ktls: Check the record type message holds its byte
sosend_generic() read the TLS record type past a TLS_SET_RECORD_TYPE
control message holding only a cmsghdr, and sent that stale byte.
Approved by: markj
Fixes: b2e60773c6b0 ("Add kernel-side support for in-kernel TLS.")
Sponsored by: Netflix
editors/openoffice-devel: upgrade to new snapshot
Upgrade to a newer snapshot of the upstream trunk branch.
Wiki Publisher no longer uses apache-commons-codec or the insecure
apache-commons-httpclient so unbreak and re-enable the WIKI_PUBLISHER_
option.
These patches have been upstreamed:
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_call.s
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_cpp2uno.cxx
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_share.hxx
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_uno2cpp.cxx
patch-jvmfwk_plugins_sunmajor_pluginlib_vendorbase.hxx
patch-set_soenv.in
patch-source__soenv.sh
Use bundled lucene instead of the lucene port and remove DEPRECATED.
MFH: 2026Q4
[LV] Generate SCEV runtime checks for outer loops. (#237780)
Update GenerateRTChecks::create to generate SCEV predicate checks for
outer loops as well. Memory checks are not supported yet, but we must
respect the SCEV predicates added to PSE.
build: take the NextBSD version from SystemVersion.plist (#612)
nextbsd-version, /etc/os-release and the image names now come from the
installed NextBSD-everything's /System/Library/CoreServices/SystemVersion.plist,
which nextbsd-pkg writes (nextbsd/nextbsd#536), instead of the image's
IMG_DATE:
- /bin/nextbsd-version reads the plist each time it runs and prints
"NextBSD 27.0.0 (<build>)", so it follows pkg upgrade.
- /etc/os-release gets NAME, VERSION, VERSION_ID, BUILD_ID and
PRETTY_NAME from the plist. nextbsd-fetch, the login banner, prints
PRETTY_NAME, so the banner shows "NextBSD 27.0.0 (<build>)". On an
installed system NextBSD-everything's Lua post-install script writes
the same lines on every upgrade, so os-release is not left at the
version the image was built with.
- The disk image, ISO and rpi5 image are named
NextBSD-<arch>-27.0.0-<build>. The workflow reads the stamp off the
file build.sh wrote, and the continuous release notes name the
version and build.
[7 lines not shown]
[LV] Add tests with trip counts known less than VF x UF. (#237777)
Add tests where trip counts are known to be less than VF x UF, but we
still pick a VF that exceeds the trip count.
py-zensical: update to 0.0.74.
This version adds support for the optimize plugin and includes
fixes for redirects, blog dates, validation settings, privacy
downloads, and llms.txt output.
libthr: Remove deadcode in join_common
The while loop previous can only be break when ret == ETIMEDOUT. They
never produce EBUSY. Remove the deadcode here.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60711
(cherry picked from commit a0e152973613e0d0d55257f4e1f614509b7ec4c9)
libthr: Fix LIBPTHREAD_QUEUE_FIFO range
LIBPTHREAD_QUEUE_FIFO is used in bitwise offset, we set the limit to
0~31 so that it won't cause undefined behavior. Also, create a new
helper function to do getenv++strtol directly and check the boundary of
the valid value.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60487
(cherry picked from commit 5fb07bbcd5d5d9a865d9e7765fb93e9ba5edef1c)
linux: cap mount id to INT_MAX
linux stores mount id as a int32_t, using xor would make it becomes
negative in some cases. As a result, we cap the value to INT_MAX to
prevent getting a negative value from userspace.
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D59202
(cherry picked from commit 23626eb9e3d61928358c9c813aa5a17e797ba404)
hyperv: Fix single page invalidation path
A single page invalidation sets addr2 == 0. In the original code, it
falsely flush the whole address in non global pmap. However, the
kernel pmap are all PG_G, which means a single page flush will always be
staled and thus become invalid. As a result, we set parameter based on
their op in a new helper function instead of relying on args. This
affects only on AMD platform as Intel has their PTI implementation.
PR: 291577
Tested by: franco at opnsense.org
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60380
(cherry picked from commit 5b1f1fd624352840cd9666447ff9cdebeaf910d4)
libthr: Fix some bugs in trylock
1. When contester > 2, a release causes kernel set CONTENTION bit but
with no owner. In this case, the userspace should be able to try the
lock instead of fall immediately. We copy this from trylock2.
2. A PI mutex should consult to kernel instead of decided by userspace
itself.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60427
(cherry picked from commit de2c0f157a9cce0b763da9ae97ada870fa4d1824)
devel/svn_load_dirs: deprecate, superseded by svn-vendor.py
Upstream itself documents tools/client-side/svn-vendor.py as the
replacement for svn_load_dirs.pl. devel/subversion no longer bundles
any of tools/client-side/ (dropped in the 1.15.0 rework), so there's
no FreeBSD port shipping the replacement either; anyone who needs it
fetches svn-vendor.py directly from a matching upstream release
tarball.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
libthr: Do not rely on UB in counter
counter + 1 > 0 is a undefined behavior and nobody guarantee that it
will be honestly perform by the compiler that counter + 1 will always be
INT_MIN. We switch to INT_MAX check instead to provide a deterministic
result.
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D60426
(cherry picked from commit 1d21e67e720a08992e81d626cff9d76524a81f22)
uchcom: Set rate to 1 if 0
If userspace provides rate == 0, it causes kernel panic as rate is
directly used as a divident, which cannot be zero. Fix it by set the
rate to 1 if it is passed as 0.
Reviewed by: imp, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59111
(cherry picked from commit 228b1a011660ee1005bc4ab7c97113af8d87fe5c)
py-websockets: update to 17.4.
Security fix
websockets 17.4 fixes a security issue.
:meth:`~asyncio.connection.Connection.recv` now rejects fragmented messages split into more than 4096 frames. You may adjust the limit with the :envvar:`WEBSOCKETS_MAX_FRAGMENTS` environment variable.
Earlier versions were vulnerable to denial of service by memory exhaustion because they didn't enforce such a limit (CVE ID pending). All implementations were affected.
:meth:`~asyncio.connection.Connection.recv_streaming` isn't affected.
Improvements
Chained consistently to :exc:`~exceptions.ConnectionClosed` exceptions that close the connection.
py-urwid: update to 5.0.1.
Urwid 5.0.0
2026-10-28
Breaking Changes ⚠
Drop Python 3.9 and 3.10: urwid requires Python 3.11 or newer by @penguinolog in https://github.com/urwid/urwid/pull/1401
Allow display attributes to inherit colors and settings: canvas content and Text.get_text() carry LayeredAttr for nested attributes, custom screens have to call BaseScreen.resolve_attr() instead of reading the palette, and an attribute an AttrMap maps to None shows the map’s None attribute by @penguinolog in https://github.com/urwid/urwid/pull/1409
🗹 AttrSpec foreground and background default to 'inherit'; also a new feature, see “Major features” below: Draw OSC 8 hyperlinks from display attributes by @penguinolog in https://github.com/urwid/urwid/pull/1415
Drop code planned for removal in 5.0: the Columns, Pile, GridFlow, Frame and ListBox get_focus/set_focus methods and 1.1-era list attributes, the Frame header/body/footer getters and setters, ListBox.contents() called as a method, content_delta, shards_delta, shard_cviews_delta, BaseScreen.run_wrapper, font.add_font, WidgetWrap._set_w, AttrWrap.w and Filler.body; MonitoredDeque.insert() with an index without __index__ raises TypeError by @penguinolog in https://github.com/urwid/urwid/pull/1402
⚡ Remove the vterm escape compatibility constants and plain-tuple CSI_COMMANDS entries, return WHSettings members from Pile.options() for 'given' and 'weight', and require typing_extensions on Python older than 3.13; also see “Deprecations” below: Unify deprecation warnings and removal versions by @penguinolog in https://github.com/urwid/urwid/pull/1421
Stop re-exporting unrelated names from urwid.graphics by @penguinolog in https://github.com/urwid/urwid/pull/1163
[237 lines not shown]
