devel/guile30-slib: Catch up with slib version in variable
This is kind of pointless, but choose consistency over thinking about
the real problem for now.
privoxy: update to 4.2.0.
Provided by Stepan Ipatov in pkgsrc-wip.
Privoxy 4.2.0 fixes a couple of bugs and brings general improvements
such as support for elliptic-curve keys.
Two potential security problems have been reported and addressed.
www/php-ja-wordpress: update to 7.0.4
7.0.4 (2026-08-12)
Security updates
This release features several security fixes. Because this is a security
release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly
reporting vulnerabilities, and allowing them to be fixed in this release:
* An authenticated Author+ remote code execution issue via malicious file
upload on sites that use Imagick and Ghostscript reported by the team at
pwn.ai
www/wordpress: update to 7.0.4
7.0.4 (2026-08-12)
Security updates
This release features several security fixes. Because this is a security
release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly
reporting vulnerabilities, and allowing them to be fixed in this release:
* An authenticated Author+ remote code execution issue via malicious file
upload on sites that use Imagick and Ghostscript reported by the team at
pwn.ai
www/ruby-rack2: update to 2.2.24
2.2.23 (2026-04-01)
Security
* CVE-2026-34763 Root directory disclosure via unescaped regex interpolation
in Rack::Directory.
* CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding
which could lead to denial of service.
* CVE-2026-26961 Raise error for multipart requests with multiple boundary
parameters.
* CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path
mismatch.
* CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
[19 lines not shown]
python312 py312-html-docs: updated to 3.12.14
3.12.14
macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE 2026-72522.
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
[31 lines not shown]
python311 py311-html-docs: updated to 3.11.16
3.11.16
macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522.
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
[28 lines not shown]
python310 py310-html-docs: updated to 3.10.21
3.10.21
macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE-2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186.
gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
[23 lines not shown]
nginx-devel: updated to 1.31.3
1.31.3
fixes for buffer overflow vulnerability when using map with regex
(CVE-2026-42533), memory disclosure vulnerability when using
ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when
using ngx_http_ssi_module (CVE-2026-56434)
unbound: updated to 1.26.0
1.26.0
Features
Update icannbundle.pem certificates in unbound-anchor. It has the public keys for 2009 to 2029 and for 2025 to 2045.
Fix to add `max-transfer-size` and `max-transfer-time` that limit auth-zone and rpz transfer amount and time taken. Default is disabled. This hardens against unbounded transfers. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Merge 1087: Overload `local_data_remove` to support removing specific records.
Merge 1433 from jisakiel: Add new static zone type block_aaaa to suppress AAAA queries.
Fix 1477: respip + dns64: dns64 uses A records modified by respip instead of original A records. Adds local-zone types block_a_wdata and block_aaaa_wdata, that are like block_a and block_aaaa, and uses local-data if present.
p5-Net-CIDR-Set: update to 0.23.
0.23 2026-08-11 20:08:42+01:00 Europe/London
[Security]
- Fix an unbounded IPv6 netmask prefix length (CVE-2026-19566)
0.22 2026-06-13 14:44:25+01:00 Europe/London
[Toolchain]
- Set the static install flag
- Adjusted build prerequisites to be recommended instead of required.
- Sign distribution with SigStore.
[Tests]
- Added author tests.
- Update minimum prereqs for some tests.
