HardenedBSD/src 7b0b185usr.bin/m4/tests m4_test.sh regress.gnuprefix.out, usr.sbin/daemon daemon.c daemon.8

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+249-0usr.bin/m4/tests/m4_test.sh
+0-44usr.bin/m4/tests/regress.gnuprefix.out
+44-0usr.bin/m4/tests/regress.gnuprefix.err
+0-32usr.bin/m4/tests/regress.sh
+21-7usr.sbin/daemon/daemon.c
+15-2usr.sbin/daemon/daemon.8
+329-8513 files not shown
+360-10419 files

HardenedBSD/ports 4ac6913games/moonlight-embedded/files patch-src_input_evdev.c, multimedia/navidrome distinfo Makefile

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+0-11,718multimedia/navidrome/files/packagejsons/package-lock.json
+0-645multimedia/navidrome/files/modules.txt
+192-167net/keycloak/pkg-plist
+7-257multimedia/navidrome/distinfo
+22-192multimedia/navidrome/Makefile
+0-94games/moonlight-embedded/files/patch-src_input_evdev.c
+221-13,07340 files not shown
+424-13,55646 files

HardenedBSD/ports cac11d2games/moonlight-embedded-devel Makefile distinfo

games/moonlight-embedded-devel: 2.7.5 => 2.7.6

Change:
- Add 'drm/drm_vaapi/wayland/wayland_vaapi' platform.
- Add direct render for drm and wayland display.
- Add libyuv or libswscale converter to replace egl.
- Add HDR support for drm and wayland platform.
https://github.com/armin-25689/moonlight-embedded/releases/tag/v2.7.6
https://github.com/armin-25689/moonlight-embedded/compare/v2.7.5...v2.7.6

- Fix warnigs from portlint, portclippy and portfmt.

PR:     292991
DeltaFile
+13-8games/moonlight-embedded-devel/Makefile
+3-3games/moonlight-embedded-devel/distinfo
+16-112 files

HardenedBSD/ports 397c794games/moonlight-embedded Makefile distinfo, games/moonlight-embedded/files patch-src_input_evdev.c patch-src_main.c

games/moonlight-embedded: Update 2.7.0 => 2.7.1

Changelog:
- Increased packet size when streaming remotely over IPv6.
- Improved reliability on high latency connections.
- Improved gamepad input batching.
- Fixed build on 32-bit platforms using 64-bit time.
- Fixed several compiler warnings.
- Updated included gamepad mappings.
https://github.com/moonlight-stream/moonlight-embedded/releases/tag/v2.7.1

- Fix warnings from portlint, portclippy and portfmt.
- Moonlight embedded has remove x11 platform, so remove some patches.

PR:     292992
DeltaFile
+0-94games/moonlight-embedded/files/patch-src_input_evdev.c
+0-84games/moonlight-embedded/files/patch-src_main.c
+55-0games/moonlight-embedded/files/patch-third__party_moonlight-common-c_enet_host.c
+22-18games/moonlight-embedded/Makefile
+0-18games/moonlight-embedded/files/patch-libgamestream_client.c
+3-3games/moonlight-embedded/distinfo
+80-2171 files not shown
+82-2197 files

HardenedBSD/src 25a8168usr.bin/m4 eval.c, usr.bin/m4/tests m4_test.sh defn.m4

m4: Change defn processing order

Currently, defn pushes its arguments on the stack in order, which means
they are then processed in reverse order.  POSIX does not specify what
order they are processed in, which arguably suggests that they should be
processed in the order they are listed.  Push them in reverse order so
they will be processed in their original order.  This matches GNU m4.

PR:             292937
MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    obiwac, imp
Differential Revision:  https://reviews.freebsd.org/D55116
DeltaFile
+9-0usr.bin/m4/tests/m4_test.sh
+5-0usr.bin/m4/tests/defn.m4
+1-1usr.bin/m4/eval.c
+2-0usr.bin/m4/tests/Makefile
+1-0usr.bin/m4/tests/regress.defn.out
+18-15 files

HardenedBSD/src 16e073dusr.bin/m4/tests m4_test.sh regress.gnuprefix.err

m4: Convert tests to ATF

MFC after:      1 week
Sponsored by:   Klara, Inc.
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55115
DeltaFile
+240-0usr.bin/m4/tests/m4_test.sh
+44-0usr.bin/m4/tests/regress.gnuprefix.err
+0-44usr.bin/m4/tests/regress.gnuprefix.out
+0-32usr.bin/m4/tests/regress.sh
+8-5usr.bin/m4/tests/Makefile
+0-5usr.bin/m4/tests/legacy_test.sh
+292-865 files not shown
+298-8911 files

HardenedBSD/ports 28a0df0databases/proxysql Makefile

databases/proxysql: Resolve build failure on 15.x

PR:             293023
Reported by:    Vincent Milum Jr <freebsd at darkain.com>
DeltaFile
+1-0databases/proxysql/Makefile
+1-01 files

HardenedBSD/ports 8c60b94devel/py-levenshtein Makefile

devel/py-levenshtein: Pass MAINTAINER to someone who uses it

Now that this is included with PostgreSQL, I no longer use it.

PR:             293012
DeltaFile
+1-1devel/py-levenshtein/Makefile
+1-11 files

HardenedBSD/ports 697778emultimedia/navidrome distinfo Makefile, multimedia/navidrome/files modules.txt

multimedia/navidrome: Update to 0.60.0, Take maintainership

- Fix 'github.com/navidrome/navidrome/adapters/taglib: invalid flag in pkg-config --cflags: --define-prefix'
- Build assets using a Makejail which simplify a lot.
- Use NAVIDROME_{USER|GROUP} that are more descriptive.

PR:             293000
Security:       a6effa17-1fd4-4895-8471-d5c684d7807c
MFH:            2026Q1
DeltaFile
+0-11,718multimedia/navidrome/files/packagejsons/package-lock.json
+0-645multimedia/navidrome/files/modules.txt
+7-257multimedia/navidrome/distinfo
+22-192multimedia/navidrome/Makefile
+0-85multimedia/navidrome/files/packagejsons/package.json
+29-12,8975 files

HardenedBSD/ports ceece55security/vuxml/vuln 2026.xml

security/vuxml: Add multimedia/navidrome < 0.60.0
DeltaFile
+26-0security/vuxml/vuln/2026.xml
+26-01 files

HardenedBSD/ports 66b658ddevel/py-Levenshtein Makefile, devel/py-Levenshtein/files patch-src_Levenshtein_levenshtein__cpp.cxx patch-src_Levenshtein_Levenshtein-c___levenshtein.hpp

devel/py-Levenshtein: Update to 0.27.3 and rename to match distname

This commit also updates any ports depending up on that port.

PR:             293012
DeltaFile
+0-74devel/py-Levenshtein/files/patch-src_Levenshtein_levenshtein__cpp.cxx
+0-69devel/py-Levenshtein/files/patch-src_Levenshtein_Levenshtein-c___levenshtein.hpp
+0-30devel/py-Levenshtein/files/patch-src_Levenshtein_levenshtein__cpp.pyx
+25-0devel/py-levenshtein/Makefile
+0-24devel/py-Levenshtein/Makefile
+0-16devel/py-Levenshtein/files/patch-src_Levenshtein_Levenshtein-c___levenshtein.cpp
+25-21312 files not shown
+49-23418 files

HardenedBSD/src 1c09ae2sys/dev/nvme nvme_qpair.c

nvme: Use __diagused instead of __unused

Reviewed by:    imp
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
DeltaFile
+1-1sys/dev/nvme/nvme_qpair.c
+1-11 files

HardenedBSD/ports f8fee70net/keycloak pkg-plist distinfo

net/keycloak: Update 26.4.7 => 26.5.2

Release Notes:
https://www.keycloak.org/2026/01/keycloak-2650-released
https://www.keycloak.org/2026/01/keycloak-2651-released
https://www.keycloak.org/2026/01/keycloak-2652-released

PR:             293007
Security:       CVE-2025-67735
Security:       CVE-2025-66560
Security:       CVE-2025-14559
MFH:            2026Q1
DeltaFile
+192-167net/keycloak/pkg-plist
+3-3net/keycloak/distinfo
+1-1net/keycloak/Makefile
+196-1713 files

HardenedBSD/ports 0799c78multimedia/obs-studio Makefile

multimedia/obs-studio: Add workaround for the crash due to the Qt6 problem
DeltaFile
+3-0multimedia/obs-studio/Makefile
+3-01 files

HardenedBSD/ports 9163fc3databases/pgbackrest Makefile distinfo

databases/pgbackrest: Update 2.57.0 => 2.58.0

Release Notes:
https://pgbackrest.org/release.html#2.58.0

Use ETCDIR in Makefile.

PR:     293014
DeltaFile
+3-3databases/pgbackrest/Makefile
+3-3databases/pgbackrest/distinfo
+6-62 files

HardenedBSD/ports 54efdacsecurity/lego distinfo Makefile

security/lego: Update 4.30.1 => 4.31.0

Changelog:
https://github.com/go-acme/lego/blob/v4.31.0/CHANGELOG.md

PR:     292986
DeltaFile
+5-5security/lego/distinfo
+1-2security/lego/Makefile
+6-72 files

HardenedBSD/ports 4991ab5sysutils/stackit distinfo Makefile

sysutils/stackit: Update 0.52.0 => 0.53.1

Changelog:
https://github.com/stackitcloud/stackit-cli/releases/tag/v0.53.1

PR:     292998
DeltaFile
+5-5sysutils/stackit/distinfo
+1-2sysutils/stackit/Makefile
+6-72 files

HardenedBSD/ports d3acc53databases/mariadb118-server distinfo Makefile

databases/mariadb118-server: Update to 11.8.6
DeltaFile
+3-3databases/mariadb118-server/distinfo
+1-1databases/mariadb118-server/Makefile
+4-42 files

HardenedBSD/src a3b90a1usr.sbin/daemon daemon.c daemon.8

daemon: Add option for output file mode

The daemon utility has always created its output file with a fixed mode
of 0600. This causes issues for log collection setups where the collector
does not run as root but instead relies on group access to the watched
daemon’s log file.

Introduce a new option that allows specifying the output file mode using
install(1)-style semantics. This enables non-root log collectors to access
the file as intended and improves compatibility with log rotation tools.

Reviewed by:    kevans
MFC after:      1 week
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D54930
DeltaFile
+21-7usr.sbin/daemon/daemon.c
+15-2usr.sbin/daemon/daemon.8
+36-92 files

HardenedBSD/src 4e160c6lib/libfetch common.c common.h

libfetch: Check for failure to create SSL context

* Drop the ssl_meth member, there is no reason to hang on to it.

* Replace deprecated SSLv23_client_method() with TLS_client_method().

* Check the return value from SSL_CTX_new().

MFC after:      1 week
PR:             292903
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55098
DeltaFile
+7-3lib/libfetch/common.c
+0-1lib/libfetch/common.h
+7-42 files

HardenedBSD/src 4faa62esbin/ifconfig ifconfig.8, sys/netinet6 in6_ifattach.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+9-13sys/netinet6/in6_ifattach.c
+11-8sbin/ifconfig/ifconfig.8
+20-212 files

HardenedBSD/ports 2c00a8adevel/electron39/files patch-electron_shell_app_electron__main__delegate.cc patch-electron_shell_common_electron__paths.cc, devel/electron39/files/packagejsons yarn.lock

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+5-26devel/electron39/files/packagejsons/yarn.lock
+31-0security/vuxml/vuln/2026.xml
+6-15devel/electron39/files/patch-electron_shell_app_electron__main__delegate.cc
+20-0devel/electron39/files/patch-electron_shell_common_electron__paths.cc
+15-0net-p2p/xbt/files/patch-Tracker_connection.cpp
+7-7devel/electron39/files/patch-electron_BUILD.gn
+84-4819 files not shown
+133-10225 files

HardenedBSD/src 4548149sbin/ifconfig ifconfig.8, sys/netinet6 in6_ifattach.c

netinet6: Fix my style issues

Reported by:            pouria
Reviewed by:            pouria, ziaee, glebius
Approved by:            glebius
Fixes:                  31ec8b6407fdd5a87d70265762457c67ce618283
Differential Revision:  https://reviews.freebsd.org/D55136
DeltaFile
+9-13sys/netinet6/in6_ifattach.c
+11-8sbin/ifconfig/ifconfig.8
+20-212 files

HardenedBSD/ports c004847lang Makefile

lang/Makefile: Remove python-doc-pdf-a4

PR:             292970
Approved by:    blanket
Fixes:          5e61a90f3a23 (lang/python-doc-pdf-a4: remove)
DeltaFile
+0-1lang/Makefile
+0-11 files

HardenedBSD/ports 95e7551security/vuxml/vuln 2026.xml

security/vuxml: Document potential DoS in traefik
DeltaFile
+31-0security/vuxml/vuln/2026.xml
+31-01 files

HardenedBSD/ports a18d213net/traefik distinfo Makefile

net/traefik: Update to upstream release 3.6.7

Details:
- Bugfix release, see
  https://github.com/traefik/traefik/releases/tag/v3.6.7
- Addresses a potential DoS vulnerability, see
  https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq
- This may require an update to the traefik configuration:
  https://doc.traefik.io/traefik/v3.6/migrate/v3/#v367

MFH:            2026Q1
Security:       CVE-2026-22045
DeltaFile
+3-3net/traefik/distinfo
+1-2net/traefik/Makefile
+4-52 files

HardenedBSD/ports 6d0d6d4audio/py-pyradio distinfo Makefile

audio/py-pyradio: Update to 0.9.3.11.27

ChangeLog:      https://github.com/coderholic/pyradio/releases/tag/0.9.3.11.27
Reported by:    Spiros Georgaras <notifications at github.com>
DeltaFile
+3-3audio/py-pyradio/distinfo
+1-1audio/py-pyradio/Makefile
+4-42 files

HardenedBSD/src 58a369ausr.bin/sockstat main.c

sockstat: Surround explicit IPv6 addresses with brackets

PR:             254611
Approved by:    otis, tuexen, des
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D54375

(cherry picked from commit fe81e3944c085e765c83c4f78941d7529ceb556e)
DeltaFile
+9-1usr.bin/sockstat/main.c
+9-11 files

HardenedBSD/ports bb8d302editors/vscode Makefile, net-im/deltachat-desktop Makefile

*/*: Bump port revision after electron39 update (8d9f189881c9)
DeltaFile
+1-1editors/vscode/Makefile
+1-1net-im/deltachat-desktop/Makefile
+2-22 files

HardenedBSD/ports 8d9f189devel/electron39 distinfo, devel/electron39/files patch-electron_shell_app_electron__main__delegate.cc patch-electron_shell_common_electron__paths.cc

devel/electron39: Update to 39.5.1

Changelog:
- https://github.com/electron/electron/releases/tag/v39.4.0
- https://github.com/electron/electron/releases/tag/v39.5.0
- https://github.com/electron/electron/releases/tag/v39.5.1

Reported by:    GitHub (watch releases)
DeltaFile
+5-26devel/electron39/files/packagejsons/yarn.lock
+6-15devel/electron39/files/patch-electron_shell_app_electron__main__delegate.cc
+20-0devel/electron39/files/patch-electron_shell_common_electron__paths.cc
+7-7devel/electron39/distinfo
+7-7devel/electron39/files/patch-electron_BUILD.gn
+4-4devel/electron39/files/patch-electron_shell_common_node__bindings.cc
+49-595 files not shown
+54-6711 files