BSD Commit Log Search

   as discussed with op@, I will take sole MAINTAINER for now

   as discussed with op@, take over MAINTAINER from him

   Wait up to 1 second for lite software reset to complete instead of 5 ms,
   matching the Linux lan78xx driver.  This fixes "timeout on lite software reset"
   on a LAN7800.

   ok kettenis@

   Fix a kernel stack overflow in mue_init_ltm().

   idx[] was uint8_t[6] but the LTM table read into it is 24 bytes.
   Also handle mue_read_eeprom() errors like Linux does and byte swap
   the values with letoh32().

   Reported by Acts1631
   ok kettenis@

   Update to tailscale-1.104.1

   From Adriano Barbosa (maintainer)

   Update to gopls-0.24.0

   From Laurent Cheylus (maintainer)

   Update to moor-2.19.5

   From Lydia Sobot (maintainer)

   Remove abandoned, broken setuid-root net/bing

   No HOMEPAGE, multiple newer versions on the internet, distfile mirrored
   and segfault on startup.

   OK kirill sthen

   restore net/fping

   readd accidentially removed net/fping

   i meant to remove net/bing

   Take the child's ps_refcnt reference before PS_EMBRYO clean to make
   concurrent exit wait for us.

   ok claudio

   reimport accidentially removed net/fping

   i meant to remove net/bing

   Remove abandoned, broken setuid-root net/fping

   No HOMEPAGE, multiple newer versions on the internet, distfile mirrored
   and segfault on startup.

   OK kirill sthen

   lang/gcc/16: build stage1 compiler with -O2

   By default it builds stage1 compilers as -g only which leads to large binaries
   like ~350Mb on amd64, and replacing it by -O2 reduces size of them to ~50Mb.

   What reduces build time at fast amd64 with NVME from ~28 to ~15 minutes.

   ocspcheck: check all OCSP AIA URLs for invalid characters

   Check every OCSP AIA URL in the certificate, rather than only the
   first. The first URL remains the one used for the request.

   pointed out by tb@
   ok tb@ beck@

   ocspcheck: reject control characters in OCSP URL

   Reject OCSP URL containing non-ASCII or control characters before
   using their path in an HTTP request. This prevents HTTP request
   injection via a certificate's AIA URI.

   ok tb@ beck@

   net/rate-mirrors: update to 0.34.0

   update p5-Cpanel-JSON-XS to 4.80
   CVE-2026-110672 CVE-2026-110673 CVE-2026-110674 CVE-2026-110675
   CVE-2026-110676 CVE-2026-110677 CVE-2026-110678 CVE-2026-110680
   CVE-2026-110681 CVE-2026-110682 CVE-2026-110684 CVE-2026-110685
   CVE-2026-110686 CVE-2026-110687 CVE-2026-110688

   Update to jjui 0.10.12

   https://github.com/idursun/jjui/releases/tag/v0.10.12

   Update to zizmor 1.31.1

   https://github.com/zizmorcore/zizmor/releases/tag/v1.31.1

   sys/video: fix video buffer handling and mmap lifetime

   Check dequeue errors and allocation bounds, correct the mmap buffer base,
   and revoke user mappings before freeing capture buffers.

   Based on diffs from Acts1631, thanks!

   OK: mglocker@

   Tor Browser: update to 15.0.25

   Back out the last video(4) vulnerability fix, which changed the
   kern.video.record behavior.  We found a solution in the meantime to
   fix the vulnerability without changing the previous kern.video.record
   behavior (blanking), which will be committed next.

   ok deraadt@, kirill@

   lang/gcc/16: enable modula2

   lang/gcc/16: replace list of arches by GCC49_ARCHS which is the same now

   games/xjewel: add _permit_setugid S_ISGID marker

   www/librewolf: update to 158.0-1, from Leah Rowe (MAINTAINER)

   drops policy patch to align with librewolf upstream.

   kscreenlocker: export _permit_setugid

   The symbol ended up local due to -fvisibility=hidden. Mark it Q_DECL_EXPORT.

   https://doc.qt.io/qt-6/qtcompilerdetection.html#Q_DECL_EXPORT

   kscreenlocker: add _permit_setugid S_ISGID marker

   pkgconf regress: bump version to 3.0.10