FreeNAS/freenas 56424ffsrc/middlewared/middlewared/api/base/handler full_admin.py, src/middlewared/middlewared/pytest/unit/api test_api_structure.py

NAS-142160 / 27.0.0-BETA.1 / Restrict mutation of pass-through config fields to FULL_ADMIN (#19553)

Several public API fields pass caller-supplied text straight through to
a root command line or to a privileged daemon's configuration file,
handing the caller a capability the role guarding the endpoint was never
meant to grant. `rsynctask.extra` becomes rsync flags, where `-e` names
the program rsync spawns; `ssh.options` is interpolated verbatim into
`sshd_config`; `ups.shutdowncmd` is what upsmon runs as root. Two
shipped roles reach one of these with no custom privilege configured:
`REPLICATION_ADMIN` reaches `rsynctask.extra`, and `SHARING_ADMIN`
reaches `ftp.options`.

A new `FullAdmin[...]` marker on the API model restricts mutation of
such a field to callers holding `FULL_ADMIN`. Enforcement lives in
`CRUDService.create`, `CRUDService.update` and `ConfigService.update`,
which already receive `app`, so marking the field is all a plugin has to
do. `cloudsync.list_directory` and `cloudsync.sync_onetime` do not route
through those wrappers and call the helper themselves; a unit test fails
the build if a marked field is ever left with no enforcement path.

    [132 lines not shown]
DeltaFile
+336-0src/middlewared/middlewared/pytest/unit/api/base/test_full_admin.py
+163-0src/middlewared/middlewared/api/base/handler/full_admin.py
+115-0src/middlewared/middlewared/pytest/unit/api/test_api_structure.py
+112-0src/middlewared/middlewared/utils/privilege.py
+82-11tests/api2/test_account_privilege_role_forbidden_fields.py
+86-0src/middlewared/middlewared/pytest/unit/api/base/types/test_single_line_string.py
+894-1135 files not shown
+1,471-12141 files

LLVM/project 7a7cea9lld/ELF SymbolTable.h SymbolTable.cpp

[ELF] Version script: simplify wildcard matching. NFC (#223202)

Replace a loop over non-"*" wildcard patterns and another loop over "*"
with a single loop that calls the inlined
`SymbolTable::assignWildcardVersion`.
DeltaFile
+52-50lld/ELF/SymbolTable.cpp
+0-1lld/ELF/SymbolTable.h
+52-512 files

FreeBSD/ports 8ef1469www/ilias Makefile distinfo

www/ilias: Update to 11.4
DeltaFile
+3-3www/ilias/distinfo
+1-1www/ilias/Makefile
+4-42 files

FreeBSD/ports aa688b1databases/turso Makefile Makefile.crates

databases/turso: Update to 0.7.2
DeltaFile
+81-57databases/turso/distinfo
+39-27databases/turso/Makefile.crates
+3-2databases/turso/Makefile
+123-863 files

FreeBSD/ports 03e134bsecurity/vuxml/vuln 2026.xml

security/vuxml: document Gitlab vulnerabilities
DeltaFile
+63-0security/vuxml/vuln/2026.xml
+63-01 files

LLVM/project 745ff71llvm/lib/Target/RISCV RISCVInstrInfo.cpp RISCVISelLowering.cpp, llvm/lib/Target/RISCV/GISel RISCVInstructionSelector.cpp

[RISCV] Consistently use RISCVSubtarget::is64Bit() instead of isRV32/isRV64. (#223038)

99% of code uses RISCVSubtarget::is64Bit().

Maybe we should consider removing is64Bit(), and using isRV64() instead
but right now I think we should be consistent.
DeltaFile
+3-3llvm/lib/Target/RISCV/GISel/RISCVInstructionSelector.cpp
+1-2llvm/lib/Target/RISCV/RISCVTargetTransformInfo.cpp
+1-1llvm/lib/Target/RISCV/RISCVInstrInfo.cpp
+1-1llvm/lib/Target/RISCV/RISCVISelLowering.cpp
+6-74 files

FreeBSD/ports ce0437dgraphics/shaderc Makefile distinfo

graphics/shaderc: Update to 2026.4

Changelog: https://github.com/google/shaderc/blob/v2026.4/CHANGES

Reported by:    portscout
DeltaFile
+5-5graphics/shaderc/distinfo
+2-2graphics/shaderc/Makefile
+7-72 files

FreeBSD/ports ac8fe94deskutils/taskwarrior Makefile Makefile.crates, deskutils/taskwarrior/files patch-CMakeLists.txt patch-test_bash__tap__tw.sh

deskutils/taskwarrior: Update to 3.5.0
DeltaFile
+699-5deskutils/taskwarrior/distinfo
+348-0deskutils/taskwarrior/Makefile.crates
+35-11deskutils/taskwarrior/Makefile
+37-0deskutils/taskwarrior/files/patch-src_Task.cpp
+28-0deskutils/taskwarrior/files/patch-test_bash__tap__tw.sh
+0-21deskutils/taskwarrior/files/patch-CMakeLists.txt
+1,147-374 files not shown
+1,181-4410 files

FreeBSD/ports d07d9c0devel Makefile, devel/rust-cxxbridge pkg-descr Makefile.crates

devel/rust-cxxbridge: New port

cxxbridge generates the C++ side of the cxx bridge and is required
at build time by projects that use corrosion's
corrosion_add_cxxbridge() without network access.
DeltaFile
+45-0devel/rust-cxxbridge/distinfo
+29-0devel/rust-cxxbridge/Makefile
+22-0devel/rust-cxxbridge/Makefile.crates
+3-0devel/rust-cxxbridge/pkg-descr
+1-0devel/Makefile
+100-05 files

OpenBSD/src UdiKPHVsys/net pf_osfp.c

   gnezdo@ found another case of using ioctl string fields (in debug code),
   before validating that the strings are NUL terminated.  do those checks first.
VersionDeltaFile
1.50+11-11sys/net/pf_osfp.c
+11-111 files

FreeBSD/src 5fe1964tools/test/stress2/misc unionfs23.sh unionfs22.sh

stress2: add two new unionfs test scenarios

These exercise lookup traversal from tmpfs into unionfs, which is
useful because, unlike UFS, tmpfs does not allow recursion on its vnode
locks by default.

unionfs22.sh exercises these lookups with a normal unionfs mount, while
unionfs23.sh uses '-o below' for the unionfs mount and reproduces the
panic described in PR 298201.

Reviewed by:    kib, markj, pho
Tested by:      pho
Differential Revision:  https://reviews.freebsd.org/D59494
DeltaFile
+77-0tools/test/stress2/misc/unionfs23.sh
+77-0tools/test/stress2/misc/unionfs22.sh
+154-02 files

FreeBSD/src f57ce26sys/kern vfs_lookup.c

vfs_lookup_cross_mount(): fix missing LK_CANRECURSE

This was a rather dumb miss on my part in commit 42442d7a6e.
LK_CANRECURSE is clearly needed in any case in which the covered vnode
is held exclusive across the call to VFS_ROOT(), regardless of whether
it was initially held exclusive or upgraded.  The commit message for
that change also noted that unionfs lookup only worked without
LK_CANRECURSE due to a coincidence of the then-current unionfs
implementation.  As it happens, said coincidence was recently removed
in commit b952606b4f ("unionfs_lock(): eliminate LK_CANRECURSE special-
case").

PR:             298201
Reported by:    olivier
Fixes:          42442d7a6e "Generalize the VV_CROSSLOCK logic in
vfs_lookup"
Reviewed by:    kib, markj, pho
Tested by:      pho
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D59494
DeltaFile
+8-4sys/kern/vfs_lookup.c
+8-41 files

FreeBSD/ports 1fda1d9audio/py-soxr/files patch-pyproject.toml

audio/py-soxr: Fix build broken by nanobind upgrade to 3.x
DeltaFile
+11-2audio/py-soxr/files/patch-pyproject.toml
+11-21 files

FreeBSD/ports 91c91f0misc/py-mmsegmentation/files patch-setup.py

misc/py-mmsegmentation: remove tests directory that was installed
DeltaFile
+11-0misc/py-mmsegmentation/files/patch-setup.py
+11-01 files

FreeBSD/ports dd2ae0dmisc/nanocoder Makefile distinfo, misc/nanocoder/files package-lock.json

misc/nanocoder: update 1.29.0 → 1.30.0
DeltaFile
+966-77misc/nanocoder/pkg-plist
+187-133misc/nanocoder/files/package-lock.json
+3-3misc/nanocoder/distinfo
+1-1misc/nanocoder/Makefile
+1,157-2144 files

FreeBSD/ports aef124emultimedia/py-torchcodec distinfo Makefile, multimedia/py-torchcodec/files patch-pyproject.toml patch-src_torchcodec___core_CMakeLists.txt

multimedia/py-torchcodec: update 0.13.0 → 0.16.0

PR:     298409
DeltaFile
+38-0multimedia/py-torchcodec/files/FindWebP.cmake
+23-10multimedia/py-torchcodec/Makefile
+21-0multimedia/py-torchcodec/files/patch-src_torchcodec___core_CMakeLists.txt
+17-1multimedia/py-torchcodec/files/patch-pyproject.toml
+3-3multimedia/py-torchcodec/distinfo
+102-145 files

FreeBSD/ports daecb62misc/netron Makefile distinfo

misc/netron: update 9.1.9 → 9.2.8
DeltaFile
+3-3misc/netron/distinfo
+1-1misc/netron/Makefile
+4-42 files

FreeBSD/ports 09d8d15misc/py-pytorch Makefile, misc/py-pytorch/files patch-CMakeLists.txt patch-tools_metadata_dependencies.py

misc/py-pytorch: update 2.13.0 → 2.14.0

ChangeLog: https://github.com/pytorch/pytorch/releases/tag/v2.14.0

Also:
- Build changed to the scikit-build-core backend.
- files/example.py added for quick testing.
DeltaFile
+132-0misc/py-pytorch/files/example.py
+0-83misc/py-pytorch/files/patch-setup.py
+25-5misc/py-pytorch/Makefile
+6-17misc/py-pytorch/files/patch-pyproject.toml
+20-0misc/py-pytorch/files/patch-tools_metadata_dependencies.py
+7-7misc/py-pytorch/files/patch-CMakeLists.txt
+190-1128 files not shown
+219-14514 files

FreeBSD/ports c24fbeemisc/librepo Makefile distinfo, misc/librepo/files patch-librepo_CMakeLists.txt patch-librepo_librepo.pc.cmake

misc/librepo: update 1.20.0 → 1.21.1
DeltaFile
+3-3misc/librepo/files/patch-librepo_librepo.pc.cmake
+3-3misc/librepo/files/patch-CMakeLists.txt
+3-3misc/librepo/distinfo
+3-1misc/librepo/Makefile
+1-0misc/librepo/files/patch-librepo_CMakeLists.txt
+13-105 files

FreeBSD/ports 3737b27misc/py-faster-coco-eval distinfo Makefile

misc/py-faster-coco-eval: update 1.7.2 → 1.8.0
DeltaFile
+19-7misc/py-faster-coco-eval/Makefile
+3-3misc/py-faster-coco-eval/distinfo
+22-102 files

FreeBSD/ports 55a1c8bmisc/py-pymatreader distinfo Makefile

misc/py-pymatreader: update 1.2.3 → 1.3.1
DeltaFile
+7-6misc/py-pymatreader/Makefile
+3-3misc/py-pymatreader/distinfo
+10-92 files

FreeBSD/ports ed6cb49misc/py-csvw distinfo Makefile, misc/py-csvw/files patch-setup.cfg

misc/py-csvw: update 4.0.0 → 4.1.0
DeltaFile
+6-6misc/py-csvw/Makefile
+11-0misc/py-csvw/files/patch-setup.cfg
+3-3misc/py-csvw/distinfo
+20-93 files

FreeBSD/ports 6562761devel/py-cmeel Makefile distinfo

devel/py-cmeel: update 0.60.1 → 0.61.0
DeltaFile
+3-3devel/py-cmeel/distinfo
+1-2devel/py-cmeel/Makefile
+4-52 files

FreeBSD/ports d683b8fmultimedia/py-pysubs2 distinfo Makefile

multimedia/py-pysubs2: update 1.8.1 → 1.9.0
DeltaFile
+3-3multimedia/py-pysubs2/distinfo
+5-1multimedia/py-pysubs2/Makefile
+8-42 files

FreeBSD/ports d40a24cdevel/py-scooby distinfo Makefile

devel/py-scooby: update 0.11.2 → 0.12.0
DeltaFile
+5-3devel/py-scooby/Makefile
+3-3devel/py-scooby/distinfo
+8-62 files

FreeBSD/ports d7db5e7misc/py-ibm-watsonx-ai distinfo Makefile

misc/py-ibm-watsonx-ai: update 1.6.0 → 1.7.2
DeltaFile
+3-3misc/py-ibm-watsonx-ai/distinfo
+3-3misc/py-ibm-watsonx-ai/Makefile
+6-62 files

OpenBSD/ports LdhGtwqx11/xfce4/thunar Makefile distinfo

   x11/xfce4/thunar: update to 4.20.10
VersionDeltaFile
1.66+2-2x11/xfce4/thunar/distinfo
1.129+1-1x11/xfce4/thunar/Makefile
+3-32 files

LLVM/project 474b735llvm/tools/llc NewPMDriver.h NewPMDriver.cpp, llvm/tools/llc/lib NewPMDriver.h NewPMDriver.cpp

[llc] Move LLVMLlcDriver implementation into lib (#222840)

Addressing comment
[here](https://github.com/llvm/llvm-project/pull/221896#discussion_r3982250858)
DeltaFile
+0-906llvm/tools/llc/llcdriver.cpp
+906-0llvm/tools/llc/lib/llcdriver.cpp
+0-215llvm/tools/llc/NewPMDriver.cpp
+215-0llvm/tools/llc/lib/NewPMDriver.cpp
+0-50llvm/tools/llc/NewPMDriver.h
+50-0llvm/tools/llc/lib/NewPMDriver.h
+1,171-1,1714 files not shown
+1,188-1,18910 files

FreeBSD/src f616f8asys/dev/iwx if_iwx.c

iwx: fix kernel panic on module unload with assertions enabled

When interface is up and running 'kldunload if_iwx' stops the device and executes RUN -> INIT state transition.
Since the device is already stopped iwx_run_stop fails to stop the device again and returns non-zero exit code from iv_newstate callback which triggers 'INIT state change failed' assertion.

I reused IWX_FLAG_SHUTDOWN flag to:
a) set it in iwx_detach
b) check it in iwx_newstate_sub - when it is set all custom state transition logic is skipped

Accidentally found while experimenting with iwlwifi / iwx drivers

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D59624
DeltaFile
+4-0sys/dev/iwx/if_iwx.c
+4-01 files

LLVM/project 387c965lld/test/ELF dynamic-list-cpp.s version-script-reassign-glob.s

[ELF,test] Cover wildcard precedence in version scripts and dynamic lists (#223195)

version-script-wildcard-precedence.s, renamed from
version-script-reassign-glob.s, covers more cases.

dynamic-list-glob.s absorbs dynamic-list-cpp.s and adds an extern "C++"
wildcard, which had no --dynamic-list coverage.
DeltaFile
+89-0lld/test/ELF/version-script-wildcard-precedence.s
+27-9lld/test/ELF/dynamic-list-glob.s
+0-28lld/test/ELF/version-script-reassign-glob.s
+0-18lld/test/ELF/dynamic-list-cpp.s
+116-554 files