BSD Commit Log Search

   mention usefulness of request type allow/denylisting for servers
   accepting untrusted clients

   document EACESS if __pledge_open() in /usr/share/zoneinfo terminates
   on a non-regular file
   ok dgl

   only allow __pledge_open(2) to open regular files in the /usr/share/zoneinfo
   directory.  other file types return EACCES.
   ok dgl

   net/curl: update to 8.20.0

   Includes fixes for
   CVE-2026-4873: connection reuse ignores TLS requirement
   CVE-2026-5545: wrong reuse of HTTP Negotiate connection
   CVE-2026-5773: wrong reuse of SMB connection
   CVE-2026-6253: proxy credentials leak over redirect-to proxy
   CVE-2026-6276: stale custom cookie host causes cookie leak
   CVE-2026-6429: netrc credential leak with reused proxy connection
   CVE-2026-7168: cross-proxy Digest auth state leak

   lrsz: fix incompatible pointer types (socklen_t * vs size_t *) for llvm22

   magicpoint: passing int * to size_t * makes llvm22 unhappy

   comms/x3270: fix -Wincompatible-pointer-types (socklen_t vs size_t)

   In the vscsi_callback() handle ISCSI_SCSI_STAT_CHCK_COND more carefully.

   Especially the embedded sense data needs to be extracted respecting the
   real buffer length. Make sure at least 2 bytes are availabe for the lenght
   and also check that the resulting len is not bigger then the buffer
   itself.

   Reported by Frank Denis
   OK deraadt@

   Update to upterm 0.24.0.

   Update to unbound_exporter 0.6.0.

   update to 148.0.7778.178

   Update to tor 0.4.9.8

   ok sthen@

   Also copy aspa_state and aspa_generation in path_copy() this way
   the linked db copy of the path gets the right ASPA cache data.

   OK tb@

   multimedia/libheif: Update to 1.22.0

   From Brad, thanks

   Update nextcloud to 33.0.3

   Update nextcloud to 32.0.9

   sync

   Introduce a force_update flag to force pend_prefix_add() calls
   in adjout_prefix_update().

   peer_dump() can be called with a preloaded Adj-RIB-Out and in that case
   the code needs to force updates out. This is done instead of walking the
   table twice -- once with peer_dump() and then with peer_blast().
   Using the force_update flag there ensures that all entries are properly
   sent to the peer.

   OK tb@

   devel/codex: update to 0.132.0

   net/rabbitmq: Update to 4.3.1

   Security update to vaultwarden-1.36.0

   Contains security fixes for:
   - SSO Login CSRF
   - User/Organization Enumeration
   - SSO existing-user binding
   - SSRF via Icon Endpoint
   - Some crate's updated and other minor security enhancements

   Changes:
   https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.8
   https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0

   Update to vaultwarden-web-2026.4.1

   Changes:
   https://github.com/dani-garcia/bw_web_builds/releases/tag/v2026.3.1
   https://github.com/dani-garcia/bw_web_builds/releases/tag/v2026.4.1

   Update to samba-4.24.2

   Changes: https://www.samba.org/samba/history/samba-4.24.2.html

   add a note about long delays in some tests if redis is already running

   neomutt docs are generated with, in order of preference, w3m / lynx / elinks.
   change the BDEP to w3m so that builds are consistent.

   update to libunbound-1.25.1

   update to libunbound-1.25.1

   fix MODPY_PYBUILD, add missing tdeps

   add missing dep on py-jwt

   add missing dep on py-jwt