OPNSense/core ef530a4src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api DNatController.php

The return of the trailing comma
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/DNatController.php
+1-11 files

OPNSense/core 9e176c1src/opnsense/mvc/app/controllers/OPNsense/Base ApiMutableModelControllerBase.php, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes JsonAuditField.php

only allow serialization of JsonAuditField from persistent configuration
DeltaFile
+2-24src/opnsense/mvc/app/controllers/OPNsense/Base/ApiMutableModelControllerBase.php
+23-2src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/JsonAuditField.php
+25-262 files

FreeBSD/src 189ee41sys/arm64/arm64 vfp.c

arm64 vfp: eliminate nested critical sections

At two out of three call sites to vfp_restore_state_common(), the caller
must use critical_{enter,exit}() to prevent preemption between its call
to vfp_restore_state_common() and other actions, notably its call to
sve_enable().  So, it is arguably better to make
vfp_restore_state_common()'s caller responsible for performing
critical_{enter,exit}() and simply perform CRITICAL_ASSERT() inside
vfp_restore_state_common().

Reviewed by:    kib, markj
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D58859
DeltaFile
+3-4sys/arm64/arm64/vfp.c
+3-41 files

LLVM/project df50dc9llvm/include/llvm/ExecutionEngine/Orc EPCGenericJITLinkMemoryManager.h SimpleMemoryMapSPS.h, llvm/lib/ExecutionEngine/Orc SimpleMemoryMapSPS.cpp SimpleRemoteMemoryMapper.cpp

[ORC] Share memory-map bindings between their two clients (#216911)

SimpleMemoryMapBindings holds an executor-side memory manager's instance
address and a Proxy per operation: reserve, initialize, deinitialize,
release. EPCGenericJITLinkMemoryManager and SimpleRemoteMemoryMapper
both take one, so the operations are described once rather than per
client.

SimpleRemoteMemoryMapper previously held a SymbolAddrs struct and made
raw EPC.callSPSWrapperAsync calls. Going through proxies drops the
per-call serialization-error plumbing, since Proxy already folds that
into the result.

sps::createSimpleMemoryMapBindings resolves the bindings with a single
lookup, under the specs' default (SimpleNativeMemoryMap) names. The
specs move out of EPCGenericJITLinkMemoryManagerSPS.h alongside the
bindings, as they describe the interface rather than either client.

llvm-jitlink's simple-remote memory manager uses that instead of reading
the legacy SimpleExecutorMemoryManager* names out of the bootstrap
symbol map.
DeltaFile
+68-0llvm/include/llvm/ExecutionEngine/Orc/SimpleMemoryMap.h
+12-53llvm/lib/ExecutionEngine/Orc/SimpleRemoteMemoryMapper.cpp
+24-39llvm/include/llvm/ExecutionEngine/Orc/SimpleRemoteMemoryMapper.h
+57-0llvm/include/llvm/ExecutionEngine/Orc/SimpleMemoryMapSPS.h
+4-35llvm/include/llvm/ExecutionEngine/Orc/EPCGenericJITLinkMemoryManager.h
+37-0llvm/lib/ExecutionEngine/Orc/SimpleMemoryMapSPS.cpp
+202-1275 files not shown
+220-17711 files

LLVM/project 5d49857clang/docs ReleaseNotes.md, clang/lib/Lex PPDirectives.cpp

[clang][lex] Do not translate repeated include into import (#216704)

Using `ModuleToImport` when deciding whether to turn a repeated include
into an import, or whether to skip it, isn't right. We have
`ModuleToImport=true` even without `-fmodules` in textual compilations.
This PR starts checking `UsableClangHeaderModule`, matching what we do
for the first inclusion of that header.

rdar://184549117
DeltaFile
+31-0clang/test/Modules/non-modular-with-module-file.c
+2-1clang/lib/Lex/PPDirectives.cpp
+1-0clang/docs/ReleaseNotes.md
+34-13 files

FreeBSD/ports d5c96badeskutils/flameshot distinfo pkg-plist

deskutils/flameshot: Update to 14.0.0

- Switch from QT5 to QT6 libraries
- Download Color-Widgets component from GitLab, because we only have a
  QT5 version in the ports tree (x11-toolkits/color-widgets-qt5)
- Pet portclippy

PR:             297559
DeltaFile
+20-10deskutils/flameshot/Makefile
+9-0deskutils/flameshot/pkg-plist
+5-3deskutils/flameshot/distinfo
+34-133 files

OPNSense/core 644d58csrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api SourceNatController.php OneToOneController.php

Move a base set of ignored fields to FilterBaseController
DeltaFile
+14-3src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterBaseController.php
+5-7src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/DNatController.php
+2-8src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/SourceNatController.php
+2-8src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/OneToOneController.php
+2-8src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/NptController.php
+2-8src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+27-426 files

LLVM/project 6394197bolt/test/runtime setup-race.cpp

[BOLT] Fix test for systems where dl/pthread are not part of libc (#206944)

The bolt/test/runtime/setup-race.cpp test (including the original one)
crashes with a segfault on Ubuntu 20.04 (glibc 2.31) because the dlsym
symbol is not found.
According to the glibc 2.34 release notes, libpthread, libdl, libutil,
and libanl have been integrated into libc. For older glibc versions, it
is still necessary to link against libdl (for dlsym) and libpthread (for
pthread_* symbols).
DeltaFile
+1-1bolt/test/runtime/setup-race.cpp
+1-11 files

OPNSense/src 9838480sys/kern uipc_ktls.c kern_mbuf.c, sys/sys mbuf.h

ktls: Propagate EPG_FLAG_ANON to mapped mbufs

Otherwise ktls_mbuf_crypto_state() will reject mbufs created by
_mb_unmapped_to_ext(), which arises when transmitting packets through an
interface that doesn't support unmapped mbufs, and the loopback
interface in particular.

PR:             296498
Fixes:          3444414cb463 ("ktls: Don't attempt to modify non-anonymous mbufs on the receive path")
Reviewed by:    gallatin, jhb
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D57557

(cherry picked from commit 815976ee14121bafe8a8ab002459d32f8928f2de)
DeltaFile
+2-1sys/kern/uipc_ktls.c
+3-0sys/kern/kern_mbuf.c
+1-0sys/sys/mbuf.h
+6-13 files

LLVM/project 1503caallvm/include/llvm/CodeGen/GlobalISel MIPatternMatch.h, llvm/lib/Target/AArch64/GISel AArch64InstructionSelector.cpp

GlobalISel: Add m_PosZeroFP matcher and use it in AArch64 selector

Add an FP-constant predicate matcher m_PosZeroFP, mirroring the IR
PatternMatch helper, and use it in emitFPCompare instead of binding the
ConstantFP just to test for +0.0. NFC.

Co-authored-by: Claude (Opus 4.8) <noreply at anthropic.com>
DeltaFile
+17-0llvm/include/llvm/CodeGen/GlobalISel/MIPatternMatch.h
+2-4llvm/lib/Target/AArch64/GISel/AArch64InstructionSelector.cpp
+19-42 files

LLVM/project 7423100clang/lib/Interpreter IncrementalExecutor.cpp, clang/test/Interpreter emulated-tls.cpp

Reland "[ORC] Track __emutls_t definitions in IRMaterializationUnit" (#207161) (#209717)

Relands #207161 (the `IRMaterializationUnit::discard` fix for duplicated
`__emutls_t.<var>` symbols). History: #207161 merged, reverted in
#207775,
relanded in #208413, reverted again in #209260 (a day before the 23.x
cut).

### Why #208413 was reverted

clang-repl's JIT lowers `thread_local` to emulated TLS on every target
(`JITTargetMachineBuilder` forces `EmulatedTLS`), so JIT'd code always
references `__emutls_get_address`. #208413 only made that symbol
resolvable on
Darwin (`#ifdef __APPLE__` + `isOSBinFormatMachO()`), where it lives in
the
compiler-rt builtins static archive. The same gap exists on any host
that
links compiler-rt builtins instead of libgcc_s: the arm-toolchain CI hit

    [80 lines not shown]
DeltaFile
+50-0clang/lib/Interpreter/IncrementalExecutor.cpp
+28-0clang/test/Interpreter/emulated-tls.cpp
+1-0llvm/lib/ExecutionEngine/Orc/Layer.cpp
+79-03 files

LLVM/project ebd743cllvm/lib/Transforms/Vectorize VectorCombine.cpp, llvm/test/Transforms/VectorCombine load-insert-store.ll

[VectorCombine] Handle frees and synchronization in single element stores (#216562)

foldSingleElementStore only checked whether intervening instructions modified
the stored memory. Calls that may free or synchronize could therefore make
scalarization incorrect.

Fixes https://github.com/llvm/llvm-project/issues/216557
DeltaFile
+21-1llvm/test/Transforms/VectorCombine/load-insert-store.ll
+11-5llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+1-1llvm/test/Transforms/VectorCombine/SPIRV/load-insert-store.ll
+33-73 files

LLVM/project d37b02clibc/benchmarks/gpu CMakeLists.txt, libc/cmake/modules LLVMLibCTestRules.cmake

[libc] Drop .unit/.hermetic suffix from test support libraries (#216689)

This is not necessary now that we only build one kind of a test in a
given build configuration. This also makes it easier to convert to
something closer to how other libc libraries work.
DeltaFile
+33-53libc/test/UnitTest/CMakeLists.txt
+15-25libc/benchmarks/gpu/CMakeLists.txt
+9-23libc/cmake/modules/LLVMLibCTestRules.cmake
+1-7libc/test/src/time/CMakeLists.txt
+3-3libc/utils/MPFRWrapper/CMakeLists.txt
+2-2libc/utils/MPCWrapper/CMakeLists.txt
+63-1131 files not shown
+64-1147 files

FreeBSD/ports 3924da0devel/gitaly distinfo, net/gitlab-agent distinfo

www/gitlab: security update to 19.2.4

Changes:        https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/?nav=19.2.4
Security:       3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3
(cherry picked from commit d7ee3dbf7cdc4cb71516bf6d03c51595955d232a)
DeltaFile
+13-13devel/gitaly/distinfo
+6-6www/gitlab/distinfo
+5-5www/gitlab-workhorse/distinfo
+5-5www/gitlab-pages/distinfo
+5-5net/gitlab-agent/distinfo
+1-1www/gitlab/Makefile.common
+35-356 files

LLVM/project a28c028llvm/lib/TargetParser Host.cpp

[RISCV] Query sched_getaffinity before hwprobe for -mcpu=native (#216886)

Heterogenous CPUs like the SpacemiT K3 have a different marchid/mimpid
on different cores. The previous code asked for the common marchid/mimpid
amongst all CPUs. This will return -1 since they don't match across all
CPUs.

This patch uses sched_getaffinity to get the CPUs the compiler is
running on. If the process has been restricted to either the X100 or
A100 cores, this will allow us to get the marchid/mimpid for just those
cores.
DeltaFile
+17-13llvm/lib/TargetParser/Host.cpp
+17-131 files

FreeBSD/doc 2d4e1e6documentation/content/en/books/handbook/mirrors _index.adoc, shared mirrors.adoc

mirrors: ftp1.az.FreeBSD.org does not support FTP

HTTP and rsync only.

Reported by:    Orkhan Guliyev <orkhan at our.az>
DeltaFile
+1-1documentation/content/en/books/handbook/mirrors/_index.adoc
+0-1shared/mirrors.adoc
+1-22 files

LLVM/project 5ff04f6mlir/lib/Conversion/ComplexToStandard ComplexToStandard.cpp

[mlir][ComplexToStandard] fix typo in complex sine comment (NFC) (#216738)
DeltaFile
+1-1mlir/lib/Conversion/ComplexToStandard/ComplexToStandard.cpp
+1-11 files

HardenedBSD/src c303c5elib/libc/gen fts.3 fts.c, lib/libc/tests/gen fts_openat_test.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+250-0lib/libc/tests/gen/fts_openat_test.c
+28-70sys/dev/ufshci/ufshci_dev.c
+57-11lib/libc/gen/fts.c
+44-0sys/dev/ice/if_ice_iflib.c
+22-20sys/dev/ufshci/ufshci_req_sdb.c
+33-1lib/libc/gen/fts.3
+434-1029 files not shown
+485-12015 files

LLVM/project fd5d289llvm/lib/CodeGen MachineSink.cpp, llvm/test/CodeGen/X86 machinesink-coalesce-undef.mir

CodeGen: Fix machine sink critical edge crash on an undef register (#216870)
DeltaFile
+59-0llvm/test/CodeGen/X86/machinesink-coalesce-undef.mir
+1-2llvm/lib/CodeGen/MachineSink.cpp
+60-22 files

LLVM/project d5ff5c4llvm/lib/Target/RISCV RISCVVectorPeephole.cpp

RISCV: Fix using getVRegDef on a physical register (#216749)
DeltaFile
+2-0llvm/lib/Target/RISCV/RISCVVectorPeephole.cpp
+2-01 files

HardenedBSD/src 4404675lib/libc/gen fts.3 fts.c, lib/libc/tests/gen fts_openat_test.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+250-0lib/libc/tests/gen/fts_openat_test.c
+28-70sys/dev/ufshci/ufshci_dev.c
+57-11lib/libc/gen/fts.c
+44-0sys/dev/ice/if_ice_iflib.c
+22-20sys/dev/ufshci/ufshci_req_sdb.c
+33-1lib/libc/gen/fts.3
+434-1029 files not shown
+485-12015 files

HardenedBSD/src 29dea9acontrib/less search.c command.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+245-91contrib/less/decode.c
+213-114contrib/less/less.nro
+147-59contrib/less/regexp.c
+173-29contrib/less/optfunc.c
+132-54contrib/less/command.c
+83-55contrib/less/search.c
+993-40243 files not shown
+1,926-76649 files

HardenedBSD/ports 4dfd522devel/gitaly distinfo, graphics/opencv/files patch-modules_videoio_src_cap__v4l.cpp

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+31-0security/vuxml/vuln/2026.xml
+13-13devel/gitaly/distinfo
+13-2graphics/opencv/files/patch-modules_videoio_src_cap__v4l.cpp
+6-6www/gitlab/distinfo
+5-5www/gitlab-workhorse/distinfo
+5-5www/gitlab-pages/distinfo
+73-3116 files not shown
+128-6722 files

LLVM/project ca1719fclang/include/clang/Basic Specifiers.h, clang/lib/AST TypePrinter.cpp

[clang][SPIR-V] Remove CC_SpirFunction calling convention (#216252)

CC_SpirFunction is now redundant: CC_C already lowers to spir_func on
SPIR/SPIR-V targets, after
https://github.com/llvm/llvm-project/pull/210882
DeltaFile
+32-34clang/include/clang/Basic/Specifiers.h
+1-3clang/lib/Basic/Targets/SPIR.h
+0-3clang/lib/AST/TypePrinter.cpp
+0-2clang/lib/CodeGen/CGDebugInfo.cpp
+0-2clang/lib/CodeGen/CGCall.cpp
+1-1clang/lib/CodeGen/Targets/SPIR.cpp
+34-454 files not shown
+34-5010 files

FreeBSD/ports d7ee3dbdevel/gitaly distinfo, net/gitlab-agent distinfo

www/gitlab: security update to 19.2.4

Changes:        https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/?nav=19.2.4
Security:       3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3
DeltaFile
+13-13devel/gitaly/distinfo
+6-6www/gitlab/distinfo
+5-5www/gitlab-workhorse/distinfo
+5-5www/gitlab-pages/distinfo
+5-5net/gitlab-agent/distinfo
+1-1www/gitlab/Makefile.common
+35-356 files

HardenedBSD/ports d7ee3dbdevel/gitaly distinfo, net/gitlab-agent distinfo

www/gitlab: security update to 19.2.4

Changes:        https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/?nav=19.2.4
Security:       3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3
DeltaFile
+13-13devel/gitaly/distinfo
+6-6www/gitlab/distinfo
+5-5www/gitlab-workhorse/distinfo
+5-5www/gitlab-pages/distinfo
+5-5net/gitlab-agent/distinfo
+1-1www/gitlab/Makefile.common
+35-356 files

OPNSense/core 724e778src/opnsense/mvc/app/views/OPNsense/Diagnostics health.volt

reporting: adjust capitalization on health settings buttons #10724

The old delete functionality in the reporting settings was a bit more
prominent but it's nice to see it's still here.  Not sure about the
"show collected reports" since it doesn't imply you can delete the
inidividual reports from there.
DeltaFile
+2-2src/opnsense/mvc/app/views/OPNsense/Diagnostics/health.volt
+2-21 files

OPNSense/src 98f9e01sbin/ifconfig sfp.c ifstf.c

ifconfig: Add SPDX-License-Identifier tags

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55272

(cherry picked from commit d685228989020f7bceebdaf6ea79be09305d2954)
DeltaFile
+2-0sbin/ifconfig/sfp.c
+2-0sbin/ifconfig/ifstf.c
+2-0sbin/ifconfig/ifipsec.c
+6-03 files

OPNSense/src 326a32bsys/netipsec xform_ipcomp.c

netipsec/xform_ipcomp.c: fix sockaddr type set in ipcomp6_nonexp_encapcheck()

(cherry picked from commit 01d4e3c1d3ffa14041d8faa3a7a6e6509e73af84)
DeltaFile
+1-1sys/netipsec/xform_ipcomp.c
+1-11 files

OPNSense/src 2beca9asys/netipsec key.c

PF_KEY socket: limit the length of copied socket address

PR:     297264

(cherry picked from commit cba481a7bff2fcf31420ee8b2714660e2666452b)
DeltaFile
+69-59sys/netipsec/key.c
+69-591 files