www/bunkerweb: Update to 1.6.13
This covers the 1.6.12 and 1.6.13 releases.
Security: session fixation on login and an open redirect via the
post-login "next" parameter in the web UI, a second open redirect in
the antibot post-challenge flow, and cache deletion routes that
bypassed authorization. Biscuit token generation now binds the Host
header, client IP and username as typed terms, and adds an optional
API_ALLOWED_HOSTS allowlist. Reverse DNS results are forward-confirmed
before an IGNORE_RDNS or GREYLIST_RDNS suffix match is honored, so a
self-configured PTR record no longer bypasses blocking. ACME challenge
tokens are validated against the base64url character set, closing a
path traversal through the internal API. TOTP verification is enforced
on the exact validation endpoint instead of any path containing /totp.
New settings: REVERSE_PROXY_SSL_VERIFY and friends for upstream HTTPS
certificate verification, USE_LIMIT_REQ_GLOBAL and
LIMIT_REQ_GLOBAL_RATE for an aggregate per-service request rate,
[19 lines not shown]
databases/mysql97-{client,server}: Update to 9.7.2
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 43 of the 54 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
Drop patch-libs_mysql_gtid_tag__plain.h, the type_traits include
is upstream as of 9.7.2.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html
Security: 10f5f76e-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql84-{client,server}: Update to 8.4.11
This release contains the security fixes of the Oracle Critical
Patch Update of July 2026. 31 of the 54 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-11.html
Security: 10f5d195-90a5-11f1-bc30-3497f65b111b
Sponsored by: Netzkommune GmbH
security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026
The Oracle Critical Patch Update of July 2026 fixes 54 issues in
Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series,
including the MySQL Router shipped with the server ports.
Three issues require no credentials: one in the X Plugin and two in
MySQL Router, the latter of which allows unauthorized read and write
access. The remaining ones mostly need a privileged account and lead
to a denial of service.
Fixed in 8.4.11 and 9.7.2 respectively.
Sponsored by: Netzkommune GmbH
games/anki: Update to 26.08
* Switch to USES=npm and adjust/remove the relevant parts.
Although Yarn v4 is already being used according to "package.json",
stick with Yarn v1 for now to complete a 1:1 migration from the before
to the after state with respect to the used tools during build.
Changelog:
https://github.com/ankitects/anki/releases/tag/26.08
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
