OPNSense/core 09654casrc/opnsense/mvc/app/controllers/OPNsense/Diagnostics InterfaceController.php, src/opnsense/mvc/app/models/OPNsense/Diagnostics/ACL ACL.xml

ACL: some missing references and using camelcase pointers instead of snakecase [ref: https://github.com/opnsense/core/issues/10351]
DeltaFile
+6-6src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/InterfaceController.php
+3-0src/opnsense/mvc/app/models/OPNsense/Diagnostics/ACL/ACL.xml
+9-62 files

FreeBSD/ports ba8e3b5x11/antimicrox distinfo pkg-plist

x11/antimicrox: update 3.6.0 -> 3.6.1

Changelog: https://github.com/AntiMicroX/antimicrox/releases/tag/3.6.1
DeltaFile
+3-3x11/antimicrox/distinfo
+2-2x11/antimicrox/pkg-plist
+1-1x11/antimicrox/Makefile
+6-63 files

OpenBSD/ports LUV1MYyx11/xfce4/xfwm4 Makefile, x11/xfce4/xfwm4/patches patch-src_startup_notification_c

   xfwm4: use proper types in startup_notification.c, ok landry (maintainer)

   sn_startup_sequence_get_last_active_time() takes a time_t * and a suseconds_t *
VersionDeltaFile
1.4+10-12x11/xfce4/xfwm4/patches/patch-src_startup_notification_c
1.79+1-1x11/xfce4/xfwm4/Makefile
+11-132 files

NetBSD/pkgsrc x3vCJ2bdoc CHANGES-2026

   Updated net/py-impacket, devel/py-testfixtures
VersionDeltaFile
1.3265+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc ara0HcDdevel/py-testfixtures PLIST distinfo

   py-testfixtures: updated to 12.0.0

   12.0.0 (23 May 2026)

   .. warning:: Breaking changes:

     - Comparers have moved from :mod:`!testfixtures.comparison` to :mod:`testfixtures.comparers`.
     - :func:`!django_compare` has been removed, :func:`compare` now works with Django models.

   - Refactoring of :class:`LogCapture` to introduce support for :doc:`loguru <loguru>`,
     :doc:`structlog <structlog>` and similar support for :doc:`twisted <twisted>` by way of the new
     :class:`~testfixtures.logcapture.CaptureSource` architecture.

   - :func:`compare` now supports per-type ``ignore_eq``.

   - :func:`compare` now supports both :doc:`polars <polars>` and :doc:`pandas <pandas>` dataframes.

   - :func:`compare` now provides better feedback when objects being compared raised exceptipns in
     their :any:`str` or :any:`repr`.

    [3 lines not shown]
VersionDeltaFile
1.7+16-1devel/py-testfixtures/PLIST
1.6+4-4devel/py-testfixtures/distinfo
1.8+2-2devel/py-testfixtures/Makefile
+22-73 files

FreeBSD/ports 3b53751multimedia/jellyfin Makefile

multimedia/jellyfin: webpack is a memory hog on arm64

allow more heap for v8, to try to prevent an OOM on arm64 cluster
DeltaFile
+1-0multimedia/jellyfin/Makefile
+1-01 files

NetBSD/pkgsrc YE1puGpnet/py-impacket PLIST Makefile

   py-impacket: updated to 0.13.1

   Impacket v0.13.1 (May 2026):

   1. Library improvements

       * SMB: Improved server and relay behavior with SMB server signing support, optional read-only shares, Kerberos/NTLM authentication controls, graceful SMB relay packet handling, SMBv1 relay fixes, SMB 3.1.1 negotiation fixes, and clearer errors for truncated SMB responses.
       * Kerberos: Fixed S4U2Self service ticket parsing, non-ASCII authentication encoding, LSA Kerberos key decryption, GSSAPI BER length parsing, ccache/kirbi conversion edge cases, and PAC preservation/signing helpers used by ticket tooling.
       * MSSQL/TDS: Added TDS 8.0 support for Force Strict Encryption targets, EPA channel binding handling, TDS_SSVARIANT parsing, stricter TLS-backed packet handling, workstation/application name support, and more reliable SQL reply error tracking.
       * DCE/RPC and WMI: Added WMI PutClass/DeleteClass support, Remote Event Log subscription calls, Remote Desktop Services process parsing fixes, SCMR failure action marshaling fixes, and safer TCP transport handling on empty receives.
       * Directory and data parsing: Added LDAP CRUD helpers, improved LDAP attribute handling, fixed large-page ESE tag parsing for Windows Server 2025 NTDS.dit files, improved NTFS sparse and INDEX_ROOT reads, fixed DPAPI_BLOB parsing with oversized input, and corrected high-codepoint unicode structure sizing.
       * Added a reusable ACL helper module and expanded regression coverage for ACLs, NTFS, TDS, Kerberos, ESE, SCMR, WMI, SMB, and packet parsing.

   2. Examples improvements

       * [ntlmrelayx.py](examples/ntlmrelayx.py):
           * Added MSSQL and RDP relay servers, strict MSSQL relay support, TLS-backed TDS frame reassembly, NTLM sign/seal removal paths for CVE-2025-33073-related relay workflows, and `--remove-mic` handling.
           * Improved WinRM relay error handling and NTLMv2 detection, fixed WinRM NTLM relay behavior, made SMB relay negotiation more conservative by avoiding unsupported NEGOEX advertisement, and added multibyte AD CS template name support.
           * Added shadow credentials commands to the interactive LDAP shell and updated KeyCreds handling for the January 2026 Windows changes.

    [40 lines not shown]
VersionDeltaFile
1.13+21-7net/py-impacket/PLIST
1.17+14-11net/py-impacket/Makefile
1.11+4-4net/py-impacket/distinfo
+39-223 files

NetBSD/pkgsrc-wip 698fdbdrio PKGMESSAGE Makefile, rio/files README.NetBSD

rio: replace PKGMESSAGE with files/README.NetBSD

PKGMESSAGE is reserved for critical warnings; operational notes
belong in a README file installed under share/doc/<pkg>/.

- Remove PKGMESSAGE
- Add files/README.NetBSD with terminal-type, shell, and theme notes
- Install it to share/doc/rio/ via do-install
- Add share/doc/rio to INSTALLATION_DIRS and PLIST
DeltaFile
+0-34rio/PKGMESSAGE
+26-0rio/files/README.NetBSD
+4-1rio/Makefile
+1-0rio/PLIST
+31-354 files

FreeBSD/ports 796f109multimedia/jellyfin distinfo Makefile, multimedia/jellyfin/files/packagejsons package-lock.json package.json

multimedia/jellyfin: update to 10.11.10

Release notes:
- Fix GHSA-f47c-m7gr-q92j, GHSA-jg92-mrxq-vv75, GHSA-wwwm-px48-fpvq (security)
- Fix stale UserData cache
- Fix/user manager collation
- Fix XSS in listview (jellyfin-web)

(cherry picked from commit 88ee059d8dfde92a07114891f104892f4f1fe6ec)
DeltaFile
+9-9multimedia/jellyfin/distinfo
+2-2multimedia/jellyfin/files/packagejsons/package-lock.json
+1-1multimedia/jellyfin/Makefile
+1-1multimedia/jellyfin/files/packagejsons/package.json
+13-134 files

FreeBSD/ports 8ff6253multimedia/jellyfin distinfo pkg-plist, multimedia/jellyfin/files/packagejsons package-lock.json package.json

multimedia/jellyfin: update to 10.11.8

(cherry picked from commit fb5be169620dc37f850f5b44902ef101a376708f)
DeltaFile
+9-9multimedia/jellyfin/distinfo
+2-2multimedia/jellyfin/files/packagejsons/package-lock.json
+1-1multimedia/jellyfin/pkg-plist
+1-1multimedia/jellyfin/Makefile
+1-1multimedia/jellyfin/files/packagejsons/package.json
+14-145 files

NetBSD/pkgsrc QcXoqgFdoc CHANGES-2026

   Updated mail/py-checkdmarc, misc/py-pbs-installer
VersionDeltaFile
1.3264+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc bsaWfqhmisc/py-pbs-installer Makefile distinfo

   py-pbs-installer: updated to 2026.5.10

   2026.5.10
   Unknown changes
VersionDeltaFile
1.18+3-5misc/py-pbs-installer/Makefile
1.18+4-4misc/py-pbs-installer/distinfo
+7-92 files

NetBSD/pkgsrc 0U8RZakmail/py-checkdmarc distinfo Makefile

   py-checkdmarc: updated to 5.16.2

   5.16.2

   BIMI: forbidden x/y attributes on the root <svg> element are now actually rejected. get_svg_metadata was reading the wrong xmltodict keys, so the existing rejection in check_svg_requirements never fired on real SVGs. The metadata also lost the y value to a typo that clobbered metadata["x"].
   DNSSEC: narrowed three broad except Exception clauses to specific exception types (dns.exception.DNSException, OSError, EOFError) so programming errors propagate instead of being silently swallowed.

   5.16.1

   Simplify the warning emitted for pct/rf/ri to just "Support for the {tag} tag was removed in RFC 9989".

   5.16.0

   Rename DMARCbis references to RFC 9989
   In compliance with RFC 9989, treat a DMARC p tag as p=none, instead of requiring it
   Instead, a warning is raised that older versions of DMARC require it
   DMARC: the pct, rf, and ri tags are removed in RFC 9989. They are no longer implicitly added to parsed results, are no longer strictly validated (invalid values that previously raised now just warn), and explicit use emits a "removed in RFC 9989" warning. Pre-9989 readers may still honor them, so the value is left intact for those consumers.
   DMARC: unknown tags are now ignored with a warning instead of raising InvalidDMARCTag, per RFC 9989 ("Unknown tags MUST be ignored").
   DMARC: the order constraint that p must immediately follow v is now a warning rather than a hard syntax error. RFC 9989 permits any tag ordering after v; older RFC 7489 readers may still expect p second.

    [3 lines not shown]
VersionDeltaFile
1.30+4-4mail/py-checkdmarc/distinfo
1.32+2-3mail/py-checkdmarc/Makefile
+6-72 files

LLVM/project 0285f1cmlir/include/mlir/Support ThreadLocalCache.h, mlir/lib/Conversion/PDLToPDLInterp RootOrdering.cpp

[mlir] Don't assume non-erased DenseMap entries remain valid after erase. NFC (#199365)

Like the preceding llvm/ change, fix MLIR sites that reuse an iterator
or bucket reference after erasing from the same map, in preparation for
backward-shift DenseMap deletion which relocates surviving entries.

Use DenseMap::remove_if in ThreadLocalCache::clearExpiredEntries and the
RootOrdering cycle contraction (deferring the in-cycle graph erases
until
after iteration). ThreadLocalCache::get reads the value into a local and
bufferizeOp snapshots the worklist before folding, since those erases
re-enter via a rewriter listener.

Aided by Claude Opus 4.7
DeltaFile
+20-20mlir/lib/Conversion/PDLToPDLInterp/RootOrdering.cpp
+9-6mlir/include/mlir/Support/ThreadLocalCache.h
+8-2mlir/lib/Dialect/Bufferization/Transforms/Bufferize.cpp
+37-283 files

FreeBSD/ports bec8c52audio/ncspot distinfo Makefile.crates

audio/ncspot: update 1.3.3 -> 1.3.4

Changelog: https://github.com/hrkfdn/ncspot/releases/tag/v1.3.4
DeltaFile
+143-99audio/ncspot/distinfo
+70-48audio/ncspot/Makefile.crates
+1-2audio/ncspot/Makefile
+214-1493 files

FreeBSD/ports 399058bsecurity/vuxml/vuln 2026.xml

security/vuxml: document jellyfin < 10.11.10 vulnerabilities

Three security advisories fixed in jellyfin 10.11.10:
- GHSA-f47c-m7gr-q92j
- GHSA-jg92-mrxq-vv75
- GHSA-wwwm-px48-fpvq

References:
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jg92-mrxq-vv75
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq
https://github.com/jellyfin/jellyfin/releases/tag/v10.11.10
DeltaFile
+33-0security/vuxml/vuln/2026.xml
+33-01 files

FreeBSD/ports 88ee059multimedia/jellyfin distinfo Makefile, multimedia/jellyfin/files/packagejsons package-lock.json package.json

multimedia/jellyfin: update to 10.11.10

Release notes:
- Fix GHSA-f47c-m7gr-q92j, GHSA-jg92-mrxq-vv75, GHSA-wwwm-px48-fpvq (security)
- Fix stale UserData cache
- Fix/user manager collation
- Fix XSS in listview (jellyfin-web)
DeltaFile
+9-9multimedia/jellyfin/distinfo
+2-2multimedia/jellyfin/files/packagejsons/package-lock.json
+1-1multimedia/jellyfin/files/packagejsons/package.json
+1-1multimedia/jellyfin/Makefile
+13-134 files

NetBSD/src rEZNlmVsys/arch/aarch64/aarch64 pmap_machdep.c, sys/arch/aarch64/include pmap_machdep.h

   aarch64: mi pmap: save a PTE software bit when doing modify emulation.

   Use only OS_MODEMUL and release OS_MODIFIED. A mapping is deemed modified
   if it is marked RW and OS_MODEMUL which only ever happens via emulation.
VersionDeltaFile
1.17+12-13sys/arch/aarch64/include/pmap_machdep.h
1.17+6-9sys/arch/aarch64/aarch64/pmap_machdep.c
+18-222 files

pkgng/pkgng f9993a7external/fetch http.c, libpkg pkg_jobs_universe.c

fix: yet another batch at fixing leaks
DeltaFile
+4-0libpkg/pkg_jobs_universe.c
+1-1external/fetch/http.c
+5-12 files

NetBSD/src Jf3jk6esys/uvm/pmap pmap.c

   mi pmap: pmap_clear_attribute should check cached value of the attribute

   The pmap_clear_attribute implementation used by the MI pmap should
   check the cached valued of the attribute as well as any value held
   in the PTE(s).

   Some emulation implementations require this as some operations, e.g
   changing page mappings to RO, can lose PTE attribute information.
VersionDeltaFile
1.100+9-7sys/uvm/pmap/pmap.c
+9-71 files

NetBSD/src wzmalEGusr.bin/calendar/calendars calendar.christian calendar.judaic

   Update calendar entries for items happening in the first half of
   the year in the hopes that NetBSD 11.0 gets released around mid-year.
VersionDeltaFile
1.16+13-13usr.bin/calendar/calendars/calendar.christian
1.14+13-13usr.bin/calendar/calendars/calendar.judaic
1.37+11-11usr.bin/calendar/calendars/calendar.holiday
1.14+7-7usr.bin/calendar/calendars/calendar.usholiday
+44-444 files

OpenBSD/xenocara aKrhIa4. 3RDPARTY

   update
VersionDeltaFile
1.469+2-23RDPARTY
+2-21 files

NetBSD/pkgsrc MMRANL1doc CHANGES-2026

   Updated databases/py-sqlalchemy, www/py-soupsieve
VersionDeltaFile
1.3263+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc mphBLgrwww/py-soupsieve distinfo Makefile

   py-soupsieve: updated to 2.8.4

   2.8.4

   - **FIX**: Fix another inefficient attribute pattern
   - **FIX**: Limit total number of selectors processed in a pattern to prevent massive selector requests
VersionDeltaFile
1.23+4-4www/py-soupsieve/distinfo
1.23+2-2www/py-soupsieve/Makefile
+6-62 files

NetBSD/pkgsrc pDmtTa2databases/py-sqlalchemy distinfo Makefile

   py-sqlalchemy: updated to 2.0.50

   2.0.50

   orm

   [orm] [bug]

   Fixed issue where using joinedload() with PropComparator.of_type() targeting a joined-table subclass combined with PropComparator.and_() referencing a column on that subclass would generate invalid SQL, where the subclass column was not adapted to the subquery alias. Pull request courtesy Joaquin Hui Gomez.

   [orm] [bug]

   Fixed issue where the presence of a SessionEvents.do_orm_execute() event hook would cause internal execution options such as yield_per and loader-specific state from the first orm_pre_session_exec pass to leak into the second pass, leading to errors when using relationship loaders such as selectinload() and immediateload(). The execution options passed to the second compilation pass are now based on the original options plus only the explicit updates made via ORMExecuteState.update_execution_options() within the event hook.

   [orm] [bug]

   Fixed issue where using with_polymorphic() on a leaf class (a subclass with no further descendants) or a non-inherited class would fail with an AttributeError when used in an ORM statement, due to configure_mappers() not being triggered implicitly. The fix ensures that AliasedInsp participates in the _post_inspect hook, triggering mapper configuration during ORM statement compilation.

   sql

    [34 lines not shown]
VersionDeltaFile
1.86+4-4databases/py-sqlalchemy/distinfo
1.99+2-2databases/py-sqlalchemy/Makefile
+6-62 files

FreeBSD/ports 73e8dc3polish/libreoffice distinfo, portuguese/libreoffice distinfo

editors/libreoffice: update to 26.2.3 release (+)

LibreOffice 26.2.3 is the third bugfix release of the latest line.

Release notes:  https://wiki.documentfoundation.org/ReleaseNotes/26.2
Changelog:      https://wiki.documentfoundation.org/Releases/26.2.3/RC1 \
                https://wiki.documentfoundation.org/Releases/26.2.3/RC2
DeltaFile
+5-5vietnamese/libreoffice/distinfo
+5-5ukrainian/libreoffice/distinfo
+5-5russian/libreoffice/distinfo
+5-5portuguese/libreoffice/distinfo
+5-5portuguese/libreoffice-pt_BR/distinfo
+5-5polish/libreoffice/distinfo
+30-30116 files not shown
+501-496122 files

FreeBSD/src 7ba9229sbin/ipfw ipv6.c ipfw2.c, sbin/ipfw/tests test_add_rule.py

ipfw: treat ipv6 address with zero mask as 'any'

Make the behaviour similar for both IPv4 and IPv6. Also add
the corresponding tests.

PR:             294733
Differential Revision:  https://reviews.freebsd.org/D56618

(cherry picked from commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1)
DeltaFile
+24-0sbin/ipfw/tests/test_add_rule.py
+7-4sbin/ipfw/ipv6.c
+4-3sbin/ipfw/ipfw2.c
+2-0tests/atf_python/sys/netpfil/ipfw/insns.py
+37-74 files

FreeBSD/src 9acea8asbin/ipfw ipv6.c ipfw2.c, sbin/ipfw/tests test_add_rule.py

ipfw: treat ipv6 address with zero mask as 'any'

Make the behaviour similar for both IPv4 and IPv6. Also add
the corresponding tests.

PR:             294733
Differential Revision:  https://reviews.freebsd.org/D56618

(cherry picked from commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1)
DeltaFile
+24-0sbin/ipfw/tests/test_add_rule.py
+7-4sbin/ipfw/ipv6.c
+4-3sbin/ipfw/ipfw2.c
+2-0tests/atf_python/sys/netpfil/ipfw/insns.py
+37-74 files

FreeBSD/ports 5a7df29editors/libreoffice Makefile

editors/libreoffice: remove flex from dependencies

PR:             293142
DeltaFile
+1-3editors/libreoffice/Makefile
+1-31 files

NetBSD/pkgsrc 919l6tXfilesystems/fuse-httpdirfs Makefile

   fuse-httpdirfs: fix download
VersionDeltaFile
1.3+2-1filesystems/fuse-httpdirfs/Makefile
+2-11 files