Firewall: NAT: Destination NAT - add proper support for container items in search field selection, export and import data, implement this in DNAT ui. closes https://github.com/opnsense/core/issues/10691
DAG: Use poison instead of undef in SimplifyDemandedVectorElts
I left getKnownUndefForVectorBinop since I'm not sure
if it's correct to just replace with poison.
DAG: Skip poison elements in BUILD_VECTOR computeKnownBits (#213326)
This defends against regressions in future patches. Copies the logic
from the IR version of computeKnownBits's handling of ConstantVector.
I'm not sure why the IR version doesn't directly return a value for
poison, but this follows suit.
Co-authored-by: Claude (Claude-Opus-4.8)
[clang][bytecode] Remove the !Caller case in Ret opcodes (#215226)
The bottom frame is always created via an `EvalEmitter`, which has its
own implementation of the `Ret` opcode. The exception is
`Context::Run`/`isPotentialConstantExpr`.
[GlobalISel] Fix vector.deinterleave2 with <1 x float> results (#214718)
`translateVectorDeinterleave2Intrinsic` used to try to build
`G_SHUFFLE_VECTOR`
with a scalar result type, which is not valid.
This was the case because the LLT that corresponds to the `<1 x float>`
IR type is a scalar type, not a vector type.
Add a special case for scalar result types to build
`G_EXTRACT_VECTOR_ELT` instead.
Fixes: #214713
www/caddy: Move model mount to OPNsense namespace (#5616)
* www/caddy: Move model mount to OPNsense namespace
* www/caddy: Bump plugin version to 2.2.0
ports-mgmt/pkg-devel: update to 2.8.99.1
Changes:
- security: bound vulnerability database downloads and decompression; build a temporary database and atomically replace it only after validation
- security: bound repository archive downloads and extraction (1 GiB or half of free temporary storage, 1 MiB metadata) and reject duplicate members and oversized target members
- security: bound repository signature extraction (8 MiB callback response, at most 8 signature entries of 1 MiB each)
- security: drop to nobody before entering Capsicum in the sandboxed archive and signature callbacks
- security: enforce the signed package size while fetching, capping the stream even when the server omits a Content-Length
- security: reject invalid repository signature types; only pubkey, fingerprints and none are accepted
- repo: keep file lists out of the data catalog
- repo: open the catalogue read-only when checking its validity
- rwhich: store the compressed filesite as a standalone file
- rwhich: verify the repository signature and store the filesite as a raw compressed file
- rwhich: add a global and a per-repository configuration
- fix: report (added)/(removed) reinstall reasons only once
- fix: use-after-free during the additional SAT cycle
- fix: deferred rc script execution
- rcscript: add a dedicated PKG_EVENT_RC_SCRIPT event for rc.d script actions
- fix: remove leftover nested @dir parents on deinstall
[6 lines not shown]
ports-mgmt/pkg: update to 2.8.2
Changes:
- lots of security improvements
- repo: keep file lists out of the data catalog
- rwhich: store filesite as a compressed archive locally.
- rwhich add global and per repository configuration of the file
database
- fix deferred rc script execution
- fix duplicated reinstall reason
- fix UAF in additional SAT cycle
- fix SRV/HTTP mirror handling
- respect compression level for file database and metadata
ports-mgmt/pkg: update to 2.8.2
Changes:
- lots of security improvements
- repo: keep file lists out of the data catalog
- rwhich: store filesite as a compressed archive locally.
- rwhich add global and per repository configuration of the file
database
- fix deferred rc script execution
- fix duplicated reinstall reason
- fix UAF in additional SAT cycle
- fix SRV/HTTP mirror handling
- respect compression level for file database and metadata
ports-mgmt/pkg-devel: update to 2.8.99.1
Changes:
- security: bound vulnerability database downloads and decompression; build a temporary database and atomically replace it only after validation
- security: bound repository archive downloads and extraction (1 GiB or half of free temporary storage, 1 MiB metadata) and reject duplicate members and oversized target members
- security: bound repository signature extraction (8 MiB callback response, at most 8 signature entries of 1 MiB each)
- security: drop to nobody before entering Capsicum in the sandboxed archive and signature callbacks
- security: enforce the signed package size while fetching, capping the stream even when the server omits a Content-Length
- security: reject invalid repository signature types; only pubkey, fingerprints and none are accepted
- repo: keep file lists out of the data catalog
- repo: open the catalogue read-only when checking its validity
- rwhich: store the compressed filesite as a standalone file
- rwhich: verify the repository signature and store the filesite as a raw compressed file
- rwhich: add a global and a per-repository configuration
- fix: report (added)/(removed) reinstall reasons only once
- fix: use-after-free during the additional SAT cycle
- fix: deferred rc script execution
- rcscript: add a dedicated PKG_EVENT_RC_SCRIPT event for rc.d script actions
- fix: remove leftover nested @dir parents on deinstall
[6 lines not shown]
[AArch64][GlobalISel] Avoid cross bank copies for NEON vcvtfp2fx results (#213277)
Currently, patterns to avoid cross bank copies for the intrinsic
vcvtfp2fx only work with SelectionDAG. This patch allows the DAG
patterns to work with GlobalISel.
SelectionDAG PR: #210275
Pullup ticket #7224 - requested by maya
lang/perl5: security fix
follow-up: remove 0-byte patches, these files were meant to be deleted in the
last commit.
py-pyvcd: updated to 0.4.2
pyvcd-0.4.2 (2026-08-09)
* fix: accept special characters in reader scope and variable names
* fix: take a variable's bit index from the final bracketed section of its
reference
* build: remove deprecated packaging metadata
* docs: official support for Python 3.14
* docs: cite IEEE 1800-2023 for the VCD specification
* docs: project moved back to the SanDisk-Open-Source organization
py-time-machine: updated to 3.3.1
3.3.1
Fix small rounding errors in destination calculations.
Previously, time-machine computed destinations in floating-point seconds, which could lead to small rounding errors: up to a few hundred nanoseconds for present-day destinations, growing to several microseconds by the year 2500. This change fixes the pipeline to use integer nanoseconds throughout, so time-travel is precise for any supported date.
3.3.0
Support Python 3.15.
Mock datetime.date.today() directly, for Python 3.15 support.
Previously time-machine was mocked only indirectly, since CPython implemented it by calling cls.fromtimestamp(time.time()). Python 3.15 added a fast path that reads the system clock directly (CPython Issue 130980), so time travel no longer affected it, which the new mock fixes. Consequently, there are new escape hatch functions: escape_hatch.datetime.date.today() and escape_hatch.datetime.datetime.today().
Support isolated subinterpreters, as created by concurrent.interpreters on Python 3.14+. Previously, importing time-machine in an isolated subinterpreter failed with an ImportError.
Move the intermediary functions that patched functions call from Python to C. This change reduces the overhead of calling patched functions like time.time() while time travelling, making them around 10-20% faster.
[19 lines not shown]
py-tablib: updated to 3.10.0
3.10.0
Security
Escape dataset title in HTML serialization
Added
Add support for Python 3.15
Use lazy imports on Python 3.15 to improve startup speed
Changed
Remove #yaml tag from generic error message URL
Drop support for Python 3.9
Fixed
[8 lines not shown]
py-pygit2: updated to 1.20.0
1.20.0 (2026-08-08)
- New `RemoteCallbacks.custom_headers()`
- New rebase API: `Repository.rebase_init(...)`, `Repository.rebase_open(...)`,
`Rebase`, and `RebaseOperation`
- Fix `Config.snapshot()` for non-repository configs, allow `PathLike` in
`Config.__init__()`, and improve config documentation
- Fix `UnicodeDecodeError` with non-UTF-8 file paths in `Repository.status()`,
`DiffFile.path`, index paths, checkout callbacks, and related APIs
- Fix `enums.CheckoutStrategy.CONFLICT_STYLE_ZDIFF3`, which was mistakenly
bound to the `DIFF3` constant
- Fix crashes and reference-lifetime bugs in custom refdb backends
- Update wheels to libgit2 1.9.6 and OpenSSL 3.5.7
- Add riscv64 wheels
