FreeBSD/ports 1ef4141 — security/vuxml/vuln 2026.xml

security/vuxml: Document redmine vulnerabilities

Affects redmine70 < 7.0.3, redmine61 < 6.1.6 and redmine60 < 6.0.12.

Obtained from:  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
DeltaFile
+61-0security/vuxml/vuln/2026.xml
+61-01 files

LLVM/project 5c3a1fe — mlir/lib/Conversion/SPIRVToLLVM SPIRVToLLVM.cpp, mlir/test/Conversion/SPIRVToLLVM cl-ops-to-llvm.mlir

[mlir][SPIR-V] Add SPIRVToLLVM conversion for CL clamp ops (#237747)
DeltaFile
+18-0mlir/test/Conversion/SPIRVToLLVM/cl-ops-to-llvm.mlir
+5-2mlir/lib/Conversion/SPIRVToLLVM/SPIRVToLLVM.cpp
+23-22 files

FreeBSD/ports 0e3aa73 — www/redmine70 Makefile distinfo

www/redmine70: update to 7.0.3

Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
DeltaFile
+3-3www/redmine70/distinfo
+1-1www/redmine70/Makefile
+4-42 files

FreeBSD/ports 6cfdf12 — www/redmine61 Makefile distinfo

www/redmine61: update to 6.1.6

Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
DeltaFile
+3-3www/redmine61/distinfo
+1-1www/redmine61/Makefile
+4-42 files

FreeBSD/ports 0d80323 — www/redmine60 Makefile distinfo

www/redmine60: update to 6.0.12

Security release: fixes a ReDoS in wiki macro argument parsing, a
reflected XSS and open redirect via back_url, and two private data
leaks via the REST API.
DeltaFile
+3-3www/redmine60/distinfo
+1-1www/redmine60/Makefile
+4-42 files

LLVM/project f4009f1 — llvm/lib/CodeGen CodeGenPrepare.cpp

[CGP] Restrict GEP unmerge to canonical ptradd (#237292)

Only work on canonical constant ptradds. This makes the implementation
simpler and avoids the need to think about things like how the index
width and scale may affect wrapping behavior.

Motivated by https://github.com/llvm/llvm-project/issues/236397. (But
does not fix it. While that issue focuses on the scale for some reason,
the actual issue also exists without scaling.
DeltaFile
+15-33llvm/lib/CodeGen/CodeGenPrepare.cpp
+15-331 files

LLVM/project 99bbd2a — llvm/docs LangRef.md

Be more specific about sets containing data races.
DeltaFile
+3-3llvm/docs/LangRef.md
+3-31 files

NetBSD/pkgsrc cvpkAhv — doc CHANGES-2026

   Updated net/py-lexicon, textproc/py-unicode-segmentation-rs, devel/py-test-codspeed
VersionDeltaFile
1.7553+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc Ur30rJK — devel/py-test-codspeed Makefile distinfo

   py-test-codspeed: updated to 5.0.4

   5.0.4
   Support pytest 9.2: pytest --codspeed no longer crashes at session start when pytest-benchmark is installed
VersionDeltaFile
1.12+4-4devel/py-test-codspeed/distinfo
1.14+2-2devel/py-test-codspeed/Makefile
+6-62 files

NetBSD/pkgsrc POkoVhn — textproc/py-unicode-segmentation-rs cargo-depends.mk Makefile

   py-unicode-segmentation-rs: updated to 1.0.1

   1.0.1
   Dependency updates
VersionDeltaFile
1.3+7-7textproc/py-unicode-segmentation-rs/distinfo
1.3+2-2textproc/py-unicode-segmentation-rs/Makefile
1.3+1-1textproc/py-unicode-segmentation-rs/cargo-depends.mk
+10-103 files

NetBSD/pkgsrc H1LCoYZ — net/py-lexicon PLIST Makefile

   py-lexicon: updated to 3.26.0

   3.26.0

   Added

   Providers can restrict the record types they accept through VALID_TYPES;
   powerdns accepts any type
   The gransy provider has a REST API backend, used when --auth-token is set.
   zeep is only required for the SOAP backend
   The ovh provider supports OAuth2 service accounts with --auth-client-id and
   --auth-client-secret, and ovh-us is a valid --auth-entrypoint
   Support for Python 3.15 is added

   Modified

   The ovh provider now requires only a token scoped to the managed zone
   (/domain/zone/example.com/*) and strips the quotes the API adds around TXT
   content. Behavior change: TXT content is no longer returned quoted

    [30 lines not shown]
VersionDeltaFile
1.98+4-4net/py-lexicon/distinfo
1.106+3-3net/py-lexicon/Makefile
1.54+2-1net/py-lexicon/PLIST
+9-83 files

LLVM/project 87ed6c0 — llvm/lib/Target/PowerPC PPCISelLowering.cpp, llvm/test/CodeGen/PowerPC ld-splat-two-loads.ll

[PowerPC] No splat loads on multi-use through bitcast (#231147)

When lowering a vector shuffle of a load to a splatting load, we look
through bitcasts and scalar_to_vector on the input. We then check that
the input load has a single use. However, it is also important to check
that the bitcast/scalar_to_vector has a single use as a second use will
prevent the removal of the load. What's even worse than the performance
issue is that the old load will no longer be chained to what it was
chained to previously, allowing it to be moved across possible aliased
stores.

Fixes: https://github.com/llvm/llvm-project/issues/230422
DeltaFile
+20-0llvm/test/CodeGen/PowerPC/ld-splat-two-loads.ll
+14-5llvm/lib/Target/PowerPC/PPCISelLowering.cpp
+34-52 files

LLVM/project c7afb2b — mlir/lib/Conversion/SPIRVToLLVM SPIRVToLLVM.cpp, mlir/test/Conversion/SPIRVToLLVM cl-ops-to-llvm.mlir

[mlir][SPIR-V] Add SPIRVToLLVM conversion for CL.clz and CL.ctz (#237851)
DeltaFile
+23-0mlir/lib/Conversion/SPIRVToLLVM/SPIRVToLLVM.cpp
+9-0mlir/test/Conversion/SPIRVToLLVM/cl-ops-to-llvm.mlir
+32-02 files

LLVM/project e469a2d — llvm/lib/Transforms/Scalar GVN.cpp, llvm/test/Transforms/GVN bitextract-bitinsert.ll

[GVN] Fold equivalent `bitextract` and `bitinsert`
DeltaFile
+2-4llvm/test/Transforms/GVN/bitextract-bitinsert.ll
+2-0llvm/lib/Transforms/Scalar/GVN.cpp
+4-42 files

LLVM/project 0f9ccd4 — llvm/lib/Transforms/Scalar GVN.cpp, llvm/test/Transforms/GVN invariant.group.ll metadata.ll

[GVN] Preserve per-bit `poison` and provenance when forwarding a load
DeltaFile
+59-52llvm/test/Transforms/GVN/load-poison.ll
+102-1llvm/lib/Transforms/Scalar/GVN.cpp
+26-27llvm/test/Transforms/GVN/PRE/rle.ll
+7-7llvm/test/Transforms/GVN/rle-coerced-noalias.ll
+6-4llvm/test/Transforms/GVN/metadata.ll
+3-2llvm/test/Transforms/GVN/invariant.group.ll
+203-931 files not shown
+206-957 files

LLVM/project 6704199 — llvm/test/Transforms/GVN load-poison.ll

[GVN] Pre-commit tests for per-bit `poison` and provenance when forwarding a load
DeltaFile
+424-0llvm/test/Transforms/GVN/load-poison.ll
+424-01 files

LLVM/project 49e36ea — llvm/test/Transforms/GVN bitextract-bitinsert.ll

[GVN] Pre-commit tests for equivalent `bitextract` and `bitinsert`
DeltaFile
+104-0llvm/test/Transforms/GVN/bitextract-bitinsert.ll
+104-01 files

LLVM/project 37b8a72 — llvm/lib/Transforms/Utils VNCoercion.cpp, llvm/test/Transforms/GVN pr14166.ll ptr-vector-coercion.ll

[GVN] Keep `poison` per lane when forwarding vectors
DeltaFile
+48-63llvm/test/Transforms/GVN/pr63059.ll
+31-50llvm/test/Transforms/GVN/vector-poison.ll
+12-6llvm/lib/Transforms/Utils/VNCoercion.cpp
+4-9llvm/test/Transforms/GVN/ptr-vector-coercion.ll
+0-1llvm/test/Transforms/GVN/pr14166.ll
+95-1295 files

LLVM/project 1f820c5 — llvm/test/Transforms/GVN vector-poison.ll

[GVN] Pre-commit tests for per-lane `poison` in forwarded vectors
DeltaFile
+244-0llvm/test/Transforms/GVN/vector-poison.ll
+244-01 files

LLVM/project 9d2d3b6 — llvm/test/Transforms/InstCombine bitextract-of-vector.ll

[InstCombine] Pre-commit tests for `bitextract` of a vector
DeltaFile
+400-0llvm/test/Transforms/InstCombine/bitextract-of-vector.ll
+400-01 files

LLVM/project df80dc5 — llvm/lib/Transforms/InstCombine InstructionCombining.cpp InstCombineCasts.cpp, llvm/test/Transforms/InstCombine bitextract-of-vector.ll

[InstCombine] Fold `bitextract` of a vector to `extractelement` or `shufflevector`
DeltaFile
+187-99llvm/test/Transforms/InstCombine/bitextract-of-vector.ll
+56-0llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp
+53-0llvm/lib/Transforms/InstCombine/InstructionCombining.cpp
+296-993 files

NetBSD/pkgsrc v30tfLY — doc CHANGES-2026

   Updated net/libtorrent, net/rtorrent
VersionDeltaFile
1.7552+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc BYcIf4t — net/libtorrent PLIST Makefile, net/rtorrent Makefile distinfo

   libtorrent rtorrent: updated to 0.16.27

   0.16.27
   This release contains a few minor bug fixes and cleanup, and is part of a stable release series.
VersionDeltaFile
1.74+4-4net/rtorrent/distinfo
1.80+4-4net/libtorrent/distinfo
1.105+3-4net/libtorrent/Makefile
1.141+2-2net/rtorrent/Makefile
1.31+2-2net/libtorrent/PLIST
+15-165 files

LLVM/project 579ae30 — bolt/include/bolt/Core BinaryContext.h, bolt/lib/Core BinaryContext.cpp

[BOLT] Pass the context's MCTargetOptions to createMCAsmBackend (#236594)

## Summary 

Previously BOLT passed a temporary MCTargetOptions when creating the
MCAsmBackend. The backend outlives the statement that creates it, but
the temporary is destroyed at the end of that statement. If future code
reads the stored reference (RISC-V keeps it), the reference is dangling
and the behaviour is undefined.

The llvm/llvm-project#194200 change made MCAsmInfo hold a reference to a
function-local static MCTargetOptions in createBinaryContext, so the
options outlive MCAsmInfo.
* Use the context's existing long-lived MCTargetOptions at the
createMCAsmBackend call sites as well, so they outlive the MCAsmBackend.

Also remove a backend in DWARFRewriter.cpp that was created but never
used.


    [12 lines not shown]
DeltaFile
+4-3bolt/lib/Core/BinaryContext.cpp
+0-4bolt/lib/Rewrite/DWARFRewriter.cpp
+2-2bolt/lib/Passes/AsmDump.cpp
+1-2bolt/include/bolt/Core/BinaryContext.h
+7-114 files

NetBSD/pkgsrc guTzWTu — doc CHANGES-2026

   Updated emulators/libspectrum, emulators/fuse-emulator[-utils]
VersionDeltaFile
1.7551+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc SnpBSKL — emulators/fuse-emulator-utils Makefile distinfo

   fuse-emulator-utils: updated to 1.5.1

   1.5.1

   * audio2tape
     * Document PZX and CSW output support and format limitations
       (thanks, Sergio Baldoví) (Fredrick Meunier).

   * tapeconv
     * Document PZX and CSW output support and format limitations
       (thanks, Sergio Baldoví) (Fredrick Meunier).
     * Improve conversion error messages and warn when PZX output omits
       screen or inlay attachments (Fredrick Meunier).

   * tzxlist
     * Show TZX CSW recording details (bug 528) (thanks, AJ B)
       (Fredrick Meunier).
     * Read TZX metadata as UTF-8 from libspectrum when converting to
       the current locale's character encoding (Fredrick Meunier).

    [8 lines not shown]
VersionDeltaFile
1.18+4-4emulators/fuse-emulator-utils/distinfo
1.25+2-2emulators/fuse-emulator-utils/Makefile
+6-62 files

NetBSD/pkgsrc vNRw0yS — emulators/fuse-emulator Makefile distinfo, emulators/fuse-emulator/patches patch-sound_coreaudiosound.c

   fuse-emulator: updated to 1.10.1

   Fuse 1.10.1

   * New features:
     * Support writing PZX files (Fredrick Meunier).

   * Emulation core improvements:
     * Improve tape recording accuracy when tape traps are disabled,
       preserving the timing and polarity of recorded signals (Fredrick
       Meunier).
     * Correct tape playback timing on machines with CPU clocks other
       than 3.5 MHz, including the Spectrum 128K (Fredrick Meunier).
     * Support ROM tape traps for standard PZX data blocks (Fredrick
       Meunier).
     * Avoid mistaking keyboard scans for tape loader activity (thanks,
       Sergio Baldoví) (Fredrick Meunier).
     * Improve AY sound accuracy across video frame boundaries (Fredrick
       Meunier).

    [77 lines not shown]
VersionDeltaFile
1.24+4-5emulators/fuse-emulator/distinfo
1.77+2-2emulators/fuse-emulator/Makefile
1.2+1-1emulators/fuse-emulator/patches/patch-sound_coreaudiosound.c
+7-83 files

NetBSD/pkgsrc pPzcDJM — shells/xonsh Makefile

   xonsh: does not support Python > 3.13
VersionDeltaFile
1.13+3-2shells/xonsh/Makefile
+3-21 files

NetBSD/pkgsrc UsVtr71 — emulators/libspectrum Makefile distinfo

   libspectrum: updated to 1.8.0

   libspectrum 1.8.0

   * Add PZX tape writing, including conversion of legacy tape blocks,
     recordings, generalised data, bounded jumps and finite loops
     (Fredrick Meunier).

   * Support TZX CSW recording blocks and add tape sample-rate and CSW
     accessors (fixes bug 528) (Fredrick Meunier, thanks AJ B).

   * Replace libaudiofile with a portable PCM WAV reader, enabling WAV
     input in every build (Fredrick Meunier).

   * Standardise metadata APIs on UTF-8, converting legacy encodings
     with lossy substitution where necessary (Fredrick Meunier).

   * Improve waveform, timing and initial polarity preservation when
     converting between PZX, TZX and CSW tapes (Fredrick Meunier).

    [25 lines not shown]
VersionDeltaFile
1.33+4-4emulators/libspectrum/distinfo
1.69+2-2emulators/libspectrum/Makefile
+6-62 files

LLVM/project f29435b — flang/lib/Optimizer/Transforms LoopInvariantCodeMotion.cpp, flang/test/Transforms licm-modref-cache.fir

[flang] Cache in flang-licm which locations a loop may modify

Hoisting a load asks the alias analysis whether the loop may modify each
location the load reads, and the answer depends only on the loop and the
location. The loads of a loop read the same few locations over and over, so
flang-licm asked the same question many times: on a large OpenACC region 97%
of the queries of a run repeated an earlier one, and with alias analysis
implementations that are expensive to query the pass took minutes.

Cache the answers of a run, keyed by the loop and the location, in a small
LoopModifiesLocationCache that the pass owns. It is valid for the whole run
because the pass only hoists operations that have no effects or only read: it
never moves a write, so a location that is not modified in a loop does not
become modified in it. Only whether the location may be modified is used, as
before.

-debug-only=flang-licm-cache prints, for each run, how many queries were
answered from the cache and how many asked the alias analysis.
DeltaFile
+105-0flang/test/Transforms/licm-modref-cache.fir
+67-3flang/lib/Optimizer/Transforms/LoopInvariantCodeMotion.cpp
+172-32 files