BSD Commit Log Search

   start moving some global pf counters to per cpu counters.

   this moves the pfctl_status.fcounters, which includes the state
   search counter which is bumped every time the state table is searched.

   the places that get a copy of these counters now have to read the
   per cpu counters and fold them into a struct pf_status rather than
   just copy the global now.

   ok sashan@

   add support for loading files (kernels) from the efi system partition.

   this means you can put the openbsd boot loader and bsd.rd on the
   efi boot partition and run the installer that way. this is a port
   of the same code i got working on arm64.

   ok jmatthew@

   Update binaryen to 125.

   Update p5-Image-ExifTool to 13.42.

   +gblc

   Initial revision

   + dms

   Initial revision

   Ignore any iterator when traversing nd6 list.

   nd6_rtrequest() could crash with a NULL pointer dereference if an
   interator in nd6_list was inspected.  Skip freeing neigbor discovery
   entries and optimization in this unlikely case and try again later.

   reported by Mischa and Anton Kasimov; OK mvs@

   this is errata/7.8/011_nd6.patch.sig

   recycle _heartbeat (gone since 2016) as _dms for multimedia/dms;  OK caspar

   Fix incomplete mitigation of CVE-2025-11411 in unbound and unwind.
   https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-11411_2_wtests.diff

   This extends the previous fix by also scrubbing unsolicited NS RRSets (and
   their respective address records) for YXDOMAIN and nodata non-referral answers.

   from sthen@ florian@

   this is errata/7.8/010_unbound.patch.sig

   Fix incomplete mitigation of CVE-2025-11411 in unbound and unwind.
   https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-11411_2_wtests.diff

   This extends the previous fix by also scrubbing unsolicited NS RRSets (and
   their respective address records) for YXDOMAIN and nodata non-referral answers.

   from sthen@ florian@

   this is errata/7.7/017_unbound.patch.sig

   Backport fixes from png 1.6.51.
   CVE-2025-64505 CVE-2025-64506 CVE-2025-64720 CVE-2025-65018

   from matthieu@

   this is errata/7.8/008_libpng.patch.sig

   Fix drm code to avoid spurious tsleep errors leading to crashes

   __set_current_state() reimplements parts of sleep_finish() but forgot
   to clear P_SINTR.  Later another tsleep->sleep_finish() call could
   pick up the flag and erroneously return ERESTART early, leading to
   crashes in unsuspecting code using tsleep(0, INFSLP).

   Issue experienced by Piotr Isajew using iridium on 7.8 and myself
   using firefox.

   from jca; ok claudio@ mpi@ and most likely kettenis@

   this is errata/7.8/007_drm.patch.sig

   Fix drm code to avoid spurious tsleep errors leading to crashes

   __set_current_state() reimplements parts of sleep_finish() but forgot
   to clear P_SINTR.  Later another tsleep->sleep_finish() call could
   pick up the flag and erroneously return ERESTART early, leading to
   crashes in unsuspecting code using tsleep(0, INFSLP).

   Issue experienced by Piotr Isajew using iridium on 7.8 and myself
   using firefox.

   from jca; ok claudio@ mpi@ and most likely kettenis@

   this is errata/7.7/015_drm.patch.sig

   add LOGIN_SETXDGENV to setusercontex(3) and pass on XDG_RUNTIME_DIR to the session

   update to pecl-imagick-3.8.1

   update to qutebrowser-3.6.2

   update to py3-mitogen-0.3.34

   update to ccache-4.12.2

   update to borgmatic-2.0.12

   update to py3-hatchling-1.28.0

   update to py3-types-psutil-7.1.3.20251128

   update to py3-mdown-extensions-10.17.2

   update to fcgi-2.4.7, CVE-2025-23016

   update to fcgi-2.4.7, CVE-2025-23016, fixes integer overflow (and
   resultant heap-based buffer overflow) via crafted nameLen or valueLen
   values in data to the IPC socket, in fcgiapp.c:ReadParams()

   actually previous COMPILER setting was ok, so revert to that, if
   COMPILER is set _before_ bsd.port.mk is included, COMPILER_LANGS is set
   to c c++, and 3/python.port.mk doesn't override it.

   update to py3-sgp4-2.25
   add "COMPILER_LANGS=c c++" as recent lang/3/python.port.mk dropped c++

   shells/bash: update to 5.3 patchlevel 8

   Add "no banner" option to suppress Server header

   Introduces a global and per-server "[no] banner" directive that prevents httpd
   from sending the Server HTTP response header and removes server identification
   from error documents. The SERVER_SOFTWARE CGI environment variable remains set
   as required by RFC 3875.

   Diff by Lloyd (thanks), ok kirill@