knot-resolver: Update to 6.4.1
Knot Resolver 6.4.1 (2026-07-22)
Security:
DNS-over-QUIC (DoQ) had severe issues, allowing even RCE Many people reported (some of) these issues to us.
DNSSEC correctness issues, acting mainly through the aggressive cache:
* dealing with Labels field in RRSIGs being smaller than the signer’s
* dealing with NSEC’s next-name pointing outside of the zone
Special thanks to Qifan Zhang from Palo Alto Networks.
Improvements:
docker: upgrade to Debian 13 (!1856)
update IANA’s certificate for root trust anchor bootstrapping (!1845)
Bugfixes:
/local-data/addresses*: make multiple addresses work (#808, #954)
views: fix protocol-based matching for DoQ
lang/gcc15: Add changes to make this build on NetBSD/macppc 11.0_RC6.
This pulls over changes to config/rs6000/ and gcc/config.gcc from
our in-tree gcc instance of gcc14, while preserving existing Homebrew-
related changes to gcc/config.gcc.
The most important fix is that on NetBSD/powerpc, -msecure-plt is enabled
by default, so that resulting executables can be run with PAX_MPROTECT
active. Otherwise, we end up with executables with sections which have
both "write" and "execute" turned on, which PAX_MPROTECT rejects.
Fixes PR#60439.
Bump PKGREVISION for both gcc15 and gcc15-libs, to adhere to rules in comments,
even though this *should* be a single-arch build fix, since I had to merge
the patch to gcc/config.gcc.
multimedia/dav1d: Update to 1.5.4
Changelog:
dav1d 1.5.4 'Sonic'
1.5.4 is a minor release of dav1d, focused on optimizations and maintenance:
Support for OS/2, including API exports and assembly
Switch to external checkasm
Add Armv9.3-A GCS (Guarded Control Stack) support
AArch64: optimize ipred_v, ipred_h and ipred_smooth_* 8bpc functions, and reduce .text size
ARM32: optimize prep_neon
RISC-V: ipred_(dc, h, v, pal) optimizations for 8 and 16bpc, generate_grain_y for 8bpc, and optimizations (prep/put_8tap, 6-tap and copy paths)
Portability improvements for non-POSIX systems (signal() fallback)
Schedule tile tasks for all passes at once, improving threading
Precompute the quantization matrix tables at build time
Move loop-invariant computations out of hot loops
ibus: add kludge to fix bulk build on NetBSD/amd64 10.0
See PR pkg/60476 for details.
XXX: still fails on builds on hosts with xserver set using official gtk3
binary package
security/pdfrip: import pdfrip-3.0.0
pdfrip is a fast multithreaded PDF password cracking utility written
in Rust with support for wordlist-based dictionary attacks, date,
number range, and alphanumeric brute-forcing, and a custom query
builder for password formats.
mail/thunderbird: Update to 152.0.1
Changelog:
152.0.1:
What's Fixed
fixed
Reply All button was missing for some EWS messages with multiple recipients
fixed
Security fixes
Security fixes:
Mozilla Foundation Security Advisory 2026-63
#CVE-2026-57962: Denial-of-service via malicious LDAP address-book server
#CVE-2026-57963: Chat UI manipulation by injection
152.0:
[182 lines not shown]
audio/tenacity: import tenacity-1.3.5
Tenacity is an easy-to-use multi-track audio editor and recorder
for Windows, macOS, Linux and other operating systems. It is built
on top of the widely popular Audacity and is being developed by a
wide, diverse group of volunteers.
knot: Update to 3.5.6
Release notes
Knot DNS 3.5.6 (2026-07-20)
Improvements:
knotd: new log message when accepting a control client fails
knotd: new log message when UDP or TCP worker initialization fails
knotd: improved log message when loading an expired zone
knotd: more verbose log messages for DDNS forwarding
knotd: disabled 0-RTT when forwarding DDNS updates over QUIC
utils: configuration detection considers an empty database directory as unused
libknot: added support for EDE code 33 (Negative Trust Anchor) (Thanks to Babak Farrokhi)
libs: upgraded embedded libngtcp2 to 1.24.0
doc: various improvements
Bugfixes:
knotd: server crashes when evaluating an ACL rule with 'cert-hostname' set
knotd: failed to start with 'listen-tls' and 'tcp-reuseport' enabled
[7 lines not shown]
dnscontrol: Update to 4.43.3
v4.43.3
No changes since the last release.
v4.43.2
No changes since the last release.
Release v4.43.0 highlights:
• 4 New Providers! The most new providers we've had in one release in a long time! Thanks and welcome to our newest maintainers! We look forward to great things!
- DYNU (#4364) thanks to @DustyRah!
- OpenWRT (#4166) thanks to @huskyistaken!
- GIGAHOST (#4394) thanks to @jochristian!
- SCALEWAY (#4462) thanks to @alessiopcc!
• AUTODNS now supports child domains. Thanks, @arnoschoon!
• ROUTE53 can now edit SOA records. Thanks, @istenrot!
• AXFRDDNS now supports communication over Unix domain sockets. Thanks, @tomfitzhenry!
• GANDI_V5 now supports HTTPS/SVCB, NAPTR, LOC, OPENPGPKEY record types. Thanks @francois2metz!
• "init" support added for AKAMAIEDGEDNS, AUTODNS, CLOUDNS, SeSEC, DNSSCCALE, DNSMADEEASY, FORTIGATE, JOKER, LINODE, MIKROTIK, and PORKBUN. If you haven't tried "dnscontrol init" yet, it's one of the coolest new features.
• The HETZNER provider has been removed, having been replaced by HETZNERV2, thanks to @das7pad!
