BSD Commit Log Search

   Handle '=' padding in base64url encoded EAB keys.

   bentley@ found one in the wild and confirmed that this makes it work

   pass back errors from ed25519 key generation, which theoretically
   can fail. From Dimitri John Ledkov via GHPR702.

   ok deraadt@ dtucker@

   Move check of public key type against allowed algorithms to before
   parsing of the key sent by the peer.

   This removes at least some key parsing and verification paths from
   the pre-auth attack surface.

   Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@

   Update to samba-4.24.5

   Security release addressing CTDB protocol bounds checking issues
   (CVE-2026-58224). AD and DNS/KDC vulnerabilities do not affect standard
   OpenBSD builds. Details:
   https://www.samba.org/samba/history/samba-4.24.5.html

   Tested by Ian McWilliam (maintainer).

   Update to samba-4.24.5

   Security release addressing CTDB protocol bounds checking issues
   (CVE-2026-58224). AD and DNS/KDC vulnerabilities do not affect standard
   OpenBSD builds. Details:
   https://www.samba.org/samba/history/samba-4.24.5.html

   Tested by Ian McWilliam (maintainer).

   Fix double frees (impossible to reach outside of a test harness),
   and also use freezero where possible
   from Christopher Paul Rohlf at Anthropic
   ok djm

   Update to lilypond-2.26.0

   lang/node: Update to 24.18.1

   Security update, fixes:

   CVE-2026-56846, CVE-2026-56848,
   CVE-2026-58043, CVE-2026-56850,
   CVE-2026-58040, CVE-2026-58041,
   CVE-2026-58042, CVE-2026-58045,
   CVE-2026-56847, CVE-2026-58039,
   CVE-2026-58044

   Fix unzoomed width when scrollbars are hidden.

   graphics/pixelorama: Update to 1.2

   lang/gleam: Update to 1.18

   vmd(8): validate qcow2 l1 table extents before allocation.

   Report and diff by Andrew Griffiths.

   ok hshoexer@

   vmd(8): restrict qcow2 cluster shifts at parse time.

   Qcow2 minimum is 9 (512 bytes). Cap a maximum at 21 (2 MiB).

   Report and diff by Andrew Griffiths.

   ok hshoexer@

   vmd(8): reject short qcow2 l2 metadata reads.

   Prevents use of partially initialized buffer if the read is short.

   Report and diff by Andrew Griffiths.

   ok hshoexer@

   vmd(8): cap ELF section string table allocations.

   Report and diff by Andrew Griffiths.

   ok hshoexer@

   lang/erlang/28: Update to 28.5.0.4

   Fixes
   CVE-2026-42792, CVE-2026-47078,
   CVE-2026-54890, CVE-2026-55737,
   CVE-2026-55953, CVE-2026-58227

   ok sthen@

   Correctly skip padding at end of line, GitHub issue 5411.

   MODTK_VERSION=8.6


   ok sthen@

   Update to vaultwarden-1.37.1

   Changes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.1

   MODTK_VERSION=8.6


   ok sthen@

   vmd(8): validate ELF32 section names before string table lookup.

   Report and diff by Andrew Griffiths.

   ok hshoexer@

   MODTK_VERSION=8.6

   Convert ntpd to use imsgbuf_get. Also convert some trivial messages to
   use imsg_get_data.

   OK florian@

   Add a flag to turn off scrollbars for display-panes; GitHub issue 5440
   from David Marte.

   Convert to imsgbuf_get

   OK dv@

   Convert vmd over to imsgbuf_get.

   OK dv@

   relayd: Use imsg_get_data(3) to access imsg-data and add error handling

   Hint and OK tb

   relayd: Use imsg_get_type(3) to get imsg type

   OK tb

   * Fix SIGBUS on sparc64 w/gcc 16
   * Fix os::naked_short_nanosleep on OpenBSD when < 20 miliseconds

   misc/remind: update to 6.2.9

   from Martin Ziemer (maintainer)