HardenedBSD/src 71ba188lib/libsys mq_open.2, release/packages/ucl kyua-all.ucl ncurses-all.ucl

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+29-31release/packages/ucl/kyua-all.ucl
+24-2release/packages/ucl/ncurses-all.ucl
+22-1lib/libsys/mq_open.2
+1-1sbin/tunefs/tunefs.c
+76-354 files

HardenedBSD/src 615e1f5lib/libsys mq_open.2, release/packages/ucl kyua-all.ucl ncurses-all.ucl

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+29-31release/packages/ucl/kyua-all.ucl
+24-2release/packages/ucl/ncurses-all.ucl
+22-1lib/libsys/mq_open.2
+1-1sbin/tunefs/tunefs.c
+76-354 files

HardenedBSD/src 16cf93fetc/mtree BSD.usr.dist, sys/dev/ena ena_netmap.c ena.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+5-3sys/dev/ena/ena_netmap.c
+2-3sys/dev/ena/ena.c
+1-2sys/dev/ena/ena_rss.h
+0-2etc/mtree/BSD.usr.dist
+1-1sys/dev/ena/ena.h
+9-115 files

HardenedBSD/ports 183c163finance/gnucash/files patch-CMakeLists.txt, security/wazuh-agent distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+896-61security/wazuh-manager/pkg-plist
+75-77security/wazuh-manager/distinfo
+39-39security/wazuh-agent/distinfo
+11-20security/wazuh-manager/Makefile
+27-0finance/gnucash/files/patch-CMakeLists.txt
+9-9security/wazuh-server/distinfo
+1,057-206513 files not shown
+1,621-716519 files

HardenedBSD/ports 6254acbmath/octave-forge-datatypes distinfo Makefile

math/octave-forge-datatypes: Update to 1.2.2.
DeltaFile
+3-3math/octave-forge-datatypes/distinfo
+1-1math/octave-forge-datatypes/Makefile
+4-42 files

HardenedBSD/ports 6705953security/tailscale distinfo Makefile

security/tailscale: Update to 1.96.4

MFH:            2026Q2
DeltaFile
+5-5security/tailscale/distinfo
+2-3security/tailscale/Makefile
+7-82 files

HardenedBSD/src 3e9f4fdlib/libsys mq_open.2

mq_open(2): document sysctl limit EINVAL and ENFILE conditions

Document two missing error conditions for mq_open(2):

- EINVAL: returned when mq_maxmsg exceeds kern.mqueue.maxmsg or
  mq_msgsize exceeds kern.mqueue.maxmsgsize.
- ENFILE: add kern.mqueue.maxmq sysctl name to the existing entry.

PR:             243209
Reviewed by:    mhorne
MFC after:      1 week
Signed-off-by:  Kit Dallege <xaum.io at gmail.com>
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2098
DeltaFile
+22-1lib/libsys/mq_open.2
+22-11 files

HardenedBSD/ports e74caedsecurity/wazuh-agent distinfo Makefile, security/wazuh-manager pkg-plist distinfo

security/wazuh*: Update to 4.14.4

ChangeLog at:   https://documentation.wazuh.com/current/release-notes/release-4-14-4.html
DeltaFile
+896-61security/wazuh-manager/pkg-plist
+75-77security/wazuh-manager/distinfo
+39-39security/wazuh-agent/distinfo
+11-20security/wazuh-manager/Makefile
+9-9security/wazuh-server/distinfo
+4-6security/wazuh-agent/Makefile
+1,034-2125 files not shown
+1,045-22311 files

HardenedBSD/ports 151e4dasecurity/zaproxy Makefile

security/zaproxy: Update JAVA_VERSION to 17+

- JAVA 22 will be removed soon so 17+ shows us the current java versions
  supported by zaproxy
- Bump PORTREVISION

PR:             294176
Reported by:    ronald
DeltaFile
+2-2security/zaproxy/Makefile
+2-21 files

HardenedBSD/src 1059899sys/dev/ena ena_netmap.c

ena: Verify that an ENA ring is in netmap only in native mode

netmap operates in two modes:
1) Emulated - netmap handling is done by the network stack, the
NIC driver operates transparently to netmap.
2) Native - netmap management is done by the NIC driver.

When checking whether a specific ENA ring is running in netmap
mode, only the following checks were done:
1. IFCAP_NETMAP - Check whether netmap capability is enabled on
the device.
2. NKR_NETMAP_ON - Check whether netmap is actively using this
ring.

The above checks implied that the netmap mode is native and the
ENA driver needs to handle the netmap logic.
The code was missing an explicit check on whether native mode
is actually on (NAF_NATIVE).
This led to a case where though emulated mode was used and

    [19 lines not shown]
DeltaFile
+5-3sys/dev/ena/ena_netmap.c
+5-31 files

HardenedBSD/src 3a01651sys/dev/ena ena.c ena_rss.h

ena: Minor changes

1. Move parenthesis to correct place in switch and fix include order
2. Add comment at the end of an ifdef for clarity
3. Change include order.

Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D55696
Sponsored by: Amazon, Inc.

(cherry picked from commit 2667a8454cff5896c7b467c78cd4ace5ad40f5eb)
DeltaFile
+2-3sys/dev/ena/ena.c
+1-2sys/dev/ena/ena_rss.h
+3-52 files

HardenedBSD/src 332708asys/dev/ena ena.h

ena: Update driver version to v2.8.2

Bug Fixes:
* Verify that an ENA ring is in netmap only in native mode

Minor Changes:
* Move parenthesis to correct place in switch
* Add comment
* Reorder define

Reviewed by: cperciva
Differential Revision: https://reviews.freebsd.org/D55698
Sponsored by: Amazon, Inc.

(cherry picked from commit 96c5eaf0ac6b98d0832e1037d672064de43a7e00)
DeltaFile
+1-1sys/dev/ena/ena.h
+1-11 files

HardenedBSD/src bee397aetc/mtree BSD.usr.dist

mtree: stop creating /usr/share/doc/ncurses

In base 68ad2b0d7af2a the ncurses html documentation was removed, and
entries added to ObsoleteFiles.inc to get rid of /usr/share/doc/ncurses,
but the directory was still being re-created via BSD.usr.dist. Remove it
from there too.

Fixes:          68ad2b0d7af2a
MFC after:      1 month

(cherry picked from commit 212272a43767c3d7be3ddb87605612f6164774c1)
DeltaFile
+0-2etc/mtree/BSD.usr.dist
+0-21 files

HardenedBSD/src d725929release/packages/ucl kyua-all.ucl ncurses-all.ucl

release: Restore licenses for kyua and ncurses

These were modified to avoid triggering a libucl bug which is now fixed.

MFC after:      1 week
Reviewed by:    ivy, kevans
Differential Revision:  https://reviews.freebsd.org/D52824
DeltaFile
+29-31release/packages/ucl/kyua-all.ucl
+24-2release/packages/ucl/ncurses-all.ucl
+53-332 files

HardenedBSD/ports 53930f3finance/gnucash-docs distinfo Makefile

finance/gnucash-docs: Update to 5.15
DeltaFile
+3-3finance/gnucash-docs/distinfo
+1-1finance/gnucash-docs/Makefile
+4-42 files

HardenedBSD/ports 08c2b08finance/gnucash distinfo Makefile, finance/gnucash/files patch-CMakeLists.txt

finance/gnucash: Update to 5.15
DeltaFile
+27-0finance/gnucash/files/patch-CMakeLists.txt
+3-3finance/gnucash/distinfo
+1-1finance/gnucash/Makefile
+1-0finance/gnucash/pkg-plist
+32-44 files

HardenedBSD/src 616f47fsbin/tunefs tunefs.c

tunefs: Fix alignment warning on arm64

MFC after:      1 week
Fixes:          c5e79c7e93dd ("tunefs: Don't lower WARNS")
Reviewed by:    bakul
Differential Revision:  https://reviews.freebsd.org/D56229
DeltaFile
+1-1sbin/tunefs/tunefs.c
+1-11 files

HardenedBSD/ports 964d3b5security/spectre-meltdown-checker distinfo Makefile

security/spectre-meltdown-checker: update to v26.21.0401891

Changelog:      https://github.com/speed47/spectre-meltdown-checker/releases/tag/v26.21.0401891
DeltaFile
+3-3security/spectre-meltdown-checker/distinfo
+1-1security/spectre-meltdown-checker/Makefile
+4-42 files

HardenedBSD/ports 86813e9biology/fastqc Makefile, biology/figtree Makefile

*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:     293559
DeltaFile
+2-2java/java-subversion/Makefile
+1-1biology/fastqc/Makefile
+1-1biology/figtree/Makefile
+1-1biology/gatk/Makefile
+1-1biology/gkl/Makefile
+1-1biology/igv/Makefile
+7-7479 files not shown
+486-438485 files

HardenedBSD/ports 3386304Mk bsd.default-versions.mk

Mk/bsd.default-versions.mk: update JAVA_DEFAULT to 25

The ports tree is adjusted and tested to be ready to set the default
java version to 25.

Openjdk 25 upstream dropped support for i386 so the default for i386
stays at openjdk21.

Thanks to everybody involved in making Java a vivid environment on
FreeBSD.

PR:     293559
Relnotes:       yes
DeltaFile
+3-1Mk/bsd.default-versions.mk
+3-11 files

HardenedBSD/ports b9af07dmisc/claude-code Makefile

misc/claude-code: Patch claude to increase timeouts to 24 hours

Current timeouts of 1 and 10 minutes easily get exceeded when
the AI endpoint API backend is CPU-based.

Even 10x10 munutes can easily get exceeded.

I raised this issue with the upstream.
Patching it here in the meantime.
DeltaFile
+11-0misc/claude-code/Makefile
+11-01 files

HardenedBSD/ports a2f88efmisc/claude-code pkg-plist distinfo, misc/claude-code/files package-lock.json

misc/claude-code: update 2.1.89 → 2.1.90
DeltaFile
+4-4misc/claude-code/files/package-lock.json
+0-7misc/claude-code/pkg-plist
+3-3misc/claude-code/distinfo
+3-1misc/claude-code/Makefile
+10-154 files

HardenedBSD/ports 355760cdevel/websvn distinfo Makefile

devel/websvn: Update to 2.8.6

MFH:            2026Q2
Changelog:      https://github.com/websvnphp/websvn/releases/tag/2.8.6
DeltaFile
+3-3devel/websvn/distinfo
+1-1devel/websvn/Makefile
+4-42 files

HardenedBSD/src 15f6966share/man/man5 src.conf.5, share/mk src.opts.mk

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+3-1share/man/man5/src.conf.5
+1-0share/mk/src.opts.mk
+1-0sys/kern/kern_event.c
+5-13 files

HardenedBSD/src 3bb9143share/man/man5 src.conf.5, share/mk src.opts.mk

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+3-1share/man/man5/src.conf.5
+1-0share/mk/src.opts.mk
+1-0sys/kern/kern_event.c
+5-13 files

HardenedBSD/ports 797d634cad/openvsp distinfo Makefile

cad/openvsp: Update to 3.48.2

ChangeLog:
https://openvsp.org/blogs/announcements/2026/03/04/openvsp-3-48-2-released

 * Fix regressions to Stack Presets caused by 3.48.1 fixes.
DeltaFile
+3-3cad/openvsp/distinfo
+1-1cad/openvsp/Makefile
+4-42 files

HardenedBSD/ports 81ce44ddevel/libvirt/files patch-src_secret_meson.build, devel/p5-EV/files patch-typemap

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+7-29games/anki/files/patch-pylib_tools_hookslib.py
+30-2games/anki/files/patch-build_configure_src_python.rs
+0-25devel/libvirt/files/patch-src_secret_meson.build
+0-24games/anki/pkg-plist
+15-3sysutils/nut-devel/pkg-plist
+0-17devel/p5-EV/files/patch-typemap
+52-10026 files not shown
+116-17032 files

HardenedBSD/ports c36ab38www/gohugo distinfo Makefile

www/gohugo: Update to 0.159.2

ChangeLog: https://github.com/gohugoio/hugo/releases/tag/v0.159.2

 * Fix potential content XSS by escaping dangerous URLs in Markdown links and
   images.
 * resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser.

Approved by:    doceng@ (implicit)
MFH:            2026Q2 security issue
DeltaFile
+5-5www/gohugo/distinfo
+1-1www/gohugo/Makefile
+6-62 files

HardenedBSD/ports 7d53c72devel/p5-EV distinfo Makefile, devel/p5-EV/files patch-typemap

devel/p5-EV: Update 4.34 => 4.37

ChangeLog:
https://metacpan.org/dist/EV/changes

PR:             293942
Reported by:    Sergei Vyshenski <svysh.fbsd at gmail.com> (maintainer)
Approved by:    vvd (mentor)
MFH:            2026Q1
DeltaFile
+0-17devel/p5-EV/files/patch-typemap
+3-3devel/p5-EV/distinfo
+1-1devel/p5-EV/Makefile
+4-213 files

HardenedBSD/ports 8bea2b0audio/waves distinfo Makefile

audio/waves: Update to 0.1.44

ChangeLog:      https://github.com/llehouerou/waves/releases/tag/v0.1.44
Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+5-5audio/waves/distinfo
+1-1audio/waves/Makefile
+6-62 files