HardenedBSD/src 150bfd8sbin/pfctl parse.y, sbin/pfctl/tests/files pf1078.in pf1078.ok

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+32-0sys/net/if_ovpn.c
+25-0tests/sys/net/if_ovpn/if_ovpn.sh
+3-0sbin/pfctl/tests/files/pf1078.in
+1-1sbin/pfctl/parse.y
+1-1tools/build/mk/OptionalObsoleteFiles.inc
+2-0sbin/pfctl/tests/files/pf1078.ok
+64-21 files not shown
+65-27 files

HardenedBSD/ports f28d7aemail/nmh-devel pkg-plist, net/hostapd-devel Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+0-316net/hostapd-devel/files/config
+7-7sysutils/zot/distinfo
+7-7www/ungoogled-chromium/distinfo
+10-3net/hostapd-devel/Makefile
+12-0mail/nmh-devel/pkg-plist
+5-5sysutils/zli/distinfo
+41-33889 files not shown
+187-47595 files

HardenedBSD/ports 939d877cad/opencascade Makefile, devel/godot Makefile

multimedia/libvpx: update 1.16.0

Changes:        https://chromium.googlesource.com/webm/libvpx/+log/v1.15.2..v1.16.0
Reported by:    Repology
DeltaFile
+3-3multimedia/libvpx/pkg-plist
+3-3multimedia/libvpx/distinfo
+1-1emulators/virtualbox-ose/Makefile
+1-1www/qt6-webengine/Makefile
+1-1cad/opencascade/Makefile
+1-1devel/godot/Makefile
+10-1044 files not shown
+54-4750 files

HardenedBSD/src 48c3a93tools/build/mk OptionalObsoleteFiles.inc

OptionalObsoleteFiles.inc: Treat compat runtime loaders as libraries

Binaries require the runtime loader to use shared libraries, and
removing the runtime loader in `make delete-old` while leaving the
libraries around makes it impossible to use those shared libraries.
Treat rtld as a de facto dependency of shared libraries to ensure it
is not removed until the corresponding shared libraries are removed.

Differential Revision:  https://reviews.freebsd.org/D52210

(cherry picked from commit 8e1c85f03260ff9d214fcd99c7ad1a848e3ac23b)
DeltaFile
+1-1tools/build/mk/OptionalObsoleteFiles.inc
+1-11 files

HardenedBSD/ports a5ddb68mail/nmh-devel pkg-plist Makefile

mail/nmh-devel: update to latest git commit on savannah
DeltaFile
+12-0mail/nmh-devel/pkg-plist
+3-4mail/nmh-devel/Makefile
+3-3mail/nmh-devel/distinfo
+18-73 files

HardenedBSD/ports e9d64f3security/nmap-devel distinfo Makefile

security/nmap-devel: Update to the latest GH commit
DeltaFile
+3-3security/nmap-devel/distinfo
+2-2security/nmap-devel/Makefile
+5-52 files

HardenedBSD/ports bc5bcd8security/krb5-devel distinfo Makefile

security/krb5-devel: update to the latest MIT/KRB5 github commit
DeltaFile
+3-3security/krb5-devel/distinfo
+2-2security/krb5-devel/Makefile
+5-52 files

HardenedBSD/ports 91a0a48shells/ksh-devel distinfo Makefile

shells/ksh-devel: update to the latest ksh93/ksh github commit
DeltaFile
+3-3shells/ksh-devel/distinfo
+2-2shells/ksh-devel/Makefile
+5-52 files

HardenedBSD/ports 6f31ba7sysutils/cfengine-masterfiles-devel distinfo Makefile

sysutils/cfengine-masterfiles-devel: Update to latest GH commit
DeltaFile
+3-3sysutils/cfengine-masterfiles-devel/distinfo
+2-2sysutils/cfengine-masterfiles-devel/Makefile
+5-52 files

HardenedBSD/ports 56666f1net/hostapd-devel Makefile distinfo, net/hostapd-devel/files config

net/hostapd-devel: Update to the latest GH commit

Update to the latest w1.fi commit, proxied through my GH account
DeltaFile
+0-316net/hostapd-devel/files/config
+10-3net/hostapd-devel/Makefile
+3-3net/hostapd-devel/distinfo
+13-3223 files

HardenedBSD/ports 927fbb8sysutils/cfengine-devel distinfo Makefile

sysutils/cfengine-devel: Update to latest GH commit
DeltaFile
+3-3sysutils/cfengine-devel/distinfo
+2-2sysutils/cfengine-devel/Makefile
+5-52 files

HardenedBSD/ports b2201f3security/wpa_supplicant-devel distinfo Makefile

security/wpa_supplicant-devel: Update to latest GH commit

Update to the latest w1.fi commit, proxied through my GH account.
DeltaFile
+3-3security/wpa_supplicant-devel/distinfo
+2-2security/wpa_supplicant-devel/Makefile
+5-52 files

HardenedBSD/src c59a47dshare/mk src.opts.mk

src.opts.mk: Enable LLDB by default globally

Previously it was enabled for all architectures except but RISC-V.
Upstream made significant progress on RISC-V support over the last
year[1], and although there's still some FreeBSD-specific work to do we
can start building it now.

[1] https://jonasdevlieghere.com/post/lldb-2025/

Sponsored by:   The FreeBSD Foundation
DeltaFile
+1-5share/mk/src.opts.mk
+1-51 files

HardenedBSD/ports ba93ecaaudio/baresip distinfo Makefile

audio/baresip: Update 4.4.0 => 4.5.0

Changelog:
https://github.com/baresip/baresip/releases/tag/v4.5.0

While here remove GH_ACCOUNT - this is default value.

PR:     292785
DeltaFile
+3-3audio/baresip/distinfo
+1-3audio/baresip/Makefile
+2-2audio/baresip/pkg-plist
+6-83 files

HardenedBSD/ports fe029d4audio/re distinfo pkg-plist

audio/re: Update 4.4.0 => 4.5.0

Changelog:
https://github.com/baresip/re/releases/tag/v4.5.0

PR:     292785
DeltaFile
+3-3audio/re/distinfo
+2-2audio/re/pkg-plist
+1-1audio/re/Makefile
+6-63 files

HardenedBSD/src 79b05e7sys/compat/linuxkpi/common/include/linux radix-tree.h, sys/compat/linuxkpi/common/src linux_radix.c linux_xarray.c

linuxkpi: Add tag support to radix tree

The tag is used to perform lookup in a different way.

New functions were introduced:
* to set, check and clear a tag
* to walk through a radix tree based on a given tag

Furthermore, the `radix_tree_delete()` function was modified to clear
tags on deletion.

The amdgpu DRM driver started to use this in Linux 6.10.

While here, the `radix_tree_gang_lookup()` function was added because it
is very close to `radix_tree_gang_lookup_tag()`, but it is not used by
the DRM drivers as of this commit.

Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54503
DeltaFile
+215-4sys/compat/linuxkpi/common/src/linux_radix.c
+25-4sys/compat/linuxkpi/common/include/linux/radix-tree.h
+2-2sys/compat/linuxkpi/common/src/linux_xarray.c
+242-103 files

HardenedBSD/src 20285casys/dev/virtio/network if_vtnet.c

vtnet: remove M_HASHTYPE when there is only one pair of rx/tx queue

Summary:
Doing so will let the upper layer know how to deal with software hash,
with benefits like inp_flowid can be set and m_pkthdr.flowid can be set
in output path.

Reviewed by: tuexen
Differential Revision: https://reviews.freebsd.org/D54929
DeltaFile
+10-2sys/dev/virtio/network/if_vtnet.c
+10-21 files

HardenedBSD/src 670b568contrib/capsicum-test linux.cc capability-fd.cc, tests/sys/capsicum linux.cc capability-fd.cc

capsicum-test: Move out of contrib

Google developed the Capsicum unit test suite[1] as part of the
Capsicum-Linux[2] project, based on unit tests that existed in FreeBSD
and unit tests developed as part of the initial Capsicum-Linux port.

Capsicum-Linux was archived as of October 31, 2022 and is no longer
being maintained.  FreeBSD is currently the only consumer of and
contributor to the test suite.  Move the src into tests/sys/capsicum to
simplify ongoing maintenance.

The makefiles were deleted as we (continue to) use the existing bespoke
FreeBSD Makefile, and CONTRIBUTING.md was removed as the Google CLA is
no longer applicable.

[1] https://github.com/google/capsicum-test
[2] https://github.com/google/capsicum-linux

Reviewed by:    asomers, oshogbo

    [2 lines not shown]
DeltaFile
+0-1,500contrib/capsicum-test/linux.cc
+1,500-0tests/sys/capsicum/linux.cc
+1,359-0tests/sys/capsicum/capability-fd.cc
+0-1,359contrib/capsicum-test/capability-fd.cc
+1,097-0tests/sys/capsicum/procdesc.cc
+0-1,097contrib/capsicum-test/procdesc.cc
+3,956-3,95662 files not shown
+8,915-9,07468 files

HardenedBSD/ports c52b51fwww/ungoogled-chromium distinfo, www/ungoogled-chromium/files patch-chrome_common_chrome__features.cc patch-chrome_common_chrome__features.h

www/ungoogled-chromium: update to 144.0.7559.109

Security:       https://vuxml.freebsd.org/freebsd/409d70ab-fc23-11f0-85c5-a8a1599412c6.html
DeltaFile
+7-7www/ungoogled-chromium/distinfo
+4-4www/ungoogled-chromium/files/patch-chrome_common_chrome__features.cc
+3-3www/ungoogled-chromium/files/patch-chrome_common_chrome__features.h
+2-2www/ungoogled-chromium/files/patch-chrome_browser_ui_views_location__bar_location__bar__view.cc
+2-2www/ungoogled-chromium/files/patch-ui_views_window_dialog__delegate.cc
+2-2www/ungoogled-chromium/files/patch-third__party_blink_common_features.cc
+20-202 files not shown
+23-248 files

HardenedBSD/ports 3e947f9x11-wm/plasma6-kwin distinfo Makefile

x11-wm/plasma6-kwin: backport upstream patch

to fix a regression  that made it impossible to turn
offscreens through kscreen in some setups.
DeltaFile
+3-1x11-wm/plasma6-kwin/distinfo
+3-0x11-wm/plasma6-kwin/Makefile
+6-12 files

HardenedBSD/ports 0e8ee2asysutils/zot distinfo Makefile

sysutils/zot: Update to 2.1.14

PR:             292746
DeltaFile
+7-7sysutils/zot/distinfo
+1-2sysutils/zot/Makefile
+1-1sysutils/zot/pkg-message
+9-103 files

HardenedBSD/ports 87d14afsysutils/zli distinfo Makefile

sysutils/zli: Update to 2.1.14
DeltaFile
+5-5sysutils/zli/distinfo
+1-2sysutils/zli/Makefile
+6-72 files

HardenedBSD/ports 24c939fdevel/R-cran-sparsevctrs distinfo Makefile

devel/R-cran-sparsevctrs: Update to 0.3.6

ChangeLog: https://cran.r-project.org/web/packages/sparsevctrs/news/news.html
DeltaFile
+3-3devel/R-cran-sparsevctrs/distinfo
+1-1devel/R-cran-sparsevctrs/Makefile
+4-42 files

HardenedBSD/ports 7aef23ctextproc/R-cran-vroom Makefile distinfo

textproc/R-cran-vroom: Update to 1.7.0

ChangeLog: https://cran.r-project.org/web/packages/vroom/news/news.html
DeltaFile
+5-3textproc/R-cran-vroom/Makefile
+3-3textproc/R-cran-vroom/distinfo
+8-62 files

HardenedBSD/ports c4c03e5devel/R-cran-data.table distinfo Makefile

devel/R-cran-data.table: Update to 1.18.2.1

ChangeLog: https://cran.r-project.org/web/packages/data.table/news/news.html
DeltaFile
+3-3devel/R-cran-data.table/distinfo
+1-1devel/R-cran-data.table/Makefile
+4-42 files

HardenedBSD/src 975c58alibexec/flua Makefile, libexec/flua/modules lposix.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+32-0sbin/ifconfig/tests/ifconfig.sh
+21-4usr.sbin/cpucontrol/cpucontrol.c
+6-10sbin/ifconfig/iffib.c
+8-4libexec/flua/modules/lposix.c
+2-1sbin/ifconfig/tests/Makefile
+0-1libexec/flua/Makefile
+69-206 files

HardenedBSD/src 768d2f2libexec/flua Makefile, libexec/flua/modules lposix.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+32-0sbin/ifconfig/tests/ifconfig.sh
+21-4usr.sbin/cpucontrol/cpucontrol.c
+6-10sbin/ifconfig/iffib.c
+8-4libexec/flua/modules/lposix.c
+2-1sbin/ifconfig/tests/Makefile
+0-1libexec/flua/Makefile
+69-206 files

HardenedBSD/ports 06690d6textproc/libxml2 Makefile

textproc/libxml2: bump PORTREVISION to force rebuild

FreeBSD-ports-latest - for FreeBSD 15 - currently carries packages
that have the libxml2-core package as a dependency (and the
libxml2-core).

Bump PORTREVISION to force the package builder to resynch onto ports
where there is no libxml2-core package, to reduce confusion.

(2026Q1 is unaffected, it did not have this change.)
DeltaFile
+1-0textproc/libxml2/Makefile
+1-01 files

HardenedBSD/ports 9b62750www/deno distinfo Makefile.crates, www/deno/files patch-build_config_compiler_BUILD.gn patch-cli_task_runner.rs

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+441-325www/deno/distinfo
+219-161www/deno/Makefile.crates
+72-54www/deno/files/patch-build_config_compiler_BUILD.gn
+26-47www/deno/files/patch-cli_task_runner.rs
+29-0www/deno/files/patch-tests_util_server_src_servers_mod.rs
+16-13www/deno/Makefile
+803-60046 files not shown
+1,018-71352 files

HardenedBSD/src 59bbb62usr.sbin/cpucontrol cpucontrol.c

cpucontrol: Be more strict with input validation

Avoid truncating 32-bit values.  This would have saved me a bit of time
when I was looking at a cpuid leaf on my system and typed 0x80000001f
instead of 0x8000001f.

Reviewed by:    kib
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D54919
DeltaFile
+21-4usr.sbin/cpucontrol/cpucontrol.c
+21-41 files