NetBSD/pkgsrc-wip b250984 — py-mopidy TODO

py-mopidy: Add reference to CVE-2026-111925
DeltaFile
+2-0py-mopidy/TODO
+2-01 files

NetBSD/pkgsrc-wip 6ec2353 — openbao TODO

openbao: Add reference to recent CVEs
DeltaFile
+4-0openbao/TODO
+4-01 files

NetBSD/pkgsrc-wip cc4ecd2 — libosmocore TODO

libosmocore: Add reference to recent CVEs
DeltaFile
+2-0libosmocore/TODO
+2-01 files

NetBSD/pkgsrc-wip 709981f — xdg-desktop-portal TODO

xdg-desktop-portal: Add reference to recent CVEs
DeltaFile
+3-0xdg-desktop-portal/TODO
+3-01 files

NetBSD/pkgsrc-wip 02daaef — rtl_433 TODO

rtl_433: Add reference to CVE-2026-117609
DeltaFile
+3-1rtl_433/TODO
+3-11 files

NetBSD/pkgsrc-wip 16a0c97 — llama.cpp TODO

llama.cpp: Add reference to recent CVEs
DeltaFile
+4-1llama.cpp/TODO
+4-11 files

NetBSD/pkgsrc-wip 3f895eb — dokuwiki TODO

dokuwiki: Add reference to CVE-2026-113356
DeltaFile
+1-1dokuwiki/TODO
+1-11 files

NetBSD/pkgsrc-wip 992cc3e — busybox TODO

busybox: Add reference to CVE-2026-92205
DeltaFile
+1-1busybox/TODO
+1-11 files

LLVM/project 44868d2 — llvm/lib/Analysis ValueTracking.cpp, llvm/lib/Transforms/InstCombine InstCombineCompares.cpp

[InstCombine] Generalize existing pattern from "abs(val) != 0 -> val != 0" to "abs(val) == 0 -> val == 0" (#233763)

Generalize fold of `(c ? x : -x) != 0` to `x != 0` by moving the pattern
to stripNullTest() and thus also supporting `==` predicates and other
patterns supported by that helper.

The missed pattern is noticed in Google Abseil's demangler
(https://github.com/abseil/abseil-cpp/blob/master/absl/debugging/internal/demangle.cc).

Proof: https://alive2.llvm.org/ce/z/7WQeXT

Fixes #233753

Assisted-by: Qwen3.7-Plus, which helps me locate the existing pattern
instead of opening a new pattern.
DeltaFile
+24-0llvm/test/Transforms/InstCombine/icmp.ll
+0-16llvm/lib/Transforms/InstCombine/InstCombineCompares.cpp
+8-0llvm/lib/Analysis/ValueTracking.cpp
+32-163 files

FreeBSD/src c6b08de — sys/netpfil/ipfw ip_fw_table_algo.c

ipfw: fix off-by-one error in bdel()

After deleting an item from a sorted array, bdel() moves the tail
following it, but the size of the data to move was calculated with
an off-by-one error, causing memmove() to read one element past the
end of the array. This can happen when the table is full for ifidx
or numarray algorithms.

Obtained from:  Yandex LLC
MFC after:      1 week
Sponsored by:   Yandex LLC
DeltaFile
+1-1sys/netpfil/ipfw/ip_fw_table_algo.c
+1-11 files

LLVM/project 4215403 — llvm/lib/Target/AMDGPU SIISelLowering.cpp, llvm/test/CodeGen/AMDGPU insert_vector_elt.v2i16.ll insert_vector_elt.v2bf16.ll

[AMDGPU] Custom lower dynamic insertelt on wide vectors of 16-bit elements (#232288)

Currently, in case of dynamic-index `insertelement` into v8, v16 and v32
of i16, f16 and bf16 was set to Expand. At -O1 and above, single inserts
were expanded into a select per element and chains of inserts were
folded into a stack temporary. At -O0, every insert went through the
stack unconditionally.

This patch extends the existing `v_bfi_b32` custom lowering, previously
limited to 64-bit vectors, to the 16-bit wide vectors as well, making
`INSERT_VECTOR_ELT` as now Custom for them, so legalization uses the
custom lowering at all optimization levels, and the generic DAGCombiner
chain fold, which only applies to Expand types, no longer fires.

In 'lowerINSERT_VECTOR_ELT' each 64-bit sized piece updates with `(Mask
& splat(Val)) | (~Mask & Piece)`, where only the piece holding the index
gets a nonzero mask, alongwith skipping `performInsertVectorEltCombine`
that use select-per-element expansion for such types, since the custom
lowering is cheaper. wider i8 vectors still use the stack.
DeltaFile
+1,013-90llvm/test/CodeGen/AMDGPU/insert_vector_dynelt.ll
+251-587llvm/test/CodeGen/AMDGPU/insert_vector_elt.v2bf16.ll
+187-463llvm/test/CodeGen/AMDGPU/insert_vector_elt.v2i16.ll
+58-25llvm/lib/Target/AMDGPU/SIISelLowering.cpp
+1,509-1,1654 files

LLVM/project b723001 — flang/lib/Optimizer/Transforms AddAliasTags.cpp, flang/test/Transforms tbaa-omp-private.fir

[flang][AddAliasTags] OpenMP privatization is a local allocation (#236201)

OpenMP privatization generates code which looks a bit like this
```
%host = ...
omp.parallel private(@privatizer %host -> %private_copy : !fir.ref<type>) {
  %priv = fir.declare %private_copy ... -> !fir.ref<type>
}
```

`fir::AliasAnalysis` already correctly categorises accesses to these
private variables (`%priv` in this example) as local allocations. It
reports the source operation for the allocation as being the
`fir.declare` operation (as there is no allocation operation visible in
mlir).

When AddAliasTags processed this access it did not handle allocations
having `fir.declare` as their source and so was not able to give it the
local allocation tag. This commit fixes that by treating `fir.declare`

    [15 lines not shown]
DeltaFile
+198-0flang/test/Transforms/tbaa-omp-private.fir
+14-2flang/lib/Optimizer/Transforms/AddAliasTags.cpp
+212-22 files

FreeBSD/ports a952cea — java/openjdk21 Makefile distinfo

java/openjdk21: Version 21.0.13.0.3 more cert fixes

Update to latest upstream patch version to address more issues with the
eMudhra certificate incident.

See also: https://openjdk.org/emudhra

MFH:            2026Q4
Security:       CVE 2026-114820
Security:       JDK-8395690
Sponsored by:   The FreeBSD Foundation
DeltaFile
+3-3java/openjdk21/distinfo
+1-1java/openjdk21/Makefile
+4-42 files

FreeBSD/ports db3f8c8 — mail/nextcloud-mail Makefile distinfo

mail/nextcloud-mail: Update to 5.12.6
DeltaFile
+3-3mail/nextcloud-mail/distinfo
+1-1mail/nextcloud-mail/Makefile
+4-42 files

LLVM/project cc717ca — libc/src/__support/math cospif16.h, libc/test/src/math/smoke cospif16_test.cpp

[libc][math] Fix  error handling
DeltaFile
+9-4libc/src/__support/math/cospif16.h
+4-1libc/test/src/math/smoke/cospif16_test.cpp
+13-52 files

LLVM/project 32dbc53 — mlir/include/mlir/Dialect/SPIRV/IR SPIRVStructureOps.td, mlir/lib/Dialect/SPIRV/IR SPIRVOps.cpp

[mlir][SPIR-V] Move symbol lookups into verifySymbolUses (#235042)

Looking up symbols in verify() made verification quadratic
DeltaFile
+44-28mlir/lib/Dialect/SPIRV/IR/SPIRVOps.cpp
+16-7mlir/include/mlir/Dialect/SPIRV/IR/SPIRVStructureOps.td
+15-0mlir/test/Dialect/SPIRV/IR/structure-ops.mlir
+75-353 files

FreeNAS/freenas 9444e31 — src/middlewared/middlewared/plugins/container crud.py

Remove `idmap_slice`
DeltaFile
+1-1src/middlewared/middlewared/plugins/container/crud.py
+1-11 files

FreeNAS/freenas 07af1da — src/middlewared/middlewared/service crud_service_part.py

`filter_list` is stricter than SQL filter; we should always run it unless otherwise is requested explicitly
DeltaFile
+3-2src/middlewared/middlewared/service/crud_service_part.py
+3-21 files

FreeNAS/freenas 52cbc3b — src/middlewared/middlewared/pytest/unit/utils test_filter_list.py, src/middlewared/middlewared/service crud_service_part.py

Consolidate filter attrs gathering
DeltaFile
+52-1src/middlewared/middlewared/pytest/unit/utils/test_filter_list.py
+34-15src/middlewared/middlewared/utils/filter_list.py
+6-19src/middlewared/middlewared/service/crud_service_part.py
+92-353 files

FreeNAS/freenas a1195ec — src/middlewared/middlewared/etc_files/cron.d middlewared.mako, src/middlewared/middlewared/plugins/container stats.py lifecycle.py

Use `force_sql_filters` by default when possible
DeltaFile
+31-1src/middlewared/middlewared/service/crud_service_part.py
+2-10src/middlewared/middlewared/plugins/container/lifecycle.py
+3-6src/middlewared/middlewared/etc_files/cron.d/middlewared.mako
+9-0src/middlewared/middlewared/plugins/replication/crud.py
+3-4src/middlewared/middlewared/plugins/container/stats.py
+7-0src/middlewared/middlewared/plugins/vm/crud.py
+55-2132 files not shown
+111-4538 files

OPNSense/core f011589 — src/opnsense/scripts/suricata installRules.py rule-updater.py, src/opnsense/scripts/suricata/lib downloader.py metadata.py

ids: support Suricata datasets in rule metadata (#11073)
DeltaFile
+15-31src/opnsense/scripts/suricata/rule-updater.py
+28-4src/opnsense/scripts/suricata/installRules.py
+24-3src/opnsense/scripts/suricata/lib/metadata.py
+3-3src/opnsense/scripts/suricata/lib/downloader.py
+70-414 files

LLVM/project 9e6672d — clang/test/Analysis lifetime-end-order.cpp

Add helper to the foor loop test case.
DeltaFile
+3-0clang/test/Analysis/lifetime-end-order.cpp
+3-01 files

FreeNAS/freenas ee9c734 — src/middlewared/middlewared/plugins alert.py, src/middlewared/middlewared/plugins/ups utils.py upssched_event.py

NAS-144937 / 27.0.0 / Fix flaky UPS alerts (by themylogin) (#20077)

* Receiving any message that was not in `alert_mapping` (i.e. `NOCOMM`,
`FSD` and `SHUTDOWN`) removed all alerts with some probability
* Alert creation raced with deletion (this commit introduces long
overdue `oneshot_replace`)
* Fix test utils. The dummy driver only notices whole-second mtime
changes, so sometimes fake data was not published at all.

Original PR: https://github.com/truenas/middleware/pull/20076

Co-authored-by: themylogin <themylogin at gmail.com>
DeltaFile
+86-12tests/api2/test_530_ups.py
+44-17src/middlewared/middlewared/plugins/alert.py
+6-3src/middlewared/middlewared/plugins/ups/__init__.py
+2-4src/middlewared/middlewared/plugins/ups/upssched_event.py
+4-0src/middlewared/middlewared/plugins/ups/utils.py
+142-365 files

FreeNAS/freenas de4a08c — src/middlewared/middlewared/alembic/versions/27.0 2026-10-23_12-00_password_history_separator.py, src/middlewared/middlewared/plugins account.py

NAS-144867 / 27.0.0 / Fix `set_password` corrupting password history (#20047)

`user.set_password` joined the hashes with `', '` while every reader
splits on whitespace. Each hash but the last kept a trailing comma and
no longer matched the password that produced it. Commas never appear in
a crypt hash, so dropping them recovers the original hash.
DeltaFile
+61-0tests/api2/test_account_password_history.py
+46-0src/middlewared/middlewared/alembic/versions/27.0/2026-10-23_12-00_password_history_separator.py
+1-1src/middlewared/middlewared/plugins/account.py
+108-13 files

FreeBSD/doc 4433d7f — documentation/content/en/books/accessibility/development _index.adoc

Change the www.eklhad.net from http to https

No content changes.

Event:  Olso Hackathon 2026
DeltaFile
+1-1documentation/content/en/books/accessibility/development/_index.adoc
+1-11 files

FreeBSD/ports fb45524 — java/openjdk25 Makefile distinfo

java/openjdk25: Version 25.0.5.0.3 more cert fixes

Update to latest upstream patch version to address more issues with the
eMudhra certificate incident.

See also: https://openjdk.org/emudhra

MFH:            2026Q4
Security:       CVE 2026-114820
Security:       JDK-8395690
Sponsored by:   The FreeBSD Foundation

(cherry picked from commit 82145c8e18fa5d657233f3c7c5f5c85711a656b8)
DeltaFile
+3-3java/openjdk25/distinfo
+1-1java/openjdk25/Makefile
+4-42 files

LLVM/project ac4bd3c — mlir/test/lib/IR CMakeLists.txt

[MLIR] Fix regression in linking to `MLIRAnalysisBase` via dylib (#236359)

Fix the regression introduced in #232793 where the `MLIRTestIR` library
ends up linking directly to `MLIRAnalysisBase` rather than to `MLIR`
dylib, and therefore duplicate it and all the static libraries it
depends on the linker command line.

Signed-off-by: Michał Górny <mgorny at gentoo.org>
DeltaFile
+2-2mlir/test/lib/IR/CMakeLists.txt
+2-21 files

LLVM/project 7ce39ab — llvm/include/llvm/CodeGen TargetLowering.h, llvm/test/CodeGen/AArch64 partial-reduce-non-power-of-two-elts.ll

[AArch64][ISel] Fix crash for partial reduction actions (#236179)

getPartialReduceMLAAction assumed that the provided VTs would always be
simple, and crashed if not. So we should just bail out in such cases
(e.g. invalid non-power-of-two element types) by defaulting to Expand.
DeltaFile
+39-0llvm/test/CodeGen/AArch64/partial-reduce-non-power-of-two-elts.ll
+4-0llvm/include/llvm/CodeGen/TargetLowering.h
+43-02 files

Dreckly/dreckly e4f4156 — audio/vorbis-tools distinfo, audio/vorbis-tools/patches patch-ae patch-aa

vorbis-tools: Update to 1.4.3
DeltaFile
+0-25audio/vorbis-tools/patches/patch-share_Makefile.in
+0-19audio/vorbis-tools/patches/patch-ogginfo_codec__skeleton.c
+0-18audio/vorbis-tools/patches/patch-ab
+0-14audio/vorbis-tools/patches/patch-aa
+4-9audio/vorbis-tools/distinfo
+0-12audio/vorbis-tools/patches/patch-ae
+4-972 files not shown
+17-1058 files

LLVM/project 1040982 — llvm/lib/Target/AMDGPU AMDGPUCodeGenPrepare.cpp, llvm/test/CodeGen/AMDGPU amdgpu-codegenprepare-mul24-mad64.ll mad_u64_u32_mul24.ll

address review feedback
DeltaFile
+186-66llvm/test/CodeGen/AMDGPU/mad_u64_u32_mul24.ll
+100-27llvm/test/CodeGen/AMDGPU/amdgpu-codegenprepare-mul24-mad64.ll
+4-0llvm/lib/Target/AMDGPU/AMDGPUCodeGenPrepare.cpp
+290-933 files