LLVM/project 5b1b0efclang/tools/diagtool ShowEnabledWarnings.cpp

[Clang][diagtool] Fix memory leak in ShowEnabledWarnings (#191711)

Fix 136-byte memory leak introduced in commit 6dc059ac3c7c. Before
that commit, the TextDiagnosticBuffer was passed to DiagnosticsEngine
constructor which took ownership and managed its lifetime. After the
refactoring, the buffer is no longer passed to DiagnosticsEngine, so
it becomes an orphaned allocation that is never freed. Changed to use
std::unique_ptr for automatic cleanup.
DeltaFile
+2-1clang/tools/diagtool/ShowEnabledWarnings.cpp
+2-11 files

LLVM/project 56775ballvm/tools/llubi/lib Library.cpp

[llubi] Fix invalid printf format specifier for %c (#191713)

Fix ASAN warning about unexpected format specifier %llc introduced
in commit f149ab665a4b. The 'c' format specifier should not have the
'll' length modifier. Separated the 'c' case to use the correct format
without the length modifier, casting to int as required by the standard.
DeltaFile
+7-2llvm/tools/llubi/lib/Library.cpp
+7-21 files

FreeBSD/ports 841bc4baudio/libopenmpt distinfo Makefile

audio/libopenmpt: Update to 0.8.6

(cherry picked from commit efed77193807757891b4723ea02f72fe89621aa0)
DeltaFile
+3-3audio/libopenmpt/distinfo
+1-1audio/libopenmpt/Makefile
+4-42 files

OPNSense/core 913863asrc/opnsense/mvc/app/models/OPNsense/Kea KeaDhcpv6.php

Services: Kea DHCP: Kea DHCPv6 - fix "Delegated length must be longer than or equal to prefix length" validation, closes https://github.com/opnsense/core/issues/10146

While here, also fix a prefix validation (when x::/64 is specified for example).
DeltaFile
+5-2src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
+5-21 files

FreeBSD/ports cb35b3dlang/python314 pkg-plist Makefile, lang/python314/files patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser

lang/python314: Security update to 3.14.4

Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:      https://docs.python.org/release/3.14.4/whatsnew/changelog.html

PR:             294324

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:       https://github.com/python/cpython/issues/145986
                / CVE-2026-4224


    [34 lines not shown]
DeltaFile
+108-0lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers
+83-0lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser
+17-5lang/python314/pkg-plist
+12-6lang/python314/Makefile
+3-3lang/python314/distinfo
+1-1lang/python314/Makefile.version
+224-156 files

FreeBSD/ports 6e083a7graphics/jpeg-turbo distinfo Makefile

graphics/jpeg-turbo: Update to 3.1.4.1

Changelog:
https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/3.1.4.1

PR:             294261
Reviewed by:    desktop (makc)
Exp-run by:     antoine

(cherry picked from commit 5c947edf90309fb747d0c42a838cf40cba620d39)
DeltaFile
+3-3graphics/jpeg-turbo/distinfo
+1-1graphics/jpeg-turbo/Makefile
+4-42 files

FreeBSD/ports 332c8ddgraphics/tiff Makefile, graphics/tiff/files patch-libtiff_tif__getimage.c

graphics/tiff: Fix CVE-2026-4775

Backport upstream commit 782a11d6b5b61c6dc21e714950a4af5bf89f023c

Reference:
https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c

PR:             294370
Reviewed by:    desktop (arrowd)

(cherry picked from commit a7af345cb919c0cab70b0801abaff2b528f1eaff)
DeltaFile
+38-0graphics/tiff/files/patch-libtiff_tif__getimage.c
+1-0graphics/tiff/Makefile
+39-02 files

FreeBSD/ports 92cd59cgraphics/png distinfo Makefile

graphics/png: Update to 1.6.57

Fixes CVE-2026-34757

Changelog: https://github.com/pnggroup/libpng/blob/v1.6.57/ANNOUNCE

PR:             294349
Reported by:    Christos Chatzaras <chris at cretaforce.gr>
Reviewed by:    desktop (arrowd) (previous iteration)

(cherry picked from commit fd1980fafbbede3b50816970488013516da84394)
DeltaFile
+5-5graphics/png/distinfo
+1-1graphics/png/Makefile
+1-1graphics/png/pkg-plist
+7-73 files

FreeBSD/ports 333fe6faudio/libopenmpt distinfo Makefile

audio/libopenmpt: Update to 0.8.5

Fixes possible out-of-bounds sample data read in a specific
combination of reverse sample playback + offset past sample loop

* Remove gmake dependency
* Add USES= pathfix to fix install location of pkgconfig file
  and make build log consistent

Changelog:
https://lib.openmpt.org/libopenmpt/2026/03/22/security-updates-0.8.5-0.7.18-0.6.27-0.5.41-0.4.53/

PR:             294006
Approved by:    maintainer timeout, 2+ weeks

(cherry picked from commit 9a16505d8f8cc3f7fe94d2b3fce4b241f0cde84f)
DeltaFile
+3-3audio/libopenmpt/distinfo
+2-2audio/libopenmpt/Makefile
+5-52 files

FreeBSD/ports 2a26951graphics/png distinfo Makefile

graphics/png: Update to 1.6.56

Fixes CVE-2026-33416 and CVE-2026-33636

Initial patch submitted by Fabian Wenk

Changelog:      https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE

PR:             294061
Reviewed by:    ports-secteam (fluffy)
Exp-run by:     antoine

(cherry picked from commit 9daa967c64e010af5caccef10e97113dffabdab2)
DeltaFile
+5-5graphics/png/distinfo
+1-1graphics/png/Makefile
+1-1graphics/png/pkg-plist
+7-73 files

FreeBSD/src 817e699sys/dev/usb/input wsp.c

wsp(4): Make evdev interface operational if sysmouse one is not opened

Before this change evdev interface sent only copy of data sent through
the sysmouse interface. It worked as /dev/wsp0 device node was
automatcaly opened by devd(8) with starting of moused(8).
Starting with 15.0 moused(8) does not open sysmouse interface by default
thus making wsp(4) device dysfunctional.
Fix it with adding extra checks of interfaces state.

MFC after:      1 week
DeltaFile
+10-1sys/dev/usb/input/wsp.c
+10-11 files

FreeBSD/src dc5a949sys/dev/usb/input wsp.c

wsp(4): Do not handle pressure on non-ForceTouch devices

They always report it value as zero breaking pressure-driven drivers
like moused(8) and xf86-input-synaptics.

MFC after:      1 week
DeltaFile
+4-2sys/dev/usb/input/wsp.c
+4-21 files

FreeBSD/src 9d0404csys/dev/hid bcm5974.c

bcm5974(4): Do not handle pressure on non-ForceTouch devices

They always report it value as zero breaking pressure-driven drivers
like moused(8) and xf86-input-synaptics.

MFC after:      1 week
DeltaFile
+5-3sys/dev/hid/bcm5974.c
+5-31 files

FreeBSD/src 2ba6ce5sys/dev/hid hid.h

hid: Change Usage Page names to match documentation

According to "HID Usage Tables FOR Universal Serial Bus (USB)"
Usage Page ID range 0x93-0xF1CF is "Reserved" and Usage Page ID range
0xFF00-0xFFFF is "Vendor-defined".

MFC after:      1 week
DeltaFile
+7-3sys/dev/hid/hid.h
+7-31 files

FreeBSD/src 8448878usr.sbin/bluetooth/iwmbtfw iwmbt_hw.c iwmbt_fw.c

iwmbtfw(8): Identify device type based on HCI quieries result

rather than on VID/PID. Later is not reliable for some types.
VID/PID identification can be restored by specifying of -p option.

Tested by:      arrowd, wulf
PR:             290639
MFC after:      1 week
DeltaFile
+47-103usr.sbin/bluetooth/iwmbtfw/iwmbt_hw.c
+105-0usr.sbin/bluetooth/iwmbtfw/iwmbt_fw.c
+75-5usr.sbin/bluetooth/iwmbtfw/main.c
+5-2usr.sbin/bluetooth/iwmbtfw/iwmbtfw.8
+3-0usr.sbin/bluetooth/iwmbtfw/iwmbt_hw.h
+2-0usr.sbin/bluetooth/iwmbtfw/iwmbt_fw.h
+237-1106 files

FreeBSD/src d6477cdsys/dev/hid bcm5974.c

bcm5974(4): Fix pre-2015 Apple touchpad support

These devices appeared to stop sending reports via mouse USB interface
after switching to RAW mode. Fix it with changing Usage of Top Level
Collection to one found in HID report descriptor of proper interface.

MFC after:      1 week
DeltaFile
+38-34sys/dev/hid/bcm5974.c
+38-341 files

FreeBSD/src 98118afsecure/lib/libcrypto Makefile

[OpenSSL] Add missing header file (openssl/ml_kem.h)

Add missing header file (openssl/ml_kem.h) of OpenSSL 3.5

Reviewed by:    fluffy, ngie
Approved by:    ngie (maintainer)
Differential Revision:  https://reviews.freebsd.org/D56291
DeltaFile
+1-1secure/lib/libcrypto/Makefile
+1-11 files

HardenedBSD/src 39c2e99share/man/man9 hashalloc.9, sys/kern subr_hash.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+350-54sys/kern/subr_hash.c
+314-0share/man/man9/hashalloc.9
+54-92sys/netpfil/pf/pf.c
+30-22sys/netinet/in_pcb.c
+26-15sys/netinet/ip_input.c
+37-0sys/sys/hash.h
+811-18311 files not shown
+887-23217 files

HardenedBSD/src 6ee0e50share/man/man9 hashalloc.9, sys/kern subr_hash.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+350-54sys/kern/subr_hash.c
+314-0share/man/man9/hashalloc.9
+54-92sys/netpfil/pf/pf.c
+30-22sys/netinet/in_pcb.c
+26-15sys/netinet/ip_input.c
+37-0sys/sys/hash.h
+811-18311 files not shown
+887-23217 files

LLVM/project b799b38llvm/include/llvm/CodeGen AsmPrinter.h, llvm/lib/CodeGen/AsmPrinter AsmPrinter.cpp

[AsmPrinter] Fix redundant/weaker .prefalign when IR align attr >= prefalign (#191675)

PR #155529 (only fired with -ffunction-sections, then modified by PR
184032) compared `MF->getAlignment()` (the backend's minimum function
alignment) against `MF->getPreferredAlignment()` to decide whether to
emit `.prefalign`. This ignored the IR function's own align attribute,
which `emitAlignment` picks up later via `getGVAlignment`, so the
comparison was against the wrong minimum.

Consequences on x86 (backend min = 1, target pref = 16):

* `[[gnu::aligned(32)]] void g(){}` lowers to `align 32 prefalign(32)`.

      .p2align 5
      .prefalign 5, .Lfunc_end, nop

  The .prefalign is fully redundant: .p2align 5 already forces the
  desired 32-byte alignment.


    [9 lines not shown]
DeltaFile
+18-14llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp
+15-0llvm/test/CodeGen/X86/prefalign.ll
+4-3llvm/include/llvm/CodeGen/AsmPrinter.h
+37-173 files

FreeBSD/ports 2eb75c6security/vuxml/vuln 2026.xml

security/vuxml: Update entry for Python CVE-2026-4519

Fixed in 3.14.4

PR:             294324
Security:       9fdad262-2e0f-11f1-88c7-00a098b42aeb
                / CVE-2026-4519
DeltaFile
+1-1security/vuxml/vuln/2026.xml
+1-11 files

HardenedBSD/ports 2eb75c6security/vuxml/vuln 2026.xml

security/vuxml: Update entry for Python CVE-2026-4519

Fixed in 3.14.4

PR:             294324
Security:       9fdad262-2e0f-11f1-88c7-00a098b42aeb
                / CVE-2026-4519
DeltaFile
+1-1security/vuxml/vuln/2026.xml
+1-11 files

FreeBSD/ports 955268blang/python314 pkg-plist Makefile, lang/python314/files patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser

lang/python314: Security update to 3.14.4

Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:      https://docs.python.org/release/3.14.4/whatsnew/changelog.html

PR:             294324

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:       https://github.com/python/cpython/issues/145986
                / CVE-2026-4224


    [32 lines not shown]
DeltaFile
+108-0lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers
+83-0lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser
+17-5lang/python314/pkg-plist
+12-6lang/python314/Makefile
+3-3lang/python314/distinfo
+1-1lang/python314/Makefile.version
+224-156 files

HardenedBSD/ports 955268blang/python314 pkg-plist Makefile, lang/python314/files patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser

lang/python314: Security update to 3.14.4

Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:      https://docs.python.org/release/3.14.4/whatsnew/changelog.html

PR:             294324

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:       https://github.com/python/cpython/issues/145986
                / CVE-2026-4224


    [32 lines not shown]
DeltaFile
+108-0lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers
+83-0lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser
+17-5lang/python314/pkg-plist
+12-6lang/python314/Makefile
+3-3lang/python314/distinfo
+1-1lang/python314/Makefile.version
+224-156 files

Linux/linux 35bdc19kernel workqueue.c

Merge tag 'wq-for-7.0-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

Pull workqueue fix from Tejun Heo:
 "This is a fix for a stall which triggers on ordered workqueues when
  there are multiple inactive work items during workqueue property
  changes through sysfs, which doesn't happen that frequently.

  While really late, the fix is very low risk as it just repeats an
  operation which is already being performed:

   - Fix incomplete activation of multiple inactive works when
     unplugging a pool_workqueue, where the pending_pwqs list
     wasn't being updated for subsequent works"

* tag 'wq-for-7.0-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works
DeltaFile
+13-1kernel/workqueue.c
+13-11 files

LLVM/project 6ea4377libcxx/test/std/numerics/numeric.ops/numeric.ops.sat saturate_cast.pass.cpp saturating_cast.pass.cpp, llvm/lib/Target/AMDGPU GCNSchedStrategy.cpp

Rebase

Created using spr 1.3.7
DeltaFile
+2,253-17llvm/test/CodeGen/AMDGPU/freeze.ll
+0-394libcxx/test/std/numerics/numeric.ops/numeric.ops.sat/saturate_cast.pass.cpp
+394-0libcxx/test/std/numerics/numeric.ops/numeric.ops.sat/saturating_cast.pass.cpp
+385-0llvm/test/CodeGen/X86/apx/pr191368.ll
+157-138llvm/lib/Target/AMDGPU/GCNSchedStrategy.cpp
+140-150llvm/test/CodeGen/AMDGPU/load-global-i16.ll
+3,329-699234 files not shown
+8,456-3,789240 files

OpenBSD/ports ppAG7d4games/wesnoth distinfo Makefile

   update to wesnoth-1.18.7
VersionDeltaFile
1.63+2-2games/wesnoth/distinfo
1.119+1-2games/wesnoth/Makefile
+3-42 files

HardenedBSD/src cd5ff4esys/net pfvar.h, sys/netpfil/pf pf.c

pf: use hashalloc(9) for key, id, src-node and udp-endpoint hashes

Reviewed by:            kp
Differential Revision:  https://reviews.freebsd.org/D56113
DeltaFile
+54-92sys/netpfil/pf/pf.c
+1-2sys/net/pfvar.h
+55-942 files

FreeBSD/src cd5ff4esys/net pfvar.h, sys/netpfil/pf pf.c

pf: use hashalloc(9) for key, id, src-node and udp-endpoint hashes

Reviewed by:            kp
Differential Revision:  https://reviews.freebsd.org/D56113
DeltaFile
+54-92sys/netpfil/pf/pf.c
+1-2sys/net/pfvar.h
+55-942 files

HardenedBSD/src 87ef306sys/netinet tcp_lro.c

tcp lro: use hashalloc(9)

Reviewed by:            tuexen, rrs
Differential Revision:  https://reviews.freebsd.org/D56177
DeltaFile
+20-6sys/netinet/tcp_lro.c
+20-61 files