HardenedBSD/src 920b789lib/libsys sigreturn.2, usr.bin/calendar/calendars calendar.status_reports calendar.freebsd

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+28-0usr.bin/calendar/calendars/calendar.status_reports
+16-8lib/libsys/sigreturn.2
+0-4usr.bin/calendar/calendars/calendar.freebsd
+2-2usr.bin/clang/llvm-objcopy/Makefile
+2-1usr.bin/clang/llvm-ar/Makefile
+1-1usr.bin/clang/llvm-nm/Makefile
+49-166 files not shown
+55-2212 files

HardenedBSD/src e593b51lib/libsys sigreturn.2, usr.bin/calendar/calendars calendar.status_reports calendar.freebsd

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+28-0usr.bin/calendar/calendars/calendar.status_reports
+16-8lib/libsys/sigreturn.2
+2-2usr.bin/clang/llvm-objcopy/Makefile
+0-4usr.bin/calendar/calendars/calendar.freebsd
+2-1usr.bin/clang/llvm-ar/Makefile
+1-1usr.bin/clang/llvm-size/Makefile
+49-166 files not shown
+55-2212 files

HardenedBSD/src 5813a1ckrb5/include autoconf.h, lib/libc/tests/stdlib system_test.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+56-1sys/dev/usb/storage/umass.c
+27-11lib/libc/tests/stdlib/system_test.c
+19-7sys/compat/linuxkpi/common/src/linux_80211.c
+8-0krb5/include/autoconf.h
+3-2sys/net80211/ieee80211_ht.c
+2-2share/dict/web2
+115-233 files not shown
+120-269 files

HardenedBSD/ports 942a901security/openssl40 pkg-plist Makefile, security/openssl40/files extra-patch-ktls

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+611-426www/librewolf/files/patch-libwebrtc-generated
+540-0security/openssl40/files/extra-patch-ktls
+392-0sysutils/slurm-wlm/files/patch-configure
+282-0security/openssl40/pkg-plist
+200-0security/openssl40/Makefile
+120-0security/vuxml/vuln/2026.xml
+2,145-42684 files not shown
+3,116-59290 files

HardenedBSD/src b373cf4krb5/include autoconf.h

krb5: Include <features.h> on Linux so __GLIBC__ can be checked

__GLIBC__ is not pre-defined by the toolchain, it comes from features.h,
so we need to make sure that's included by this point.

Fixes:  4dd2b869cd07 ("krb5: Fix -Wint-conversion when bootstrapping on GNU/Linux")
(cherry picked from commit 34e7a57673c9730ee5d1f7ebb07e152567bd8e0b)
DeltaFile
+3-0krb5/include/autoconf.h
+3-01 files

HardenedBSD/src fdddd00krb5/include autoconf.h

krb5: Fix -Wint-conversion when bootstrapping on GNU/Linux

This shows up in GitHub Actions as a warning, and some compilers can
default to it being an error.

(cherry picked from commit 4dd2b869cd078ed6f40c42d1ef429222da16a58f)
DeltaFile
+5-0krb5/include/autoconf.h
+5-01 files

HardenedBSD/ports bd7b119multimedia/mpv Makefile

multimedia/mpv: Disable YTDLP option by default

The www/yt-dlp dependency now requires npm and deno as dependencies (via www/py-yt-dlp-ejs). This pulls in a bunch of build and run
dependencies which were not previously required.
There are two main downsides to this:
  1. Exploding build times
  2. Installing multimedia/mpv on a system now also installs a javascript interpreter which violates POLA and is generally not desirable.

Therefore, we're disabling the YTDLP option by default.

PR:             293736
Approved by:    makc (multimedia)
DeltaFile
+2-1multimedia/mpv/Makefile
+2-11 files

HardenedBSD/ports b22a58dports-mgmt/pkg-devel distinfo Makefile

ports-mgmt/pkg-devel: update to 2.6.99.1

Changes:
- greatly improve the test coverage
- add support for trigger per package (pre installation, post installation)
- fix info export wrong json for multiple packages
- solver: many fixes preventing useless extra reinstallation
- jobs: prevent install -f from deleting packages
- upgrade: prevent rdeps discovery explosion
- fix crash when using external merge tool
- fix ctrl-c during download not really killing pkg
- lots of code cleanup
- prevent running in jail if fflages are involved and the jail does not allow them
- prevent running if secure_level will block them
- improve performance by adding new indexes
- don't try anymore to upgrade the DB if it is readonly
- only open the db RW if needed
- fix pkg -N with WAL
- repositories: add per repo ssh_args

    [8 lines not shown]
DeltaFile
+3-3ports-mgmt/pkg-devel/distinfo
+2-2ports-mgmt/pkg-devel/Makefile
+5-52 files

HardenedBSD/ports be0fcc2devel/gitaly distinfo, net/gitlab-agent distinfo

www/gitlab: security and patch update to 18.9.2

Changes:        https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/
Security:       0236eab0-1d62-11f1-88f8-2cf05da270f3
DeltaFile
+13-13devel/gitaly/distinfo
+6-6www/gitlab/distinfo
+5-5net/gitlab-agent/distinfo
+5-5www/gitlab-pages/distinfo
+5-5www/gitlab-workhorse/distinfo
+1-1www/gitlab/Makefile.common
+35-356 files

HardenedBSD/ports 07a21fctextproc/bookokrat pkg-descr distinfo

textproc/bookokrat: Update to 0.3.8

- Update COMMENT/pkg-descr

ChangeLog:      https://github.com/bugzmanov/bookokrat/releases/tag/v0.3.8
Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+11-23textproc/bookokrat/pkg-descr
+7-3textproc/bookokrat/distinfo
+2-2textproc/bookokrat/Makefile
+2-0textproc/bookokrat/Makefile.crates
+22-284 files

HardenedBSD/ports f617237net-im/linux-discord distinfo Makefile

net-im/linux-discord: Update to 0.0.128
DeltaFile
+3-3net-im/linux-discord/distinfo
+1-1net-im/linux-discord/Makefile
+4-42 files

HardenedBSD/src 4c7dbe9sys/dev/usb/quirk usb_quirk.c, sys/dev/usb/storage umass.c

usb: umass: add SCSIEJECT quirk and fix RTW8821CU_CD (USB mode switch)

Several Realtek (and lots other) USB dongles present themselves as
CDROM device first.  Upon eject they do a mode switch and suddenly
are a different kind of device (sometimes even with different IDs),
e.g., a wireless dongle.

In order to avoid the CDROM stage and rather than adding the quirk
handling to more drivers, add support to umass and if enabled
automatically eject the "CDROM" to make it the real device.

Longer-term some other drivers could stop using their hand-rolled
support for this.  It is unclear as-to how much we need the list of
(eject) quirks from u3g here, or if these are very specific to that
kind of devices.

Sponsored by:   The FreeBSD Foundation
Fixes:          b3b6a959c85a, 9c0cce328363
Reviewed by:    imp

    [3 lines not shown]
DeltaFile
+56-1sys/dev/usb/storage/umass.c
+1-1sys/dev/usb/quirk/usb_quirk.c
+57-22 files

HardenedBSD/src 68fcf0bsys/net80211 ieee80211_ht.c

net80211: fix VHT160/80P80/80 chanwidth selection in the "40-" case

Depending on the base channel ni_vht_chan2 - ni_vht_chan1 can be
negative.  Apply abs() as indicated in the comments right above
        | CCFS1 - CCFS0 | = 8  or > 16
in order to fix the channel width selection.

Sponsored by:   The FreeBSD Foundation
PR:             293645
Fixes:          4bf049bfeefd9
Reviewed by:    adrian
Differential Revision: https://reviews.freebsd.org/D55717

(cherry picked from commit 6cfd2b93e68061c7831016b91c2e308d01658764)
DeltaFile
+3-2sys/net80211/ieee80211_ht.c
+3-21 files

HardenedBSD/src 86417d5sys/compat/linuxkpi/common/src linux_80211.c

LinuxKPI: 802.11: lkpi_sta_auth_to_scan() fail graciously on lsta == NULL

Usually after a firmware crash, we see reports of crashes in
lkpi_sta_auth_to_scan().  One of the last ones was in the PR
mentioned below.

These crashes are often attributed as the problem while the real
problem happened before.

At this point try avoid the NULL pointer and to fail graciously if
lvif->iv_bss (lsta) is no longer set.  This way users have a chance
to possibly recover using netif restart wlan0 rather than dealing
with a panic.

See if this helps us to better track down the original problems
rather than the follow-up crash.

On a debug kernel the KASSERT should normally have caught that
condition as well but we see panics on page faults were the log

    [8 lines not shown]
DeltaFile
+19-7sys/compat/linuxkpi/common/src/linux_80211.c
+19-71 files

HardenedBSD/src 9450995share/dict web2

share/dict/web2: Sort

PR: 293659
Fixes: e49b6ead4114 ("Add a number of five letter words to the dictionary")
(cherry picked from commit 72f0bc868bf00586cba1e50057d8f1998b4abe80)
DeltaFile
+2-2share/dict/web2
+2-21 files

HardenedBSD/ports 92d46e3lang/rust-nightly distinfo Makefile

lang/rust-nightly: update 1.95.0.20260223 → 1.96.0.20260309

Approved by:    rust (implicit)
DeltaFile
+9-9lang/rust-nightly/distinfo
+3-3lang/rust-nightly/Makefile
+12-122 files

HardenedBSD/src 56401a9sys/compat/linuxkpi/common/include/linux sort.h

LinuxKPI: avoid -Werror=unused-value in sort() from BUILD_BUG_ON_ZERO()

The BUILD_BUG_ON_ZERO() macro returns an (int)0 if it does not fail
at build time. LinuxKPI sort() has it as a guard for an unsupported
argument but ignores the return value.

This leads to gcc complaining:

/usr/src/sys/compat/linuxkpi/common/include/linux/build_bug.h:60:33: error: statement with no effect [-Werror=unused-value]
   60 | #define BUILD_BUG_ON_ZERO(x)    ((int)sizeof(struct { int:-((x) != 0); }))
      |                                 ^
/usr/src/sys/compat/linuxkpi/common/include/linux/sort.h:37:9: note: in expansion of macro 'BUILD_BUG_ON_ZERO'
   37 |         BUILD_BUG_ON_ZERO(swap);                        \
      |         ^~~~~~~~~~~~~~~~~
/usr/src/sys/contrib/dev/rtw89/core.c:2575:9: note: in expansion of macro 'sort'
 2575 |         sort(drift, RTW89_BCN_TRACK_STAT_NR, sizeof(*drift), cmp_u16, NULL);

Change to BUILD_BUG_ON() for the statement version.


    [8 lines not shown]
DeltaFile
+1-1sys/compat/linuxkpi/common/include/linux/sort.h
+1-11 files

HardenedBSD/ports 6a78f43deskutils/xdg-desktop-portal/files patch-document-portal_document-portal-fuse.c

deskutils/xdg-desktop-portal: Fix building on 16-CURRENT with renameat2(2)

Reported by:    pkg-fallout
DeltaFile
+21-0deskutils/xdg-desktop-portal/files/patch-document-portal_document-portal-fuse.c
+21-01 files

HardenedBSD/ports dbc1700security/vuxml/vuln 2026.xml

security/vuxml: document gitlab vulnerabilities
DeltaFile
+55-0security/vuxml/vuln/2026.xml
+55-01 files

HardenedBSD/ports 871b06edevel/patch Makefile

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-4devel/patch/Makefile
+0-41 files

HardenedBSD/ports 4dfe4ccdatabases/duckdb pkg-plist distinfo, devel/patch/files patch-lib__localcharset.c patch-lib__Makefile.in

Merge remote-tracking branch 'internal/freebsd/main' into hardenedbsd/main

Conflicts:
        devel/patch/Makefile (unresolved)
DeltaFile
+454-67net/dpdk/pkg-plist
+0-98devel/patch/files/patch-lib__localcharset.c
+76-21databases/duckdb/pkg-plist
+0-43devel/patch/files/patch-lib__Makefile.in
+42-0devel/patch/files/patch-src_patch.c
+19-19databases/duckdb/distinfo
+591-24859 files not shown
+1,025-37665 files

HardenedBSD/ports 9823288net/krakend-ce distinfo Makefile

net/krakend-ce: Update 2.13.1 => 2.13.2

Approved by:    db@, yuri@ (Mentors, implicit)
DeltaFile
+5-5net/krakend-ce/distinfo
+1-2net/krakend-ce/Makefile
+6-72 files

HardenedBSD/ports c68ed62devel/gogs distinfo Makefile

devel/gogs: update to 0.14.2

PR:             291575
Reported by:    polarian at polarian.dev
Approved by:    lwhsu (mentor, implicitly)
DeltaFile
+5-5devel/gogs/distinfo
+2-3devel/gogs/Makefile
+1-1devel/gogs/pkg-plist
+8-93 files

HardenedBSD/src 738aea3usr.bin/calendar/calendars calendar.status_reports calendar.freebsd

Calendars: Update status reports deadlines

Also move the deadlines in their own calendar file.

Reported by:    jhs
Reviewed by:    jhs, adamw,
                Graham Percival <gperciva at tarsnap.com>
Differential Revision:  https://reviews.freebsd.org/D55491
DeltaFile
+28-0usr.bin/calendar/calendars/calendar.status_reports
+0-4usr.bin/calendar/calendars/calendar.freebsd
+28-42 files

HardenedBSD/ports c78a9f0devel/fossil distinfo Makefile

deve/fossil: update to 2.28

Release notes:
https://fossil-scm.org/home/doc/trunk/www/changes.wiki#v2_28
DeltaFile
+3-3devel/fossil/distinfo
+1-1devel/fossil/Makefile
+4-42 files

HardenedBSD/ports f32d9c6www/librewolf distinfo Makefile, www/librewolf/files patch-libwebrtc-generated patch-third__party_libwebrtc_modules_desktop__capture_desktop__capturer.h

www/librewolf: Update 147.0.4-1 => 148.0.2-1

Release Notes:
https://www.firefox.com/firefox/148.0/releasenotes/
https://www.firefox.com/firefox/148.0.2/releasenotes/

PR:     293729
MFH:    2026Q1
DeltaFile
+611-426www/librewolf/files/patch-libwebrtc-generated
+20-0www/librewolf/files/patch-third__party_libwebrtc_modules_desktop__capture_desktop__capturer.h
+3-3www/librewolf/distinfo
+2-2www/librewolf/Makefile
+636-4314 files

HardenedBSD/src 9da4a80lib/libsys sigreturn.2

sigreturn.2: refresh the man page

Remove mention of the longjmp(3), which does not use sigreturn.
Try to be more precise when describing the syscall effects.

Reviewed by:    emaste, markj
Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
Differential revision:  https://reviews.freebsd.org/D55750
DeltaFile
+16-8lib/libsys/sigreturn.2
+16-81 files

HardenedBSD/ports e06f655lang/gcc16-devel distinfo Makefile

lang/gcc16-devel: Update to 16.0.1.s20260308
DeltaFile
+3-3lang/gcc16-devel/distinfo
+1-1lang/gcc16-devel/Makefile
+4-42 files

HardenedBSD/ports 8cd1546lang/gcc15-devel distinfo Makefile

lang/gcc15-devel: Update to 15.2.1.s20260307
DeltaFile
+3-3lang/gcc15-devel/distinfo
+1-1lang/gcc15-devel/Makefile
+4-42 files

HardenedBSD/ports e7c9864lang/gcc14-devel distinfo Makefile

lang/gcc14-devel: Update to 14.3.1.s20260306
DeltaFile
+3-3lang/gcc14-devel/distinfo
+1-1lang/gcc14-devel/Makefile
+4-42 files