BSD Commit Log Search

security/vuxml: Document njs XML canonicalization vulnerability

CVE-2026-78689, fixed in njs 1.0.1.

Sponsored by:   Netzkommune GmbH

dns/nsd: Update 4.15.1 => 4.15.2

Release Notes:
https://community.nlnetlabs.nl/t/nsd-4-15-2-released/3451

PR:             298140
Reported by:    Jaap Akkerhuis <jaap at NLnetLabs.nl> (maintainer)
Approved by:    osa, vvd (Mentors, implicit)
MFH:            2026Q3

(cherry picked from commit e5b6b785df35dcb504218ee8f269821b7c6ad161)

dns/nsd: Update 4.15.1 => 4.15.2

Release Notes:
https://community.nlnetlabs.nl/t/nsd-4-15-2-released/3451

PR:             298140
Reported by:    Jaap Akkerhuis <jaap at NLnetLabs.nl> (maintainer)
Approved by:    osa, vvd (Mentors, implicit)
MFH:            2026Q3

www/nginx-devel: Update to 1.31.5

Changes with nginx 1.31.5                                        02 Sep
2026

    *) Feature: control API.

    *) Feature: predicate locations.

    *) Feature: the ngx_http_json_module.

    *) Feature: the "client_body_early_read" directive.

    *) Bugfix: use-after-free might occur in a worker process if
proxying
       with buffering was used and an error occurred while sending the
       response to an HTTP/2 client.

    *) Bugfix: a worker process might not exit or "accept4() failed (9:

    [13 lines not shown]

games/veloren-weekly: update to s20260902

Changes:        https://gitlab.com/veloren/veloren/-/compare/1292019541...f64ec65731
(cherry picked from commit 2a2e9d1ec0e41f6c7600d35a84dd568c40a2e784)

games/veloren-weekly: update to s20260902

Changes:        https://gitlab.com/veloren/veloren/-/compare/1292019541...f64ec65731

www/{nginx,nginx-devel,freenginx}: 3rd-party modules management

Chase the www/nginx-module-njs update to 1.0.1, which contains
security fixes.  Bump PORTREVISION so the packages pick up the new
module.

Sponsored by:   Netzkommune GmbH

www/nginx-module-njs: Update to 1.0.1

This release contains security fixes: an access control bypass in
js_access when an asynchronous request body continuation threw an
exception, a worker process crash when reading Response.statusText, a
heap buffer overflow in XML exclusive canonicalization and a stack
buffer overflow when exporting large RSA keys to JWK in WebCrypto.
Upstream has not assigned CVE numbers.

Changes:        https://nginx.org/en/docs/njs/changes.html

Sponsored by:   Netzkommune GmbH

devel/libnjs: Update to 1.0.1

This release contains security fixes: a heap buffer overflow while
parsing namespace prefix lists in XML exclusive canonicalization and a
stack buffer overflow when exporting RSA keys larger than 4096 bits to
JWK in WebCrypto.  Upstream has not assigned CVE numbers.

Changes:        https://nginx.org/en/docs/njs/changes.html

Sponsored by:   Netzkommune GmbH

lang/njs: Update to 1.0.1

This release contains security fixes: a heap buffer overflow while
parsing namespace prefix lists in XML exclusive canonicalization and a
stack buffer overflow when exporting RSA keys larger than 4096 bits to
JWK in WebCrypto.  Upstream has not assigned CVE numbers.

Changes:        https://nginx.org/en/docs/njs/changes.html

Sponsored by:   Netzkommune GmbH

sysutils/mstflint: update to 4.37.0.1

Sponsored by:   Netflix

graphics/mesa*: update to 26.2.2

PR:             298129
Approved by:    x11 (arrowd, maintainer)

Sponsored by:   tipi.work

biology/py-macs2: Remove

MACS2 is dead upstream, with no plans to make it compatible with
cython 3.x or other newer dependencies.  Though the port was
set to expire in another month, I'm removing it now to stop wasting
package building resources.  It has not been buildable for some time.

(cherry picked from commit 08256be5a8582d2a23383495dc6a1ab477da3f97)

irc/quassel: regen distinfo

Reported by:    pkg-fallout

www/linux-widevine-cdm: update to 4.10.3057.0 release

Approved by:    arrowdOA

www/linux-chrome: update to 152.0.7977.75 stable release

www/linux-brave: update to 1.94.117 stable release

www/freenginx-acme: update freenginx distro

Bump PORTREVISION.

Sponsored by:   tipi.work

science/anari: fix "unknown ISA" on 144i386

Reported by:    pkg-fallout

security/vuxml: Document electron42 multiple vulnerabilities

Obtained from:  https://github.com/electron/electron/releases/tag/v42.11.1

math/R-cran-mitools: Update to 2.7

textproc/R-cran-writexl: Update to 2.0.1

textproc/R-cran-openxlsx: Update to 4.2.9

www/tikiwiki: Update to 30.1

devel/gwm: Update to 1.10.0

devel/pyenv: Update to 2.8.5

security/y509: Update to 1.0.4

finance/nextcloud-cospend: Update to 4.1.3

textproc/krep: Update 3.0.1 => 3.0.2

net/activemq: Update 6.3.1 => 6.3.2

Release Notes:
https://activemq.apache.org/components/classic/download/classic-06-03-02

Reported by:    portscout
Sponsored by:   UNIS Labs