HardenedBSD/src 5db004econtrib/tzdata theory.html Makefile

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+186-181contrib/tzdata/theory.html
+138-58contrib/tzdata/Makefile
+135-0contrib/tzdata/NEWS
+47-47contrib/tzdata/zonenow.tab
+36-16contrib/tzdata/europe
+41-10contrib/tzdata/northamerica
+583-31221 files not shown
+746-41827 files

HardenedBSD/src 9a83afcsys/netpfil/pf pf.c, tests/sys/netpfil/pf sctp.py

Merge branch 'freebsd/14-stable/main' into hardened/14-stable/master
DeltaFile
+67-0tests/sys/netpfil/pf/sctp.py
+6-2sys/netpfil/pf/pf.c
+73-22 files

HardenedBSD/src 60e06balib/libpfctl libpfctl.c, sys/netpfil/pf pf.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+67-0tests/sys/netpfil/pf/sctp.py
+5-1sys/netpfil/pf/pf.c
+2-2lib/libpfctl/libpfctl.c
+74-33 files

HardenedBSD/ports 08a84f9www/iridium/files patch-chrome_browser_about__flags.cc patch-chrome_browser_flag__descriptions.h

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+142-79www/iridium/files/patch-chrome_browser_about__flags.cc
+19-162www/iridium/files/patch-chrome_browser_flag__descriptions.h
+0-172www/iridium/files/patch-chrome_browser_flag__descriptions.cc
+99-53www/iridium/files/patch-chrome_browser_chrome__browser__main.cc
+30-81www/iridium/files/patch-chrome_browser_chrome__content__browser__client.cc
+49-22www/iridium/files/patch-third__party_blink_renderer_platform_runtime__enabled__features.json5
+339-5691,528 files not shown
+3,259-3,3981,534 files

HardenedBSD/ports afd5eabdevel/sabre/files patch-build.xml

devel/sabre: fix build with jdk21

The patch for build.xml hardcoded java 5 source and target which is not available for javac in openjdk21. I removed the source and target.

[javac] Compiling 80 source files to /wrkdirs/usr/ports/devel/sabre/work/Simple API for Binary REpresentations (SABRE)/build/classes
[javac] warning: [options] bootstrap class path not set in conjunction with -source 5
[javac] error: Source option 5 is no longer supported. Use 8 or later.
[javac] error: Target option 5 is no longer supported. Use 8 or later.

Later JDKs are more picky about the charset used. Also for characters in comments. I hinted the encoding for the compiler.

[javac] /wrkdirs/usr/ports/devel/sabre/work/Simple API for Binary REpresentations (SABRE)/src/java/de/tu_darmstadt/informatik/rbg/bstickler/udflib/tools/OSTAIdentifierTranslation.java:6: error: unmappable character (0xF6) for encoding UTF-8
[javac]  *      Bj?rn Stickler <...>

PR:     291571
DeltaFile
+1-1devel/sabre/files/patch-build.xml
+1-11 files

HardenedBSD/ports f0ec4e0sysutils/loki/files loki.in

sysutils/loki: Fix a copy/paste mishap in comments

Several comments in loki's rc.d file referred to "grafana" where they
should have referred to "loki". Looks like a copy/paste mishap from
grafana's rc.d.

Approved by:    portmgr blanket
Fixes:          a96c988a2977 sysutils/loki: Add new port
Pull Request:   https://github.com/freebsd/freebsd-ports/pull/466
DeltaFile
+3-3sysutils/loki/files/loki.in
+3-31 files

HardenedBSD/ports 37c8cb7net/dpinger distinfo Makefile

net/dpinger: Update to 3.4

and take maintainership

PR:             291558
DeltaFile
+3-3net/dpinger/distinfo
+2-2net/dpinger/Makefile
+5-52 files

HardenedBSD/ports 6d414b7sysutils/helm distinfo Makefile

sysutils/helm: Update to 3.19.3

Changelog:
https://github.com/helm/helm/releases/tag/v3.19.3
DeltaFile
+5-5sysutils/helm/distinfo
+2-3sysutils/helm/Makefile
+7-82 files

HardenedBSD/ports 3befd43sysutils/kubectl distinfo Makefile

sysutils/kubectl: Update to 1.34.3

Changelog:
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md#changelog-since-v1342
DeltaFile
+3-3sysutils/kubectl/distinfo
+1-2sysutils/kubectl/Makefile
+4-52 files

HardenedBSD/ports f30ff7cscience/siesta Makefile

science/siesta: Constrain to gfortran
DeltaFile
+1-1science/siesta/Makefile
+1-11 files

HardenedBSD/ports fa0193blang/ratfor Makefile

lang/ratfor: Fix building with Flang and newest Clang
DeltaFile
+1-0lang/ratfor/Makefile
+1-01 files

HardenedBSD/ports 97d9eeecad/scotch Makefile

cad/scotch: Fix building with Flang and newest Clang
DeltaFile
+1-0cad/scotch/Makefile
+1-01 files

HardenedBSD/ports 900510enet/spread-j Makefile

net/spread-j: only compiles on jdk8 and jdk11

Error on later JDKs:
[javac] /wrkdirs/usr/ports/net/spread-j/work/spread-src-3.17.3/java/spread/SpreadConnection.java:1800: error: invalid use of a restricted identifier 'yield'
[javac]                                         yield();

PR:     272855
Approved-by:    no maintainer
DeltaFile
+1-0net/spread-j/Makefile
+1-01 files

HardenedBSD/ports 7d5f8d2www/forgejo-lts distinfo Makefile

www/forgejo-lts: Update to 11.0.8

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.8.md

MFH:            2025Q4
DeltaFile
+3-3www/forgejo-lts/distinfo
+1-2www/forgejo-lts/Makefile
+4-52 files

HardenedBSD/ports 2d879b8www/forgejo distinfo Makefile

www/forgejo: Update to 13.0.3

Changelog:
* https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.3.md

MFH:            2025Q4
DeltaFile
+3-3www/forgejo/distinfo
+1-2www/forgejo/Makefile
+4-52 files

HardenedBSD/ports e84deb6java/apache-commons-pool distinfo Makefile

java/apache-commons-pool: update to 2.13.0 release
DeltaFile
+3-3java/apache-commons-pool/distinfo
+1-1java/apache-commons-pool/Makefile
+4-42 files

HardenedBSD/src ac4fb06sys/net pfvar.h, sys/netpfil/pf pf.c

pf: handle TTL expired during nat64

If the TTL (or hop limit) expires during nat64 translation we may
need to send the error message in the original address family (i.e.
pre-translation).
We'd usually handle this in pf_route()/pf_route6(), but at that point we
have already translated the packet, making it difficult to include it in
the generated ICMP message.

Check for this case in pf_translate_af() and send icmp errors directly
from it.

PR:             291527
MFC after:      2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D54166
DeltaFile
+36-0tests/sys/netpfil/pf/nat64.py
+20-5sys/netpfil/pf/pf.c
+0-1sys/net/pfvar.h
+56-63 files

HardenedBSD/src a717a40sys/netpfil/pf pf.c, tests/sys/netpfil/pf sctp.py

pf: relax sctp v_tag verification

pf was too strict when validating SCTP tags. When a server receives a
retransmitted INIT it will reply with a random initiate tag every time.
However, pf saves the first initiate tag and expects every subsequent INIT_ACK
retransmission to have the same tag. This is not the case, leading to endless
INIT/INIT_ACK cycles.

Allow the tag to be updated as long as we've not gone past COOKIE_WAIT.

Add a test case to verify this.

MFC after:      2 weeks
See also:       https://redmine.pfsense.org/issues/16516
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit bc3b72ff48953551e0e8bd6e5a2c718ecd973285)
DeltaFile
+67-0tests/sys/netpfil/pf/sctp.py
+6-2sys/netpfil/pf/pf.c
+73-22 files

HardenedBSD/src f629ee0lib/libpfctl libpfctl.c

libpfctl: improve error handling

If we fail to open /dev/pf don't try to close it again. That would result in
errno getting overwritten by close(), hiding potentially useful information.

MFC after:      2 weeks
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 238ad591da9eede122a708be925b6b6a20e9046b)
DeltaFile
+2-2lib/libpfctl/libpfctl.c
+2-21 files

HardenedBSD/src cc638b2sys/netpfil/pf pf.c, tests/sys/netpfil/pf sctp.py

pf: relax sctp v_tag verification

pf was too strict when validating SCTP tags. When a server receives a
retransmitted INIT it will reply with a random initiate tag every time.
However, pf saves the first initiate tag and expects every subsequent INIT_ACK
retransmission to have the same tag. This is not the case, leading to endless
INIT/INIT_ACK cycles.

Allow the tag to be updated as long as we've not gone past COOKIE_WAIT.

Add a test case to verify this.

MFC after:      2 weeks
See also:       https://redmine.pfsense.org/issues/16516
Sponsored by:   Rubicon Communications, LLC ("Netgate")

(cherry picked from commit bc3b72ff48953551e0e8bd6e5a2c718ecd973285)
DeltaFile
+67-0tests/sys/netpfil/pf/sctp.py
+5-1sys/netpfil/pf/pf.c
+72-12 files

HardenedBSD/src a35545esys/vm vm_glue.c

vm: Fix kstack alignment assertion

The expectation that the allocation will be aligned to the kstack size
only applies when allocating from a kstack arena, not when allocating a
non-standard size from the kernel arena.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Fixes:          7a79d0669761 ("vm: improve kstack_object pindex calculation to avoid pindex holes")
Reviewed by:    bnovkov, siderop1_netapp.com
Differential Revision:  https://reviews.freebsd.org/D54171
DeltaFile
+6-4sys/vm/vm_glue.c
+6-41 files

HardenedBSD/ports 3166f9bjava/javamail Makefile distinfo, java/javamail/files patch-build.properties

java/javamail: remove java from run dependencies

As javamail is a library and not an application itself it should not
have a run-dependency on Java. It doesn't run on its own.
It will always use the java version of the application that uses javamail.

Use source and target arguments compatible with jdk21.

If not using openjdk8 bring back the Java Activation Framework. In
openjdk8 these classes were included in the core packages. In later
JDK versions it was removed again.

PR:     291388
DeltaFile
+15-3java/javamail/Makefile
+3-1java/javamail/distinfo
+2-2java/javamail/files/patch-build.properties
+20-63 files

HardenedBSD/src e3fa0a2usr.sbin/bhyve pci_uart.c

bhyve: pci-uart needs to also set subclass and function

edk2 PciSioSerialDxe driver setup depends on subclass and function
being set, adding them does make it possible to access pci-uart
serial port from UEFI.

Reviewed by:            corvink
Differential Revision:  https://reviews.freebsd.org/D54167
Sponsored by:           Edgecast Cloud LLC
DeltaFile
+2-0usr.sbin/bhyve/pci_uart.c
+2-01 files

HardenedBSD/ports 48b6aedwww/iridium/files patch-chrome_browser_about__flags.cc patch-chrome_browser_flag__descriptions.h

www/iridium: update to 2025.12.143
DeltaFile
+142-79www/iridium/files/patch-chrome_browser_about__flags.cc
+19-162www/iridium/files/patch-chrome_browser_flag__descriptions.h
+0-172www/iridium/files/patch-chrome_browser_flag__descriptions.cc
+99-53www/iridium/files/patch-chrome_browser_chrome__browser__main.cc
+30-81www/iridium/files/patch-chrome_browser_chrome__content__browser__client.cc
+49-22www/iridium/files/patch-third__party_blink_renderer_platform_runtime__enabled__features.json5
+339-5691,501 files not shown
+3,191-3,3441,507 files

HardenedBSD/ports fb16179misc/openhab distinfo Makefile, misc/openhab-addons distinfo Makefile

misc/openhab: Update to 4.3.9.
DeltaFile
+3-3misc/openhab-addons/distinfo
+3-3misc/openhab/distinfo
+1-1misc/openhab-addons/Makefile
+1-1misc/openhab/Makefile
+8-84 files

HardenedBSD/ports f77f497shells/bash distinfo Makefile

shells/bash: Update to 5.3.9
DeltaFile
+3-1shells/bash/distinfo
+1-2shells/bash/Makefile
+4-32 files

HardenedBSD/src 419ce7ashare/man/man4 bnxt.4, sys/dev/aq aq_common.h aq_fw2x.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+23-10share/man/man4/bnxt.4
+0-11sys/kern/uipc_socket.c
+1-7sys/dev/aq/aq_common.h
+1-1sys/dev/aq/aq_fw2x.c
+1-1sys/dev/aq/aq_fw1x.c
+1-1sys/dev/aq/aq_fw.c
+27-312 files not shown
+28-338 files

HardenedBSD/ports d8f1819devel/etcd35 distinfo, devel/lua-language-server distinfo Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+49-47devel/lua-language-server/distinfo
+64-0www/mediawiki145/Makefile
+60-0net-mgmt/xymon-server/files/patch-xymond_rrd_do__vmstat.c
+28-29devel/lua-language-server/Makefile
+25-25devel/etcd35/distinfo
+47-0security/vuxml/vuln/2025.xml
+273-10124 files not shown
+363-17030 files

HardenedBSD/src a86dc94contrib/tzdata theory.html Makefile

contrib/tzdata: import tzdata 2025c

Changes: https://github.com/eggert/tz/blob/2025c/NEWS

MFC after:      3 days
DeltaFile
+186-181contrib/tzdata/theory.html
+138-58contrib/tzdata/Makefile
+135-0contrib/tzdata/NEWS
+47-47contrib/tzdata/zonenow.tab
+36-16contrib/tzdata/europe
+41-10contrib/tzdata/northamerica
+583-31216 files not shown
+682-40822 files

HardenedBSD/src 7d227f6. theory.html Makefile

Import tzdata 2025c
DeltaFile
+186-181theory.html
+138-58Makefile
+135-0NEWS
+47-47zonenow.tab
+36-16europe
+41-10northamerica
+583-31217 files not shown
+693-41923 files