FreeBSD/ports c08043fsecurity/vuxml/vuln 2026.xml

security/vuxml: document Gitlab vulnerabilities
DeltaFile
+41-0security/vuxml/vuln/2026.xml
+41-01 files

OpenBSD/src DJ34HLfbin/ls print.c, usr.bin/find ls.c

   find,ls: Ensure -ls output matches ls -dils as documented; print the
   epoch if localtime() fails. Synchronize the code with ls, so it always
   checks localtime()'s return value.

   ok tb@
VersionDeltaFile
1.20+6-2usr.bin/find/ls.c
1.42+3-2bin/ls/print.c
+9-42 files

OpenBSD/src hw401Wausr.bin/stat stat.c

   stat: Show the stringified epoch if localtime() fails. Avoids segfault
   on out of range time values. The raw value can still be obtained with
   stat -f %m.

   ok tb@
VersionDeltaFile
1.26+8-2usr.bin/stat/stat.c
+8-21 files

LLVM/project a7831dcclang-tools-extra/clang-tidy/bugprone ImplicitWideningOfMultiplicationResultCheck.cpp, clang-tools-extra/docs ReleaseNotes.md

[Clang-Tidy] Improve `bugprone-implicit-widening-of-multiplication-result`. (#214501)

Implicit integer promotions make it a bit difficult to deduce the
correct type in the following expression:
```
std::uint64_t calc_array_size(std::uint16_t width, std::uint16_t height) {
    return width * height;
}
```

Originally, Clang-Tidy suggested to use the following code:
```
return static_cast<long long>(width) * height;
```

It is fully correct according to the C++ rules, but it makes it a bit
harder to reason for people. This change adds a more readable "FixIt"
taking into account the source type and avoid intermediate
representations.

Co-authored-by: Dmitrii Kuragin <dkuragin at adobe.com>
DeltaFile
+34-8clang-tools-extra/test/clang-tidy/checkers/bugprone/implicit-widening-of-multiplication-result-short.cpp
+13-5clang-tools-extra/clang-tidy/bugprone/ImplicitWideningOfMultiplicationResultCheck.cpp
+7-1clang-tools-extra/docs/ReleaseNotes.md
+54-143 files

LLVM/project b0d94cborc-rt/include/orc-rt/bedrock IntervalSet.h ExecutorAddress.h

[orc-rt] Fix relative paths in includes. NFC. (#219340)
DeltaFile
+2-2orc-rt/include/orc-rt/bedrock/BitmaskEnum.h
+1-1orc-rt/include/orc-rt/bedrock/IntervalSet.h
+1-1orc-rt/include/orc-rt/bedrock/ExecutorAddress.h
+1-1orc-rt/include/orc-rt/bedrock/Endian.h
+5-54 files

LLVM/project 58b67abclang/lib/Driver OffloadBundler.cpp

[clang][OffloadBundler] Fix uninitialized iterator in BinaryFileHandler (#219346)

This patch initializes NextBundleInfo at the top of ReadHeader to
prevent an uninitialized iterator comparison.

ReadHeader has several early return points where it exits without
reading any bundles.  Upon an early return, NextBundleInfo never reaches
the assignment at the bottom of ReadHeader:

  NextBundleInfo = BundlesInfo.begin();

leaving NextBundleInfo default-constructed.  A subsequent call to
ReadBundleStart then attempts an invalid iterator comparison:

  if (NextBundleInfo == BundlesInfo.end())

where NextBundleInfo is still default-constructed.

This bug was discovered with tightened epoch checks in

    [2 lines not shown]
DeltaFile
+3-1clang/lib/Driver/OffloadBundler.cpp
+3-11 files

NetBSD/pkgsrc OEwExagdoc CHANGES-2026

   doc: Updated meta-pkgs/xfce4 to 4.20.0nb19
VersionDeltaFile
1.5615+2-1doc/CHANGES-2026
+2-11 files

LLVM/project b0c1de2flang/lib/Parser parsing.cpp openmp-parsers.cpp, flang/lib/Semantics check-omp-structure.cpp

[flang][OpenMP] Support omx/ompx extension sentinels (#218475)

This adds support for the OpenMP 5.2 extension sentinels: !$omx, c$omx,
*$omx in fixed form and !$ompx in free form. Known directives after
these sentinels are handled just like !$omp, and unknown ones are
ignored with a warning so code using vendor extensions stays portable.
Added lit tests covering fixed form, free form, and the
ignore-with-warning behavior.

Assisted-by: Claude Opus 4.6

---------

Co-authored-by: Chandra Ghale <ghale at pe34genoa.hpc.amslabs.hpecorp.net>
Co-authored-by: Krzysztof Parzyszek <Krzysztof.Parzyszek at amd.com>
DeltaFile
+45-0flang/test/Parser/OpenMP/sentinel-omx.f
+39-4flang/lib/Parser/openmp-parsers.cpp
+43-0flang/test/Parser/OpenMP/sentinel-ompx.f90
+34-0flang/test/Parser/OpenMP/sentinel-extension-ignored.f90
+18-7flang/lib/Parser/parsing.cpp
+17-1flang/lib/Semantics/check-omp-structure.cpp
+196-125 files not shown
+232-1611 files

NetBSD/pkgsrc 7nlkisvdoc CHANGES-2026

   doc: Updated meta-pkgs/lxqt to 2.4.0nb2
VersionDeltaFile
1.5614+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc kCC5iCrmeta-pkgs/lxqt Makefile

   lxqt: bump for pcmanfm-qt 2.4.1
VersionDeltaFile
1.50+3-3meta-pkgs/lxqt/Makefile
+3-31 files

NetBSD/pkgsrc fN6oiLbdoc CHANGES-2026

   doc: Updated sysutils/pcmanfm-qt to 2.4.1
VersionDeltaFile
1.5613+2-1doc/CHANGES-2026
+2-11 files

OpenBSD/src TxSxNo5usr.sbin/fw_update fw_update.sh

   fw_update could be tricked into treating the untrusted comment as data.
   In some situations (-a) this could be passed into fetch(), which did not
   validate what it passed to su(1). Use the trusted output of signify and
   add stricter validation.

   with & ok afresh1@
VersionDeltaFile
1.68+15-9usr.sbin/fw_update/fw_update.sh
+15-91 files

NetBSD/pkgsrc O4jNe2qsysutils/pcmanfm-qt PLIST Makefile, sysutils/pcmanfm-qt/patches patch-CMakeLists.txt patch-pcmanfm_desktopwindow.cpp

   pcmanfm-qt: update to 2.4.1

   pkgsrc does not include the change "Set desktop screen explicitly on
   Wayland", since it requires a newer version of plasma6-layer-shell-qt
   than pkgsrc carries presently and Wayland isn't really supported yet.

   pcmanfm-qt-2.4.1 / 2026-08-26
   ==============================
    * Close tabs without close buttons by middle clicking with Qt >= 6.11.
    * Workaround for a bad behavior of wlroots.
    * Removed the redundant translations CMake file.
    * Set desktop file name.
    * Removed `<normaloff>` from ui files.
    * Updated fsf address.
VersionDeltaFile
1.1+24-0sysutils/pcmanfm-qt/patches/patch-pcmanfm_desktopwindow.cpp
1.1+16-0sysutils/pcmanfm-qt/patches/patch-CMakeLists.txt
1.21+6-4sysutils/pcmanfm-qt/distinfo
1.57+2-3sysutils/pcmanfm-qt/Makefile
1.14+2-1sysutils/pcmanfm-qt/PLIST
+50-85 files

NetBSD/pkgsrc kqxBoFjmultimedia/libmatroska Makefile

   multimedia/libmatroska: Use https for MASTER_SITES

   Via http MASTER_SITES, the tarball is not available.
VersionDeltaFile
1.55+2-2multimedia/libmatroska/Makefile
+2-21 files

LLVM/project e565c72flang/test/Lower/OpenMP metadirective-loop.f90

Improve metadirective loop tests
DeltaFile
+271-12flang/test/Lower/OpenMP/metadirective-loop.f90
+271-121 files

LLVM/project 06bfa42llvm/lib/Transforms/Scalar ScalarizeMaskedMemIntrin.cpp, llvm/utils profcheck-xfail.txt

[ScalarizeMaskedMemIntrin][ProfCheck] Correctly annotate branch weights (part 2) (#219286)

https://github.com/llvm/llvm-project/pull/218753 broke LLVM CI because
it added a new test in `ScalarizeMaskedMemIntrin` that was not opted out
of during profcheck. Profcheck failed because this pass creates new
branches that did not attach branch weight metadata. We don't have any
information on the distribution of masks at runtime, so we have to mark
branch weights as explicitly unknown.

This basically extends https://github.com/llvm/llvm-project/pull/181568,
Aiden am I missing something for why you didn't add the branch weight
metadata for all branch creation before?

Tested the `ScalarizeMaskedMemIntrin` tests with profcheck locally and
they all pass.
DeltaFile
+35-7llvm/lib/Transforms/Scalar/ScalarizeMaskedMemIntrin.cpp
+0-7llvm/utils/profcheck-xfail.txt
+35-142 files

LLVM/project 50d4fbcllvm/include/llvm/ADT FoldingSet.h, llvm/include/llvm/Analysis ScalarEvolution.h

[ADT] Remove unused IDHash parameter from Equals (NFC) (#219313)

This patch removes the unused IDHash parameter from several functions.
Now that FoldingSetTrait<SDVTListNode>::Equals no longer checks IDHash,
no implementation of Equals uses this parameter.

Assisted-by: Antigravity
DeltaFile
+8-12llvm/include/llvm/ADT/FoldingSet.h
+3-4llvm/lib/Support/FoldingSet.cpp
+2-2llvm/include/llvm/Analysis/ScalarEvolution.h
+1-1llvm/include/llvm/CodeGen/SelectionDAG.h
+14-194 files

NetBSD/pkgsrc-wip c06eeffovergrowth Makefile

overgrowth: CMake compat
DeltaFile
+1-0overgrowth/Makefile
+1-01 files

LLVM/project ce4f490llvm/lib/Transforms/Vectorize VPlanTransforms.cpp

Use make_pointer_range
DeltaFile
+1-2llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
+1-21 files

LLVM/project be0676allvm/test/Transforms/LoopVectorize/RISCV tail-folding-complex-mask.ll

Precommit test
DeltaFile
+163-0llvm/test/Transforms/LoopVectorize/RISCV/tail-folding-complex-mask.ll
+163-01 files

LLVM/project 3099e1cllvm/lib/Transforms/Vectorize LoopVectorizationPlanner.h VPlanTransforms.cpp, llvm/test/Transforms/LoopVectorize/RISCV tail-folding-complex-mask.ll

[VPlan] Append recipes created via builder to worklist

The previous PR appended the top most created recipe to the worklist, and this PR extends it to any other nested recipes that were created, similar to InstCombine.

This removes the header mask in a good few more places on RISC-V as measured on SPEC CPU 2017, e.g. for the following loop:

```c
long f(const int *p, const int *q, long n) {
  long a = 0, b = 0;
  for (long i = 0;; i++) {
    if (p[i] && q[i]) { a += i; b += i; }
    if (i + 1 == n) break;
  }
  return a + b;
}
```

Before:


    [49 lines not shown]
DeltaFile
+24-7llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
+11-4llvm/lib/Transforms/Vectorize/LoopVectorizationPlanner.h
+5-7llvm/test/Transforms/LoopVectorize/RISCV/tail-folding-complex-mask.ll
+40-183 files

LLVM/project b8bd749llvm/test/Transforms/LoopVectorize blend-i1.ll

Precommit test
DeltaFile
+58-0llvm/test/Transforms/LoopVectorize/blend-i1.ll
+58-01 files

LLVM/project fe1edc7llvm/lib/Transforms/Vectorize VPlanTransforms.cpp, llvm/test/Transforms/LoopVectorize blend-i1.ll dont-fold-tail-for-divisible-TC.ll

[VPlan] Process simplifyRecipes in a worklist

This brings simplifyRecipes further in line with InstCombine, and asides from unlocking more simplifications it also helps avoid spurious test churn whenever passes are moved around simplifyRecipes.

For now just push the new recipe onto the worklist, not its users.
This uses a post order traversal so we maintain the same simplification order as before.

I've gone through and checked every simplification we do is a canonicalisation that converges, and I checked on llvm-test-suite + SPEC CPU 2017 in various configurations that we don't hit any cycles.
DeltaFile
+23-14llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
+4-8llvm/test/Transforms/LoopVectorize/dont-fold-tail-for-divisible-TC.ll
+2-3llvm/test/Transforms/LoopVectorize/blend-i1.ll
+29-253 files

FreeBSD/ports 9e15a0dmisc/py-instructor Makefile distinfo

misc/py-instructor: Update to 1.16.0

Changelog: https://github.com/567-labs/instructor/blob/v1.16.0/CHANGELOG.md

Reported by:    Repology
DeltaFile
+3-3misc/py-instructor/distinfo
+3-2misc/py-instructor/Makefile
+6-52 files

OpenBSD/ports C1vwrChgames/lwjgl3 Makefile distinfo, games/lwjgl3/patches patch-config_openbsd_build_xml patch-config_build-bindings_xml

   Update to LWJGL 3.3.2.0

   Allows playing Minecraft up through 1.21.11
VersionDeltaFile
1.7+12-3games/lwjgl3/pkg/PLIST
1.5+4-4games/lwjgl3/distinfo
1.16+2-3games/lwjgl3/Makefile
1.2+0-0games/lwjgl3/patches/patch-config_openbsd_build_xml
1.2+0-0games/lwjgl3/patches/patch-config_build-bindings_xml
+18-105 files

LLVM/project 5eaa5caflang/lib/Lower ConvertConstant.cpp, flang/lib/Optimizer/CodeGen CodeGen.cpp

[flang] Speed up large CHARACTER DATA initializers (#218813)

[flang] Speed up large CHARACTER DATA initializers

Repeated CHARACTER(KIND=1) array constants were lowered as one
fir.insert_value per element. Converting those chains to LLVM IR is
quadratic and can make compilation take tens of minutes.

Lower consecutive equal KIND=1 character elements with
fir.insert_on_range
and emit full-range initializers as a single flattened [N x i8] LLVM
global
string, keeping Fortran blank padding.

A 160000-element character DATA statement now compiles in well under a
second and before was more than 10 minutes.
DeltaFile
+51-11flang/lib/Optimizer/CodeGen/CodeGen.cpp
+40-0flang/test/Lower/character-array-constant.f90
+20-13flang/lib/Lower/ConvertConstant.cpp
+111-243 files

FreeBSD/ports 845ec8ddevel/py-ty Makefile distinfo

devel/py-ty: Update to 0.0.75

Changelog: https://github.com/astral-sh/ty/blob/0.0.75/CHANGELOG.md

Reported by:    Repology
DeltaFile
+3-3devel/py-ty/distinfo
+1-1devel/py-ty/Makefile
+4-42 files

FreeBSD/src 3ccccd8sys/net iflib.c

iflib: Initialize the VFLR task unconditionally

The VFLR task was initialized only from drivers MSI-X interrupt
assignment paths.  ixl's legacy interrupt handler can nevertheless defer
VFLR work, leaving an uninitialized task.  Even with MSI-X, the admin
interrupt was established before the task was initialized.

Initialize it alongside the other private tasks.  The existing detach
check and private-taskqueue drains then cover its lifecycle for every
interrupt mode and registration failure.

Sponsored by:   BBOX.io

(cherry picked from commit b4208a67edc2eb7898a9ff2a6f3990c6852910e4)
DeltaFile
+1-1sys/net/iflib.c
+1-11 files

FreeBSD/src 375892cshare/man/man4 iflib.4, sys/net iflib.c

iflib: Add an admin task detach fail point

Add an exact-device fail point immediately after the admin task checks
IFC_IN_DETACH. This makes the detach race reproducible without affecting
another interface.

Use a bounded delay to keep the task active while detach enters the
taskqueue drain.  Mark the point nonsleepable as a safety backstop, and
document a one-shot test for verifying that deregistration drains an
already-running task before ether_ifdetach().

Reviewed by:    gallatin, kgalazka
Sponsored by:   BBOX.io
Differential Revision:  https://reviews.freebsd.org/D58720

(cherry picked from commit ac56d36007a5a1a01fe69df370f272060e852e0b)
DeltaFile
+19-0share/man/man4/iflib.4
+11-0sys/net/iflib.c
+30-02 files

FreeBSD/src 546e2c0sys/net iflib.c

iflib: Drain configuration tasks before interface detach

iflib_device_deregister() sets IFC_IN_DETACH before removing the
interface, but a task which already passed its detach check can still
report a link change.  This can re-arm if_linktask after
ether_ifdetach() has drained it and leave work pending across queue
teardown.

Drain the entire private taskqueue before ether_ifdetach().  Drivers
may register their own link-related configuration tasks there, so
draining only the framework admin task leaves the same race for those
drivers.

Differential Revision:  https://reviews.freebsd.org/D58452

Co-authored-by: Andrew Gallatin <gallatin at FreeBSD.org>
Co-authored-by: Kevin Bowling <kbowling at FreeBSD.org>
(cherry picked from commit ba353c8950d575f9d15b82c92658e660935fba25)
DeltaFile
+7-0sys/net/iflib.c
+7-01 files