lang/php74: Apply changes from PHP-7.4-CVE-2026-109618-109619
Apply changes from tagged as PHP-7.4-CVE-2026-109618-109619 from GitHub.
Quote from security advisory announce on https://www.php.net:
Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.
Bump PKGREVISION.
archivers/libarchive: fix build on -10 / with older bmake
Avoid using $^ in the makefile. With bmake that doesn't support it,
which includes the one on -10 which is still supported, it expands to
empty and the result is that the build hangs trying to grep from
stdin.
Once -10 is EOL this change can be dropped.
Build fix, so no need to bump anything.
PR 60077
powerdns: Update to 5.1.5
Released: 21st of October 2026
This is release 5.1.5 of the Authoritative Server. It contains bug fixes, as well as a minor feature and a security fix.
Please review the Upgrade Notes before upgrading from versions < 5.1.x.
Improvements
api: allow forced update for EXTEND and DELETE zone patch operations
References: pull request 18104
report remote in “unable to get SOA” messages
References: pull request 18131
correctly stop the Lua checker thread when exiting
References: pull request 18134
Bug Fixes
SQL: stricter listSubZones operation
References: pull request 18105
rest-api: fix signedness bug in json data normalization
References: pull request 18106
[14 lines not shown]
knot: Update to 3.6.2
Improvements:
knotd: added MONOTONIC_USEC to sd_notify() for systemd's notify-reload service type
Bugfixes:
knotd: ZONEMD verification omits regular nodes that collide with NSEC3 ones (Thanks to Joshua Rogers)
knotd: catalog updates can purge non-catalog zones with conflicting names (Thanks to Joshua Rogers)
knotd: blocking transfer freeze operation returns prematurely
libknot: connection table exhaustion during QUIC sweep
libknot: uncontrolled compression-pointer traversal in DNS message parsing
libknot: unbounded write-backpressure busy-spin in the DoT send path
tests: build fails if --disable-daemon is specified
tmux: update to 3.8
* Many improvements to floating panes:
- new-pane and split-window can now set the title with -T and
border lines with -B, and new-pane -W waits for the pane command
to exit;
- dragging with Ctrl now creates a new floating pane;
- modal panes may be created with new-pane -O; a window can have
one modal pane and it prevents interaction with the other panes
while it is active. -C closes the pane when the mouse is clicked
outside it and -K sends all keys, including the prefix key, to
the pane. -D closes the modal pane with Escape or C-c. A modal
pane is now used for the editor in buffer mode;
- new-pane -A creates a floating pane which remains above a zoomed
pane; modal panes do this by default;
- move-pane and resize-pane can now move and resize floating panes,
including mouse dragging;
- split-window in a floating pane creates a new floating pane that
does not overlap the active pane, if possible;
[202 lines not shown]
net/netatalk4 -- update to v4.6.1
v4.6.1 - What's Changed
update CONTRIBUTORS.md for the v4.6 release cycle by @rdmark in #3310
revise contributors with GitHub handles by @rdmark in #3317
compat: add header so strlcpy is defined on platforms with older glibc
by @nutzman in #3318
ci: generate and publish afpd code coverage statistics
by @rdmark in #3319
distrib: fix test suite flag checks in container entrypoint
by @rdmark in #3326
doc: programmatically generate TOC index for manpages
by @rdmark in #3322
doc: Japanese localization of the fce_ev_script.8 man page
by @rdmark in #3325
docs: expand workflow environment variables in compile instructions
by @rdmark in #3323
afpd: harden legacy FinderInfo symlink handling
[78 lines not shown]
dnscontrol: Update to 5.7.0
Changelog
Provider-specific changes:
71c0081: feat(p/CONSTELLIX): add Constellix DNS provider (#5029) (@ZeroClover)
d1823f7: fix(p/BIND): extract zones from %f and %F filenames (#5026) (@spicysharkco)
Bug fixes:
5309786: fix(DKIM_BUILDER): encode non-ASCII notes as UTF-8 octets (#5024) (@spicysharkco)
3322ff1: fix(LOC_BUILDER_DD): accept zero and reject missing coordinates (#5027) (@spicysharkco)
d392e6e: fix(diff2): MODIFY messages no showing provider-specific fields (#5030) (@cvas22)
1029216: fix: make IGNORE_TARGET match HTTPS and SVCB targets (#5028) (@spicysharkco)
Deprecation warnings
Warning
REV() will switch from RFC2317 to RFC4183 sometime after v5.0 is released.
This is a breaking change. Warnings are output if your configuration is affected.
See https://docs.dnscontrol.org/language-reference/top-level-functions/revcompat
NAMEDOTCOM, OPENSRS and SOFTLAYER need maintainers! These providers have no maintainer.
Maintainers respond to PRs and fix bugs in a timely manner,
and try to stay on top of protocol changes.
miniflux: Update to version 2.3.4
New features
Added Gotify push notification support.
Added Steam scraper rules.
Added validation with helpful error messages when saving rewrite rules.
Performance improvements
Reduced database storage used by enclosure and entry indexes.
Reduced memory used by internal data structures.
Security
Blocked reserved IP address ranges to further protect against server-side request forgery.
Hardened WebAuthn redirects against open-redirect attacks, including redirect URLs containing surrounding whitespace.
Prevented per-feed proxy URLs from bypassing private-network restrictions by default. Set FETCHER_ALLOW_PRIVATE_FEED_PROXY=1 to retain access to private per-feed proxies.
Enforced DISABLE_LOCAL_AUTH for API password authentication and password changes; API clients must use an API key when local authentication is disabled.
Rejected Google Reader authentication tokens when no password is configured.
Restricted embedded iframe URLs to web schemes and tightened YouTube hostname validation.
Bug fixes
[20 lines not shown]
resterm: Update to 1.16.0
New RestermScript helpers
Standard library names without rts.
Stricter null handling
+ on lists and dictionaries
@use and @setting stay in their request
Clearer error messages
