mail/rspamd: update to 4.1.4
pkgsrc change: remove a pkglint warning of cfgfiles.mk.
4.1.4 (2026-07-29)
Incompatible changes
* Build: rspamd now links a single shared jemalloc instance per process and
refuses a static-only jemalloc — duplicated allocators caused segfaults
at startup
Features
* WebUI: read-only users can now access the Selectors tab and the Errors
history
Bug fixes
[21 lines not shown]
net/samba4: update to 4.24.5
pkgsrc change:
* remove pkglint warnings of patches/patch-lib_util_util__crypt.c
==============================
Release Notes for Samba 4.24.5
July 28, 2026
==============================
This is a security release in order to address the following defects:
o CVE-2026-6949: TSIG packet with name compression can crash DNS
Incorrect size calculations when a TSIG record contains
compressed names can lead to a large out-of-bounds write
[72 lines not shown]
www/ruby-rails80: update to 8.0.5.1
Ruby on Rails 8.0.5.1 (2026-07-29)
Active Storage
* A possible arbitrary file read and remote code execution in Active Storage
variant processing (CVE-2026-66066)
[analyzer] Improve UseAfterLifetimeEnd checker's diagnostic with descriptive names and value tracking (#212158)
Currently the `UseAfterLifetimeEnd` checker used `getString()` for
constructing error message. However, `getString()` is a debug only
stringification and should not be used for emitting reports to the
users. That is why I have changed it to `getDescriptiveName()` and also
implemented the `getRegionName`(#211552) function to return the region's
descriptive name. The `getRegionName()` function got also moved to the
modeling checker since both of the reporting checkers consume it
(#211818). This PR also uses the `trackStoredValue()` for value tracking
path notes, so the report points at where the value's source came from.
www/ruby-rails72: update to 7.2.3.2
Ruby on Rails 7.2.3.2 (2026-07-29)
Active Storage
* A possible arbitrary file read and remote code execution in Active Storage
variant processing (CVE-2026-66066)
[AMDGPU][Docs] Memory Model: Refactor location-order to cover reads
This shouldn't change anything semantically, only make the spec
(a) closer to the Vulkan spec, which includes reads in their location-ordered
relation: https://docs.vulkan.org/spec/latest/appendices/memorymodel.html#memory-model-location-ordered
(b) more uniform: this way, the may-see constraints are the same as the vanilla
LLVM constraints, only with all occurrences of "happens-before" replaced by
"location-ordered before".
[VPlan] Process simplifyRecipes in a worklist
For now just push the new recipe onto the worklist, not its users. For users we need to be careful if we're introducing cycles.
[libc++] Fix std::mt19937 seeding with std::seed_seq under vectorized ABI (#209860)
This PR fixes a bug in `std::mersenne_twister_engine::seed(_Sseq&)`
where the initialization twist is bypassed when the vectorized engine
optimization (`_LIBCPP_ABI_VECTORIZED_MERSENNE_TWISTER_ENGINE`) is
enabled.
In the vectorized implementation introduced in #206423, the engine state
must be pre-twisted during initialization by calling
`__update_all_states()` at the end of the `seed` functions.
However, in `seed(_Sseq& __q)`, the all-zero state check contains an
early `return;` when a non-zero state is verified. This early return
bypasses the trailing `__update_all_states()` call. Consequently, the
generator is initialized with raw, untwisted seed values (tempered)
rather than the standard twisted values.
This only manifests when compiled with unstable ABI settings
(`_LIBCPP_ABI_VERSION >= 2`) which enables the vectorized
[7 lines not shown]
[libc++][ranges] P3059R2: Making user-defined constructors of view iterators/sentinels private (#193891)
Implements https://wg21.link/P3059R2 (DR)
Closes #189599
1. Made constructors of iterator and sentinel types of the following
views private:
- `iota_view`
- `basic_istream_view`
- `filter_view`
- `transform_view`
- `take_view`
- `take_while_view`
- `join_view`
- `lazy_split_view`
- `split_view`
- `elements_view`
2. Updated all relevant tests to fix the usages of the now private
[10 lines not shown]
[libc] Refactor statfs Linux syscalls and provide 'struct statfs' (#212930)
* Extract statfs/fstatfs Linux syscall wrappers to
`linux/syscall_wrappers` directory;
* Provide our own definition of `struct statfs` type and a corresponding
proxy header (to use system type in overlay mode);
* Migrate callers (e.g. statfs->statvfs translation) to use the new
syscall wrapper.
This would allow us to add Linux-specific (non-POSIX) `<sys/statfs.h>`
header as a next step.
Assisted by: Gemini, human-reviewed
Don't forget to advance within the segment in _bus_dmamap_load_raw.
This went unnoticed, because the function is rarely used. While it is
wired in PowerPC DMA routines, no PowerPC specific drivers actually
use it. It only appears in a few MI drivers.
With small _dm_segcnt, load just failed with EFBIG, with large value
all segments pointed to the same page, which resulted in corrupting
the transfer.
