opentofu112: Update to 1.12.8
pkgsrc changes:
- Do not force particular Go version, build fine with Go 1.27.x now
Changes:
1.12.8
SECURITY ADVISORIES:
- Previous versions of OpenTofu could potentially experience excessive
CPU usage if connecting to an attacker-controlled HTTP2 server while
installing dependencies in tofu init. (4700)
BUG FIXES:
- Lifecycle destroy will no longer crash when given an expression with
references (4648)
1.12.7
- When using either a remote-exec or file provisioner to connect to an
attacker-controlled SSH server, the server could previously deadlock
the connection by sending certain unexpected packet types. (4551)
www/forgejo: import at version 16.0.6
forgejo is a forge software package for hosting software development
version control using Git as well as other collaborative features
like bug tracking, code review, continuous integration, kanban
boards, tickets, and wikis.
Tested on NetBSD/amd64.
security/sslx: import package
The modern way to work with certificates and TLS.
A fast, beautiful replacement for common openssl commands. Single binary,
zero config, pure Rust.
p5-Text-CSV_XS: update to 1.65.
1.65 - 2026-10-15, H.Merijn Brand
* CPAN.org does not forward email anymore
* parse (): report trailing lone CR, do not store EOF as 0xFF (CVE-2026-110759)
* Under allow_whitespace, do not strip beyond field start (CVE-2026-110758)
* combine (): decide quoting from the bytes, not the NV flags (CVE-2026-110757)
* Flush saved bytes in Combine () (CVE-2026-110756)
* Re-use AHEAD with \r instead of copying (CVE-2026-110755)
* getline (): free the result array when the parse fails (CVE-2026-110754)
* Do not free the bound column scalar in skip_empty_rows (CVE-2026-110753)
* fragment (): do not size memory by the selector integers (CVE-2026-110752)
p5-Cpanel-JSON-XS: update to 4.80.
4.80 2026-09-?? (rurban)
- Security fixes, reported by Stig Palmquist (CPANSec):
* CVE-2026-110672 decode: free the hash key on "Duplicate keys not
allowed" and on a missing ':' (leak).
* CVE-2026-110673 decode: charge allow_tags "(" nesting against
max_depth (stack overflow).
* CVE-2026-110674 decode: look bare keys up as UTF-8, so the
duplicate check no longer misses or crashes on non-ASCII keys.
* CVE-2026-110675 decode: validate bare hash keys as UTF-8 like
quoted keys (malformed keys).
* CVE-2026-110676 encode: compact allow_bignum Math::BigFloat
values with huge exponents (30MB from 12 bytes).
* CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference
counts (leaked every array).
* CVE-2026-110678 incr_parse: apply max_size to the buffered text
in every context.
* CVE-2026-110680 encode: bound the canonical key snapshot for
[49 lines not shown]
Update to 9.50
Upstream changes:
9.50 2026-10-16
- Added SECURITY.md policy for reporting security issues.
- Fixed a security issue in Mojo::DOM where the content of title and textarea elements was not escaped during
rendering, allowing escaped end tags to break out and turn sanitized HTML into live markup.
9.49 2026-08-10
- Added EXPERIMENTAL support for partitioned cookies. (rawleyfowler)
- Added EXPERIMENTAL partitioned attributes to Mojo::Cookie::Response and Mojolicious::Sessions
devel/libagcre and textproc/agcre: Update to version 20261015
Changes since previous version:
Bring over changes from the development branch:
+ unicode escapes can be set with \xNNNN as well as \uNNNN
+ tighten up bounds checking when looking ahead while compiling
+ make sure illegal utf8 sequences are handled as single bytes
+ fill out the unicode sequences recognised by unicode_isprint
and unicode_isgraph
+ update unicode_isspace to not recognise 0x200e and 0x200f (they're
directional markers for BiDi text, not whitespace)
+ tighten up the way hex numbers are calculated in unicode escapes
+ bump version number to 20261015
