security/zeek: Update to 8.0.10
https://github.com/zeek/zeek/releases/tag/v8.0.10
This release fixes the following vulnerabilities:
- HIGH: SMB: Chains of AndX messages can crash Zeek
- HIGH: DNP3: Memory exhaustion via file control (g70v1) fields
- HIGH: SIP: Memory exhaustion from long request/response paths
- HIGH: DHCP: Memory exhaustion from retained options after analyzer
violation
- HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
entries
- HIGH: SMB: DCE/RPC memory exhaustion from fragment state
[65 lines not shown]
security/zeek: Remove /var/spool/zeek/zeekctl-config.sh on uninstall
... and remove from pkg-plist as it is automatically generated.
(cherry picked from commit 6dda64c6b5761551bbd747426a5ae8c36996af83)
security/zeek: Address stage-qa issues
Add missing pkg-plist entries for things installed in /var.
Also clean up empty include directories in STAGEDIR.
Reported by: diizzy
(cherry picked from commit e05695c847b90e2d4373c7f533a5872d61a8794f)
[VPlan] Expand sequential/regular UMin SCEVs in VPSCEVExpander. (#209786)
Add support for expanding SequentialUMinExpr SCEV expressions in
VPSCEVExpander.
For regular UMin expressions, the expansion unconditionally expands &
executes all operands, while the semantics of sequential UMin only
require the first operand to be evaluated unconditionally.
For sequential UMin expressions, we need to make sure potentially
UB/poison generating operands must be accounted for. Matching IR SCEV
expander, make sure that divisors of UDiv are poison-free and non-zero
inside sequential UMin. Similarly, freeze all operands other than the
first, to avoid poison from propagating.
PR: https://github.com/llvm/llvm-project/pull/209786
HBSD: Refer to the right branch in hbsd-update-build(8)
I forgot to switch this over to 15-STABLE as part of the branch
creation.
This is a direct commit to hardened/15-stable/main.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
HBSD: Bump copyright on hbsd-update-build(8)
The last commit to hbsd-update-build was in 2026 to account for the
migration from self-hosted GitLab Enterprise to Radicle.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to: 15-STABLE
See-Also: f6cd14174c3289988d2e931862c7861e420e578a
(cherry picked from commit f115cf376fbb7564d27435c9754d773614be2eb6)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
HBSD: Bump copyright on hbsd-update-build(8)
The last commit to hbsd-update-build was in 2026 to account for the
migration from self-hosted GitLab Enterprise to Radicle.
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to: 15-STABLE
See-Also: f6cd14174c3289988d2e931862c7861e420e578a
devel/sem: update to 0.23.0
[0.23.0] - 2026-08-22
Changed
C++ and Python's precomputed-facts fast paths are now opt-in (SEM_MUL_CPP=1, SEM_MUL_PYTHON=1), and Rust's stays opt-in (SEM_MUL_RUST=1). These fast paths trade memory for speed by skipping a second parse of files whose facts are already known. Re-measuring peak memory footprint (the metric that actually tracks memory pressure and swap risk, as opposed to resident-set size, which can look artificially low once memory has been compressed) found C++ costing ~25-28% more than a default build on llvm-project and Python ~22-25% more on home-assistant/core — both above the project's +15% admission ceiling, even after a follow-up trim narrowed the gap. Rust independently re-measured at ~33% over. Cold builds on large C++/Python repos are correspondingly slower by default than in 0.22.1, but use less memory; set the relevant env var if you have RAM headroom and want the speed.
Go's fast path is now on by default, no configuration needed. It cleared the same ceiling (+6.8% to +8.5% peak memory footprint on Kubernetes, well under +15%) once the correctness fixes below landed, and delivers a 12-17% faster cold build on Kubernetes as a result.
Fixed
Go call resolution no longer merges same-named packages from different API groups. Kubernetes has dozens of packages literally named v1 — one per API group (kubeadm, bootstraptoken, pod-security-admission, and more) — and import resolution used to key packages only by their bare directory name, so a call like DeepCopyInto from one API group's type could resolve to a same-named method in a completely unrelated package. Packages are now disambiguated by their full import path. This alone removes roughly 32,000 false cross-package edges on Kubernetes, and (combined with the fix below) makes Kubernetes cold builds 28-30% faster.
Go resolution no longer confuses a source file's own name with a standard-library package it happens to share a name with. Large Go codebases routinely contain files literally named os.go or time.go; a secondary lookup route used to treat a file's own bare filename as if it were an importable package, so calls like os.Stat() or time.Now() could resolve to the local file instead of the real standard-library package. That route has been removed entirely — only the correct, directory-based lookup remains.
Rust call resolution no longer confuses an external standard-library import with a same-named local module. use std::cmp; followed by cmp::max(...) could previously resolve to an unrelated local cmp.rs instead of the real standard-library function. Imports rooted at std/core/alloc are now excluded from local-module matching outright (an external import can never legitimately resolve to a file in your own repo), and a genuine same-named local-module collision is now disambiguated per the specific item being called rather than per whole-file bucket, falling back to an honest miss instead of guessing when it can't be told apart.
Fixed a scope-resolution precedence bug affecting every supported language: a nested closure or sibling function could resolve a call to the wrong same-named target — for example, a TypeScript call landing on a sibling closure's function of the same name instead of the one actually being called. A function's own locally declared bindings now always take precedence over an outer scope's binding of the same name, and nested locals inside a plain function (not just a class or module) are now registered for lookup at all, closing a gap where they were invisible to their own siblings.
Go's cross-file method resolution is now internally consistent when the fast path is enabled. Rewriting a method's identity to reflect its true cross-file package location left other places that cache that identity out of date, which could push a call through an unrelated fallback path instead of the correct local lookup. Every place an entity's identity is cached is now kept in sync with the rewrite, and the fast-path build is now bit-identical to the default build on Kubernetes.
Multi-document YAML files (----separated) no longer lose entities to id collisions. Top-level keys sharing a name across different documents in the same file used to collapse onto one generated id, silently dropping all but one from the graph — including whether it was a test. Each document is now part of the generated id whenever a real collision exists; ordinary single-document files are unaffected.
sem entities's index-backed listings no longer come back empty on Windows. An absolute path built by ordinary path-joining wasn't normalized the same way as the repository root before comparison, and Windows always prepends its extended-path marker during normalization, so the two could never match. Two related normalization gaps in the MCP server and the index reader were fixed alongside it.
Fixed a parse-cache test flake caused by tests sharing global cache state under parallel execution; the cache is now injectable per test/thread, with no change to production behavior.
sem setup no longer installs a SessionStart hook that forks mcp --resident. That resident server was deleted in 0.22.0 (--resident is kept only as a no-op flag for old installs), so every fresh sem setup was forking a process that does nothing, once per Claude Code session. sem setup now installs only the UserPromptSubmit hook (sem hook prompt-submit); sem unsetup still recognizes and removes a legacy mcp --resident SessionStart hook from an older install.
[20 lines not shown]
