HardenedBSD/ports 39f681bfilesystems/zrepl-dsh2dsh distinfo Makefile, math/octave-forge-interval distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+63-63www/grafana/distinfo
+85-23www/redmine60/files/patch-Gemfile
+5-5filesystems/zrepl-dsh2dsh/distinfo
+3-3math/octave-forge-interval/distinfo
+3-3ports-mgmt/poudriere-dsh2dsh/distinfo
+2-3filesystems/zrepl-dsh2dsh/Makefile
+161-1008 files not shown
+176-11114 files

HardenedBSD/ports 47e451bwww/redmine60 Makefile, www/redmine60/files patch-Gemfile commonmark.rb

www/redmine60: Update mini_magick to v5, set daemon title flags

- Switch RMAGIC dependency from rubygem-mini_magick4 to rubygem-mini_magick >= 5.0.1
- Update files/mini_magick.rb minimum version to 5.0.1
- Refresh patch-Gemfile: replace upstream version-pinned DB adapter logic
  with bundler.d-based loading; update mini_magick group to ~> 5.0.1
- Add -T/-t flags to daemon invocation for proper process title tagging

PR:     ports/293251
DeltaFile
+85-23www/redmine60/files/patch-Gemfile
+2-2www/redmine60/Makefile
+2-1www/redmine60/files/commonmark.rb
+1-1www/redmine60/files/mini_magick.rb
+1-1www/redmine60/files/redmine.in
+91-285 files

HardenedBSD/ports 3f4049ewww/grafana distinfo Makefile

www/grafana: Update 12.3.0 => 12.3.3 (Fixes security vulnerabilities)

Changelogs:
https://github.com/grafana/grafana/releases/tag/v12.3.1
https://github.com/grafana/grafana/releases/tag/v12.3.2
https://github.com/grafana/grafana/releases/tag/v12.3.3

PR:             293245
Security:       CVE-2026-21722
Security:       CVE-2025-41117
MFH:            2026Q1
DeltaFile
+63-63www/grafana/distinfo
+2-3www/grafana/Makefile
+65-662 files

HardenedBSD/ports 9d7fda0filesystems/zrepl-dsh2dsh distinfo Makefile

filesystems/zrepl-dsh2dsh: Update 1.1.0 => 1.2.0

Changelog:
https://github.com/dsh2dsh/zrepl/releases/tag/v1.2.0

PR:     293211
DeltaFile
+5-5filesystems/zrepl-dsh2dsh/distinfo
+2-3filesystems/zrepl-dsh2dsh/Makefile
+5-0filesystems/zrepl-dsh2dsh/pkg-plist
+12-83 files

HardenedBSD/ports 07aa548ports-mgmt/poudriere-dsh2dsh distinfo Makefile

ports-mgmt/poudriere-dsh2dsh: Update 3.4.99.20251214 => 3.4.99.20260216

Upstream changes:
 - rollbackfs/do_clone_del: Don't force rewrite every file.
 - jail: -bB UX updates and fixes
 - jail: Use the right arch for a pkgbase jail
 - jail: Use the real path
 - jail: Exit with an error if pkg-update(8) fails
 - jail: Do not run make in jails without src

PR:     293242
DeltaFile
+3-3ports-mgmt/poudriere-dsh2dsh/distinfo
+1-1ports-mgmt/poudriere-dsh2dsh/Makefile
+4-42 files

HardenedBSD/ports d36b08amath/octave-forge-interval distinfo Makefile

math/octave-forge-interval: Update to 3.2.2.
DeltaFile
+3-3math/octave-forge-interval/distinfo
+1-2math/octave-forge-interval/Makefile
+4-52 files

HardenedBSD/src 2b14f79sys/cddl/dev/dtrace/aarch64 dtrace_isa.c, sys/dev/scc scc_bus.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+31-21sys/kern/vfs_mount.c
+4-38tools/build/mk/OptionalObsoleteFiles.inc
+14-2sys/cddl/dev/dtrace/aarch64/dtrace_isa.c
+9-7sys/dev/virtio/virtio.h
+15-0sys/sys/bus.h
+8-6sys/dev/scc/scc_bus.h
+81-7443 files not shown
+175-15949 files

HardenedBSD/ports 2b337c6audio/subtui distinfo, databases/greptimedb distinfo Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+1,843-1,409databases/greptimedb/distinfo
+948-711databases/greptimedb/Makefile
+50-0lang/cbqn/Makefile
+14-0databases/greptimedb/files/patch-cargo-crates_rsasl-2.2.0_src_context.rs
+11-0lang/cbqn/distinfo
+5-5audio/subtui/distinfo
+2,871-2,12528 files not shown
+2,926-2,18634 files

HardenedBSD/src 23a8479usr.bin/diff diff.c, usr.bin/diff/tests diff_test.sh

diff: Tweak range of -C and -U arguments

POSIX uses the terms “positive decimal integer” for -C and “non-negative
decimal integer” for -U, which translates into lower bounds of 1 for -C
and 0 for -U.

POSIX does not specify a minimum upper bound for either mode, but as of
5fc739eb5949 both our backends support context sizes up to and including
INT_MAX, so use that.

Having had the opportunity to consult the Unix System Test Suite, the
diff test cases found therein happen to precisely match these bounds.

While here, switch to using strtonum() to parse numerical arguments, and
try to be more consistent in how we report usage errors.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans

    [3 lines not shown]
DeltaFile
+38-24usr.bin/diff/tests/diff_test.sh
+26-18usr.bin/diff/diff.c
+64-422 files

HardenedBSD/src 6458b1asys/dev/nvme nvme_qpair.c

nvme: Use __diagused instead of __unused

Reviewed by:    imp
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.

(cherry picked from commit 1c09ae2be059da0b945a2543ac7dd0bd5198d0e3)
DeltaFile
+1-1sys/dev/nvme/nvme_qpair.c
+1-11 files

HardenedBSD/src 3bfe51cbin/timeout timeout.c timeout.1

timeout: Clean up

* Annotate logv() and fix format string bug.

* Don't reinvent str2sig(3).

* Reorganize kill_self() so we unblock signals as late as possible, and
  use raise(2) instead of kill(2).

* Explicitly close unused pipe descriptors.

* Use correct type to collect result of read(2) and write(2).

* Compare return values to 0, not -1.

* Sort local variables according to style(9).

* Reduce unnecessary nesting.


    [10 lines not shown]
DeltaFile
+73-85bin/timeout/timeout.c
+1-1bin/timeout/timeout.1
+74-862 files

HardenedBSD/src 608d3c7usr.bin/diff/tests diff_test.sh

diff: Tweak recursion tests

The -r flag is not required to compare two directories; it is only
required to compare them recursively, i.e. descend into their common
subdirectories.  Adjust tests that use -r needlessly, and adjust the
dirloop test to verify that these two cases remain distinct.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D55262

(cherry picked from commit b2532432971fbd9339a9a49eca1b532978bb6d48)
DeltaFile
+16-14usr.bin/diff/tests/diff_test.sh
+16-141 files

HardenedBSD/src 3562c80sys/dev/nvme nvme_private.h

nvme: Use size_t for payload size

Using uint32_t here can cause spurious compiler warnings.  I assume it
was done to constrain the range; use a KASSERT instead.

Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55279

(cherry picked from commit be7e4dc878eab090cd411c9ef28880e4f62116f5)
DeltaFile
+3-1sys/dev/nvme/nvme_private.h
+3-11 files

HardenedBSD/ports 0eea2f2net/cloudflared Makefile distinfo

net/cloudflared: Update to 2026.2.0

While here, pet portclippy.

A number of people were involved in this update, especially Xiaodi Ma.
This committed patch, however, was created by Paavo-Einari Kaipila, and
I'm really sorry in advance if I accidentally butchered the spelling of
either of those names.

Changes: https://github.com/cloudflare/cloudflared/blob/master/CHANGES.md

PR:             290847
Approved by:    maintainer timeout (3 months, plus multiple emails)
DeltaFile
+3-4net/cloudflared/Makefile
+3-3net/cloudflared/distinfo
+6-72 files

HardenedBSD/ports b50b446ports-mgmt/poudriere-devel distinfo Makefile

ports-mgmt/poudriere-devel: Update to 3.3.0-2515-g919be9ac1

Changes:
 - testport: Fix deleting existing packages (regression from Sep 2025)
 - testport: Default to not forcing TRYBROKEN; require -T.
 - destroyfs: Cleanup tmpfs mountpoints. (such as image cleanup)
DeltaFile
+3-3ports-mgmt/poudriere-devel/distinfo
+2-2ports-mgmt/poudriere-devel/Makefile
+5-52 files

HardenedBSD/src 669347fusr.sbin/ngctl config.c

ngctl: Fix buffer overflow in config command

Keep track of our buffer length when assembling the argument list.

PR:             293075
MFC after:      1 week
Reviewed by:    zlei, markj
Differential Revision:  https://reviews.freebsd.org/D55259

(cherry picked from commit 59906a163e474c8d00bdebe226c4d47332b91bad)
DeltaFile
+14-8usr.sbin/ngctl/config.c
+14-81 files

HardenedBSD/src 221c09cusr.sbin/ngctl write.c

ngctl: Check hook name length

Check the length of the hook name when copying it into the sockaddr.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55258

(cherry picked from commit 585190dff436eeea3be97300e36c82559028d3dd)
DeltaFile
+14-4usr.sbin/ngctl/write.c
+14-41 files

HardenedBSD/src 05f0dcdlib/libarchive/tests functional_test.sh, usr.bin/bsdcat/tests functional_test.sh

tests: Simplify libarchive tests

The ATF tests work by first running the test program with an invalid
flag, which causes it to print an error message, a summary of options,
and a list of available test cases.  Switch to the new -l option which
simply prints the list, and simplify the awk script used to parse the
output.  No functional change.

MFC after:      1 week

(cherry picked from commit 394201ce5b4e2f84f1e39a7ce8bdc3f5a5ef8390)
DeltaFile
+2-2usr.bin/tar/tests/functional_test.sh
+1-1usr.bin/unzip/tests/functional_test.sh
+1-1usr.bin/bsdcat/tests/functional_test.sh
+1-1lib/libarchive/tests/functional_test.sh
+1-1usr.bin/cpio/tests/functional_test.sh
+6-65 files

HardenedBSD/src c8d2ac7usr.sbin/ngctl main.c msg.c

ngctl: Modernize code somewhat

* Replace fgets(3) with getline(3)

* Replace select(2) with poll(2)

* Avoid needlessly copying text around

* Correct use of getopt(3)

* Pick some style and whitespace nits

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55257

(cherry picked from commit 3cbdcabf714d5187e22d8ff1cbfbc261dc8622eb)
DeltaFile
+110-125usr.sbin/ngctl/main.c
+16-23usr.sbin/ngctl/msg.c
+6-8usr.sbin/ngctl/list.c
+4-6usr.sbin/ngctl/write.c
+4-6usr.sbin/ngctl/status.c
+4-5usr.sbin/ngctl/config.c
+144-1739 files not shown
+164-21215 files

HardenedBSD/src 935cf32sys/kern vfs_mount.c

vfs_mount.c: Don't call VFS_MOUNT() if only exports are being updated

PR#293198 reports a hang within ZFS when exports
are being updated concurrently with a VOP_SETEXTATTR().
The hang appears to be caused by mishandling of the
z_teardown_lock, but fixing handling of this lock appears
to be a major effort. Since the hang occurs when
VFS_MOUNT() acquires a write/exclusive z_teardown_lock,
which rarely occurs, except when exports are being updated,
this patch avoids the VFS_MOUNT() call for this case.

Avoiding a VFS_MOUNT() call fixes the hang for the case
reported by PR#293198 and is also an optimization.
As such, this patch avoids the VFS_MOUNT() call when only exports
are being updated similar to what was already being done
within vnet prisons.

PR:     293198
Reviewed by:    kib, markj

    [2 lines not shown]
DeltaFile
+31-21sys/kern/vfs_mount.c
+31-211 files

HardenedBSD/src bc6c827tools/build/mk OptionalObsoleteFiles.inc

OptionalObsoleteFiles: Add figpar to dialog section

MFC after:      3 days
Fixes:          15d781b53233 ("lib: Gate libfigpar under MK_DIALOG")
Reviewed by:    jhb, emaste
Differential Revision:  https://reviews.freebsd.org/D55330
DeltaFile
+4-0tools/build/mk/OptionalObsoleteFiles.inc
+4-01 files

HardenedBSD/src f9f4a02. ObsoleteFiles.inc, tools/build/mk OptionalObsoleteFiles.inc

ObsoleteFiles: Deduplicate

Since we dropped support for profile libraries, all optional entries for
them are now non-optional.  Most of them were already duplicated there,
a few were not.

MFC after:      3 days
Reviewed by:    jhb, emaste
Differential Revision:  https://reviews.freebsd.org/D55329
DeltaFile
+0-38tools/build/mk/OptionalObsoleteFiles.inc
+3-2ObsoleteFiles.inc
+3-402 files

HardenedBSD/ports 17fd9cfaudio/subtui distinfo Makefile

audio/subtui: Update to 2.4.0

Changelog: https://github.com/MattiaPun/SubTUI/releases/tag/v2.4.0
DeltaFile
+5-5audio/subtui/distinfo
+1-1audio/subtui/Makefile
+6-62 files

HardenedBSD/src f6aead8sys/modules/zlib Makefile

HBSD: Opt zlib kernel module into -ftrivial-var-auto-init=zero

Recent CVEs in the zlib project demonstrate the need to apply additional
protections.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
See-Also:       https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf
MFC-to:         15-STABLE
DeltaFile
+2-0sys/modules/zlib/Makefile
+2-01 files

HardenedBSD/src 5a02f00sys/sys sdt.h

sdt: Disable SDT probes in kernel modules for GCC on aarch64

For PIC code, the existing assembly constraints do compile on aarch64.
Some kernel modules build ok using the 'p' constraint with the 'a'
operand modifier, but not all.

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55166
DeltaFile
+7-0sys/sys/sdt.h
+7-01 files

HardenedBSD/src 1101292sys/contrib/vchiq/interface/vchiq_arm vchiq_2835_arm.c

vchiq: Fix return type of vchiq_copy_from_user

Change the function definition to map the declaration and consistently
return an enum value.  This fixes the following error reported by GCC:

sys/contrib/vchiq/interface/vchiq_arm/vchiq_2835_arm.c:322:1: error: conflicting types for 'vchiq_copy_from_user' due to enum/integer mismatch; have 'int(void *, const void *, int)' [-Werror=enum-int-mismatch]
  322 | vchiq_copy_from_user(void *dst, const void *src, int size)
      | ^~~~~~~~~~~~~~~~~~~~
In file included from sys/contrib/vchiq/interface/vchiq_arm/vchiq_arm.h:38,
                 from sys/contrib/vchiq/interface/vchiq_arm/vchiq_2835_arm.c:61:
sys/contrib/vchiq/interface/vchiq_arm/vchiq_core.h:647:1: note: previous declaration of 'vchiq_copy_from_user' with type 'VCHIQ_STATUS_T(void *, const void *, int)'
  647 | vchiq_copy_from_user(void *dst, const void *src, int size);
      | ^~~~~~~~~~~~~~~~~~~~

Differential Revision:  https://reviews.freebsd.org/D55163
DeltaFile
+2-2sys/contrib/vchiq/interface/vchiq_arm/vchiq_2835_arm.c
+2-21 files

HardenedBSD/src c7f7b67sys/arm/broadcom/bcm2835 vc_vchi_audioserv_defs.h

arm bcm2835: Appease a warning from GCC

No code currently uses the vc_audio_msg_type_names array of strings.

Reported by:    -Wunused-variable
Differential Revision:  https://reviews.freebsd.org/D55162
DeltaFile
+1-1sys/arm/broadcom/bcm2835/vc_vchi_audioserv_defs.h
+1-11 files

HardenedBSD/src 4092df8sys/arm64/arm64 locore.S

arm64: Explicitly use movz

This appeases GNU as which doesn't map the mov alias to movz.

Reviewed by:    andrew
Differential Revision:  https://reviews.freebsd.org/D55160
DeltaFile
+1-1sys/arm64/arm64/locore.S
+1-11 files

HardenedBSD/src 87984edsys/sys bus.h

bus: Renumber global IVAR ranges

Use a more consistent scheme for allocating shared IVAR index ranges.

Differential Revision:  https://reviews.freebsd.org/D54161
DeltaFile
+3-3sys/sys/bus.h
+3-31 files

HardenedBSD/src dc47d99sys/arm64/arm64 gic_v3_var.h, sys/sys bus.h

arm gicv3: Use private IVAR range for GICV3 IVARs

Suggested by:   andrew
Differential Revision:  https://reviews.freebsd.org/D54191
DeltaFile
+1-1sys/arm64/arm64/gic_v3_var.h
+0-1sys/sys/bus.h
+1-22 files