FreeBSD/ports 5e9e571security/zeek Makefile pkg-plist

security/zeek: Update to 8.0.10

    https://github.com/zeek/zeek/releases/tag/v8.0.10

This release fixes the following vulnerabilities:

 - HIGH: SMB: Chains of AndX messages can crash Zeek

 - HIGH: DNP3: Memory exhaustion via file control (g70v1) fields

 - HIGH: SIP: Memory exhaustion from long request/response paths

 - HIGH: DHCP: Memory exhaustion from retained options after analyzer
   violation

 - HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path
   entries

 - HIGH: SMB: DCE/RPC memory exhaustion from fragment state

    [65 lines not shown]
DeltaFile
+3-3security/zeek/distinfo
+4-0security/zeek/pkg-plist
+1-2security/zeek/Makefile
+8-53 files

FreeBSD/ports b092299security/zeek pkg-plist Makefile

security/zeek: Remove /var/spool/zeek/zeekctl-config.sh on uninstall

... and remove from pkg-plist as it is automatically generated.

(cherry picked from commit 6dda64c6b5761551bbd747426a5ae8c36996af83)
DeltaFile
+1-1security/zeek/pkg-plist
+1-1security/zeek/Makefile
+2-22 files

FreeBSD/ports 55f5b75security/zeek Makefile pkg-plist

security/zeek: Address stage-qa issues

Add missing pkg-plist entries for things installed in /var.
Also clean up empty include directories in STAGEDIR.

Reported by:    diizzy

(cherry picked from commit e05695c847b90e2d4373c7f533a5872d61a8794f)
DeltaFile
+10-8security/zeek/pkg-plist
+3-0security/zeek/Makefile
+13-82 files

FreeBSD/ports a685eefdatabases/mongodb-tools Makefile distinfo

databases/mongodb-tools: 100.18.0

Changelog:
https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md#100180
DeltaFile
+3-3databases/mongodb-tools/distinfo
+1-2databases/mongodb-tools/Makefile
+4-52 files

FreeBSD/ports 45beb70www/nginx-prometheus-exporter distinfo Makefile

www/nginx-prometheus-exporter: Update 1.5.1 => 1.5.3

Changelog:
https://github.com/nginx/nginx-prometheus-exporter/releases/tag/v1.5.2
https://github.com/nginx/nginx-prometheus-exporter/releases/tag/v1.5.3

Commit log:
https://github.com/nginx/nginx-prometheus-exporter/compare/v1.5.1...v1.5.3

PR:             297740
Sponsored by:   UNIS Labs
DeltaFile
+7-7www/nginx-prometheus-exporter/Makefile
+5-5www/nginx-prometheus-exporter/distinfo
+12-122 files

NetBSD/src z7bVUPousr.bin/make/unit-tests varmod-ifelse.mk cmd-errors-lint.mk

   tests/make: clean up and extend a few tests
VersionDeltaFile
1.3+6-39usr.bin/make/unit-tests/varparse-mod.mk
1.21+18-7usr.bin/make/unit-tests/directive-include-guard.mk
1.20+10-8usr.bin/make/unit-tests/varmod-range.mk
1.23+7-5usr.bin/make/unit-tests/varmod-range.exp
1.42+4-4usr.bin/make/unit-tests/varmod-ifelse.mk
1.9+4-4usr.bin/make/unit-tests/cmd-errors-lint.mk
+49-672 files not shown
+52-688 files

LLVM/project fc9f8ecllvm/lib/Transforms/Vectorize VPlanUtils.h VPlanUtils.cpp, llvm/test/Transforms/LoopVectorize/X86 cost-model.ll

[VPlan] Expand sequential/regular UMin SCEVs in VPSCEVExpander. (#209786)

Add support for expanding SequentialUMinExpr SCEV expressions in
VPSCEVExpander.

For regular UMin expressions, the expansion unconditionally expands &
executes all operands, while the semantics of sequential UMin only
require the first operand to be evaluated unconditionally.

For sequential UMin expressions, we need to make sure potentially
UB/poison generating operands must be accounted for. Matching IR SCEV
expander, make sure that divisors of UDiv are poison-free and non-zero
inside sequential UMin. Similarly, freeze all operands other than the
first, to avoid poison from propagating.

PR: https://github.com/llvm/llvm-project/pull/209786
DeltaFile
+33-7llvm/lib/Transforms/Vectorize/VPlanUtils.cpp
+4-0llvm/lib/Transforms/Vectorize/VPlanUtils.h
+2-1llvm/test/Transforms/LoopVectorize/X86/cost-model.ll
+39-83 files

OpenBSD/src BjhFSHzshare/misc airport

   Add Gorno-Altaysk

   I flew in and out a few weeks ago to hike in the Altai mountains.
VersionDeltaFile
1.109+2-1share/misc/airport
+2-11 files

FreeBSD/ports 9b63c2ddevel/libcdada Makefile distinfo

devel/libcdada: update 0.5.2 -> 0.6.4, pet repology

Changes:        https://github.com/msune/libcdada/blob/master/CHANGELOG.md
DeltaFile
+3-3devel/libcdada/distinfo
+2-2devel/libcdada/Makefile
+5-52 files

LLVM/project 4f1d586llvm/lib/Target/RISCV RISCVPassRegistry.def RISCVTargetMachine.cpp, llvm/test/CodeGen/RISCV postra-expand-pseudo.mir

[RISCV] Port Post-RA Expand Pseudos to NewPM (#218080)

Assisted-by: AI
DeltaFile
+50-26llvm/lib/Target/RISCV/RISCVPostRAExpandPseudoInsts.cpp
+27-0llvm/test/CodeGen/RISCV/postra-expand-pseudo.mir
+9-2llvm/lib/Target/RISCV/RISCV.h
+2-2llvm/lib/Target/RISCV/RISCVTargetMachine.cpp
+1-1llvm/tools/llvm-exegesis/lib/RISCV/Target.cpp
+2-0llvm/lib/Target/RISCV/RISCVPassRegistry.def
+91-313 files not shown
+94-329 files

NetBSD/pkgsrc OFD6lVadoc CHANGES-2026

   doc: Added lang/go127 version 1.27.0
VersionDeltaFile
1.5456+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc S80wl0klang/go127 Makefile PLIST, lang/go127/patches patch-src_syscall_syscall__solaris.go patch-src_crypto_x509_root__bsd.go

   go: add Go 1.27.0 as lang/go127

   To find out what has changed in Go 1.27, read the release notes:
   https://go.dev/doc/go1.27
VersionDeltaFile
1.1+15,636-0lang/go127/PLIST
1.1+138-0lang/go127/Makefile
1.1+22-0lang/go127/patches/patch-src_cmd_dist_build.go
1.1+21-0lang/go127/patches/patch-src_crypto_x509_root__solaris.go
1.1+18-0lang/go127/patches/patch-src_crypto_x509_root__bsd.go
1.1+17-0lang/go127/patches/patch-src_syscall_syscall__solaris.go
+15,852-08 files not shown
+15,921-214 files

HardenedBSD/src 84ed654usr.sbin/hbsd-update hbsd-update-build

HBSD: Refer to the right branch in hbsd-update-build(8)

I forgot to switch this over to 15-STABLE as part of the branch
creation.

This is a direct commit to hardened/15-stable/main.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-1usr.sbin/hbsd-update/hbsd-update-build
+1-11 files

HardenedBSD/src c7a5561usr.sbin/hbsd-update hbsd-update-build

HBSD: Bump copyright on hbsd-update-build(8)

The last commit to hbsd-update-build was in 2026 to account for the
migration from self-hosted GitLab Enterprise to Radicle.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to:         15-STABLE
See-Also:       f6cd14174c3289988d2e931862c7861e420e578a
(cherry picked from commit f115cf376fbb7564d27435c9754d773614be2eb6)
Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+1-1usr.sbin/hbsd-update/hbsd-update-build
+1-11 files

HardenedBSD/src f115cf3usr.sbin/hbsd-update hbsd-update-build

HBSD: Bump copyright on hbsd-update-build(8)

The last commit to hbsd-update-build was in 2026 to account for the
migration from self-hosted GitLab Enterprise to Radicle.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to:         15-STABLE
See-Also:       f6cd14174c3289988d2e931862c7861e420e578a
DeltaFile
+1-1usr.sbin/hbsd-update/hbsd-update-build
+1-11 files

LLVM/project 0008a69llvm/lib/Transforms/Scalar InferAddressSpaces.cpp, llvm/test/Transforms/InferAddressSpaces/AMDGPU phi-cycle-uninitialized-addrspace.ll

[InferAddressSpaces] Lower stuck uninitialized values to flat before rewriting (#215525)
DeltaFile
+272-0llvm/test/Transforms/InferAddressSpaces/AMDGPU/phi-cycle-uninitialized-addrspace.ll
+64-25llvm/lib/Transforms/Scalar/InferAddressSpaces.cpp
+336-252 files

FreeBSD/ports ed98acbnet/openbgpd9 Makefile distinfo

net/openbgpd9: update 9.0 -> 9.2, pet repology

Changes:        https://marc.info/?l=openbgpd-users&m=177609375615696&w=2
                https://marc.info/?l=openbgpd-users&m=178602249930439&w=2
(cherry picked from commit 7f4dacb1add7ab4d6a4ff5fd28aeaac88f17db09)
DeltaFile
+3-3net/openbgpd9/distinfo
+1-1net/openbgpd9/Makefile
+4-42 files

HardenedBSD/src 3a0459bsys/dev/sound/pci hdspe-pcm.c

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-9sys/dev/sound/pci/hdspe-pcm.c
+0-91 files

HardenedBSD/src e8eba0dlib/libc/stdlib bsearch.3, lib/libc/tests/stdlib bsearch_b_test.c bsearch_test.c

Merge remote-tracking branch 'rad/freebsd/current/main' into hardened/current/master

Conflicts:
        sys/dev/sound/pci/hdspe-pcm.c (unresolved)
DeltaFile
+134-0lib/libc/tests/stdlib/bsearch_s_test.c
+103-5lib/libc/stdlib/bsearch.3
+92-0lib/libc/tests/stdlib/bsearch_test.c
+58-0lib/libc/tests/stdlib/bsearch_b_test.c
+42-15sys/dev/dpaa/dpaa_eth.c
+37-18usr.sbin/bhyve/pci_hda.c
+466-3811 files not shown
+621-4917 files

FreeBSD/ports 266679acad/gerbv distinfo Makefile

cad/gerbv: update 2.10.0 -> 2.13.0, pet repology

- project switched to cmake

Changes:        https://gerbv.github.io/
DeltaFile
+164-12cad/gerbv/pkg-plist
+6-23cad/gerbv/Makefile
+3-3cad/gerbv/distinfo
+173-383 files

LLVM/project 1411f47llvm/lib/Target/DirectX DXIL.td DXILOpLowering.cpp, llvm/test/CodeGen/DirectX CreateHandleHeap.ll CreateHandleHeap-NURI.ll

[DirectX] Lower `llvm.dx.resource.handlefromheap` intrinsic (#216459)

Add lowering of `llvm.dx.resource.handlefromheap` intrinsic. It gets
translated to DXIL ops `createHandleFromHeap` and `annotateHandle`.

For example, the intrinsic call

```llvm
%typed = call target("dx.TypedBuffer", <4 x float>, 1, 0, 0)
    @llvm.dx.resource.handlefromheap.tdx.TypedBuffer_v4f32_1_0_0(i32 3)
```

will lower to

```llvm
%0 = call %dx.types.Handle @dx.op.createHandleFromHeap(i32 218, i32 3, i1 false, i1 false)
%1 = call %dx.types.Handle @dx.op.annotateHandle(i32 216, %dx.types.Handle %0,
         %dx.types.ResourceProperties { i32 4106, i32 1033 })
```

    [4 lines not shown]
DeltaFile
+46-0llvm/lib/Target/DirectX/DXILOpLowering.cpp
+32-0llvm/test/CodeGen/DirectX/CreateHandleHeap.ll
+32-0llvm/test/CodeGen/DirectX/CreateHandleHeap-NURI.ll
+8-0llvm/lib/Target/DirectX/DXIL.td
+118-04 files

FreeBSD/ports 7f4dacbnet/openbgpd9 Makefile distinfo

net/openbgpd9: update 9.0 -> 9.2, pet repology

Changes:        https://marc.info/?l=openbgpd-users&m=177609375615696&w=2
                https://marc.info/?l=openbgpd-users&m=178602249930439&w=2
DeltaFile
+3-3net/openbgpd9/distinfo
+1-1net/openbgpd9/Makefile
+4-42 files

HardenedBSD/ports c0d161bdevel/cpu_rec_rs Makefile.crates distinfo, security/kanidm Makefile.crates distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+677-677www/mattermost-webapp/pkg-plist
+277-271security/kanidm/distinfo
+137-134security/kanidm/Makefile.crates
+103-107devel/cpu_rec_rs/distinfo
+89-85security/vaultwarden/distinfo
+50-51devel/cpu_rec_rs/Makefile.crates
+1,333-1,325167 files not shown
+1,967-1,834173 files

HardenedBSD/ports 0aefd8asecurity/lego Makefile distinfo

security/lego: Update 5.3.1 => 5.4.0

Changelog:
https://github.com/go-acme/lego/blob/v5.4.0/CHANGELOG.md

PR:             297764
Sponsored by:   UNIS Labs
DeltaFile
+5-5security/lego/distinfo
+1-2security/lego/Makefile
+6-72 files

FreeBSD/ports 0aefd8asecurity/lego Makefile distinfo

security/lego: Update 5.3.1 => 5.4.0

Changelog:
https://github.com/go-acme/lego/blob/v5.4.0/CHANGELOG.md

PR:             297764
Sponsored by:   UNIS Labs
DeltaFile
+5-5security/lego/distinfo
+1-2security/lego/Makefile
+6-72 files

NetBSD/pkgsrc rVQXvBiemulators/ntvcm/files ntvcm.1

   Fix another formatting error (wrong indentation).

   Spotted and patch provided by John D. Baker - thanks!
VersionDeltaFile
1.3+3-3emulators/ntvcm/files/ntvcm.1
+3-31 files

NetBSD/pkgsrc 21ofHFXdoc CHANGES-2026

   doc: Updated devel/sem to 0.23.0
VersionDeltaFile
1.5455+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc XvvhLzSdevel/sem cargo-crates.mk distinfo

   devel/sem: update to 0.23.0

   [0.23.0] - 2026-08-22
   Changed

       C++ and Python's precomputed-facts fast paths are now opt-in (SEM_MUL_CPP=1, SEM_MUL_PYTHON=1), and Rust's stays opt-in (SEM_MUL_RUST=1). These fast paths trade memory for speed by skipping a second parse of files whose facts are already known. Re-measuring peak memory footprint (the metric that actually tracks memory pressure and swap risk, as opposed to resident-set size, which can look artificially low once memory has been compressed) found C++ costing ~25-28% more than a default build on llvm-project and Python ~22-25% more on home-assistant/core — both above the project's +15% admission ceiling, even after a follow-up trim narrowed the gap. Rust independently re-measured at ~33% over. Cold builds on large C++/Python repos are correspondingly slower by default than in 0.22.1, but use less memory; set the relevant env var if you have RAM headroom and want the speed.
       Go's fast path is now on by default, no configuration needed. It cleared the same ceiling (+6.8% to +8.5% peak memory footprint on Kubernetes, well under +15%) once the correctness fixes below landed, and delivers a 12-17% faster cold build on Kubernetes as a result.

   Fixed

       Go call resolution no longer merges same-named packages from different API groups. Kubernetes has dozens of packages literally named v1 — one per API group (kubeadm, bootstraptoken, pod-security-admission, and more) — and import resolution used to key packages only by their bare directory name, so a call like DeepCopyInto from one API group's type could resolve to a same-named method in a completely unrelated package. Packages are now disambiguated by their full import path. This alone removes roughly 32,000 false cross-package edges on Kubernetes, and (combined with the fix below) makes Kubernetes cold builds 28-30% faster.
       Go resolution no longer confuses a source file's own name with a standard-library package it happens to share a name with. Large Go codebases routinely contain files literally named os.go or time.go; a secondary lookup route used to treat a file's own bare filename as if it were an importable package, so calls like os.Stat() or time.Now() could resolve to the local file instead of the real standard-library package. That route has been removed entirely — only the correct, directory-based lookup remains.
       Rust call resolution no longer confuses an external standard-library import with a same-named local module. use std::cmp; followed by cmp::max(...) could previously resolve to an unrelated local cmp.rs instead of the real standard-library function. Imports rooted at std/core/alloc are now excluded from local-module matching outright (an external import can never legitimately resolve to a file in your own repo), and a genuine same-named local-module collision is now disambiguated per the specific item being called rather than per whole-file bucket, falling back to an honest miss instead of guessing when it can't be told apart.
       Fixed a scope-resolution precedence bug affecting every supported language: a nested closure or sibling function could resolve a call to the wrong same-named target — for example, a TypeScript call landing on a sibling closure's function of the same name instead of the one actually being called. A function's own locally declared bindings now always take precedence over an outer scope's binding of the same name, and nested locals inside a plain function (not just a class or module) are now registered for lookup at all, closing a gap where they were invisible to their own siblings.
       Go's cross-file method resolution is now internally consistent when the fast path is enabled. Rewriting a method's identity to reflect its true cross-file package location left other places that cache that identity out of date, which could push a call through an unrelated fallback path instead of the correct local lookup. Every place an entity's identity is cached is now kept in sync with the rewrite, and the fast-path build is now bit-identical to the default build on Kubernetes.
       Multi-document YAML files (----separated) no longer lose entities to id collisions. Top-level keys sharing a name across different documents in the same file used to collapse onto one generated id, silently dropping all but one from the graph — including whether it was a test. Each document is now part of the generated id whenever a real collision exists; ordinary single-document files are unaffected.
       sem entities's index-backed listings no longer come back empty on Windows. An absolute path built by ordinary path-joining wasn't normalized the same way as the repository root before comparison, and Windows always prepends its extended-path marker during normalization, so the two could never match. Two related normalization gaps in the MCP server and the index reader were fixed alongside it.
       Fixed a parse-cache test flake caused by tests sharing global cache state under parallel execution; the cache is now injectable per test/thread, with no change to production behavior.
       sem setup no longer installs a SessionStart hook that forks mcp --resident. That resident server was deleted in 0.22.0 (--resident is kept only as a no-op flag for old installs), so every fresh sem setup was forking a process that does nothing, once per Claude Code session. sem setup now installs only the UserPromptSubmit hook (sem hook prompt-submit); sem unsetup still recognizes and removes a legacy mcp --resident SessionStart hook from an older install.

    [20 lines not shown]
VersionDeltaFile
1.1+409-0devel/sem/cargo-depends.mk
1.7+6-5devel/sem/Makefile
1.7+4-4devel/sem/distinfo
1.6+1-1devel/sem/cargo-crates.mk
+420-104 files

OpenBSD/src EUIuA0pdistrib/sets/lists/base md.sparc64, distrib/sets/lists/comp md.sparc64 clang.sparc64

   sync
VersionDeltaFile
1.29+0-604distrib/sets/lists/comp/gcc.sparc64
1.1065+0-6distrib/sets/lists/base/md.sparc64
1.44+2-0distrib/sets/lists/comp/clang.sparc64
1.124+0-1distrib/sets/lists/comp/md.sparc64
+2-6114 files

HardenedBSD/ports b98f58cgraphics/mesa-dri pkg-plist Makefile

graphics/mesa-dri: fix panfrost packaging on aarch64

While here, allow VMWare svga driver on aarch64

Approved by:    x11 (arrowd)
DeltaFile
+3-1graphics/mesa-dri/Makefile
+2-0graphics/mesa-dri/pkg-plist
+5-12 files