HardenedBSD/src ee4b14c. RELNOTES, lib Makefile

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+1-16share/man/man5/src.conf.5
+1-7usr.bin/gzip/Makefile
+2-3lib/Makefile
+0-4tools/build/options/WITHOUT_BZIP2
+4-0RELNOTES
+0-2share/mk/src.opts.mk
+8-321 files not shown
+8-337 files

HardenedBSD/src 6f1191f. RELNOTES, lib Makefile

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+1-16share/man/man5/src.conf.5
+1-7usr.bin/gzip/Makefile
+2-3lib/Makefile
+0-4tools/build/options/WITHOUT_BZIP2
+4-0RELNOTES
+0-2share/mk/src.opts.mk
+8-321 files not shown
+8-337 files

HardenedBSD/src 1bcba71sys/kern sys_timerfd.c, sys/sys time.h

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+1,347-0tests/sys/kern/timerfd.c
+27-17sys/kern/sys_timerfd.c
+21-0sys/sys/time.h
+2-0tests/sys/kern/Makefile
+1,397-174 files

HardenedBSD/ports 47926fcmultimedia/ringrtc distinfo Makefile.crates, net-im/signal-desktop/files pnpm-lock.yaml

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+1,888-2,137net-im/signal-desktop/files/pnpm-lock.yaml
+87-71shells/fish/distinfo
+41-39multimedia/ringrtc/distinfo
+42-34shells/fish/Makefile.crates
+37-0security/vuxml/vuln/2026.xml
+17-16multimedia/ringrtc/Makefile.crates
+2,112-2,29732 files not shown
+2,216-2,40738 files

HardenedBSD/ports d7f428fwww/firefox-esr distinfo Makefile

www/firefox-esr: update to 140.9.1

Release Notes (soon):
  https://www.firefox.com/en-US/firefox/140.9.1/releasenotes/
DeltaFile
+3-3www/firefox-esr/distinfo
+1-2www/firefox-esr/Makefile
+4-52 files

HardenedBSD/ports 3b4ee97www/firefox distinfo Makefile

www/firefox: update to 149.0.2

Release Notes (soon):
  https://www.firefox.com/en-US/firefox/149.0.2/releasenotes/
DeltaFile
+3-3www/firefox/distinfo
+1-2www/firefox/Makefile
+4-52 files

HardenedBSD/ports d7f642fsecurity/vuxml/vuln 2026.xml

security/vuxml: Add mongodb{78}0 vulnerability

 CVSS-B         6.0 MEDIUM
 Vector:        CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
DeltaFile
+37-0security/vuxml/vuln/2026.xml
+37-01 files

HardenedBSD/ports 01eedd4security/node-sqlcipher Makefile distinfo

security/node-sqlcipher: Update to 3.2.1

Drop aarch64 as signal-desktop only builds on amd64
DeltaFile
+3-16security/node-sqlcipher/Makefile
+5-9security/node-sqlcipher/distinfo
+8-252 files

HardenedBSD/ports e9bcfa3multimedia/ringrtc distinfo Makefile.crates

multimedia/ringrtc: Update to 2.67.0

Drop aarch64 as signal-desktop only builds on amd64
DeltaFile
+41-39multimedia/ringrtc/distinfo
+17-16multimedia/ringrtc/Makefile.crates
+4-5multimedia/ringrtc/Makefile
+1-1multimedia/ringrtc/update.txt
+1-1multimedia/ringrtc/webrtc_fetch.sh
+64-625 files

HardenedBSD/ports ef0d2d0net-im/signal-desktop distinfo Makefile, net-im/signal-desktop/files pnpm-lock.yaml patch-package.json

net-im/signal-desktop: Update to 7.84.1

Drop aarch64 as signal-desktop only builds on amd64
DeltaFile
+1,888-2,137net-im/signal-desktop/files/pnpm-lock.yaml
+7-3net-im/signal-desktop/files/patch-package.json
+5-5net-im/signal-desktop/distinfo
+2-3net-im/signal-desktop/Makefile
+1-1net-im/signal-desktop/get_deps.sh
+1,903-2,1495 files

HardenedBSD/ports 714dd01net-im/libsignal-node distinfo Makefile

net-im/libsignal-node: Update to 0.89.1

Drop aarch64 as signal-desktop only builds on amd64
DeltaFile
+11-7net-im/libsignal-node/distinfo
+2-3net-im/libsignal-node/Makefile
+3-1net-im/libsignal-node/Makefile.crates
+16-113 files

HardenedBSD/src c484a2dtests/sys/kern timerfd.c Makefile

timerfd: Add tests

Take Jan Kokemuller's timerfd tests from the epoll-shim project,
stripping out code that isn't directly related to FreeBSD.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D55789
MFC after:              2 weeks

(cherry picked from commit 834c1ba793d900b791e19ff449b1e0b96fb494a0)
DeltaFile
+1,318-0tests/sys/kern/timerfd.c
+3-0tests/sys/kern/Makefile
+1,321-02 files

HardenedBSD/src 0b7e325tests/sys/kern timerfd.c Makefile

timerfd: Expect periodic timer performance failures

The current timerfd implementation fails to correctly count events on a
nanosecond callout interval. The timerfd__periodic_timer_performance
test detects this and reports failure.

Mark this test as an expected failure so it isn't flagged by CI. A link
to the bug report is attached to the test for reference.

While we're here, clean up some minor style and Make issues.

Fixes:          834c1ba793d9 ("timerfd: Add tests")
MFC after:      1 week

(cherry picked from commit cb692380f1e05ffc4184877844e93051f24ed302)
DeltaFile
+2-3tests/sys/kern/timerfd.c
+0-1tests/sys/kern/Makefile
+2-42 files

HardenedBSD/src 53c01dfsys/kern sys_timerfd.c

timerfd: Use saturating sbintime conversions

Some timerfd consumers set expirations with timespec tv_sec components
larger than 2^31 - 1. In such cases, converting that timespec to
sbintime results in data loss or sign flip, yielding a shorter
expiration than desired.

To avoid this problem, use saturating timespec-to-sbintime conversion
functions. These will clamp the converted sbintime to SBT_MAX under
circumstances where the normal conversion functions would overflow.

Saturating conversions still result in data loss, but the consequences
are less severe, causing problems only after SBT_MAX (~68 years) of
system uptime elapses.

Reviewed by:            imp
Differential Revision:  https://reviews.freebsd.org/D55792
MFC after:              2 weeks

(cherry picked from commit 0e8f351be7935729bf67dc1b7aa4d178cf154931)
DeltaFile
+5-5sys/kern/sys_timerfd.c
+5-51 files

HardenedBSD/src 6a5176asys/kern sys_timerfd.c

timerfd: Wake up on discontinuous jump

If a discontinous realtime clock change occurs and sets any TFD_JUMPED
bits on the timerfd, then wake up waiting readers. This fixes failures
from the timerfd_root__clock_change_notification test case.

MFC after: 2 weeks

(cherry picked from commit b11fba41265ae132acfb05587a6dbf60334d3279)
DeltaFile
+11-3sys/kern/sys_timerfd.c
+11-31 files

HardenedBSD/src 7f087edsys/sys time.h

sys/time: Add saturating sbt conversions

When converting from timespec to sbintime, the timespec's 64-bit tv_sec
component is shifted to the left 32 bits, causing any information in the
upper 32 bits to be lost.

This data loss during conversion can turn timespecs with very large
tv_sec counters into sbintimes that represent much smaller time
durations.

Add tstosbt_sat() and tvtosbt_sat(), which are saturating versions of
tstosbt and tvtosbt. With these routines, any overflow resulting from
the conversion is clamped to [-SBT_MAX - 1, SBT_MAX].

Reviewed by:            imp, markj
Differential Revision:  https://reviews.freebsd.org/D55791
MFC after:              2 weeks

(cherry picked from commit e3799530b3ba38567f8052b9e107884609fc71ea)
DeltaFile
+21-0sys/sys/time.h
+21-01 files

HardenedBSD/src 9d71069sys/kern sys_timerfd.c

timerfd: Suppress kqueue readability after jump read

Do not report EVFILT_READ after reading a discontinuous clock jump.
This makes the kqueue filter consistent with Linux epoll behavior
and timerfd_poll(), which already checks tfd_jumped != TFD_READ before
reporting POLLIN.

MFC after: 2 weeks

(cherry picked from commit 33345b8834859cf1ad7f1256f3a34b4a7c83e8e8)
DeltaFile
+1-1sys/kern/sys_timerfd.c
+1-11 files

HardenedBSD/src 2d10377tests/sys/kern timerfd.c

timerfd: Guard expected performance failure

During the timerfd__periodic_timer_performance test, only expect
failures when the expiration count is less than 400000000. This
prevents the test from being reported as a true failure in environments
where scheduling latency is high enough to delay timerfd wakeups.

Fixes:          cb692380f1e0 ("timerfd: Expect periodic timer ...")
MFC after:      1 week

(cherry picked from commit 4b16ff49bf4bf875997fe4c80a0afc0d440b7aac)
DeltaFile
+2-1tests/sys/kern/timerfd.c
+2-11 files

HardenedBSD/src 9b78538sys/kern sys_timerfd.c, tests/sys/kern timerfd.c

timerfd: Fix interval callout scheduling

When a timerfd interval callout misses its scheduled activation time, a
differential is calculated based on the actual activation time and the
scheduled activation time. This differential is divided by the timerfd's
interval time and the quotient is added to the timerfd's counter.

Before this change, the next callout was scheduled to activate at:
scheduled activation time + timerfd interval.

This change fixes the scheduling of the next callout to activate at:
actual activation time + timerfd interval - remainder.

Reviewed by:            markj
Differential Revision:  https://reviews.freebsd.org/D55790
MFC after:              2 weeks

(cherry picked from commit 85c0f1a87da1fd1eb3e646e86f70e630c48da91a)
DeltaFile
+29-0tests/sys/kern/timerfd.c
+13-11sys/kern/sys_timerfd.c
+42-112 files

HardenedBSD/ports 9f7f5c2www/bluefish distinfo Makefile

www/bluefish: Update to 2.4.1

ChangeLog:
https://sourceforge.net/p/bluefish/code/HEAD/tree/trunk/bluefish/ChangeLog

MFH:    2026Q2 (maintenance release)
DeltaFile
+3-3www/bluefish/distinfo
+1-1www/bluefish/Makefile
+4-42 files

HardenedBSD/ports 3d180c5devel/aws-c-s3 distinfo Makefile

devel/aws-c-s3: Update to 0.12.2

ChangeLog: https://github.com/awslabs/aws-c-s3/releases/tag/v0.12.2
DeltaFile
+3-3devel/aws-c-s3/distinfo
+1-1devel/aws-c-s3/Makefile
+4-42 files

HardenedBSD/ports f701e24devel/aws-crt-cpp distinfo Makefile

devel/aws-crt-cpp: Update to 0.38.4

ChangeLog: https://github.com/awslabs/aws-crt-cpp/releases/tag/v0.38.4
DeltaFile
+3-3devel/aws-crt-cpp/distinfo
+1-1devel/aws-crt-cpp/Makefile
+4-42 files

HardenedBSD/ports b85c1eddeskutils/treesheets distinfo Makefile, deskutils/treesheets/files patch-CMakeLists.txt

deskutils/treesheets: Update to 3048

ChangeLog: https://github.com/aardappel/treesheets/compare/3033...3048
DeltaFile
+5-5deskutils/treesheets/files/patch-CMakeLists.txt
+3-3deskutils/treesheets/distinfo
+1-1deskutils/treesheets/Makefile
+9-93 files

HardenedBSD/ports 94283a6security/s2n-tls distinfo Makefile

security/s2n-tls: Update to 1.7.2

ChangeLog: https://github.com/aws/s2n-tls/releases/tag/v1.7.2
DeltaFile
+3-3security/s2n-tls/distinfo
+2-1security/s2n-tls/Makefile
+5-42 files

HardenedBSD/ports f522622shells/fish distinfo Makefile.crates, shells/fish/files patch-cmake_Install.cmake

shells/fish: 4.6.0

https://github.com/fish-shell/fish-shell/releases/tag/4.6.0

Sponsored by:   ConnectWise
DeltaFile
+87-71shells/fish/distinfo
+42-34shells/fish/Makefile.crates
+12-12shells/fish/files/patch-cmake_Install.cmake
+7-0shells/fish/pkg-plist
+2-3shells/fish/Makefile
+150-1205 files

HardenedBSD/src 2d843b7. RELNOTES

RELNOTES: Document WITHOUT_BZIP2* removal
DeltaFile
+4-0RELNOTES
+4-01 files

HardenedBSD/src ab92575share/man/man5 src.conf.5, share/mk src.opts.mk

Remove WITHOUT_BZIP2, WITHOUT_BZIP2_SUPPORT

WITHOUT_BZIP2_SUPPORT only affects a single binary, gzip(1); it doesn't
remove bzip2 support from other bits (e.g., libarchive) and there are
no similar options for gzip, xz or zstd.

WITHOUT_BZIP2 has not done anything at all since it was first added
in 2007.

MFC after:      never
Discussed on:   arch@
Reviewed by:    imp, des, adrian, delphij, emaste
Differential Revision:  https://reviews.freebsd.org/D56148
Sponsored by:           https://www.patreon.com/bsdivy
DeltaFile
+1-16share/man/man5/src.conf.5
+1-7usr.bin/gzip/Makefile
+0-4tools/build/options/WITHOUT_BZIP2
+0-2share/mk/src.opts.mk
+0-1tools/build/options/WITHOUT_BZIP2_SUPPORT
+2-305 files

HardenedBSD/src b13d706lib Makefile

libauditd: Don't build if WITHOUT_AUDIT is set

When WITHOUT_AUDIT is set, nothing is built that uses this library,
so don't build the library.  This avoids building the FreeBSD-audit
package when WITHOUT_AUDIT is set.

MFC after:      never
Reviewed by:    csjp, imp, emaste
Differential Revision:  https://reviews.freebsd.org/D56157
Sponsored by:           https://www.patreon.com/bsdivy
DeltaFile
+1-1lib/Makefile
+1-11 files

HardenedBSD/src baa7a87lib Makefile

libsamplerate: Only build when virtual_oss is built

Gate libsamplerate behind MK_CUSE and MK_SOUND, like virtual_oss.
Nothing else uses this library, so there's no point building it
if we aren't building virtual_oss.

This avoids building a useless FreeBSD-sound package containing
only this library when WITHOUT_SOUND is set.

MFC after:      1 week
Reviewed by:    christos, emaste
Differential Revision:  https://reviews.freebsd.org/D56164
Sponsored by:           https://www.patreon.com/bsdivy
DeltaFile
+1-2lib/Makefile
+1-21 files

HardenedBSD/ports 2209fdedevel/wasi-libc distinfo Makefile

devel/wasi-libc: update to sdk-32

No changes, possibly for internal upstream purposes
DeltaFile
+3-3devel/wasi-libc/distinfo
+1-2devel/wasi-libc/Makefile
+4-52 files