FreeBSD/ports 66081ddsecurity/vuxml/vuln 2026.xml

security/vuxml: Document njs XML canonicalization vulnerability

CVE-2026-78689, fixed in njs 1.0.1.

Sponsored by:   Netzkommune GmbH
DeltaFile
+38-0security/vuxml/vuln/2026.xml
+38-01 files

FreeBSD/ports 67cd26ddns/nsd Makefile distinfo

dns/nsd: Update 4.15.1 => 4.15.2

Release Notes:
https://community.nlnetlabs.nl/t/nsd-4-15-2-released/3451

PR:             298140
Reported by:    Jaap Akkerhuis <jaap at NLnetLabs.nl> (maintainer)
Approved by:    osa, vvd (Mentors, implicit)
MFH:            2026Q3

(cherry picked from commit e5b6b785df35dcb504218ee8f269821b7c6ad161)
DeltaFile
+3-3dns/nsd/distinfo
+1-1dns/nsd/Makefile
+4-42 files

FreeBSD/ports e5b6b78dns/nsd Makefile distinfo

dns/nsd: Update 4.15.1 => 4.15.2

Release Notes:
https://community.nlnetlabs.nl/t/nsd-4-15-2-released/3451

PR:             298140
Reported by:    Jaap Akkerhuis <jaap at NLnetLabs.nl> (maintainer)
Approved by:    osa, vvd (Mentors, implicit)
MFH:            2026Q3
DeltaFile
+3-3dns/nsd/distinfo
+1-1dns/nsd/Makefile
+4-42 files

FreeBSD/ports 3873173www/nginx-acme Makefile distinfo, www/nginx-devel Makefile version.mk

www/nginx-devel: Update to 1.31.5

Changes with nginx 1.31.5                                        02 Sep
2026

    *) Feature: control API.

    *) Feature: predicate locations.

    *) Feature: the ngx_http_json_module.

    *) Feature: the "client_body_early_read" directive.

    *) Bugfix: use-after-free might occur in a worker process if
proxying
       with buffering was used and an error occurred while sending the
       response to an HTTP/2 client.

    *) Bugfix: a worker process might not exit or "accept4() failed (9:

    [13 lines not shown]
DeltaFile
+3-3www/nginx-devel/distinfo
+3-3www/nginx-acme/distinfo
+1-1www/nginx-devel/version.mk
+1-1www/nginx-acme/Makefile
+0-1www/nginx-devel/Makefile
+8-95 files

FreeBSD/ports 60f848fgames/veloren-weekly Makefile distinfo

games/veloren-weekly: update to s20260902

Changes:        https://gitlab.com/veloren/veloren/-/compare/1292019541...f64ec65731
(cherry picked from commit 2a2e9d1ec0e41f6c7600d35a84dd568c40a2e784)
DeltaFile
+3-3games/veloren-weekly/distinfo
+2-2games/veloren-weekly/Makefile
+5-52 files

FreeBSD/ports 2a2e9d1games/veloren-weekly Makefile distinfo

games/veloren-weekly: update to s20260902

Changes:        https://gitlab.com/veloren/veloren/-/compare/1292019541...f64ec65731
DeltaFile
+3-3games/veloren-weekly/distinfo
+2-2games/veloren-weekly/Makefile
+5-52 files

FreeBSD/ports 5329ac5www/freenginx Makefile.extmod Makefile, www/nginx Makefile.extmod Makefile

www/{nginx,nginx-devel,freenginx}: 3rd-party modules management

Chase the www/nginx-module-njs update to 1.0.1, which contains
security fixes.  Bump PORTREVISION so the packages pick up the new
module.

Sponsored by:   Netzkommune GmbH
DeltaFile
+1-1www/nginx/Makefile.extmod
+1-1www/nginx/Makefile
+1-1www/nginx-devel/Makefile.extmod
+1-1www/nginx-devel/Makefile
+1-1www/freenginx/Makefile.extmod
+1-1www/freenginx/Makefile
+6-66 files

FreeBSD/ports 537d202www/nginx-module-njs Makefile distinfo

www/nginx-module-njs: Update to 1.0.1

This release contains security fixes: an access control bypass in
js_access when an asynchronous request body continuation threw an
exception, a worker process crash when reading Response.statusText, a
heap buffer overflow in XML exclusive canonicalization and a stack
buffer overflow when exporting large RSA keys to JWK in WebCrypto.
Upstream has not assigned CVE numbers.

Changes:        https://nginx.org/en/docs/njs/changes.html

Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3www/nginx-module-njs/distinfo
+1-1www/nginx-module-njs/Makefile
+4-42 files

FreeBSD/ports 7f8383fdevel/libnjs Makefile distinfo

devel/libnjs: Update to 1.0.1

This release contains security fixes: a heap buffer overflow while
parsing namespace prefix lists in XML exclusive canonicalization and a
stack buffer overflow when exporting RSA keys larger than 4096 bits to
JWK in WebCrypto.  Upstream has not assigned CVE numbers.

Changes:        https://nginx.org/en/docs/njs/changes.html

Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3devel/libnjs/distinfo
+1-1devel/libnjs/Makefile
+4-42 files

FreeBSD/ports 5d6f5aclang/njs Makefile distinfo

lang/njs: Update to 1.0.1

This release contains security fixes: a heap buffer overflow while
parsing namespace prefix lists in XML exclusive canonicalization and a
stack buffer overflow when exporting RSA keys larger than 4096 bits to
JWK in WebCrypto.  Upstream has not assigned CVE numbers.

Changes:        https://nginx.org/en/docs/njs/changes.html

Sponsored by:   Netzkommune GmbH
DeltaFile
+3-3lang/njs/distinfo
+1-1lang/njs/Makefile
+4-42 files

FreeBSD/ports 173d7afsysutils/mstflint Makefile pkg-plist

sysutils/mstflint: update to 4.37.0.1

Sponsored by:   Netflix
DeltaFile
+3-3sysutils/mstflint/distinfo
+3-2sysutils/mstflint/pkg-plist
+1-1sysutils/mstflint/Makefile
+7-63 files

FreeBSD/ports 29df97dgraphics/mesa-dri Makefile Makefile.common

graphics/mesa*: update to 26.2.2

PR:             298129
Approved by:    x11 (arrowd, maintainer)

Sponsored by:   tipi.work
DeltaFile
+3-3graphics/mesa-dri/distinfo
+1-1graphics/mesa-dri/Makefile.common
+0-1graphics/mesa-dri/Makefile
+4-53 files

FreeBSD/ports 5e7080fbiology Makefile, biology/py-macs2 distinfo pkg-descr

biology/py-macs2: Remove

MACS2 is dead upstream, with no plans to make it compatible with
cython 3.x or other newer dependencies.  Though the port was
set to expire in another month, I'm removing it now to stop wasting
package building resources.  It has not been buildable for some time.

(cherry picked from commit 08256be5a8582d2a23383495dc6a1ab477da3f97)
DeltaFile
+0-40biology/py-macs2/Makefile
+0-4biology/py-macs2/pkg-descr
+0-3biology/py-macs2/distinfo
+0-1biology/Makefile
+0-484 files

FreeBSD/ports 78e6147irc/quassel distinfo

irc/quassel: regen distinfo

Reported by:    pkg-fallout
DeltaFile
+3-3irc/quassel/distinfo
+3-31 files

FreeBSD/ports 7732a44www/linux-widevine-cdm Makefile distinfo

www/linux-widevine-cdm: update to 4.10.3057.0 release

Approved by:    arrowdOA
DeltaFile
+5-5www/linux-widevine-cdm/distinfo
+2-3www/linux-widevine-cdm/Makefile
+7-82 files

FreeBSD/ports e9a4c00www/linux-chrome Makefile pkg-plist

www/linux-chrome: update to 152.0.7977.75 stable release
DeltaFile
+5-5www/linux-chrome/distinfo
+1-3www/linux-chrome/pkg-plist
+1-1www/linux-chrome/Makefile
+7-93 files

FreeBSD/ports f4f2f98www/linux-brave pkg-plist Makefile

www/linux-brave: update to 1.94.117 stable release
DeltaFile
+5-5www/linux-brave/distinfo
+0-2www/linux-brave/pkg-plist
+1-1www/linux-brave/Makefile
+6-83 files

FreeBSD/ports 8c330f8www/freenginx-acme Makefile distinfo

www/freenginx-acme: update freenginx distro

Bump PORTREVISION.

Sponsored by:   tipi.work
DeltaFile
+3-3www/freenginx-acme/distinfo
+1-1www/freenginx-acme/Makefile
+4-42 files

FreeBSD/ports 75bc7c1science/anari Makefile

science/anari: fix "unknown ISA" on 144i386

Reported by:    pkg-fallout
DeltaFile
+8-1science/anari/Makefile
+8-11 files

FreeBSD/ports 33fb37fsecurity/vuxml/vuln 2026.xml

security/vuxml: Document electron42 multiple vulnerabilities

Obtained from:  https://github.com/electron/electron/releases/tag/v42.11.1
DeltaFile
+44-0security/vuxml/vuln/2026.xml
+44-01 files

FreeBSD/ports ec0f22bmath/R-cran-mitools Makefile distinfo

math/R-cran-mitools: Update to 2.7
DeltaFile
+3-3math/R-cran-mitools/distinfo
+1-2math/R-cran-mitools/Makefile
+4-52 files

FreeBSD/ports 997de05textproc/R-cran-writexl Makefile distinfo

textproc/R-cran-writexl: Update to 2.0.1
DeltaFile
+3-3textproc/R-cran-writexl/distinfo
+1-1textproc/R-cran-writexl/Makefile
+4-42 files

FreeBSD/ports 2a1b79ftextproc/R-cran-openxlsx Makefile distinfo

textproc/R-cran-openxlsx: Update to 4.2.9
DeltaFile
+3-3textproc/R-cran-openxlsx/distinfo
+1-1textproc/R-cran-openxlsx/Makefile
+4-42 files

FreeBSD/ports bcbfbe2www/tikiwiki Makefile distinfo

www/tikiwiki: Update to 30.1
DeltaFile
+3-3www/tikiwiki/distinfo
+1-1www/tikiwiki/Makefile
+4-42 files

FreeBSD/ports 493f475devel/gwm Makefile Makefile.crates

devel/gwm: Update to 1.10.0
DeltaFile
+13-13devel/gwm/distinfo
+5-5devel/gwm/Makefile.crates
+1-1devel/gwm/Makefile
+19-193 files

FreeBSD/ports 41a8aa0devel/pyenv Makefile distinfo

devel/pyenv: Update to 2.8.5
DeltaFile
+3-3devel/pyenv/distinfo
+4-2devel/pyenv/pkg-plist
+1-1devel/pyenv/Makefile
+8-63 files

FreeBSD/ports 7a6ee7dsecurity/y509 Makefile distinfo

security/y509: Update to 1.0.4
DeltaFile
+5-5security/y509/distinfo
+1-2security/y509/Makefile
+6-72 files

FreeBSD/ports 40b1334finance/nextcloud-cospend Makefile distinfo

finance/nextcloud-cospend: Update to 4.1.3
DeltaFile
+3-3finance/nextcloud-cospend/distinfo
+1-1finance/nextcloud-cospend/Makefile
+4-42 files

FreeBSD/ports 9947b1dtextproc/krep Makefile distinfo

textproc/krep: Update 3.0.1 => 3.0.2
DeltaFile
+3-3textproc/krep/distinfo
+1-1textproc/krep/Makefile
+4-42 files

FreeBSD/ports 326ce8enet/activemq Makefile distinfo

net/activemq: Update 6.3.1 => 6.3.2

Release Notes:
https://activemq.apache.org/components/classic/download/classic-06-03-02

Reported by:    portscout
Sponsored by:   UNIS Labs
DeltaFile
+3-3net/activemq/distinfo
+1-1net/activemq/Makefile
+4-42 files