HardenedBSD/ports 2b41693 — audio Makefile, audio/maolan-plugins pkg-descr Makefile

audio/maolan-plugins: New port: CLAP plugins from the Maolan ecosystem

Maolan plugins are a collection of CLAP plugins which currently includes:
- drust: A DrumGizmo-inspired drum sampler plugin.
- rural-modeler: A guitar amp modeler based on NAM and IR.
- EQ: parametric and graphic
- maximizer: adaptive clipper/limiter with Vintage and Modern variants
- imager: stereo width processor with Mild, Wide, and Aggressive algorithms
- monitoring: monitoring toolbox with 17 modes
- saturator: waveshape saturation

WWW: https://maolan.rs

PR:             294885
Reported by:    Goran Mekić <meka at sys.it.com> (new maintainer)
DeltaFile
+1,271-0audio/maolan-plugins/distinfo
+634-0audio/maolan-plugins/Makefile.crates
+33-0audio/maolan-plugins/Makefile
+8-0audio/maolan-plugins/pkg-descr
+1-0audio/Makefile
+1,947-05 files

HardenedBSD/ports d4fc967 — net/freerdp3 pkg-plist distinfo

net/freerdp3: Update 3.32.2 => 3.33.0

Changelog:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0

Security:       GHSA-hhfh-fvm7-7w65
Security:       GHSA-pq35-c472-69w2
Security:       GHSA-v7hr-xh82-79p7
Security:       GHSA-9r9q-9r7p-4mr6
Security:       GHSA-76c4-7552-ffhv
Security:       GHSA-j5pq-cm28-qm6v
Security:       GHSA-2hm9-2h5q-x525
Security:       GHSA-hj6g-r86h-wrcg
Security:       GHSA-fw6x-h8gw-778w
Security:       GHSA-q8p6-8mmj-j4ph
Security:       GHSA-r664-f94r-rgg6
Security:       GHSA-4g67-jhpc-q5xp
Security:       GHSA-8m87-jj8p-2fqc
Sponsored by:   UNIS Labs
MFH:            2026Q4
DeltaFile
+18-4net/freerdp3/Makefile
+3-3net/freerdp3/distinfo
+4-0net/freerdp3/pkg-plist
+25-73 files

HardenedBSD/ports efafedc — mail/py-alot distinfo Makefile

mail/py-alot: Update to 0.12

alot 0.9 imports the mailcap module, which was removed in Python 3.13.
0.12 supports Python 3.13 and 3.14 and depends on standard-mailcap
there.

- Switch to USE_PYTHON=pep517 with setuptools-scm
- Use mail/py-notmuch2 instead of the legacy mail/py-notmuch
- Add mail/py-standard-mailcap for Python >= 3.13
- Depend on urwid>=1.3.0 directly and on urwidtrees>=1.0.3, as 0.12
  requires
- Add concurrent to USE_PYTHON (bin/alot is installed)

PR:             299759
Approved by:    Dhananjay Balan <mail at dbalan.in> (maintainer)
DeltaFile
+19-8mail/py-alot/Makefile
+3-3mail/py-alot/distinfo
+22-112 files

HardenedBSD/ports 2d519dc — games/loderunner-ng Makefile

games/loderunner-ng: Improve Makefile

Satisfy portclippy, portfmt -D, and portlint -A
DeltaFile
+3-2games/loderunner-ng/Makefile
+3-21 files

HardenedBSD/ports bd8dfec — net-im/snac distinfo Makefile

net-im/snac: Update 2.96 => 2.97

Changelog:
* Quote-posting your own posts is now allowed.
* The Mastodon API can now be disabled.
* Fixed a crash in chunked transfer encoding code.
* Tweak to JSON loading code to circunvent fmemopen() issues.
* Mastodon API: Fixed error in voting code.
https://codeberg.org/grunfink/snac2/src/tag/2.96/RELEASE_NOTES.md

While here, replace Codeberg MASTER_SITES with USE_FORGEJO.

PR:             300295
Approved by:    Matthew Phillips (maintainer)
Approved by:    osa, vvd (mentors, implicit)
MFH:            2026Q4
DeltaFile
+5-4net-im/snac/Makefile
+3-3net-im/snac/distinfo
+8-72 files

HardenedBSD/ports 78a57bd — devel/mongo-c-driver distinfo Makefile

devel/mongo-c-driver: Update 2.5.6 => 2.5.7

Changelog:
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.7

While here, sort Makefile (pet portclippy).

PR:             300403
Approved by:    osa, vvd (mentors, implicit)
MFH:            2026Q4
DeltaFile
+3-3devel/mongo-c-driver/distinfo
+3-3devel/mongo-c-driver/Makefile
+6-62 files

HardenedBSD/ports f8724a5 — devel/libbson Makefile distinfo

devel/libbson: Update 2.5.6 => 2.5.7

Changelog:
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.7

PR:             300402
Approved by:    osa, vvd (mentors, implicit)
DeltaFile
+3-3devel/libbson/distinfo
+1-1devel/libbson/Makefile
+4-42 files

HardenedBSD/src a08dc82 — sys/netinet6 udp6_usrreq.c, tests/sys/netinet6 Makefile udp6.c

udp6: make udp6_ctlinput() same as IPv4 version

Processing an incoming ICMPv6 we need to find just the matching inpcb and
call udp_notify() on it.

The call to in6_pcbnotify() at the first glance seems like a notifying
sweep across the entire database, but it is not. It finds just the
matching inpcb, but does that in the most inefficient way!  The added test
case proves that ICMPv6 processing stays the same before and after the
change.  This weird use of in6_pcbnotify() can be tracked down all the way
to the initial KAME code.

Reviewed by:            tuexen, gallatin
Differential Revision:  https://reviews.freebsd.org/D60967
DeltaFile
+97-0tests/sys/netinet6/udp6.c
+18-14sys/netinet6/udp6_usrreq.c
+1-0tests/sys/netinet6/Makefile
+116-143 files

HardenedBSD/src 89d52f0 — sys/riscv/riscv sbi_ipi.c, sys/riscv/vmm vmm_riscv.c vmm_sbi.c

Revert "bhyve/riscv: correctly handle empty masks and broadcast in SBI IPI/RFNC"

This reverts commit ada1f577cc291336cbb69782075dbbf9fe746872.
DeltaFile
+28-43sys/riscv/vmm/vmm_sbi.c
+0-2sys/riscv/vmm/vmm_riscv.c
+0-2sys/riscv/riscv/sbi_ipi.c
+28-473 files

HardenedBSD/ports 117941e — editors/openoffice-4 Makefile, editors/openoffice-devel Makefile

editors/openoffice-*: system lucene cleanup

Delete the remaining remnants of the system lucene dependency.

Reported by:    Ronald Klop <ronald-lists at klop.ws>
DeltaFile
+1-12editors/openoffice-devel/Makefile
+1-12editors/openoffice-4/Makefile
+2-242 files

HardenedBSD/ports 3ffde00 — science/iboview distinfo Makefile, science/iboview/files patch-main.pro patch-src_Common_CxParse1.cpp

science/iboview: Update to 20260917 and migrate to Qt6

Approved by:    arrowd (co-mentor)
Approved by:    makc (mentor)
DeltaFile
+18-0science/iboview/files/patch-src_Common_CxParse1.cpp
+9-4science/iboview/Makefile
+3-3science/iboview/distinfo
+2-2science/iboview/files/patch-main.pro
+32-94 files

HardenedBSD/ports d1a995c — deskutils/birdtray distinfo Makefile

deskutils/birdtray: Update to 1.12.g20260803 and migrate to Qt6

Approved by:    arrowd (co-mentor)
Approved by:    makc (mentor)
DeltaFile
+4-5deskutils/birdtray/Makefile
+3-3deskutils/birdtray/distinfo
+7-82 files

HardenedBSD/ports cb610e1 — databases/opendbviewer Makefile, databases/opendbviewer/files patch-CMakeModules_ProjectIncludeLibrariesQt.cmake

databases/opendbviewer: Migrate to Qt6

The following issues were resolved during the switch:
- Upstream CMake files cannot find FreeBSD's nested Qt libraries
- add_definitions() leaks unresolved generator expressions into
  build.ninja
- Install paths do not follow the ports framework

Approved by:    arrowd (co-mentor)
Approved by:    makc (mentor)
DeltaFile
+31-0databases/opendbviewer/files/patch-CMakeModules_ProjectIncludeLibrariesQt.cmake
+6-7databases/opendbviewer/Makefile
+37-72 files

HardenedBSD/src f9f4abe — tests/sys/file Makefile fork_lowfd_test.c

tests/sys/file: add tests for the lowest fd after fork

fdcopy() skips plain kqueues and close-on-fork descriptors when it
copies the table into the child.  Check that dup(2) in the child still
returns the lowest unused descriptor, both when the skipped descriptor
is the lowest free slot and when it sits above an existing hole.

Test cases:

  kqueue_no_hole      a plain kqueue is the lowest descriptor; the
                      child's dup() reuses its slot
  kqueue_two          two adjacent plain kqueues; the child's dup()
                      returns the lower one
  kqueue_above_hole   a plain kqueue sits above a closed descriptor;
                      the child's dup() returns the hole
  kqueue_cponfork     a KQUEUE_CPONFORK kqueue is copied; the child's
                      dup() returns the next slot
  clofork_no_hole     an O_CLOFORK descriptor is the lowest one; the
                      child's dup() reuses its slot

    [12 lines not shown]
DeltaFile
+141-0tests/sys/file/fork_lowfd_test.c
+1-0tests/sys/file/Makefile
+142-02 files

HardenedBSD/src ada1f57 — sys/riscv/riscv sbi_ipi.c, sys/riscv/vmm vmm_riscv.c vmm_sbi.c

bhyve/riscv: correctly handle empty masks and broadcast in SBI IPI/RFNC

Bhyve treats an empty cpu set as an error which triggers MPASS panic in
the guest. As per the SBI spec, empty masks should return SBI_SUCCESS,
and a base of -1UL specifies a broadcast to all harts.  Fix both in
vmm_sbi.c, clear a1 on return, and skip the SBI ecall in
sbi_ipi_pic_ipi_send() if the mask is empty. Also add a NULL check in
riscv_send_ipi().

Signed-off-by: Doongar Singh <doonbsd at gmail.com>

Reviewed by:    br
Differential Revision:  https://reviews.freebsd.org/D61126
DeltaFile
+43-28sys/riscv/vmm/vmm_sbi.c
+2-0sys/riscv/vmm/vmm_riscv.c
+2-0sys/riscv/riscv/sbi_ipi.c
+47-283 files

HardenedBSD/ports 89002ad — www/firefox Makefile distinfo

www/firefox: update to 159.0.1 (rc1)

Release Notes (soon):
  https://www.firefox.com/en-US/firefox/159.0.1/releasenotes/
DeltaFile
+3-3www/firefox/distinfo
+1-1www/firefox/Makefile
+4-42 files

HardenedBSD/ports 9f39490 — graphics/scantpaper Makefile distinfo

graphics/scantpaper: update to 4.0.2

Release Notes:
  https://sourceforge.net/p/gscan2pdf/mailman/message/59424421/
DeltaFile
+3-3graphics/scantpaper/distinfo
+1-1graphics/scantpaper/Makefile
+4-42 files

HardenedBSD/ports c75ae8a — security/vuxml/vuln 2026.xml

security/vuxml: document www/hurl multiple vulnerabilities
DeltaFile
+34-0security/vuxml/vuln/2026.xml
+34-01 files

HardenedBSD/ports 004a013 — www/hurl Makefile Makefile.crates

www/hurl: update 8.0.1 -> 8.1.0

Changelog: https://github.com/Orange-OpenSource/hurl/blob/master/CHANGELOG.md#8.1.0

Security:       CVE-2026-63481
Security:       Fix escaping headers values in HTML
Security:       Fix symlinks escaping file root
Security:       Fix credentials leaking using --header and following redirection
Security:       Add explicit nesting limit to JSON Body parsing
Security:       Fix escaping capture name in HTML report
DeltaFile
+207-267www/hurl/distinfo
+102-132www/hurl/Makefile.crates
+1-2www/hurl/Makefile
+310-4013 files

HardenedBSD/src 8a08808 — sys/dev/virtio/network if_vtnetvar.h

vtnet: Accept VIRTIO_NET_F_CTRL_RX_EXTRA

Although the driver does not issue the extra receive-mode commands
accepting the feature is harmless and some devices, notably Apple's
Virtualization.framework, offer their control-queue features as a
group and refuse FEATURES_OK unless the whole set is acknowledged.

Signed-off-by:  Faraz Vahedi <kfv at kfv.io>
Reviewed by:    adrian
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2322

(cherry picked from commit d4ddf8eaee9371d1d20bfb753237f25505d6afee)
DeltaFile
+1-0sys/dev/virtio/network/if_vtnetvar.h
+1-01 files

HardenedBSD/src 94e19d4 — sys/dev/virtio/network if_vtnetvar.h if_vtnet.c

vtnet: Implement VIRTIO_NET_F_GUEST_ANNOUNCE

When the device sets VIRTIO_NET_S_ANNOUNCE in the config status
field, for example after a VM migrates to a new host, announce
the interface's presence on the network so peers and switches
learn the new attachment point, then acknowledge the request
with the VIRTIO_NET_CTRL_ANNOUNCE_ACK control command, as per
VirtIO v1.3, 5.1.6.5.4.

The announcement raises iflladdr_event: the stack sends gratuitous
ARPs and unsolicited neighbor advertisements for the interface's
addresses, and stacked interfaces such as vlan(4) propagate the
event and announce theirs as well.  The event handlers may sleep,
so the work is deferred from the config change interrupt to a task
on taskqueue_thread; that context also allows the acknowledgement
to be skipped safely if the interface was stopped in the meantime,
in which case the device keeps the bit set and the request is
re-delivered with the next config change interrupt.


    [5 lines not shown]
DeltaFile
+88-0sys/dev/virtio/network/if_vtnet.c
+2-0sys/dev/virtio/network/if_vtnetvar.h
+90-02 files

HardenedBSD/ports f71501e — sysutils/fjord Makefile distinfo, sysutils/fjord/files pkg-message.in fjordd.in

sysutils/fjord: Update to 0.4.2

Changelog:      https://github.com/daemonless/fjord/releases/tag/v0.4.0
                https://github.com/daemonless/fjord/releases/tag/v0.4.1
                https://github.com/daemonless/fjord/releases/tag/v0.4.2
Reviewed by:    dtxdf
Approved by:    dtxdf (mentor)
Differential Revision:  https://reviews.freebsd.org/D61092
DeltaFile
+16-1sysutils/fjord/files/fjordd.in
+7-3sysutils/fjord/files/pkg-message.in
+3-3sysutils/fjord/distinfo
+2-2sysutils/fjord/Makefile
+28-94 files

HardenedBSD/ports 0a5a674 — net/kube-apiserver Makefile, net/kube-controller-manager Makefile

net/{kube-apiserver,kube-controller-manager,kube-scheduler}: Pass maintainership to ahze@

Reviewed by:    dtxdf
Approved by:    loic.blot at unix-experience.fr (maintainer, by email), dtxdf (mentor)
Differential Revision:  https://reviews.freebsd.org/D61100
DeltaFile
+1-1net/kube-scheduler/Makefile
+1-1net/kube-controller-manager/Makefile
+1-1net/kube-apiserver/Makefile
+3-33 files

HardenedBSD/ports 7b768c3 — sysutils/cni-epair Makefile distinfo

sysutils/cni-epair: Update to 1.2.1

The jail side is configured with ifconfig -j and route -j from the host,
so an image without an ifconfig of its own gets a network.  Needs 14.0 or
newer.

Changelog:      https://github.com/daemonless/cni-epair/releases/tag/v1.2.1
Reviewed by:    dtxdf
Approved by:    dtxdf (mentor)
Differential Revision:  https://reviews.freebsd.org/D61131
DeltaFile
+3-3sysutils/cni-epair/distinfo
+1-1sysutils/cni-epair/Makefile
+4-42 files

HardenedBSD/src ede7728 — sys/netinet6 nd6_rtr.c nd6_nbr.c

netinet6: Use memcpy/memset/memcmp for consistency

Convert the remaining bzero()/bcopy()/bcmp() calls in the neighbor
discovery handlers to memset()/memcpy()/memcmp().

No functional change intended.

Reviewed by:    glebius, pouria
Sponsored by:   VersatusHPC
Differential Revision:  https://reviews.freebsd.org/D58177
DeltaFile
+19-18sys/netinet6/icmp6.c
+7-6sys/netinet6/nd6_nbr.c
+3-3sys/netinet6/nd6_rtr.c
+29-273 files

HardenedBSD/src b3b50cb — sys/kern kern_jail.c, tests/sys/kern jaildesc.c

jail: return a new descriptor from jail_get(JAIL_USE_DESC | JAIL_GET_DESC)

Prior to this change, `jail_get` when called with `JAIL_USE|JAIL_GET_DESC`
would fail to return a valid descriptor in the positive case because the
`JAIL_USE_DESC` block jumped to `found_prison` before the descriptor was
allocated. This resulted in the returned jail descriptor always being -1,
despite the call being successful.

This change fixes the logic so `jfd_out` is properly initialized in the
aforementioned scenario.

MFC after: 3 days

Reviewed by:    jamie, ngie, adrian
Differential Revision:  https://reviews.freebsd.org/D60984
DeltaFile
+40-0tests/sys/kern/jaildesc.c
+11-7sys/kern/kern_jail.c
+51-72 files

HardenedBSD/ports 480ce11 — devel/subversion-book Makefile

devel/subversion-book: deprecate, horribly out of date

Still ships the r4515 book snapshot documenting Subversion 1.7, with
no updated distfile or newer revision available from the upstream
mirror. Mark DEPRECATED and schedule removal.

Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
DeltaFile
+3-0devel/subversion-book/Makefile
+3-01 files

HardenedBSD/ports 274258e — graphics/photocraft Makefile distinfo

graphics/photocraft: update to 0.19.0

Changelog:      https://github.com/storytold/photocraft/releases/tag/v0.19.0
DeltaFile
+5-7graphics/photocraft/distinfo
+3-4graphics/photocraft/Makefile
+8-112 files

HardenedBSD/ports 5fffde8 — sysutils/roct Makefile

sysutils/roct: enable on powerpc64le
DeltaFile
+1-1sysutils/roct/Makefile
+1-11 files

HardenedBSD/ports 63f339e — deskutils/akregator Makefile, deskutils/grantlee-editor Makefile

*/*: declare the qt6-webengine dependency in the KDE PIM ports

akregator, grantlee-editor, kdepim-addons, kdepim-runtime, kmail,
libksieve and messagelib link QtWebEngineWidgets but only pulled
www/qt6-webengine in through kmailtransport and libkgapi, which does not
use it. Since libkgapi dropped it, libksieve and messagelib fail to
configure on powerpc64 instead of being skipped.
DeltaFile
+1-1net/libksieve/Makefile
+1-1deskutils/kmail/Makefile
+1-1deskutils/kdepim-runtime/Makefile
+1-1deskutils/kdepim-addons/Makefile
+1-1deskutils/grantlee-editor/Makefile
+1-1deskutils/akregator/Makefile
+6-61 files not shown
+7-77 files