[DAG] BuildVectorSDNode::getConstantRawBits - bail if src/dst scalar types don't alias perfectly (#237220)
We can add support in the future, but we need to get correct results first
Fixes #235665
graphics/R-cran-patchwork: New port: The Composer of Plots
patchwork expands the ggplot2 API to allow arbitrarily complex
composition of plots by providing mathematical operators for combining
multiple plots.
PR: 296816
Reviewed by: jrm
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D60942
security/vuxml: Document phpMyAdmin vulnerabilities
Seven issues in phpMyAdmin up to and including 5.2.3 were published on
2026-10-30, with VulnCheck as the assigning CNA. The worst of them is
an authentication bypass in the WebAuthn second factor, and the
request forgery in setup/validate.php needs no authentication at all.
There is no fixed release and no announcement from the project, so the
entry carries an open range for both ports.
Sponsored by: Netzkommune GmbH
[lldb][test] Allow LLDB_TEST_EXTRA_TSAN_OPTION (#237331)
Some platforms require additional ThreadSanitizer options. For example,
is macOS we need a workaround to make race conditions in some standard
library containers visible (as libc++ on our bot is not instrumented).
This patch adds LLDB_TEST_EXTRA_TSAN_OPTIONS which allows specifying
additional TSAN_OPTIONS that are appended to the standard TSAN_OPTIONS
used in the lldb tests.
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
[7 lines not shown]
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
[8 lines not shown]
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
(cherry picked from commit 9ed8b30188ce739e2fcae47fc2e516ead668a97c)
security/vuxml: Document MySQL vulnerabilities of October 2026
Four entries: 8.4 and 9.7, fixed in 8.4.13 and 9.7.4; 26.7, which is
end of life and has no fix, with an open range; and the connectors,
fixed in 26.10.0. mysql-shell is listed with 9.7, it bundles and
statically links the MySQL client code.
The two issues in the bundled curl and OpenSSL copies are left out,
these ports build against the libraries of the system.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
[5 lines not shown]
databases/mysql267-{server|client}: Deprecate and set an expiration date
MySQL 26.7 reached its end of life on 2026-10-20 with the release of
26.10. An Innovation release is maintained only until the next one
appears, so there will be no further 26.7 release.
79 of the 80 MySQL server issues of the Oracle Critical Patch Update
of October 2026 apply to 26.7, five of them only to 26.7, plus five in
the MySQL Router built from this port. None of them will be fixed.
Switch to databases/mysql2610-server. The expiration date is a week
out and not the usual months: the port entered the tree on 2026-10-12
and ships unfixed vulnerabilities.
Security: 24aaad94-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
[6 lines not shown]
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
databases/mysql2610-{server|client}: Add New Port
Welcome MySQL 26.10
MySQL 26.10 is the Innovation release following 26.7, which reached its
end of life with this release.
What is new in MySQL 26.10:
https://dev.mysql.com/doc/relnotes/mysql/26.10/en/news-26-10-0.html
Compared to mysql267:
- Drop seven LibreSSL guards, LibreSSL 4.4.0 has everything they
worked around
- Keep two: SSL_COMP_get_compression_methods() returns void * and
there is no SSL_COMP_get_id() or SSL_COMP_get0_name()
- Add traits to ut0prefix_cache.h and log0parsed_index_lru_cache.h,
libc++ has no character traits for a byte type
- Do not install the client-side authentication plug-ins
- Declare libfido2 and install the WebAuthn plug-in
[7 lines not shown]
[libc++] Added a benchmark for std::reduce with a trivial reduction operator (std::plus) (#236853)
This PR adds benchmarks for serial reductions with a trivial operator,
to specifically capture the cases where the compiler can do a good job
optimising the loop. This includes cases where the compiler can already
perform reordering without an explicit permission (e.g. with `int`s) and
where it requires an opt-int like `clang loop vectorize(enable)
interleave(enable)` (e.g. with `float`s, which libc++ currently doesn't
do).
Part of #234887.
devel/subversion{,-lts}: make apr_memcache opt-out explicit
configure otherwise silently autodetects a standalone apr_memcache installation
on the build host for fs_fs caching (server-side only FSFS repository caching);
this was never actually supported. Pass --without-apr_memcache explicitly
instead of leaving it to autodetection.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
[lldb] Test that unterminated DW_FORM_strp names are rejected (#237354)
c38a7054a1d8 bounded DataExtractor::PeekCStr and converted
DWARFFormValue::AsCString, but only tested the DataExtractor and Mach-O
paths. Add a DWARF test so AsCString can't regress to returning a
pointer into a .debug_str string with no terminator.
RuntimeLibcalls: Use explicit types for F80, F128 and PPCF128 libcalls (#235145)
LDbl only makes sense for encoding the long double libm functions. Other
functions have need of the specific type. Separately, LDbl brokenly
assumes
double instead of checking the module's long double format. Some
functions
are inappropriately using a specific type instead of LDbl. I'll fix both
of these issues separately.
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
[CodeGen] Use shared RegClassInfo in basic, greedy and fast allocators (#226523)
Make RegAllocBase use the MachineRegisterClassInfo analysis and publish
the
newly frozen set to it with updateReservedRegs. This reuses the set
computed by
freezeReservedRegs() instead of calling TRI->getReservedRegs() again, so
the
shared state becomes correct for everyone without an additional
reserved-set
computation.
No allocator should keep a private RegisterClassInfo after this.
A pass that changes the reserved set and is followed by an allocator no
longer
has to publish it by hand.
AI-assisted.
[SDAG] Improve bf16 converts with fast-math flags. (#231044)
This is a SDAG equivalent of #200741, where given NoNan flags we can
avoid creating for nan inputs.
