NetBSD/pkgsrc h7w4TYswww/nginx Makefile distinfo

   Pullup ticket #7207 - requested by taca
   www/nginx: Security fix

   Revisions pulled up:
   - www/nginx/Makefile                                            1.195
   - www/nginx/distinfo                                            1.144

   ---
      Module Name:      pkgsrc
      Committed By:     kim
      Date:             Tue Jul 21 03:42:05 UTC 2026

      Modified Files:
        pkgsrc/www/nginx: Makefile distinfo

      Log Message:
      nginx: Update to 1.30.4

      Changes with nginx 1.30.4                                        15 Jul 2026

    [17 lines not shown]
VersionDeltaFile
1.143.2.1+4-4www/nginx/distinfo
1.193.2.1+2-1www/nginx/Makefile
+6-52 files

NetBSD/pkgsrc Z2gfzu0lang/ruby rubyversion.mk, lang/ruby33 Makefile distinfo

   Pullup ticket #7206 - requested by taca
   lang/ruby33: Security fix

   Revisions pulled up:
   - lang/ruby/rubyversion.mk                                      1.327
   - lang/ruby33/Makefile                                          1.13
   - lang/ruby33/PLIST                                             1.11
   - lang/ruby33/distinfo                                          1.19
   - lang/ruby33/patches/patch-lib_erb.rb                          deleted
   - lang/ruby33/patches/patch-lib_erb_version.rb                  deleted
   - lang/ruby33/patches/patch-test_erb_test__erb.rb               deleted

   ---
      Module Name:      pkgsrc
      Committed By:     taca
      Date:             Sat Jul 18 14:09:03 UTC 2026

      Modified Files:
        pkgsrc/lang/ruby: rubyversion.mk

    [27 lines not shown]
VersionDeltaFile
1.10.2.1+1-13lang/ruby33/PLIST
1.18.2.1+4-7lang/ruby33/distinfo
1.12.2.1+3-7lang/ruby33/Makefile
1.324.2.1+4-4lang/ruby/rubyversion.mk
1.1.4.1+1-1lang/ruby33/patches/patch-test_erb_test__erb.rb
1.1.4.1+1-1lang/ruby33/patches/patch-lib_erb_version.rb
+14-331 files not shown
+15-347 files

NetBSD/pkgsrc FIXf9fYtextproc/p5-YAML-Syck Makefile distinfo

   Pullup ticket #7204 - requested by taca
   textproc/p5-YAML-Syck: Security fix

   Revisions pulled up:
   - textproc/p5-YAML-Syck/Makefile                                1.43
   - textproc/p5-YAML-Syck/distinfo                                1.24

   ---
      Module Name:      pkgsrc
      Committed By:     wiz
      Date:             Fri Jul 17 06:14:44 UTC 2026

      Modified Files:
        pkgsrc/textproc/p5-YAML-Syck: Makefile distinfo

      Log Message:
      p5-YAML-Syck: update to 1.47.

      1.47 Jul 13 2026

    [48 lines not shown]
VersionDeltaFile
1.23.2.1+4-4textproc/p5-YAML-Syck/distinfo
1.41.2.1+5-2textproc/p5-YAML-Syck/Makefile
+9-62 files

NetBSD/pkgsrc OtwCYmFeditors/vim-share version.mk distinfo

   Pullup ticket #7202 - requested by morr
   editors/vim-share: Bug fix

   Revisions pulled up:
   - editors/vim-share/distinfo                                    1.243
   - editors/vim-share/version.mk                                  1.179

   ---
      Module Name:    pkgsrc
      Committed By:   morr
      Date:           Fri Jul 31 13:26:12 UTC 2026

      Modified Files:
              pkgsrc/editors/vim-share: distinfo version.mk

      Log Message:
      Update vim to version 9.2.0859

      Changes:

    [14 lines not shown]
VersionDeltaFile
1.239.2.2+4-4editors/vim-share/distinfo
1.175.2.2+2-2editors/vim-share/version.mk
+6-62 files

NetBSD/pkgsrc ai5JKMenet/dnscontrol go-modules.mk

   dnscontrol: Update to 4.45.0 (go-modules.mk typo fix)
VersionDeltaFile
1.7+1-2net/dnscontrol/go-modules.mk
+1-21 files

NetBSD/pkgsrc GgzZoeztextproc/p5-XML-Bare distinfo Makefile

   Pullup ticket #7200 - requested by taca
   textproc/p5-XML-Bare: Security fix

   Revisions pulled up:
   - textproc/p5-XML-Bare/Makefile                                 1.22
   - textproc/p5-XML-Bare/distinfo                                 1.8

   ---
      Module Name:      pkgsrc
      Committed By:     wiz
      Date:             Thu Jul 16 17:46:07 UTC 2026

      Modified Files:
        pkgsrc/textproc/p5-XML-Bare: Makefile distinfo

      Log Message:
      p5-XML-Bare: fix CVE-2026-13401

      using upstream patch

    [2 lines not shown]
VersionDeltaFile
1.21.8.1+6-3textproc/p5-XML-Bare/Makefile
1.7.8.1+4-1textproc/p5-XML-Bare/distinfo
+10-42 files

NetBSD/pkgsrc Mk2le7cdevel/userspace-rcu distinfo Makefile, devel/userspace-rcu/patches patch-src_urcu-call-rcu-impl.h patch-src_urcu-call-rcu-impl.h

   Pullup ticket #7199 - requested by taca
   devel/usrespace-rcu: Bug fix

   Revisions pulled up:
   - devel/userspace-rcu/Makefile                                  1.20
   - devel/userspace-rcu/distinfo                                  1.16
   - devel/userspace-rcu/patches/patch-src_urcu-call-rcu-impl.h    1.1

   ---
      Module Name:      pkgsrc
      Committed By:     he
      Date:             Tue Jul 14 17:59:22 UTC 2026

      Modified Files:
        pkgsrc/devel/userspace-rcu: Makefile distinfo
      Added Files:
        pkgsrc/devel/userspace-rcu/patches: patch-src_urcu-call-rcu-impl.h

      Log Message:

    [6 lines not shown]
VersionDeltaFile
1.1.2.1+0-33devel/userspace-rcu/patches/patch-src_urcu-call-rcu-impl.h
1.1.2.2+33-0devel/userspace-rcu/patches/patch-src_urcu-call-rcu-impl.h
1.19.4.1+9-7devel/userspace-rcu/Makefile
1.15.8.1+2-1devel/userspace-rcu/distinfo
+44-414 files

NetBSD/pkgsrc zqfe7rHdoc CHANGES-2026

   doc: Updated net/dnscontrol to 4.45.0
VersionDeltaFile
1.4889+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc BN0dqF4net/dnscontrol Makefile go-modules.mk

   dnscontrol: Update to 4.45.0

   Changelog
   Provider-specific changes:
   •    fdc38db: AUTODNS: support two factor authentication via TOTP (#4626) (@leon-th)
   •    278b963: NAMECHEAP: just skip the failing tests (#4635) (@willpower232)
   CI/CD:
   •    f8f1cae: Build(deps): Bump brace-expansion from 5.0.7 to 5.0.9 (#4629) (@dependabot[bot])
   Dependencies:
   •    9d334eb: CHORE: Update dependencies (#4628) (@TomOnTime)
   Other changes and improvements:
   •    c097900: BUG: SPF flattening no longer drops the last term of an include with no "all" (#4630) (@shuvamk)
   •    637fbaf: BUG: preview no longer errors when a zone will be created by push (#4612) (@lopster568)
   •    c15de40: Prep release (#4643) (@TomOnTime)
   •    96f64d3: Release v4.45.0 (#4644) (@TomOnTime)
VersionDeltaFile
1.6+189-189net/dnscontrol/distinfo
1.6+63-62net/dnscontrol/go-modules.mk
1.38+1-1net/dnscontrol/Makefile
+253-2523 files

NetBSD/pkgsrc ri2gltylang/rexx-regina Makefile

   lang/rexx-regina: Replace one more interpreter
VersionDeltaFile
1.20+6-1lang/rexx-regina/Makefile
+6-11 files

NetBSD/pkgsrc PkPZPWWdoc CHANGES-2026

   doc: Add update of lang/rexx-regina to 3.9.6
VersionDeltaFile
1.4888+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc wecoaGndoc CHANGES-2026

   doc: Updated lang/rexx-regina to 3.9.7
VersionDeltaFile
1.4887+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc 3d2LjZxlang/rexx-regina PLIST Makefile

   lang/rexx-regina: Update to 3.6.7

   * My previous commit updates this to 3.9.6 silently.
     Include changes for 3.9.6 here.

   Changelog:
   3.9.7:
     * Bugs Fixed:
       - #580 Missing files in SVN trunk (target Windows)
       - #587 https://regina-rexx.sourceforge.io/ Sourceforge links mostly broken
       - #595 Unexpected NUL bytes from changestr()
       - #596 stream(filename,"C","OPEN WRITE REPLACE") fails, but "CREATE" works
       - #598 Implicit command doesn't recognize arguments
       - #600 Erroneous syntax error 37
       - #602 Error "System resources exhausted" on Haiku
       - #606 regina.dll reports WIN8 for Windows 11 systems
       - #607 Visual C++ 4.0 build is broken
       - #609 CENTER regression
       - #610 CALL X(SIGL) passes **updated** SIGL as ARG(1)

    [35 lines not shown]
VersionDeltaFile
1.12+5-5lang/rexx-regina/distinfo
1.19+3-3lang/rexx-regina/Makefile
1.5+3-1lang/rexx-regina/PLIST
+11-93 files

NetBSD/pkgsrc mWMoJQvlang/rexx-regina Makefile distinfo, lang/rexx-regina/patches patch-aa

   lang/rexx-regina: Honor LDFLAGS
VersionDeltaFile
1.6+9-18lang/rexx-regina/patches/patch-aa
1.11+5-5lang/rexx-regina/distinfo
1.18+3-4lang/rexx-regina/Makefile
+17-273 files

NetBSD/pkgsrc H0LRE2vlang/rexx-imc/patches patch-shell.c patch-rxmathfn.c

   lang/rexx-imc: Fix build with GCC 14 and honor LDFLAGS
VersionDeltaFile
1.1+24-0lang/rexx-imc/patches/patch-rxstack.c
1.1+21-0lang/rexx-imc/patches/patch-rxque.c
1.1+12-0lang/rexx-imc/patches/patch-shell.c
1.1+12-0lang/rexx-imc/patches/patch-rxmathfn.c
1.1+12-0lang/rexx-imc/patches/patch-main.c
1.1+12-0lang/rexx-imc/patches/patch-interface.c
+93-03 files not shown
+118-119 files

NetBSD/pkgsrc ZN0zsMOdoc CHANGES-2026

   Updated lang/nodejs*
VersionDeltaFile
1.4886+4-1doc/CHANGES-2026
+4-11 files

NetBSD/pkgsrc AI6pt4Olang/nodejs22 Makefile distinfo

   nodejs22: updated to 22.23.2

   22.23.2 'Jod' (LTS)

   Notable Changes

   (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
   (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
   (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
   (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
   (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
   (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
   (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
   (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
   (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
   (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
   deps: update llhttp to 9.4.3 (Paolo Insogna)
   deps: update undici to 6.28.0 (Node.js GitHub Bot)
VersionDeltaFile
1.24+4-4lang/nodejs22/distinfo
1.26+2-2lang/nodejs22/Makefile
+6-62 files

NetBSD/pkgsrc VI3C0Ibdoc CHANGES-2026

   doc: Updated www/osticket to 1.18.4
VersionDeltaFile
1.4885+2-1doc/CHANGES-2026
+2-11 files

NetBSD/pkgsrc AEnOVuiwww/osticket Makefile distinfo

   www/osticket -- update to v1.18.4

   Upstream Changelog:

   osTicket v1.18.4
   Security

       security: Latest Patches 06/2026 (52c366f, 5afdf54, c54a6ac,
       1e39bf1, feccb6a, 6eb6b98, 078516e, 98abb05, e52e010, fd96bba,
       7bbd8ab, ba6217a, 580e1c8, b535782, 5963797, d590a97, eaebe01,
       b4cc092, d457c14, 5600f94, 5ff9795, 119cefe, b4ede88, 2a0c388,
       6558b33)

   XXX pull-up candidate
VersionDeltaFile
1.3+4-4www/osticket/distinfo
1.9+2-2www/osticket/Makefile
+6-62 files

NetBSD/pkgsrc nRAPtWMlang/nodejs24 Makefile distinfo

   nodejs24: updated to 24.18.1

   24.18.1 'Krypton' (LTS)

   Notable Changes

   (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
   (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
   (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
   (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
   (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
   (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
   (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
   (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
   (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
   (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
   (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
   deps: update llhttp to 9.4.3 (Paolo Insogna)
   deps: update undici to 7.29.0 (Node.js GitHub Bot)
VersionDeltaFile
1.14+4-4lang/nodejs24/distinfo
1.14+2-3lang/nodejs24/Makefile
+6-72 files

NetBSD/pkgsrc lMuLjiflang/nodejs Makefile distinfo

   nodejs: updated to 26.5.1

   26.5.1 (Current)

   Notable Changes

   (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
   (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
   (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
   (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
   (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
   (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
   (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
   (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
   (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
   (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
   deps: update llhttp to 9.4.3 (Paolo Insogna)
   deps: update undici to 8.9.0 (Node.js GitHub Bot)
VersionDeltaFile
1.325+4-4lang/nodejs/distinfo
1.357+2-2lang/nodejs/Makefile
+6-62 files

NetBSD/pkgsrc mhculILdoc CHANGES-2026

   Updated devel/glib2*
VersionDeltaFile
1.4884+5-1doc/CHANGES-2026
+5-11 files

NetBSD/pkgsrc mPXrtXLdevel/gdbus-codegen distinfo, devel/glib2 Makefile.common distinfo

   glib2: updated to 2.88.3

   Overview of changes in GLib 2.88.3, 2026-07-29

   * Fix potential miscompilation with GCC 17 with `G_GNUC_CONST` on `get_type()`
     functions

   * Bugs fixed:
     - G_GNUC_CONST vs get_type comes home to roost (Sam James)
     - (CVE-2026-15588) Security report: GDBusServer pre-authentication DoS
       via unbounded SASL line buffering (Philip Withnall)
     - !5225 Backport !5223 “Drop G_GNUC_CONST for *_get_type” to glib-2-88
     - !5241 Backport !5240 “gdbusauth: Limit length of lines read from client” to
       glib-2-88
     - !5242 Backport !5238 “gpoll: Correctly zero-out heap-allocated fd_sets on
       macOS” to glib-2-88
     - !5243 gdbusauth: Unmark a new string as translatable
     - !5259 Backport !5248, !5249: several Meson/gcc fixes to glib-2-88
VersionDeltaFile
1.170+9-9devel/glib2/PLIST
1.348+4-4devel/glib2/distinfo
1.63+4-4devel/gdbus-codegen/distinfo
1.133+2-2devel/glib2/Makefile.common
+19-194 files

NetBSD/pkgsrc mEJEq74doc CHANGES-2026

   Updated www/nghttp2[-tools], devel/cmake[-gui]
VersionDeltaFile
1.4883+5-1doc/CHANGES-2026
+5-11 files

NetBSD/pkgsrc xjjgrP9devel/cmake version.mk distinfo

   cmake[-gui]: updated to 4.4.2

   4.4.2
   This version made no changes to documented features or interfaces. Some
   implementation updates were made to support ecosystem changes and/or fix
   regressions.
VersionDeltaFile
1.269+4-4devel/cmake/distinfo
1.90+2-2devel/cmake/version.mk
+6-62 files

NetBSD/pkgsrc XnNXeCYwww/nghttp2 Makefile.common distinfo

   nghttp2[-tools]: updated to 1.70.0

   1.70.0

   Require C++23
   Adopt Designated initializers part1
   Adopt Designated initializers part2
   Adopt Designated initializers part3
   tests: Make const values static const
   src: Rewrite util::split_str and its variants
   src: Adopt std::string::resize_and_overwrite
   src: Pass std::chrono::{time_point,duration} by value
   Bump mruby to 4.0.0
   src: Fix warning "space between quotes and suffix is deprecated in C++23"
   lib, tests: Use C-style comment
   src: Avoid std::chrono::high_resolution_clock
   src: Add noexcept to user-defined literals
   src: Replace std::optional with std::expected
   src/util: Adopt std::expected for error handling

    [110 lines not shown]
VersionDeltaFile
1.81+4-4www/nghttp2/distinfo
1.35+2-2www/nghttp2/Makefile.common
+6-62 files

NetBSD/pkgsrc 7tn59N9www/drupal11 Makefile

   www/drupal11: allow PHP 8.5

   No functional change.

   * mediawiki 1.46 supports from PHP 8.3 to 8.5:
     <https://www.drupal.org/docs/getting-started/system-requirements/php-requirements>.

   * php/json.mk is required when a package supports prior to PHP 8.0 and
     require php-json pacakge.
VersionDeltaFile
1.10+2-3www/drupal11/Makefile
+2-31 files

NetBSD/pkgsrc J6Potspwww/mediawiki Makefile

   www/mediawiki: allow PHP 8.5

   No functional change.

   * mediawiki 1.46 supports from PHP 8.3 to 8.5:
     <https://www.mediawiki.org/wiki/Compatibility>

   * php/json.mk is required when a package supports prior to PHP 8.0 and
     require php-json pacakge.
VersionDeltaFile
1.101+3-3www/mediawiki/Makefile
+3-31 files

NetBSD/pkgsrc 1ZKOPORcross/ppc-morphos-gcc Makefile, cross/ppc-morphos-gcc/files const-baserel.diff

   cross/ppc-morphos-gcc: Updated const-baserel.diff

   - Fix inconsistent categorization for section
   - Never reference rodata via r13
VersionDeltaFile
1.3+24-18cross/ppc-morphos-gcc/files/const-baserel.diff
1.10+2-2cross/ppc-morphos-gcc/Makefile
+26-202 files

NetBSD/pkgsrc ZlW7ED1doc CHANGES-2026

   Updated archivers/libarchive, devel/catch2
VersionDeltaFile
1.4882+3-1doc/CHANGES-2026
+3-11 files