HardenedBSD/src 975c58alibexec/flua Makefile, libexec/flua/modules lposix.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+32-0sbin/ifconfig/tests/ifconfig.sh
+21-4usr.sbin/cpucontrol/cpucontrol.c
+6-10sbin/ifconfig/iffib.c
+8-4libexec/flua/modules/lposix.c
+2-1sbin/ifconfig/tests/Makefile
+0-1libexec/flua/Makefile
+69-206 files

HardenedBSD/src 768d2f2libexec/flua Makefile, libexec/flua/modules lposix.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+32-0sbin/ifconfig/tests/ifconfig.sh
+21-4usr.sbin/cpucontrol/cpucontrol.c
+6-10sbin/ifconfig/iffib.c
+8-4libexec/flua/modules/lposix.c
+2-1sbin/ifconfig/tests/Makefile
+0-1libexec/flua/Makefile
+69-206 files

HardenedBSD/ports 9b62750www/deno distinfo Makefile.crates, www/deno/files patch-build_config_compiler_BUILD.gn patch-cli_task_runner.rs

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+441-325www/deno/distinfo
+219-161www/deno/Makefile.crates
+72-54www/deno/files/patch-build_config_compiler_BUILD.gn
+26-47www/deno/files/patch-cli_task_runner.rs
+29-0www/deno/files/patch-tests_util_server_src_servers_mod.rs
+16-13www/deno/Makefile
+803-60046 files not shown
+1,018-71352 files

HardenedBSD/src 59bbb62usr.sbin/cpucontrol cpucontrol.c

cpucontrol: Be more strict with input validation

Avoid truncating 32-bit values.  This would have saved me a bit of time
when I was looking at a cpuid leaf on my system and typed 0x80000001f
instead of 0x8000001f.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D54919
DeltaFile
+21-4usr.sbin/cpucontrol/cpucontrol.c
+21-41 files

HardenedBSD/ports efa59bbsysutils/fluent-bit Makefile, sysutils/fluent-bit/files fluent-bit.in

sysutils/fluent-bit: Improve RC script and fix issues

* Document 'fluent_bit_group' variable
* Install PID file with mode 0600 instead of 0755
* Reuse ${name}
* Pass '-t {name}' to daemon(8)
* Remove self-created PID file

PR:             292782
MFH:            2026Q1
Approved by:    girgen (maintainer)
DeltaFile
+10-3sysutils/fluent-bit/files/fluent-bit.in
+1-1sysutils/fluent-bit/Makefile
+11-42 files

HardenedBSD/ports a8cce21security/vuxml/vuln 2026.xml

security/vuxml: Add firefox vulnerabilities

 * CVE-2026-24868
 * CVE-2026-24869
DeltaFile
+29-0security/vuxml/vuln/2026.xml
+29-01 files

HardenedBSD/ports 1884bfasysutils Makefile, sysutils/py-ansible-core220 Makefile pkg-descr

HBSD: Revert "sysutils/py-ansible-core220: Add new port"

This reverts commit 2b0cca695ede66c78626c5bc687a6f9798209691. This
commit by upstream FreeBSD breaks the build.

Signed-off-by: Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-95sysutils/py-ansible-core220/Makefile
+0-9sysutils/py-ansible-core220/files/patch-pyproject.toml
+0-5sysutils/py-ansible-core220/pkg-descr
+0-3sysutils/py-ansible-core220/distinfo
+0-1sysutils/Makefile
+0-1135 files

HardenedBSD/src 2ea85a6sbin/ifconfig iffib.c, sbin/ifconfig/tests ifconfig.sh Makefile

ifconfig: Exit with a non-zero status when SIOCSIFFIB fails

Previously, setting an interface FIB to some invalid value would result
in a warning being printed, but the ifconfig command would exit with
status 0, but this is wrong.

Add a little regression test.

Reviewed by:    pouria, zlei, melifaro
MFC after:      2 weeks
Sponsored by:   Stormshield
Sponsored by:   Klara, Inc.
Differential Revision:  https://reviews.freebsd.org/D54918
DeltaFile
+32-0sbin/ifconfig/tests/ifconfig.sh
+6-10sbin/ifconfig/iffib.c
+2-1sbin/ifconfig/tests/Makefile
+40-113 files

HardenedBSD/ports 9c27bb8dns/dnscontrol distinfo Makefile

dns/dnscontrol: Update to 4.32.0
DeltaFile
+5-5dns/dnscontrol/distinfo
+1-1dns/dnscontrol/Makefile
+6-62 files

HardenedBSD/ports 17069d2www/forgejo distinfo Makefile

www/forgejo: Update to 14.0.1

MFH:            2026Q1
DeltaFile
+3-3www/forgejo/distinfo
+1-1www/forgejo/Makefile
+4-42 files

HardenedBSD/ports 3e4ca57www/forgejo-lts distinfo Makefile

www/forgejo-lts: Update to 11.0.10

MFH:            2026Q1
DeltaFile
+3-3www/forgejo-lts/distinfo
+1-2www/forgejo-lts/Makefile
+4-52 files

HardenedBSD/src b41b6fdlibexec/flua Makefile, libexec/flua/modules lposix.c

flua: lposix: fix WARNS=6 issues

lposix is the last holdout of modules built into flua until we can fix
the module design to have the right parts require()able.  Address a
valid bug in lua_read() found at a higher WARNS and drop the override
entirely.  Some of the modules could possibly be re-evaluated.

Fixes:  c2caf3b3313 ("flua: lposix: add more useful functions [...]")
Reported by:    des
Reviewed by:    des
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
DeltaFile
+8-4libexec/flua/modules/lposix.c
+0-1libexec/flua/Makefile
+8-52 files

HardenedBSD/ports b8866a1net-im/gotosocial distinfo Makefile

net-im/gotosocial: Update 0.20.2 => 0.20.3

Changelog:
https://codeberg.org/superseriousbusiness/gotosocial/releases/tag/v0.20.3

PR:     292772
MFH:    2026Q1
DeltaFile
+5-5net-im/gotosocial/distinfo
+1-2net-im/gotosocial/Makefile
+6-72 files

HardenedBSD/src 0734e0astand/common nvstore.c, stand/defaults loader.conf

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+5-7sys/dev/acpica/acpi.c
+4-1sys/dev/acpica/acpi_spmc.c
+1-1stand/defaults/loader.conf
+1-1stand/libsa/zfs/zfs.c
+1-1stand/common/nvstore.c
+1-1sys/dev/aic7xxx/ahc_pci.c
+13-121 files not shown
+14-127 files

HardenedBSD/src bd8af70stand/common nvstore.c, stand/defaults loader.conf

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+5-7sys/dev/acpica/acpi.c
+4-1sys/dev/acpica/acpi_spmc.c
+1-1stand/common/nvstore.c
+1-1stand/libsa/zfs/zfs.c
+1-1stand/defaults/loader.conf
+1-1sys/dev/aic7xxx/ahc_pci.c
+13-121 files not shown
+14-127 files

HardenedBSD/ports 0771d44databases/tredis distinfo Makefile, deskutils/skim distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+561-0databases/tredis/distinfo
+159-159sysutils/mise/distinfo
+301-0databases/tredis/Makefile
+79-79sysutils/mise/Makefile
+51-51lang/rust/distinfo
+25-17deskutils/skim/distinfo
+1,176-306737 files not shown
+2,180-958743 files

HardenedBSD/ports 8f9b84awww/deno distinfo Makefile.crates, www/deno/files patch-build_config_compiler_BUILD.gn patch-cli_task_runner.rs

www/deno: Update to 2.6.6

Obtained from:  OpenBSD (Volker Schlecht)
DeltaFile
+441-325www/deno/distinfo
+219-161www/deno/Makefile.crates
+72-54www/deno/files/patch-build_config_compiler_BUILD.gn
+26-47www/deno/files/patch-cli_task_runner.rs
+29-0www/deno/files/patch-tests_util_server_src_servers_mod.rs
+16-13www/deno/Makefile
+803-60035 files not shown
+958-68741 files

HardenedBSD/ports 728e2dfports-mgmt/pkg_replace distinfo Makefile

ports-mgmt/pkg_replace: Update 20260127 => 20260128

Changelog:
https://github.com/kdeguchi/pkg_replace/releases/tag/20260128

PR:     292777
DeltaFile
+3-3ports-mgmt/pkg_replace/distinfo
+1-1ports-mgmt/pkg_replace/Makefile
+4-42 files

HardenedBSD/ports 171b4e2www/chromium distinfo, www/chromium/files patch-chrome_common_chrome__features.cc patch-chrome_common_chrome__features.h

www/chromium: update to 144.0.7559.109

Security:       https://vuxml.freebsd.org/freebsd/409d70ab-fc23-11f0-85c5-a8a1599412c6.html
DeltaFile
+7-7www/chromium/distinfo
+4-4www/chromium/files/patch-chrome_common_chrome__features.cc
+3-3www/chromium/files/patch-chrome_common_chrome__features.h
+2-2www/chromium/files/patch-third__party_blink_common_features.cc
+2-2www/chromium/files/patch-ui_ozone_platform_x11_x11__window.cc
+2-2www/chromium/files/patch-ui_views_window_dialog__delegate.cc
+20-202 files not shown
+23-248 files

HardenedBSD/ports f6a6036www/iridium distinfo, www/iridium/files patch-chrome_common_chrome__features.cc patch-chrome_common_chrome__features.h

www/iridium: update to 2026.01.144.2
DeltaFile
+4-4www/iridium/files/patch-chrome_common_chrome__features.cc
+3-3www/iridium/distinfo
+3-3www/iridium/files/patch-chrome_common_chrome__features.h
+2-2www/iridium/files/patch-chrome_browser_ui_views_location__bar_location__bar__view.cc
+2-2www/iridium/files/patch-third__party_blink_common_features.cc
+2-2www/iridium/files/patch-ui_ozone_platform_x11_x11__window.cc
+16-162 files not shown
+19-208 files

HardenedBSD/ports 87d3023security/vuxml/vuln 2026.xml

security/vuxml: add www/*chromium < 144.0.7559.109

Obtained from:  https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_27.html
DeltaFile
+33-0security/vuxml/vuln/2026.xml
+33-01 files

HardenedBSD/ports a61ac34www/tomcat-devel distinfo pkg-plist

www/tomcat-devel: Update 11.0.15 => 11.0.18

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.18_(markt)

MFH:    2026Q1
DeltaFile
+3-3www/tomcat-devel/distinfo
+1-1www/tomcat-devel/pkg-plist
+1-1www/tomcat-devel/Makefile
+5-53 files

HardenedBSD/ports ddce245www/tomcat110 distinfo Makefile

www/tomcat110: Update 11.0.15 => 11.0.18

Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.18_(markt)

MFH:    2026Q1
DeltaFile
+3-3www/tomcat110/distinfo
+1-1www/tomcat110/Makefile
+1-1www/tomcat110/pkg-plist
+5-53 files

HardenedBSD/ports 184d4edwww/tomcat101 distinfo Makefile

www/tomcat101: Update 10.1.50 => 10.1.52

Changelog:
https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.52_(schultz)

MFH:    2026Q1
DeltaFile
+3-3www/tomcat101/distinfo
+1-1www/tomcat101/Makefile
+4-42 files

HardenedBSD/src 0cca627sys/dev/acpica acpi.c

acpi: Use AcpiGbl_FACS even on ACPI_REDUCED_HARDWARE

This has been possible since ACPICA 20240827, and is actually
a requirement to get out of S3 on ACPI_REDUCED_HARDWARE (that said, we
don't implement S3 on arm64 yet).

Relevant ACPICA commit:
https://github.com/acpica/acpica/commit/79cd933e7b370e8d3fb490bf36ca5d111a12f96a.

Reviewed by:    obiwac
MFC after:      2 weeks
MFC to:         stable/15
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D54625
DeltaFile
+0-2sys/dev/acpica/acpi.c
+0-21 files

HardenedBSD/src 149e6c6sys/dev/acpica acpi_spmc.c

acpi_spmc(4): Fix compilation on 32-bit platforms

Fixes:          c5daa5a4c32c ("acpi_spmc: Add system power management controller driver")
Sponsored by:   The FreeBSD Foundation
DeltaFile
+4-1sys/dev/acpica/acpi_spmc.c
+4-11 files

HardenedBSD/src 526c09asys/dev/acpica acpi.c

acpi: Use only AcpiGetSleepTypeData() to determine Sx support

Previously, we would first call AcpiEvaluateObject() to execute \_Sx
before calling AcpiGetSleepTypeData().  This was unnecessary, as
AcpiGetSleepTypeData() performs the same call itself.  While doing so,
the latter function logs any other error than AE_NOT_FOUND (which
indicates that a particular sleep state is not supported), which most
probably is an added benefit of this change.

Reviewed by:    obiwac
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D54624
DeltaFile
+5-5sys/dev/acpica/acpi.c
+5-51 files

HardenedBSD/src a9f7074sys/dev/aic7xxx ahc_pci.c

ahc(4): Fix a warning on i386 compilation

Fixes:          cd036e891a35 ("ahc_pci.c: If bus_dma...")
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-1sys/dev/aic7xxx/ahc_pci.c
+1-11 files

HardenedBSD/ports a42ee7ewww Makefile, www/surge Makefile pkg-descr

www/surge: Add high-performance download manager

Surge is a TUI/CLI download manager with parallel downloads,
pause/resume, speed graphs, and browser extension support.
DeltaFile
+19-0www/surge/Makefile
+12-0www/surge/pkg-descr
+5-0www/surge/distinfo
+1-0www/Makefile
+37-04 files

HardenedBSD/ports dbdf303math/py-cvxpy Makefile

math/py-cvxpy: Add comment
DeltaFile
+2-0math/py-cvxpy/Makefile
+2-01 files