValueObject/DILEval.cpp
+32-0lldb/test/API/commands/frame/var-dil/basics/BitFieldExtraction/TestFrameVarDILBitFieldExtraction.py
+71-02 files

FreeNAS/freenas 3181bdfsrc/middlewared/middlewared/plugins/zfs snapshot_crud.py, src/middlewared/middlewared/pytest/unit/utils/zfs test_guard.py test_no_second_registry.py

Consolidate the managed-dataset registries and guard every mutator

## Problem
"Is this a dataset middleware manages?" was answered by five separate registries with four membership sets and three matching algorithms: `INTERNAL_PATHS` in `plugins/zfs/utils.py`, `INTERNAL_DATASETS` in `plugins/pool_/dataset_query_utils.py`, `internal_datasets_filters` in `plugins/pool_/dataset.py`, inline literals in `alert/source/datasets.py`, and `INVALID_DATASETS` in `plugins/zettarepl.py`. None had unit coverage, and they had drifted: `<pool>/ix-applications` was creatable and then permanently invisible because one entry carried a trailing slash the others lacked, `<pool>/ix-apps-data` was hidden forever on a substring match, and the replication registry did not know about the apps datasets at all.

"May this caller change it?" was answered by a `bypass` field on seven public snapshot request models. It was declared `SkipJsonSchema`, which hides a field from the generated docs and JSON schema but does not block it at validation, so any caller holding `SNAPSHOT_WRITE` could send `bypass: true` and defeat every guard. `exclude_internal_paths` on `ZFSResourceQuery` was the same defect on the read side: any caller holding `ZFS_RESOURCE_READ` could enumerate every managed dataset, boot pool included. The root cause in both cases is that an authorization decision was encoded as request data -- a property of the caller modelled as a field of the request, on a model shared between the public method and the private one.

Separately, ten public mutators had no protection at all and none of them funnelled through a guarded implementation: `pool.dataset.promote`, `rename`, `set_quota`, `get_quota`, `lock`, `change_key` and `inherit_parent_encryption_properties`, both `zfs.tier` mutators, and `pool.snapshot.rename`. `promote` was the worst of them, since managed children are frequently clones and promoting one reparents its origin snapshot. `pool.snapshot.rename` turned out to be unreachable in any case: it passed a snapshot id to `zfs.resource.rename`, which rejects any name containing `@`, so the endpoint could not succeed for any valid input and had no test coverage.

## Solution
- **One registry, with shape as a first-class concept.** `utils/zfs/managed_datasets.py` holds the entries, and separates four things that are each edited in exactly one place: an *entry* (one table row), a *view* (a decision a caller makes), a *shape* (a matching strategy, bound per view in `VIEW_SHAPES`), and *drift* (per-cell overrides, quarantined and designed to be deleted). Retargeting a view onto a different shape is a one-line edit with no call-site changes, which is what makes the eventual convergence cheap.
- **Behaviour preserved exactly.** Each view keeps the matching algorithm its callers used before, so no listing changes and nothing is newly hidden or exposed. Converging the shapes would flip several unrelated consumers and is deliberately left as a follow-up; `SHAPE_OVERRIDES` holds the two cells that would have to go first. `.truenas_containers` keeps a row bound to the product listing only, reproducing today's behaviour while containers are addressed separately.
- **The override is off the wire.** `bypass` and `exclude_internal_paths` are gone from the public models and replaced by parameters on the `@private` implementations, which JSON-RPC cannot populate because it dispatches through the request model. The privilege is now a typed `InternalAccess` enum rather than a bool, so a stray value fails closed instead of silently permitting, and `InternalAccess.ALLOW` is a unique token that greps out the complete list of privileged callers. It is str-valued and coerced rather than identity-compared so it survives the JSON hop in `failover.call_remote`, which the audit dataset relies on. The fifteen owner call sites already passed `bypass=True`, so this is a rename rather than new burden. `v26_0_0` is left alone: the version adapter already drops fields absent from the newer model, and editing a frozen version would turn a silent drop into a hard failure for old clients.
- **Guards live at the chokepoint.** Protection sits inside the `@private` implementations, which every mutation passes through, rather than in each public method -- a missing guard at a public boundary fails open and silently, while a missing owner opt-in fails closed and loudly in that owner's own workflow. The four operations that have no chokepoint (quota, the two encryption operations, and tiering, which talks to an out-of-process daemon) are guarded at their public boundary instead, each as the first statement so the refusal precedes any lookup or feature check.
- **Gaps closed.** All ten unguarded mutators now refuse managed datasets, `pool.dataset.rename` also refuses a managed *destination* so a dataset can no longer be created at a protected name by renaming into it, `pool.dataset.delete` reports `EACCES` "is a protected path" instead of an errno-less "is an invalid location", and `pool.dataset.update` is protected explicitly rather than incidentally by the listing filter hiding its target and returning a misleading `ENOENT`. `pool.snapshot.rename` is routed at the snapshot rename endpoint and works. `mount` and `unmount` are deliberately left unguarded, with the reason recorded: they toggle visibility rather than changing content, and docker legitimately mounts the apps dataset. `replication.create_dataset` is likewise left unguarded, since replication is how users back up and restore the apps dataset and the target may be a remote system whose managed paths this one cannot reason about.
- **Coverage.** A truth table pins all six views across every shape edge, including the nested and prefix look-alikes the old registries disagreed on and one documented divergence on an input ZFS cannot produce. A scanner test blocks a sixth registry by matching dataset-name string literals -- including inside f-strings -- outside the registry module, and was checked to catch all five of the registries it replaces; its allowlist doubles as the convergence backlog and already records one hand-rolled membership test the audit had missed. Integration tests cover every guarded mutator against three managed datasets, with controls proving the guards reject nothing else.
DeltaFile
+271-0src/middlewared/middlewared/utils/zfs/managed_datasets.py
+225-0src/middlewared/middlewared/pytest/unit/utils/zfs/test_managed_datasets.py
+217-0tests/api2/test_internal_dataset_protection.py
+216-0src/middlewared/middlewared/pytest/unit/utils/zfs/test_no_second_registry.py
+60-46src/middlewared/middlewared/plugins/zfs/snapshot_crud.py
+94-0src/middlewared/middlewared/pytest/unit/utils/zfs/test_guard.py
+1,083-4642 files not shown
+1,641-33348 files

FreeBSD/ports d477151security/vuxml/vuln 2026.xml

security/vuxml: Fix giflib entry

The update to 6.1.3 already contains in files/ a patch for CVE-2026-26740 so use
lt instead of le to fix the version range.

PR:             296876
DeltaFile
+1-1security/vuxml/vuln/2026.xml
+1-11 files