arti: update to 2.5.1.
# Arti 2.5.1 - 3 August 2026
Arti 2.5.1 continues development on relays and directory authorities.
It also adds some performance, security, and convenience features for
onion services.
# Arti 2.5.0 — 30 June 2026
Arti 2.5.0 comes with lots of progress in the relay and directory authority
space, including ntor handshake handling, as well as encoding/decoding support
for router- and micro descriptors.
This release also includes a number of important bug fixes, as well as two security
fixes for medium-severity security issues, [TROVE-2026-24] and [TROVE-2026-27].
apr-util: update to 1.6.4.
Changes with APR-util 1.6.4
*) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
avoid producing an empty bucket. PR 64273
[Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
*) apr_brigade: Metadata buckets are now ignored in
apr_brigade_split_line, apr_brigade_flatten and
apr_brigade_to_iovec, fixing possible undefined behaviour. PR 68278
[Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
*) apr_crypto_openssl: Compatibility with OpenSSL 3. [Yann Ylavic]
*) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
on versions 1.1+. [Graham Leggett]
*) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
[5 lines not shown]
SDL3: updated to 3.4.14
3.4.14
This is a stable bugfix release, with the following changes:
GPU buffers and textures can have multiple read usages
Fixed X11 crash if the IME service was shutdown in the background
Fixed hang when hiding an X11 window on some window managers
Fixed being unable to get clipboard text on older versions of macOS
Fixed the 8BitDo Pro 3 controller showing up twice on macOS
Fixed Xbox controllers not being detected if SDL is built with GameInput support
Fixed pen creating phantom mouse events in relative mode on Android
openvpn: updated to 2.7.6
2.7.6
Enable TCP_NODELAY by default and push it to clients
options: make 'tun' the default for '--dev'
Correctly calculate packet id size when epoch packet format is in use
test_tls_crypt: Fix issue with temp file name on big endian systems
ssl_pkt: Fix doxygen warning about read_control_auth
t_client.sh.in: Do not run resolvectl if systemd is not running
test_tls_crypt: Fix test failure on Windows
ssl: Ignore hard reset packets with a non-zero packet id
mingw: avoid C99 "hh" scanf length modifier
interactive: forbid "--setenv opt" in startup data
CMake: detect cmocka_version.h via include path, not by linking
options: limit ping and keepalive values to one day
Make --x509-username-field work with Mbed TLS
Remove --providers from --help output for Mbed TLS
gstreamer1: updated to 1.28.6
1.28.6
Highlighted bugfixes:
Various security fixes and playback fixes
playbin3, playbin: fix stalls after re-enabling previously disabled subtitles
Fix regression in core if a pad is re-linked while changed sticky events are being pushed
dtls/webrtc: fix some issues with OpenSSL 4.0.0
RTP retransmission bitrate estimation fixes
Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets
Add H.266 muxing support to the Rust (f)mp4 muxers
Better handling of input buffers without timestamps in Rust (f)mp4 muxers
webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder
SMPTE ST2038 ancillary metadata and closed caption combiner improvements
Fix SEI insertion into H.265/HEVC streams with alpha
Windows D3D11 WinRT screen capture element fixes
Improved coded buffer size handling for VA encoders
[5 lines not shown]
firefox: remove target_arch=x86_64 cfg attr in patch
Fixes aarch64 build.
(target_pointer_width=64 should suffice here, NetBSD does not have x32
ABI for x86_64.)
chat/ejabberd: Update to 26.07
## Version 26.07
#### Security fixes
This release contains fixes for those issues:
- It's possible to craft PLAIN auth request and authenticate as one user, but then open
session for different one.
- mod_caps persistent cache can be poisoned by using legacy version requests.
This cache was only used to determine list of nodes that should trigger notifications
in PubSub presence-based delivery.
- SQL injection in mod_pubsub handling of paging requests.
- Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
- It was possible to make ejabberd send redirect response for OAuth requests to unvetted url.
This required enabling ejabberd to act as OAuth provider (by adding request handler for
ejabberd_oauth in http listener). As part of this fix we changed `oauth_client_id_check`
default value to `db` - using ejabberd as OAuth provider will be only allowed by clients
[20 lines not shown]
chat/ejabberd: Partially address pkglin and improve comments
- Improve version pattern for coreutils (textual change, NFCI)
- Reorder CONFIGURE_ARGS after DEPENDS
- Clarify and regularize description of build tools
- Reorder erlang bl3 depends.
Except for coreutils version, this is a comment-only/reordering
change.
chat/ejabberd: Update to 26.04
## Version 26.04
#### Core
- Add new listener options for limits to xml parser accepted input
- New predefined keyword `DATABASE_PATH` that points to the Mnesia spool dir
- Support HOST keyword in `sql_database` toplevel option, set nice default value
- ejabberd_config: New default_ram_db/3 clause that checks module support
powerdns: Update to 5.1.4
Released: 6th of August 2026
New Features
Allow NAPTR additional processing to be disabled
References: pull request 17810
Bug Fixes
more lmdb stability
References: pull request 17811, pull request 17814
Account for the existing content when parsing labels
References: pull request 17818
geoipbackend: create DNSSEC key files with mode 0600
References: pull request 17839
iputils: do not index past the address for byte-aligned prefixes
References: pull request 17846
dnsdist: Update to 2.1.1
Released: 6th of August 2026
Bug Fixes
Account for the existing content when parsing labels
References: #17790, #17797, pull request 17858
Do not index past the address for byte-aligned prefixes
References: #17835, pull request 17860
gnuplot: updated to 6.0.5
6.0.5
New features
Full mousing support for multiplots
all panels report mouse coordinates
all panels respond to pan/zoom/rotate mouse movement and hotkeys
"replot" reexecutes multiplot commands starting from current state
"remultiplot" restores the original state before reexecuting multiplot
interactive mousing remains active after ^C or "reset"
Unicode escape sequences \U+xxxx are accepted in more contexts
escape sequences are expanded in "noenhanced" strings
escape sequences are expanded during substring evaluation
escape sequences are expanded in string functions strstrt() and strlen()
New built-in function prod [<var> = <start> : <end>] <expression>
implements the sequential product operation
prod [i=a:b] f(i) = f(a) * f(a+1) * ... * f(b)
[10 lines not shown]
www/xh: update to 0.26.2
Bug fixes
- Fix --auth ignoring credentials when the username is empty (e.g. -a :password), see #467 (@upuddu)
- Decode all frames in concatenated zstd response bodies, see #470 (@snowyukitty)
