databases/php-mongodb: update to 1.21.13
1.21.6 (2026-08-27)
Release Highlights
* PHPC-2745: Reject null bytes in namespaces and periods in database names
[v1.21] by @GromNaN in #2059
1.21.7 (2026-08-27)
* Update package.xml maintainers list (#2067)
1.21.8 (2026-09-03)
Warning: this (immutable) release is defunct due to missing assets.
1.21.9 (2026-09-03)
[35 lines not shown]
databases/adodb: update to 5.22.12
pkgsrc changes:
* Add LICENSE.
* Use pax to copy files.
5.22.10 (2025-08-04)
* Security release fixing an SQL injection issue in the SQLite3 driver
(CVE-2025-54119, see advisory), thanks to Marco Nappi (@mrcnpp).
* Also fixes a few bugs in the SQLite3 driver.
5.22.11 (2025-11-22)
* Maintenance release fixing PHP 8.5 compatibility as well as a few other
issues.
[4 lines not shown]
dnscontrol: Update to version 5.8.0
Changelog
Provider-specific changes:
d0885b8: feat(p/LUADNS): batch record changes into bulk API calls (#5047) (@rootful)
Documentation:
0af8f52: docs: roll out registrar and service syntax (#4982) (@TomOnTime)
CI/CD:
2aae113: build(deps): bump alpine from 3.24.2 to 3.24.3 (#5058) (@dependabot[bot])
1cea823: build(deps): bump joi from 18.2.9 to 18.3.1 (#5062) (@dependabot[bot])
1a192aa: build(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 (#5065) (@dependabot[bot])
4d82d23: build(deps-dev): bump @commitlint/cli from 21.2.3 to 21.2.4 (#5059) (@dependabot[bot])
d16c3c0: build(deps-dev): bump prettier from 3.9.9 to 3.9.10 (#5061) (@dependabot[bot])
lz4: update to 1.11.0.
Note: this includes files for other build systems like cmake or meson;
we should consider switching to one of them to avoid our libtoolization patches.
v1.11.0
fix : data corruption in valid usage : ring buffer decoding (`LZ4_decoderRingBufferSize()`, since v1.9.0), rare cases of streaming or `destSize` compression, one reported by @freedom-winds
fix : single-thread `lz4` could truncate the decoding of concatenated frames with block checksums
fix : multithreaded decompression could write out of bounds after 2^31 frames (since v1.10.0), by @arshsmith1
fix : `LZ4F_compressBegin_usingDict()` ignored the dictionary with independent blocks
fix : some periodic data compressed up to 30x worse at fast levels, and very slowly at level 12, reported by @martinus
fix : invalid arguments (negative sizes, `NULL`, invalid `blockSizeID`, extreme levels) no longer crash nor overflow, by @arthuz-th, @jaypatrickhoward, @louislafosse, @akashdeshmukh-git, @rinsuki
fix : lz4file reports truncated files and write failures, and accepts files < 19 bytes, by @axiqia
perf : faster decompression on aarch64 and x86-64 (up to +19%, +4% on silesia.tar), `LZ4_FAST_DEC_LOOP` on aarch64 with clang and on riscv64, by @Nicoshev and @arpadpanyik-arm
perf : faster compression of small blocks at fast levels, with reused states (up to +80%) or dictionaries (up to +35%), partly proposed by @BiplabRaut
perf : faster levels 11 and 12 (+8% to +27%), level 2 compresses ~0.8% better
perf : x86 builds avoid the JCC erratum : up to +12% compression and +31% decompression on Intel Skylake-family cpus
api : multithreaded lz4frame compression (experimental `LZ4F_preferences_t.nbWorkers`) : output independent of the nb of workers and of the context's history
api : random access within frames and lz4 files : `LZ4F_resumeFrame()`, `LZ4F_seek()`, `LZ4F_tell()` (static)
[16 lines not shown]
www/match-sns: remove package
matcha-sns support PHP 5.6.x only and there are new versions that support
PHP 8.x under commercial license not Open Souce. So remove this package
now.
Approved by MAINTAINER.
doc: Update mail/roundcube and related pacakges to 1.6.21
mail/roundcube-plugin-enigma
mail/roundcube-plugin-password
mail/roundcube-plugin-zipdownload
mail/roundcube: update to 1.6.21
1.6.21 (2026-11-09)
This is a security update to the version 1.6 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:
* Fix open redirect via IMAP error recovery on attachment get, reported by
Santhoshkumar S.
* Fix so Received: header includes only trusted hostname and forwarded IP
from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
* Fix bug where some managesieve destructive actions could have been
triggered cross-site via GET, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
* Fix Sieve script injection via a rule operator, reported by Squirt1e,
Atum, N0b0dy, Gh0u1L5.
[39 lines not shown]
py-fastjsonschema: updated to 2.22.3
2.22.3
* Fixed property names with `{` or `}` being evaluated as format string in error messages
* Fixed numeric keywords (minimum, maximum, multipleOf, exclusiveMinimum, exclusiveMaximum) being applied to booleans
* Fixed `propertyNames: false` crashing on non-object values
* Fixed the `date-time` format accepting months, days and hours out of range (such as `2020-19-39T29:00:00Z`) and rejecting a leap second (`23:59:60Z`)
* Fixed the `date` and `date-time` formats accepting days that do not exist in their month, such as `2021-02-29` and `2021-04-31`
* Fixed the `time` format accepting hours, minutes, seconds and offsets out of range (such as `29:99:99`)
* Fixed `minimum` and `maximum` being exclusive in draft 06 and later when `exclusiveMinimum` or `exclusiveMaximum` is set to a number other than zero
* Fixed bools in `uniqueItems`
* Added type annotations for public API and `py.typed` marker (PEP 561)
* Added `message` to `JsonSchemaValuesException` joining messages of all collected errors
