databases/mysql97-{client,server}: Update to 9.7.2
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 43 of the 54 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
Drop patch-libs_mysql_gtid_tag__plain.h, the type_traits include
is upstream as of 9.7.2.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html
Security: 10f5f76e-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
(cherry picked from commit e04b81ba66c8f185ffc21337c18161ac69bff145)
databases/mysql97-{client,server}: Update to 9.7.2
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 43 of the 54 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
Drop patch-libs_mysql_gtid_tag__plain.h, the type_traits include
is upstream as of 9.7.2.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html
Security: 10f5f76e-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql84-{client,server}: Update to 8.4.11
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 31 of the 54 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-11.html
Security: 10f5d195-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026
The Oracle Critical Patch Update of July 2026 fixes 54 issues in
Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series,
including the MySQL Router shipped with the server ports.
Three issues require no credentials: one in the X Plugin and two in
MySQL Router, the latter of which allows unauthorized read and write
access. The remaining ones mostly need a privileged account and lead
to a denial of service.
Fixed in 8.4.11 and 9.7.2 respectively.
Sponsored by: Netzkommune GmbH
games/anki: Update to 26.08
* Switch to USES=npm and adjust/remove the relevant parts.
Although Yarn v4 is already being used according to "package.json",
stick with Yarn v1 for now to complete a 1:1 migration from the before
to the after state with respect to the used tools during build.
Changelog:
https://github.com/ankitects/anki/releases/tag/26.08
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
(cherry picked from commit 87d11fd7305cb245dff284e34be3a5c0c423aa60)
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
lang/ldc: add new bootstrap for powerpc64le after long double switch
Two new patches:
1. Don't use glibc's dual long double mechanism - we don't support
IBM long double.
2. Use proper mangling.
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Fix build and loading of the 3rd party gridfs module after the
devel/mongo-c-driver 2.x update.
The module config now obtains include and linker flags from
pkg-config instead of deriving them from the ports tree's
DISTVERSION. The previous approach ran a recursive make into
devel/mongo-c-driver on every make invocation, even with GRIDFS
unset, and derived the libbson include path from the mongo-c-driver
version although devel/libbson is a separate port with its own
DISTVERSION. Both directories happen to carry the same version
today, so the mismatch was not visible yet.
While here, add the missing assert.h include. The module calls
assert() without declaring it, which left an unresolvable symbol
"assert" in the shared object -- libc only exports __assert. Since
nginx dlopen()s modules with RTLD_NOW, load_module refused to load
the module at runtime.
[5 lines not shown]
security/vuxml: Fix affected port version of mail/thunderbird by CVE-2026-6778
Although mail/thunderbird does not actually have PORTEPOCH, one is included in vuxml.
As a result, even fixed versions were still incorrectly reported as vulnerable.
The incorrect report was as follows:
===> thunderbird-153.0.2 has known vulnerabilities:
thunderbird-153.0.2 is vulnerable:
Mozilla -- Invalid pointer
CVE: CVE-2026-6778
WWW: https://vuxml.FreeBSD.org/freebsd/5124ce36-430a-11f1-a627-b42e991fc52e.html
