FreeBSD/ports 824098c — security/libressl-devel Makefile, security/libressl-devel/files patch-crypto_ocsp patch-apps_ocspcheck

security/libressl-devel: Security fix for OCSP

Security:       aafad06c-d519-11f1-8135-8447094a420f
MFH:            2026Q4
DeltaFile
+300-0security/libressl-devel/files/patch-apps_ocspcheck
+134-0security/libressl-devel/files/patch-crypto_ocsp
+1-0security/libressl-devel/Makefile
+435-03 files

LLVM/project f6e58c3 — llvm/lib/Target/DirectX DXIL.td, llvm/utils/TableGen DXILEmitter.cpp

DirectX: Avoid DXIL op attribute record name collision (#237585)

The DXIL attributes were defined with names colliding with the normal
definitions in Attributes.td. It just happens that isn't included by
the backend today, but I am planning on changing that. Add a prefix
and add an explicit name field so the generated names don't change.
Alternatively it might be possible to specify these directly with the
attribute intrinsic properties.

Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
DeltaFile
+80-78llvm/lib/Target/DirectX/DXIL.td
+1-1llvm/utils/TableGen/DXILEmitter.cpp
+81-792 files

FreeBSD/ports 1eee532 — security/libressl Makefile distinfo, security/libressl/files patch-crypto_ocsp patch-apps_ocspcheck

security/libressl: Security fix for OCSP

Security:       aafad06c-d519-11f1-8135-8447094a420f
MFH:            2026Q4
(cherry picked from commit dfaafcfe5a58f816a5730ef6c63d31da0bf9f9bf)
DeltaFile
+300-0security/libressl/files/patch-apps_ocspcheck
+134-0security/libressl/files/patch-crypto_ocsp
+3-3security/libressl/distinfo
+1-1security/libressl/Makefile
+438-44 files

FreeBSD/src 96a1a33 — sys/net if_lagg.c

lagg: re-check port caps after bringing up a port

Some nic drivers (including iflib) do not initialize if_hwassist
until after the interface is brought up.  If a lagg member is included
in a lagg when its not yet been brought up, that will cause lagg to see
if_hwassist=0 and will disable all checksum offload, etc, on the interface.
This is almost impossible to debug without kgdb or dtrace, as ifconfig does
not surface if_hwassist.

Fix this by re-calculating lagg caps (including if_hwassist) after adding a port.

I encountered this problem when I had a commented-out if_foo1=up entry in
my rc.conf that i neglected to uncomment when I was re-configuring a lagg.

Sponsored by: Netflix
Reviewed by: markj, zlei
Differential Revision: https://reviews.freebsd.org/D58062

(cherry picked from commit 1cce5ef05d7ba077b0cb29d30b59f3a862e7e5ae)
DeltaFile
+2-0sys/net/if_lagg.c
+2-01 files

FreeBSD/ports 2738f9c — net-mgmt/icingaweb2-module-grafana Makefile distinfo

net-mgmt/icingaweb2-module-grafana: Update to 3.1.6

Changelog:
https://github.com/NETWAYS/icingaweb2-module-grafana/releases/tag/v3.1.6

PR:             300382
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+3-3net-mgmt/icingaweb2-module-grafana/distinfo
+1-1net-mgmt/icingaweb2-module-grafana/Makefile
+4-42 files

FreeBSD/ports 4a26980 — x11-servers/xlibre-server Makefile Makefile.version, x11-servers/xlibre-server/files patch-hw_xfree86_loader_loadmod.c

x11-servers/xlibre-server: Update to 25.1.11

- Fix issues with X/Xorg configure

With hat:       xlibre
PR:             299077
Reported by:    Slawomir Wojciech Wojtczak <vermaden __at__ interia.pl>
DeltaFile
+36-0x11-servers/xlibre-server/files/patch-hw_xfree86_loader_loadmod.c
+3-3x11-servers/xlibre-server/distinfo
+1-1x11-servers/xlibre-server/Makefile.version
+0-1x11-servers/xlibre-server/Makefile
+40-54 files

NetBSD/pkgsrc I3ABZME — doc CHANGES-2026

   Updated security/hashcat, devel/py-setuptools-gettext
VersionDeltaFile
1.7494+3-1doc/CHANGES-2026
+3-11 files

NetBSD/pkgsrc Ubot1O1 — devel/py-setuptools-gettext Makefile distinfo

   py-setuptools-gettext: updated to 0.1.20

   0.1.20

   Drop support for Python 3.9; add Python 3.15.
   Modernize type annotations (builtin generics, PEP 604 unions).
   Dependency updates for development tooling.
VersionDeltaFile
1.5+4-4devel/py-setuptools-gettext/distinfo
1.6+2-2devel/py-setuptools-gettext/Makefile
+6-62 files

NetBSD/pkgsrc gJCNuwk — security/hashcat Makefile cargo-depends.mk, security/hashcat/patches patch-src_rust__toolchain.mk patch-src_Makefile

   hashcat: updated to 8.0.0

   8.0.0

   Here's a quick summary:

   11 major features and four new attack-modes
   146 new hash-modes and 306 bug fixes
   4,091 files changed, with 439,469 lines added and 229,313 deleted
   Contributions from 63 people, 43 of them first-time contributors
VersionDeltaFile
1.6+752-554security/hashcat/PLIST
1.6+135-11security/hashcat/distinfo
1.6+29-38security/hashcat/patches/patch-src_Makefile
1.2+45-3security/hashcat/cargo-depends.mk
1.9+32-12security/hashcat/Makefile
1.1+15-0security/hashcat/patches/patch-src_rust__toolchain.mk
+1,008-6183 files not shown
+1,011-6219 files

FreeBSD/src 5c8bb2b — usr.sbin/bhyve bhyve.8

bhyve.8: add details on using TPM with UEFI

Add a note that UEFI VMs using TPM devices should be configured
to use a varfile. Some UEFI boot loaders, such as shim, update
persistent boot variables and then reset the system when a TPM is
present. Without a writable varfile, the VM may be reset repeatedly.

Add a TPM device example to the examples list.

While here, add a missing "\" to the "uefivm" example, and add ".Pp"
before the vCPU pinning examples for consistency with other examples.

PR:             287326
Reviewed by:    michaelo, ziaee
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D60181

(cherry picked from commit ff2efe65a89a943beec4dd4cc956f5e075a921be)
DeltaFile
+30-2usr.sbin/bhyve/bhyve.8
+30-21 files

LLVM/project 7efb163 — libcxx/include/__numeric pstl.h, libcxx/test/std/numerics/numeric.ops/inclusive.scan pstl.inclusive_scan.pass.cpp pstl.inclusive_scan_op.pass.cpp

[libc++][pstl] Add serial implementations of std::inclusive_scan and std::transform_inclusive_scan (#236219)

This PR adds serial implementations of the inclusive scan operations to
PSTL.
Within this patch they are added only to the serial backend, such that
any other backend can fall back to these implementations.
A real parallel implementation is intended to land within the `statpart`
backend later, which will be a purely additive change, it will not touch
the code in this PR.

These are the added scan operations:
- `std::inclusive_scan` (3 variants)
- `std::transform_inclusive_scan` (2 variants)

Part of #99938.

---------

Co-authored-by: PaulXiCao <paulxicao7 at gmail.com>
DeltaFile
+323-0libcxx/test/std/numerics/numeric.ops/transform.inclusive.scan/pstl.transform_inclusive_scan_bop_uop_init.pass.cpp
+241-0libcxx/test/std/numerics/numeric.ops/transform.inclusive.scan/pstl.transform_inclusive_scan_bop_uop.pass.cpp
+196-0libcxx/test/std/numerics/numeric.ops/inclusive.scan/pstl.inclusive_scan_op_init.pass.cpp
+168-0libcxx/test/std/numerics/numeric.ops/inclusive.scan/pstl.inclusive_scan_op.pass.cpp
+157-0libcxx/test/std/numerics/numeric.ops/inclusive.scan/pstl.inclusive_scan.pass.cpp
+121-0libcxx/include/__numeric/pstl.h
+1,206-05 files not shown
+1,434-011 files

LLVM/project 8059cc3 — llvm/lib/Target/X86 X86ISelLowering.cpp

[X86] LowerRotate - remove unnecessary bitwidth checks from splat amount case. NFC. (#237583)

We only accept vXi8/vXi16/vXi32 types at this point so this check is redundant.
DeltaFile
+13-15llvm/lib/Target/X86/X86ISelLowering.cpp
+13-151 files

FreeBSD/ports e306a79 — mail/cyrus-imapd312 Makefile, mail/cyrus-imapd312/files patch-master__master.c

mail/cyrus-imapd312: Fix for the error "too many failures for service imaps/ipv4, disabling until next SIGHUP".

PR:             300313
Reported by:    Fabian Wenk
DeltaFile
+12-0mail/cyrus-imapd312/files/patch-master__master.c
+1-1mail/cyrus-imapd312/Makefile
+13-12 files

LLVM/project 2ad5ff2 — offload/plugins-nextgen/amdgpu/src rtl.cpp

[Offload][AMDGPU] Roll back failed stream operations

If an HSA operation fails, rollback and release the signal to avoid the
situation where something is waiting on the completion signal forever.

Claude assisted with this patch.
DeltaFile
+119-38offload/plugins-nextgen/amdgpu/src/rtl.cpp
+119-381 files

FreeBSD/ports d102f75 — security/vuxml/vuln 2026.xml

security/vuxml: Document net/uriparser vulnerability

PR:             300378
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+27-0security/vuxml/vuln/2026.xml
+27-01 files

FreeBSD/ports 0122829 — net/uriparser pkg-plist Makefile

net/uriparser: Security update 1.0.2 => 1.0.3

Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog

While here:
- Format LICENSE section to make portfmt happy.
- Remove LICENSE_FILE since it doesn't get installed either.

PR:             300378
Approved by:    osa, vvd (Mentors, implicit)
Security:       CVE-2026-48841
MFH:            2026Q4

(cherry picked from commit f0cdd22deccdb6970769276be6e100b137095cfe)
DeltaFile
+7-7net/uriparser/distinfo
+5-6net/uriparser/Makefile
+1-1net/uriparser/pkg-plist
+13-143 files

FreeBSD/ports f0cdd22 — net/uriparser pkg-plist Makefile

net/uriparser: Security update 1.0.2 => 1.0.3

Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog

While here:
- Format LICENSE section to make portfmt happy.
- Remove LICENSE_FILE since it doesn't get installed either.

PR:             300378
Approved by:    osa, vvd (Mentors, implicit)
Security:       CVE-2026-48841
MFH:            2026Q4
DeltaFile
+7-7net/uriparser/distinfo
+5-6net/uriparser/Makefile
+1-1net/uriparser/pkg-plist
+13-143 files

OpenBSD/ports uonAf7F — geo Makefile

   geo/Makefile: +py-sfcgal
VersionDeltaFile
1.109+1-0geo/Makefile
+1-01 files

OpenBSD/ports NwiGWlA — geo/py-sfcgal distinfo Makefile, geo/py-sfcgal/pkg PLIST DESCR

   Initial revision
VersionDeltaFile
1.1+167-0geo/py-sfcgal/pkg/PLIST
1.1+31-0geo/py-sfcgal/Makefile
1.1+2-0geo/py-sfcgal/distinfo
1.1+1-0geo/py-sfcgal/pkg/DESCR
1.1.1.1+0-0geo/py-sfcgal/pkg/PLIST
1.1.1.1+0-0geo/py-sfcgal/pkg/DESCR
+201-02 files not shown
+201-08 files

FreeBSD/ports dfaafcf — security/libressl Makefile, security/libressl/files patch-crypto_ocsp patch-apps_ocspcheck

security/libressl: Security fix for OCSP

Security:       aafad06c-d519-11f1-8135-8447094a420f
MFH:            2026Q4
DeltaFile
+300-0security/libressl/files/patch-apps_ocspcheck
+134-0security/libressl/files/patch-crypto_ocsp
+1-0security/libressl/Makefile
+435-03 files

LLVM/project 12f2c46 — libcxx/docs/Status Cxx26Issues.csv, libcxx/include/__ranges elements_view.h

[libc++][ranges] Implement LWG3797: `elements_view` insufficiently constrained (#236930)

Require `std::get<N>(t)` to be valid in `has-tuple-element`. Previously,
a range of `subrange`s over a move-only iterator satisfied the
constraints of `elements_view<V, 0>` and then failed with a hard error,
because `subrange`'s lvalue `get<0>` requires `copyable<I>`.

Fixes #189811
DeltaFile
+12-1libcxx/test/std/ranges/range.adaptors/range.elements/range.concept.compile.pass.cpp
+3-1libcxx/include/__ranges/elements_view.h
+1-1libcxx/docs/Status/Cxx26Issues.csv
+16-33 files

FreeBSD/ports 432130b — misc/gitlogue Makefile Makefile.crates

misc/gitlogue: Update 0.12.1 => 0.12.2

Changelog:
https://github.com/unhappychoice/gitlogue/releases/tag/v0.12.2

Reported by:    Repology
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+9-9misc/gitlogue/distinfo
+3-3misc/gitlogue/Makefile.crates
+1-1misc/gitlogue/Makefile
+13-133 files

LLVM/project b727a62 — llvm/lib/Target/DirectX DXIL.td, llvm/utils/TableGen DXILEmitter.cpp

DirectX: Give DXIL op attribute records a Name field

The DXIL attributes were defined with names colliding with the normal
definitions in Attributes.td. It just happens that isn't included by
the backend today, but I am planning on changing that. Add a prefix
and add an explicit name field so the generated names don't change.
Alternatively it might be possible to specify these directly with the
attribute intrinsic properties.

Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
DeltaFile
+80-78llvm/lib/Target/DirectX/DXIL.td
+1-1llvm/utils/TableGen/DXILEmitter.cpp
+81-792 files

OpenBSD/src WhT0TJ4 — usr.sbin/rpki-client ca.c

   Remove superfluous returns

   OK tb@
VersionDeltaFile
1.16+1-5usr.sbin/rpki-client/ca.c
+1-51 files

OpenBSD/src ijawHTG — usr.sbin/rpki-client output-ometric.c repo.c

   Limit impact of quadratic workload caused by duplicate references from manifests

   Jacobsen et al., 2026, and, independently, eur1ka, reported that a set
   of colluding CAs could cause significant workload by publishing multiple
   manifests which all reference the same set of signed objects inside the
   same caRepository.

   In practice there should never be more than two manifests in any given
   caRepository directory since the norm is that caRepositories are not
   shared across CAs. In the normal course of operation two valid manifests
   existing in the same repository directory only occurs during a keyroll
   (RFC 6489), as is also pointed out in RFC 9286, section 2.

   This changeset introduces a limit of 20 manifests per Trust Anchor per
   caRepository. If this threshold is exceeded, any newly discovered CAs
   pointing into that caRepository are considered bad, discarded, and a
   counter is incremented in the OpenMetrics output.

   With & OK tb@
VersionDeltaFile
1.15+94-1usr.sbin/rpki-client/ca.c
1.335+16-3usr.sbin/rpki-client/main.c
1.319+7-1usr.sbin/rpki-client/extern.h
1.50+4-3usr.sbin/rpki-client/output.c
1.99+4-1usr.sbin/rpki-client/repo.c
1.19+3-1usr.sbin/rpki-client/output-ometric.c
+128-101 files not shown
+130-117 files

LLVM/project b135826 — .github/workflows lnt-submit.yml

[ci] Fix LNT submission when a single artifact is downloaded (#237584)

When the artifact pattern matches a single artifact, download-artifact
extracts it directly into the target directory instead of a subdirectory.
This means a glob like `reports/*/*.json` doesn't match. To fix this,
use a glob for both `reports/*/*.json` and `reports/*.json`.
DeltaFile
+3-1.github/workflows/lnt-submit.yml
+3-11 files

FreeBSD/ports d79d806 — net/traefik Makefile distinfo

net/traefik: Update to upstream release 3.7.17

Details:
- Bugfix release, see
  https://github.com/traefik/traefik/releases/tag/v3.7.17

MFH:            2026Q4
DeltaFile
+3-3net/traefik/distinfo
+1-1net/traefik/Makefile
+4-42 files

LLVM/project 659a52c — llvm/test/TableGen intrinsic-attrs.td, llvm/utils/TableGen/Basic IntrinsicEmitter.cpp

TableGen: Don't distinguish intrinsic function attribute sets by hasSideEffects (#237501)

hasSideEffects does not contribute to the emitted function attributes,
so including it in the uniquing key emitted duplicate attribute sets.
This removes 17 redundant function attribute sets, which also shrinks
the function attribute set ID from 8 to 7 bits.

Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
DeltaFile
+1-2llvm/utils/TableGen/Basic/IntrinsicEmitter.cpp
+1-1llvm/test/TableGen/intrinsic-attrs.td
+2-32 files

LLVM/project 3329ff7 — llvm/include/llvm/Support SourceMgrDiagnosticVerifier.h

[Support] Delete copy constructor in SourceMgrDiagnosticVerifier (#236962)

When building LLVM as a DLL on Windows, MSVC attempts to instantiate
implicit members such as the copy constructor. This class is already not
copyable due to having a `unique_ptr` member, so explicitly mark the
copy constructor and copy assignment operator as deleted.

The effort to build LLVM as a dylib is tracked in #109483.
DeltaFile
+4-0llvm/include/llvm/Support/SourceMgrDiagnosticVerifier.h
+4-01 files

LLVM/project d2f6dce — llvm/lib/Target/X86 X86ISelLowering.cpp

[X86] LowerRotate - pull out repeated checks. NFC. (#237576)
DeltaFile
+17-17llvm/lib/Target/X86/X86ISelLowering.cpp
+17-171 files