LLVM/project 81f6f8dclang/lib/ScalableStaticAnalysis/SourceTransformation/Transformations CppBoundedBuffers.cpp, clang/unittests/ScalableStaticAnalysis/SourceTransformation CppBoundedBuffersTest.cpp

fix

Created using spr 1.3.7
DeltaFile
+1,629-90llvm/test/CodeGen/AArch64/early-ifcvt-load-to-cond-br.mir
+672-0clang/unittests/ScalableStaticAnalysis/SourceTransformation/CppBoundedBuffersTest.cpp
+611-0clang/lib/ScalableStaticAnalysis/SourceTransformation/Transformations/CppBoundedBuffers.cpp
+46-333llvm/lib/Target/RISCV/RISCVExpandPseudoInsts.cpp
+359-0llvm/test/Transforms/SLPVectorizer/X86/interchangeable-cmp-predicates.ll
+163-175llvm/lib/Target/RISCV/RISCVExpandAtomicPseudoInsts.cpp
+3,480-598241 files not shown
+8,470-1,933247 files

LLVM/project 2fc1875clang/lib/ScalableStaticAnalysis/SourceTransformation/Transformations CppBoundedBuffers.cpp, clang/unittests/ScalableStaticAnalysis/SourceTransformation CppBoundedBuffersTest.cpp

[𝘀𝗽𝗿] changes introduced through rebase

Created using spr 1.3.7

[skip ci]
DeltaFile
+1,629-90llvm/test/CodeGen/AArch64/early-ifcvt-load-to-cond-br.mir
+672-0clang/unittests/ScalableStaticAnalysis/SourceTransformation/CppBoundedBuffersTest.cpp
+611-0clang/lib/ScalableStaticAnalysis/SourceTransformation/Transformations/CppBoundedBuffers.cpp
+46-333llvm/lib/Target/RISCV/RISCVExpandPseudoInsts.cpp
+359-0llvm/test/Transforms/SLPVectorizer/X86/interchangeable-cmp-predicates.ll
+163-175llvm/lib/Target/RISCV/RISCVExpandAtomicPseudoInsts.cpp
+3,480-598240 files not shown
+8,469-1,932246 files

HardenedBSD/src b2e36e4sys/dev/rtwn/usb rtwn_usb_attach.h, sys/x86/iommu amd_drv.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+194-0usr.sbin/bhyve/ipc.c
+102-36sys/x86/iommu/amd_drv.c
+7-124usr.sbin/bhyve/snapshot.c
+25-11usr.sbin/bhyvectl/bhyvectl.c
+9-8usr.sbin/bhyve/ipc.h
+10-5sys/dev/rtwn/usb/rtwn_usb_attach.h
+347-18420 files not shown
+388-20326 files

HardenedBSD/src a802c35sys/dev/rtwn/usb rtwn_usb_attach.h, sys/x86/iommu amd_drv.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+194-0usr.sbin/bhyve/ipc.c
+102-36sys/x86/iommu/amd_drv.c
+7-124usr.sbin/bhyve/snapshot.c
+25-11usr.sbin/bhyvectl/bhyvectl.c
+9-8usr.sbin/bhyve/ipc.h
+10-5sys/dev/rtwn/usb/rtwn_usb_attach.h
+347-18420 files not shown
+388-20326 files

HardenedBSD/ports 14ef681mail/pizauth Makefile.crates distinfo, mail/protonmail-bridge/files patch-pkg_keychain_helper__freebsd.go patch-pkg_keychain_helper__dbus__freebsd.go

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+399-273mail/pizauth/distinfo
+198-135mail/pizauth/Makefile.crates
+233-0mail/protonmail-bridge/files/patch-pkg_keychain_helper__dbus__freebsd.go
+130-0security/vuxml/vuln/2026.xml
+83-0mail/protonmail-bridge/files/patch-pkg_keychain_helper__freebsd.go
+33-43www/hs-postgrest/distinfo
+1,076-451160 files not shown
+2,061-989166 files

FreeBSD/ports 16465e4devel/jackson-module-jaxb-annotations Makefile distinfo

devel/jackson-module-jaxb-annotations: Update to 2.22.2

The covered releases touched other modules of jackson-modules-base
only, this one moves along to stay in step with the rest of the family.

Changes:        https://github.com/FasterXML/jackson-modules-base/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-module-jaxb-annotations/distinfo
+1-1devel/jackson-module-jaxb-annotations/Makefile
+4-42 files

HardenedBSD/ports 16465e4devel/jackson-module-jaxb-annotations Makefile distinfo

devel/jackson-module-jaxb-annotations: Update to 2.22.2

The covered releases touched other modules of jackson-modules-base
only, this one moves along to stay in step with the rest of the family.

Changes:        https://github.com/FasterXML/jackson-modules-base/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-module-jaxb-annotations/distinfo
+1-1devel/jackson-module-jaxb-annotations/Makefile
+4-42 files

HardenedBSD/ports b64fbd4devel/jackson-jaxrs-providers Makefile distinfo

devel/jackson-jaxrs-providers: Update to 2.22.2

JacksonJsonProvider now honors
DeserializationFeature.FAIL_ON_UNRESOLVED_OBJECT_IDS, otherwise only
packaging changes.

Changes:        https://github.com/FasterXML/jackson-jaxrs-providers/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+5-5devel/jackson-jaxrs-providers/distinfo
+1-1devel/jackson-jaxrs-providers/Makefile
+6-62 files

FreeBSD/ports 668d784security/dogtag-pki Makefile, security/dogtag-pki/files patch-base_tomcat-9.0_CMakeLists.txt

security/dogtag-pki: Fix incomplete javac classpath

base/tomcat-9.0 compiles against pki-common, whose classes carry
@JsonInclude, but does not list jackson-annotations, so javac cannot
resolve the annotation.  Every other subproject already lists the jar.

Sponsored by:   Netzkommune GmbH
DeltaFile
+10-0security/dogtag-pki/files/patch-base_tomcat-9.0_CMakeLists.txt
+1-0security/dogtag-pki/Makefile
+11-02 files

FreeBSD/ports b64fbd4devel/jackson-jaxrs-providers Makefile distinfo

devel/jackson-jaxrs-providers: Update to 2.22.2

JacksonJsonProvider now honors
DeserializationFeature.FAIL_ON_UNRESOLVED_OBJECT_IDS, otherwise only
packaging changes.

Changes:        https://github.com/FasterXML/jackson-jaxrs-providers/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+5-5devel/jackson-jaxrs-providers/distinfo
+1-1devel/jackson-jaxrs-providers/Makefile
+6-62 files

HardenedBSD/ports 668d784security/dogtag-pki Makefile, security/dogtag-pki/files patch-base_tomcat-9.0_CMakeLists.txt

security/dogtag-pki: Fix incomplete javac classpath

base/tomcat-9.0 compiles against pki-common, whose classes carry
@JsonInclude, but does not list jackson-annotations, so javac cannot
resolve the annotation.  Every other subproject already lists the jar.

Sponsored by:   Netzkommune GmbH
DeltaFile
+10-0security/dogtag-pki/files/patch-base_tomcat-9.0_CMakeLists.txt
+1-0security/dogtag-pki/Makefile
+11-02 files

FreeBSD/ports 90cd6e6devel/jackson-core Makefile distinfo

devel/jackson-core: Update to 2.22.2

Closes three ways around StreamReadConstraints, the limits that bound
what a single document may consume.  Further fixes concern surrogate
handling in UTF-8 and JsonPointer parsing.

Security:       CVE-2026-68498
Changes:        https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-core/distinfo
+1-1devel/jackson-core/Makefile
+4-42 files

FreeBSD/ports 20b6d89devel/jackson-databind Makefile distinfo

devel/jackson-databind: Update to 2.22.2

Closes twelve vulnerabilities: @JsonView and @JsonIgnore could be
by-passed in several ways, polymorphic type validation was incomplete,
and deserialization reached out to DNS and arbitrary URL schemes.

Security:       0cb401f9-9f19-11f1-a655-3497f65b111b
Changes:        https://github.com/FasterXML/jackson-databind/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-databind/distinfo
+1-1devel/jackson-databind/Makefile
+4-42 files

HardenedBSD/ports 90cd6e6devel/jackson-core Makefile distinfo

devel/jackson-core: Update to 2.22.2

Closes three ways around StreamReadConstraints, the limits that bound
what a single document may consume.  Further fixes concern surrogate
handling in UTF-8 and JsonPointer parsing.

Security:       CVE-2026-68498
Changes:        https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-core/distinfo
+1-1devel/jackson-core/Makefile
+4-42 files

HardenedBSD/ports 20b6d89devel/jackson-databind Makefile distinfo

devel/jackson-databind: Update to 2.22.2

Closes twelve vulnerabilities: @JsonView and @JsonIgnore could be
by-passed in several ways, polymorphic type validation was incomplete,
and deserialization reached out to DNS and arbitrary URL schemes.

Security:       0cb401f9-9f19-11f1-a655-3497f65b111b
Changes:        https://github.com/FasterXML/jackson-databind/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-databind/distinfo
+1-1devel/jackson-databind/Makefile
+4-42 files

FreeBSD/ports 220761esecurity/vuxml/vuln 2026.xml

security/vuxml: Document jackson vulnerabilities

jackson-databind before 2.22.2 by-passes @JsonView and @JsonIgnore in
several ways and validates polymorphic types incompletely, jackson-core
before 2.22.2 can be driven past StreamReadConstraints.

Security:       0cb401f9-9f19-11f1-a655-3497f65b111b
Security:       0cb42b4a-9f19-11f1-a655-3497f65b111b
Sponsored by:   Netzkommune GmbH
DeltaFile
+100-0security/vuxml/vuln/2026.xml
+100-01 files

HardenedBSD/ports 220761esecurity/vuxml/vuln 2026.xml

security/vuxml: Document jackson vulnerabilities

jackson-databind before 2.22.2 by-passes @JsonView and @JsonIgnore in
several ways and validates polymorphic types incompletely, jackson-core
before 2.22.2 can be driven past StreamReadConstraints.

Security:       0cb401f9-9f19-11f1-a655-3497f65b111b
Security:       0cb42b4a-9f19-11f1-a655-3497f65b111b
Sponsored by:   Netzkommune GmbH
DeltaFile
+100-0security/vuxml/vuln/2026.xml
+100-01 files

LLVM/project e124e31llvm/lib/Target/SPIRV SPIRVPassRegistry.def

[SPIRV] Alphabetize SPIRVPassRegistry Passes

To be consistent with other targets.

Reviewers: thurstond

Pull Request: https://github.com/llvm/llvm-project/pull/218199
DeltaFile
+2-2llvm/lib/Target/SPIRV/SPIRVPassRegistry.def
+2-21 files

FreeBSD/ports 6efd185devel/jackson-annotations Makefile distinfo

devel/jackson-annotations: Update to 2.22

Adds @JsonApplyView to switch the active JsonView on submodels,
@JsonSerializeAs and @JsonDeserializeAs, JsonTypeInfo.As.NOTHING, and
writeTypeIdForDefaultImpl to suppress the type id of default types.
@JsonIncludeProperties gained an order property, @JsonFormat a radix
property, and @JacksonInject an optional flag for values that need not
be present.

2.20 raised the baseline from Java 6 to Java 8 and started shipping
SBOMs.

Changes:        https://github.com/FasterXML/jackson-annotations/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-annotations/distinfo
+1-1devel/jackson-annotations/Makefile
+4-42 files

HardenedBSD/ports 6efd185devel/jackson-annotations Makefile distinfo

devel/jackson-annotations: Update to 2.22

Adds @JsonApplyView to switch the active JsonView on submodels,
@JsonSerializeAs and @JsonDeserializeAs, JsonTypeInfo.As.NOTHING, and
writeTypeIdForDefaultImpl to suppress the type id of default types.
@JsonIncludeProperties gained an order property, @JsonFormat a radix
property, and @JacksonInject an optional flag for values that need not
be present.

2.20 raised the baseline from Java 6 to Java 8 and started shipping
SBOMs.

Changes:        https://github.com/FasterXML/jackson-annotations/blob/2.x/release-notes/VERSION-2.x
Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/jackson-annotations/distinfo
+1-1devel/jackson-annotations/Makefile
+4-42 files

OpenZFS/src 84aa7e7lib/libspl/os/freebsd gethostid.c, man/man1 ztest.1

libspl: consult ZFS_HOSTID on FreeBSD as well

get_system_hostid() returns gethostid() on FreeBSD, so ZFS_HOSTID has
no effect there, while on Linux it overrides the SPL hostid.  zloop.sh
exports it for the iterations which need a hostid, and the ztest(1)
ENVIRONMENT VARIABLES section describes it without restricting it to
one platform, so both should read it.

Check ZFS_HOSTID first and fall back to gethostid(), parsing and
masking the value exactly as the Linux implementation does.  A value
which parses as zero is ignored there, so it is ignored here too.

Drop the "On Linux" qualifier from the -M description in ztest(1),
which this change makes untrue.

Suggested-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Michael Heller <michael.heller at gmail.com>
Closes #18918
Closes #18964
DeltaFile
+14-0lib/libspl/os/freebsd/gethostid.c
+1-1man/man1/ztest.1
+15-12 files

OpenZFS/src 9ceb410.github/workflows zloop.yml

CI: run zloop with multihost testing enabled

Pass -M so the zloop workflow exercises multihost on a fraction of
its iterations.

Drop the zgenhostid call added by eb5c93fa8.  It was there so ztest
could import a pool it had enabled multihost on, and zloop.sh now
supplies a hostid through ZFS_HOSTID for the iterations that need
one.

Suggested-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Michael Heller <michael.heller at gmail.com>
Closes #18918
Closes #18964
DeltaFile
+1-2.github/workflows/zloop.yml
+1-21 files

OpenZFS/src 867d321scripts zloop.sh

zloop.sh: add -M to run some iterations with multihost

Add an option to exercise multihost testing.  It is off by default,
so a local zloop run needs no hostid and behaves as before.

When it is given, one iteration in five passes -M to ztest.  Running
every iteration that way would cost the loop the dozen or so
operations ztest suppresses under -M, among them the zdb consistency
check.  Skipping that check also makes those iterations finish about
twice as quickly, so a time limited loop completes proportionally
more of them.  A raidz expansion iteration is left alone because
ztest forces -M off for one.

ztest needs a non-zero hostid to set the multihost property.  Export
ZFS_HOSTID for the iterations that use -M rather than creating
/etc/hostid: the ZTS mmp test group skips itself when that file
exists, so creating it would disable that group on the same machine.

Suggested-by: Brian Behlendorf <behlendorf1 at llnl.gov>

    [4 lines not shown]
DeltaFile
+28-2scripts/zloop.sh
+28-21 files

OpenZFS/src 79eb44ecmd ztest.c, man/man1 ztest.1

ztest: create the pool with multihost enabled under -M

The -M option advertised simulating a pool imported on a remote host,
but nothing under it enabled multihost.  The only writes to
spa_multihost were in ztest_mmp_enable_disable(), the function -M
disabled, so with that removed -M merely suppresses the operations
that conflict with multihost testing.

Add the multihost property to the pool ztest creates under -M.  The
property persists, so subsequent imports run the MMP activity check,
which is the point of the option.

Setting it requires a non-zero hostid, since spa_prop_validate()
returns ENOTSUP without one.  ztest creates its pool with VERIFY0(),
so -M on a host with no hostid would abort in ztest_init() rather
than explain itself.  Check the hostid while processing options and
exit with a message instead.

Suppress the MMP write-failure suspension for such a run.  ztest sets

    [18 lines not shown]
DeltaFile
+46-1cmd/ztest.c
+6-1man/man1/ztest.1
+52-22 files

OpenZFS/src 330e6fbtests/zfs-tests/tests/functional/zvol/zvol_misc zvol_misc_fua.ksh

ZTS: retry the zvol_misc_fua exports while the volume is busy

zvol_misc_fua exports and re-imports the pool for each of its two
blk-mq cases while the volume device exists, so an export can race with
the udev rule which opens it and fail with "pool is busy".
zvol_misc_trim has the same structure and already uses log_must_busy for
its exports.

Do the same here, so a transiently open device does not fail the test.

Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Michael Heller <75820586+mkhllr at users.noreply.github.com>
Closes #18970
DeltaFile
+2-2tests/zfs-tests/tests/functional/zvol/zvol_misc/zvol_misc_fua.ksh
+2-21 files

HardenedBSD/ports 903c15asecurity/vuxml/vuln 2026.xml

security/vuxml: Document multiple vulnerabilities in traefik
DeltaFile
+30-0security/vuxml/vuln/2026.xml
+30-01 files

FreeBSD/ports 903c15asecurity/vuxml/vuln 2026.xml

security/vuxml: Document multiple vulnerabilities in traefik
DeltaFile
+30-0security/vuxml/vuln/2026.xml
+30-01 files

OpenZFS/src 5bd7d44module/zfs dsl_scan.c

scan: count skipped blocks as examined

dsl_scan_scrub_cb() passes a block outside the scan's txg range to
count_block_skipped() and returns before scn_examined is touched, so
scn_skipped can exceed scn_examined and the resume in dsl_scan_init()
wraps: zpool status reports 16.0E issued. The deferred resilver check
in dsl_scan_sync() reads the same counter, and a wrapped value never
falls below zfs_resilver_defer_percent, so a resilver that should
restart early stays deferred.

Count those blocks as examined as well as skipped; they were traversed,
and the two counters have to cover the same blocks. scn_phys is on
disk, so keep clamping the resume for pools an older version skewed,
and clamp scn_to_examine - scn_skipped, which wraps the same way.

Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Nick Price <nprice at FreeBSD.org>
Closes #18928
DeltaFile
+13-5module/zfs/dsl_scan.c
+13-51 files

NetBSD/pkgsrc-wip edc17c5doggo Makefile go-modules.mk

Update net/doggo to v.1.3.0
DeltaFile
+81-75doggo/distinfo
+26-24doggo/go-modules.mk
+1-1doggo/Makefile
+108-1003 files

OpenZFS/src cf2a8cecmd/zstream zstream_selftest_queue.c zstream_recompress.c

zstream: remove the enqueue mutex

The current zstream code uses an enqueue mutex to avoid the possibility
of enqueue notifications being dropped.

Unfortunately, the enqueue mutex is highly contested. Workers must hold
it while searching queues for work, while enqueuers must acquire it to
complete their enqueues. This contention results in a nontrivial
performance cost.

This PR removes the enqueue mutex and replaces it with a separate
dispatch thread. It also adds a lazy 100 microseconds between an
enqueue and the signal that wakes up a thread to service it. This
coalescing of notifications encourages larger batch sizes and reduces
the number of worker loops.

Other changes:

- There's now a pool-level count of unclaimed items that's maintained

    [29 lines not shown]
DeltaFile
+366-193cmd/zstream/zstream_queue.c
+11-10cmd/zstream/zstream_queue.h
+3-7cmd/zstream/zstream_selftest.c
+2-2cmd/zstream/zstream_recompress.c
+2-2cmd/zstream/zstream.h
+1-1cmd/zstream/zstream_selftest_queue.c
+385-2156 files