flux2: Update to 2.9.3
Changes:
Flux v2.9.0 is a feature release. Users are encouraged to upgrade for
the best experience.
For a compressive overview of new features and API changes included in
this release, please refer to the Announcing Flux 2.9 GA blog post:
<https://fluxcd.io/blog/2026/06/flux-v2.9.0/>
Overview of the new features:
- Flux CLI Plugin System with the Mirror and Schema plugins (flux plugin)
- Server-Side Apply field ignore rules for fine-grained drift control (Kustomization)
- SOPS decryption with the Age post-quantum cipher (Kustomization)
- Kubernetes Workload Identity authentication for OpenBao and Vault (Kustomization)
- Helm post-render strategies, including chart hooks support (HelmRelease)
- Literal mode for Helm values references mirroring helm --set-literal (HelmRelease)
- Allow empty kind in CEL health check expressions (Kustomization, HelmRelease)
[8 lines not shown]
freecad: Update to 1.1.3
FreeCAD 1.1.3 is a maintenance release in the 1.1.x series. It includes several
security fixes addressing code-execution and other file-handling
vulnerabilities that can be triggered by opening a maliciously crafted FCStd
file. All previously-released versions are affected by one or more of these
issues, so we strongly recommend that all users upgrade, especially anyone who
opens FreeCAD files from untrusted or unknown sources.
What happened to 1.1.2?
Shortly after the release of 1.1.2 we discovered that a bugfix that had been
intended for inclusion in the next release had been inadvertently omitted. It
is not a security bug, so if you've already installed 1.1.2 there is no urgent
need to update to 1.1.3, though the bug is an annoyance (repeated warnings of a
version update when saving a file) so you will likely want to upgrade sooner
rather than later.
What's Changed
[112 lines not shown]
Coin: Update to 4.0.10
Coin 4.0.10
This is a bugfix release.
- Fail gracefully on recursive PROTO definitions.
- Replaced fixed length buffers in parsing functions.
- Increase robustness against malformed SoPath input.
- Reject input with invalid IS mappings.
- Fixed some vulnerabilities reported in GHSA-hcqw-f3m9-mq7p
Coin 4.0.9
This is a bugfix release.
- Skip negative indices in SoIndexedPointSet vertex arrays
- Fix cc_string inline buffer size calculation in string.h
- Remove outdated build files.
[22 lines not shown]
wip/hawk-scheme: import hawk-0.9 as wip/hawk-scheme
Hawk is a tracing JIT compiler for Scheme. It includes a bytecode
compiler, runtime, garbage collector, interpreter, trace recorder, and native
code emitters for x86-64 and aarch64.
wip/hawk-scheme: Fix "hawk --exe" compiler.
The compiler needs clang with the correct library paths.
The executable still needs "paxctl +m", which is not
fixed yet.
lean4: handle rpaths in lean compiler/build system
Define C++ standard used, use CMake variables instead of manual
post-installation rule. Depend on required gmp version.
bup-snapshot: Updat to 0.33.71.883
This is more or less 0.34alpha1, not formally named. Upstream said:
It's time. Please test main in preparation for a 0.34 release. This is
a substantial release with a lot of change, so closer scrutiny is
warranted. See note/main.md for an overview, which may suggest changes
relevant to you that warrant closer scrutiny.
gotosocial: Update to 0.22.1
# Summary
This is a minor upgdate.
If you're updating to this version from v0.22.0, it's a very easy update with no db migrations.
# Changelog
Add a codeberg tag tracking variable in the Makefile, like many packages pulled from Github for consistency and easier upstream version changes tracking.
# Verifications
- pkglint
- build using pkgsrc-trunk and bob
- deployed in production
bind920: update to version 9.20.26.
Pkgsrc changes:
* Update version number & checksums.
Upstream changes:
BIND 9.20.26
------------
Security Fixes
~~~~~~~~~~~~~~
- [CVE-2026-11331] Fix handling of rpz CNAME expansion that returns name
too long. ``b950da5f625``
Previously, if the expansion of a wildcard CNAME RPZ policy resulted
in a name that exceeded the length limit, a self referential CNAME and
the original address record were returned, allowing the policy to be
[515 lines not shown]
