[SandboxVec] Rename BottomUpVec to BundleVec (#213197)
Use `bundle-vec(bottom-up)` or `bundle-vec(top-down)` to run the
bottom-up or top-down bundle vectorizer, respectively. For example:
```
opt -passes=sandbox-vectorizer \
-sbvec-collect-seeds=loads \
-sbvec-passes="seed-collection<tr-save,bundle-vec(top-down),tr-accept>" \
input.ll -S -o out.ll
opt -passes=sandbox-vectorizer \
-sbvec-collect-seeds=stores \
-sbvec-passes="seed-collection<tr-save,bundle-vec(bottom-up),tr-accept>" \
input.ll -S -o out.ll
```
This commit is NFC, except the BundleVec requiring the user to specify
the direction upon invocation.
[CIR] Attach FenvAttr when strictfp mode is in effect (#213368)
This change adds tracking of floating-point constraints via the
CIRGenFPOptionsRAII object, deriving the state from the FP features in
effect tracking in the Clang AST. When we are about to generate an
operation that may require floating point constraints, a
CIRGenFPOptionsRAII object is used to get the effective floating-point
state from the expression for which we are generating the operations.
This object in turn sets the floating-point state of the CIRGenBuilder
which uses these settings to determine whether a cir::FenvAttr should be
attached to generated objects and, if so, what its state should be.
This does not cover complex operations, AArch64 builtins, or global
constructors. Those will be updated in follow-up changes.
Assisted-by: Cursor / various models
x11-fonts/nerd-fonts: Update to 3.5.0
Upstream renamed the D2Coding font to D2Koding due to license reasons.
Consequently, the x11-fonts/nerd-fonts-d2coding subport has moved to
x11-fonts/nerd-fonts-d2koding accompanied by an entry in the MOVED file.
Added subports:
- x11-fonts/nerd-fonts-annotationmono
- x11-fonts/nerd-fonts-googlesanscode
Changed licenses:
- x11-fonts/nerd-fonts-agave (MIT -> OFL11)
- x11-fonts/nerd-fonts-arimo (APACHE20 -> OFL11)
- x11-fonts/nerd-fonts-cousine (APACHE20 -> OFL11)
Changelog:
https://github.com/ryanoasis/nerd-fonts/releases/tag/v3.5.0
PR: 297246
[2 lines not shown]
[OpenMP] Remove Wasm limitation from openmp/runtime/cmake/config-ix.cmake (#213742)
This was originally added #71297, but this limitation no longer applies
to emscripten, and wasi-sdk will surly support this once threading is
ready there.
libssh: update to 0.12.1.
version 0.12.1 (released 2026-07-21)
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
* CVE-2026-59843: Denial of service via zero advertised channel packet size
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Allow hybrid ML-KEM key exchange in FIPS mode
[53 lines not shown]
mame: update to 0.289.
After two long months, MAME 0.289 is ready, and it’s an undeniably
massive update! But before we talk about emulation, there are a
few more mundane things to mention. The sdljoy joystick input module
now supports game controllers with up to 128 buttons. Finally,
outputs have been overhauled, improving performance and fixing
issues, but you may need to update your configuration if you’ve
got external programs hooked up, and some artwork files may need
updating.
You’ll notice a number of systems and coprocessor cards based around
NS32000 family CPUs are now working. If you aren’t familiar with
it, the NS32000 architecture was one of the first single-chip CPU
families with a 32-bit ALU. It used a highly orthogonal instruction
set with clear influences from Digital Equipment Corporation’s
earlier work. In retrospect, it didn’t have enough registers, the
instruction encoding was too complex, it took them too long to
overtake Motorola’s 68k family’s performance, and bugs in the
[31 lines not shown]
Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux
Pull fsverity fix from Eric Biggers:
"Fix a regression where truncating a file with fsverity enabled started
being allowed on kernels without fsverity support"
* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux:
fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux
Pull fscrypt fix from Eric Biggers:
"Fix a bug where FS_IOC_SET_ENCRYPTION_POLICY checked the original uid
rather than the idmapped one"
* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux:
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
[clang][CUDA] Add support for CUDA 13.3, CUDA 13.4, and sm_107 (Rubin) (#211677)
Clang counterpart to the changes in #210646
- add Clang support for CUDA versions 13.3 and 13.4 (with PTX 9.3 and PTX 9.4)
- add support for targeting sm_107 / sm_107a / sm_107f (Rubin) GPU architecture.
NAS-142011 / 27.0.0-BETA.1 / `Private` API parameters (#19456)
API parameters annotated with `Private[...]` will be excluded from API
doc, and passing them via an API call will be an error.
[clang] Don't warn on stack_protector_ignore in system macros (#213167)
Under -fstack-protector-all, stack_protector_ignore on a local is inert.
The warning is therefore accurate, and it stays useful in user code --
an opt-out that silently does nothing is worth knowing about.
The warning is not actionable when the attribute comes from a system
header macro and so this change disables it in system macros. Behavior
is otherwise unchanged. The attribute was already being ignored, so
suppressing the diagnostic hides nothing.
Also extend stack-protector-metadata.ll to cover the remaining
protection levels: test3/test4 for sspreq, where the opt-out metadata is
ignored, and test5/test6 for sspstrong, where it is honored. Only ssp
was covered before.
rdar://173529401
NAS-142040 / 26.0.0-RC.1 / Add recursive option to container delete (by Qubad786) (#19470)
## Problem
A container whose dataset has dependents could not be deleted at all,
and the attempt was not free: the libvirt domain was torn down before
ZFS refused the destroy, killing a running container and discarding a
suspended one's state for a delete that was never going to succeed.
## Solution
Validate the dataset up front, before any libvirt state is touched, so a
delete that cannot succeed is refused cleanly and the container is left
exactly as it was. Adds a `recursive` delete option that destroys the
dataset together with its dependents for callers who do want it gone.
Both refusals are now validation errors naming the option that lifts
them, which means deleting a running container without `force` returns a
validation error where it previously returned a call error.
CI: http://jenkins.eng.ixsystems.net:8080/job/tests/job/api_tests/9941/
[2 lines not shown]
fts: refactor to use fd-relative operations internally
Replace all _open() calls with _openat() in __fts_open(), fts_read(),
and fts_children(). Replace statfs() with _fstatfs().
Add fts_dirfd to struct _ftsent, set to the file descriptor of the
parent directory. Callers can use openat(ent->fts_dirfd, ent->fts_name,
...) to access files safely without relying on fts_accpath, which
enables programs in capability mode to open the files described by
_ftsent.
This is a preparatory change for fts_openat() which will allow callers
to provide a pre-opened directory fd, enabling fts(3) traversal inside
Capsicum capability mode.
Mirror all fts_open() changes to fts_open_b().
As a result of expanding _ftsend, publish new ELF symbol versions for
fts_openat and related functions.
[4 lines not shown]
[lldb][test] Pick correct frontend depending on test language (#212848)
Clang configuration files may contain frontend-specific options.
So building Objective C files with the clang++ may fail due to an option not being available for the C frontend.
Clean up the code slightly and pick the correct compiler based on the file extension.
NAS-142051 / 26.0.0-BETA.3 / Fix AttributeError in smb.set_system_sid from NAS-141946 backport (by anodos325) (#19474)
The backport of NAS-141946 (#19425) kept master's typed service accessor
(self.s.service) in smb_/sid.py, but the stable/26 ServiceContainer does
not register a `service` attribute. Every call that reached the winbindd
restart decision failed with "'ServiceContainer' object has no attribute
'service'", breaking all AD domain joins in directory services CI.
Convert both calls to the string API used elsewhere on stable/26 and
rewire the unit test mocks to match.
Original PR: https://github.com/truenas/middleware/pull/19473
Co-authored-by: Andrew Walker <andrew.walker at truenas.com>
