spell HOST_NAME_MAX with some _POSIX_ vibes
On OpenBSD this is a complete no-op. no text changes.
On -portable though, this is going to help *a lot*. The ecosystem is
not really providing a sane HOST_NAME_MAX, and I don't see any reason
why this could improve anytime soon.
Discussed many times with different folks, I think the time has finally
come.
[SLP]Fix narrowing of alternate icmp with mismatched extensions
Extend the operands of alternate compares back to the original type
unless both predicates match the operand signedness, as done for
non-alternate compares.
Fixes #240119
Assisted-by: Cursor
Reviewers:
Pull Request: https://github.com/llvm/llvm-project/pull/240141
share/mk: Skip non-existent libraries in .depend for bootstrap/cross tools
Bootstrap and cross tools link against host libraries for target libraries
that the stage does not build into ${DESTDIR}. Skip those missing entries;
otherwise, make would compalin with "ignoring stale .depend", e.g.,
```
make[3]: /usr/obj/usr/src/btools_x86_64/usr/src/bin/chmod/.depend:26: ignoring stale .depend for /usr/obj/usr/src/btools_x86_64/usr/lib/libc.a
make[3]: /usr/obj/usr/src/btools_x86_64/usr/src/usr.bin/m4/.depend:293: ignoring stale .depend for /usr/obj/usr/src/btools_x86_64/usr/lib/libc.a
make[3]: /usr/obj/usr/src/btools_x86_64/usr/src/usr.bin/m4/.depend:293: ignoring stale .depend for /usr/obj/usr/src/btools_x86_64/usr/lib/liby.a
make[3]: /usr/obj/usr/src/btools_x86_64/usr/src/usr.bin/m4/.depend:293: ignoring stale .depend for /usr/obj/usr/src/btools_x86_64/usr/lib/libl.a
make[3]: /usr/obj/usr/src/btools_x86_64/usr/src/usr.bin/m4/.depend:293: ignoring stale .depend for /usr/obj/usr/src/btools_x86_64/usr/lib/libm.a
```
www/ruby-jekyll-seo-tag: update to 2.9.1
2.9.1 (2026-09-29)
Security
* Escape all metadata attribute outputs, and make the JSON-LD block safe
inside its script tag (GHSA-572m-7cg5-6j5r)
www/ruby-jekyll-feed: update to 0.18.0
0.18.0 (2026-09-29)
Security
* Escape xml:lang values and CDATA terminators in the feed
(GHSA-3gx8-pqcm-38hw, #396)
Development Fixes
* Upgrade to Rake 13 to fix master (#381)
* feat(CI): Add Ruby 3.2/3.3 to the test matrix (#402)
* Fix style offenses (#414)
Documentation
* Fix typos in Readme (#384)
[3 lines not shown]
Fix race where TCP syn cache could free a used route.
Route timer code is not MP safe and relies on netlock. As
syn_cache_put() may free a route, syn_cache_timer() has to hold
shared netlock until syn_cache_put() has finished.
from OpenAI; OK mvs@ deraadt@
security/ruby-oauth: update to 1.1.9
1.1.9 (2026-11-07)
Added
* access_token_cross_origin_requests consumer option (default false):
AccessToken#request now refuses an absolute service URI whose origin
differs from the configured :site, raising OAuth::Error, so the signed
OAuth Authorization header is not sent to a different host. Same-origin
absolute URIs and relative paths are unaffected. Set the option to true
to restore cross-origin service calls. [CWE-918]
* kettle-jem-template-20260720-001 - READMEs can now display configured
corporate sponsor logos.
* Spec coverage for OAuth::Client::Helper, the query_string OAuth signing
scheme in lib/oauth/client/net_http.rb, and the
OAuth::Error/OAuth::Unauthorized/OAuth::Problem classes — none previously
[76 lines not shown]
graphics/geeqie: Update to 3.4
Upstream NEWS:
Geeqie 3.4
============
- Performance: configurable multi-image preloading that follows navigation direction, bounded thumbnail loading and memory use, faster selection navigation, smoother Exif scrolling, and asynchronous display-profile loading.
- Pan View: background directory scanning, incremental layout and spatial indexing, progress reporting, cancellation, and support for Geeqie’s private thumbnail cache.
- Rendering and zoom: faster magnification through reusable textures; corrected high-DPI, 100% zoom, and fullscreen behavior; fixes for blank images, stale previews, tiling artifacts, and color correction.
- File operations: directory drag-and-drop copying and moving, folder merging, “Duplicate” conflict handling, and fixes for cancellation, symlink targets, and maximum-length filenames.
- Floating tools and shortcuts: an option to keep Info and Sort Manager with floating tools; corrected menu placement and docking; file drops onto folder and collection shortcuts.
- Sort Manager and collections: folder-specific destination lists, numbered destination shortcuts, external collections in destination menus, a draggable divider, and fixes for sidebar width growth.
- Metadata: configurable XMP color labels with OSD and list-view indicators, corrected grouped-sidecar associations, image/XMP source selection in the Exif window, keyword-tree autosaving, and restored batch metadata application.
- Search and duplicates: separate Criteria and Results tabs, perceptual-hash matching, a same-folder exclusion filter, smallest/largest-file selection, JSON export and script integration, and improved synchronization after deletion.
- Slideshow: configurable transitions, improved high-DPI rendering, and rescanning of recursive folders or saved collections between cycles.
- Export and printing: cropped-copy export with an adjustable selection, JPEG/PNG conversion, restored proof-sheet printing, and Print Image in context menus.
- Keyboard and customization: configurable panning and other formerly hard-coded shortcuts, an action to focus the image pane, improved icon-view selection and focus, configurable date/time formatting, and interface color-scheme preferences.
- GPS and format support: restored map interactions and direction lines; fixes for animated WebP, AVIF crashes, JPEG XL profiles and alpha, large JPEGs, full-resolution ARW viewing, SVGZ loading, and metadata-preserving rotation.
[2 lines not shown]
cabal2pkg: Update to cabal2pkg-0.1.2
## 0.1.2 -- 2026-11-08
Compatibility changes:
* Fixed build with GHC 9.10. `cabal2pkg` no longer supports GHC 9.8.
New features:
* Added a global option `--fill-column=COLUMN` for specifying page
width. Currently only used for generating `DESCR` files. Previously it
was fixed to 80, but now it's defaulted to 76. This options is only meant
to be used for debugging.
* `cabal2pkg init` now infers a package from the name of the directory if
no package URI is given. The package is assumed to be available in
Hackage in this case.
Behaviour changes:
[66 lines not shown]
Fail graceful VM and container stop when the guest keeps running
## Problem
A graceful `vm.stop` / `container.stop` (no `force`, no `force_after_timeout`, the API default) waited `shutdown_timeout` and then reported SUCCESS even when the guest ignored the shutdown request and was still running. The UI showed the guest as stopped and a graceful container restart then failed on start with "already started". A suspended VM was also left suspended with a successful job, even with `force_after_timeout`, because the post-stop check only looked for `RUNNING`.
## Solution
After the shutdown request, both stop paths check the state again. If the guest has not stopped, it is powered off when `force_after_timeout` is set; otherwise the job fails with an ETIMEDOUT `CallError` saying it did not stop within the timeout. A suspended VM is resumed before the shutdown request so the guest can act on it, and library errors (e.g. stopping a guest that is not running) are raised as `CallError` like start already does. The docstrings describe the new behaviour and the container stop test now expects the graceful stop to fail.
cc120: Move main.cc from guts-common to libbackend
The vendor makefile specifies 'main.o' with 'libbackend.a' as in:
```
BACKEND = libbackend.a main.o libcommon-target.a libcommon.a \
$(CPPLIB) $(LIBDECNUMBER)
```
In addition, backend 'lto-wrapper' and 'collect2' have their own
'main()' definition, so don't need the 'main.o' object.
So it's more correct to move 'main.cc' from guts-common to libbackend.
bsd.{dep,lib}.mk: Simplify the sed modification to .depend
Just call sed to perform in-place modification to the .depend file,
without creating a temporary file and moving it. This practice is
already used in <bsd.hostprog.mk>.
bsd.dep.mk: Hide the command echo of appending .depend
Don't echo the unhelpful ">> .depend" commands.
In addition, tweak the ">>" shell redirection to a test + touch, since
touch(1) is available as a bootstrap tool and already used in many
places.
