OpenBSD/src WjZgZiAusr.sbin/acme-client base64.c

   Handle '=' padding in base64url encoded EAB keys.

   bentley@ found one in the wild and confirmed that this makes it work
VersionDeltaFile
1.11+5-1usr.sbin/acme-client/base64.c
+5-11 files

OpenBSD/src MD65C3gusr.bin/ssh ssh-ed25519.c

   pass back errors from ed25519 key generation, which theoretically
   can fail. From Dimitri John Ledkov via GHPR702.

   ok deraadt@ dtucker@
VersionDeltaFile
1.23+3-2usr.bin/ssh/ssh-ed25519.c
+3-21 files

OpenBSD/src uDVLsWHusr.bin/ssh auth2-pubkey.c auth2-hostbased.c

   Move check of public key type against allowed algorithms to before
   parsing of the key sent by the peer.

   This removes at least some key parsing and verification paths from
   the pre-auth attack surface.

   Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@
VersionDeltaFile
1.58+7-6usr.bin/ssh/auth2-hostbased.c
1.127+6-6usr.bin/ssh/auth2-pubkey.c
+13-122 files

OpenBSD/ports LDqdALenet/samba Makefile distinfo

   Update to samba-4.24.5

   Security release addressing CTDB protocol bounds checking issues
   (CVE-2026-58224). AD and DNS/KDC vulnerabilities do not affect standard
   OpenBSD builds. Details:
   https://www.samba.org/samba/history/samba-4.24.5.html

   Tested by Ian McWilliam (maintainer).
VersionDeltaFile
1.142+2-2net/samba/distinfo
1.378+1-1net/samba/Makefile
+3-32 files

OpenBSD/ports OeWj9Zwnet/samba Makefile distinfo

   Update to samba-4.24.5

   Security release addressing CTDB protocol bounds checking issues
   (CVE-2026-58224). AD and DNS/KDC vulnerabilities do not affect standard
   OpenBSD builds. Details:
   https://www.samba.org/samba/history/samba-4.24.5.html

   Tested by Ian McWilliam (maintainer).
VersionDeltaFile
1.138.2.4+2-2net/samba/distinfo
1.372.2.4+1-1net/samba/Makefile
+3-32 files

OpenBSD/src CPpA5vOusr.bin/ssh ssh-mldsa-eddsa.c

   Fix double frees (impossible to reach outside of a test harness),
   and also use freezero where possible
   from Christopher Paul Rohlf at Anthropic
   ok djm
VersionDeltaFile
1.3+6-3usr.bin/ssh/ssh-mldsa-eddsa.c
+6-31 files

OpenBSD/ports iWvC7KAprint/lilypond distinfo Makefile, print/lilypond/patches patch-lily_ttf_cc patch-lily_pango-font_cc

   Update to lilypond-2.26.0
VersionDeltaFile
1.15+30,997-18,022print/lilypond/pkg/PLIST-docs
1.16+18-20print/lilypond/pkg/PLIST-main
1.71+7-8print/lilypond/Makefile
1.16+4-4print/lilypond/distinfo
1.9+3-3print/lilypond/patches/patch-lily_pango-font_cc
1.10+2-2print/lilypond/patches/patch-lily_ttf_cc
+31,031-18,0593 files not shown
+31,033-18,0619 files

OpenBSD/ports wN1kv59lang/node Makefile distinfo

   lang/node: Update to 24.18.1

   Security update, fixes:

   CVE-2026-56846, CVE-2026-56848,
   CVE-2026-58043, CVE-2026-56850,
   CVE-2026-58040, CVE-2026-58041,
   CVE-2026-58042, CVE-2026-58045,
   CVE-2026-56847, CVE-2026-58039,
   CVE-2026-58044
VersionDeltaFile
1.100+4-4lang/node/distinfo
1.171+1-2lang/node/Makefile
+5-62 files

OpenBSD/src mKhT8Ayusr.bin/tmux format.c

   Fix unzoomed width when scrollbars are hidden.
VersionDeltaFile
1.410+6-3usr.bin/tmux/format.c
+6-31 files

OpenBSD/ports G6G2Xyggraphics/pixelorama Makefile distinfo

   graphics/pixelorama: Update to 1.2
VersionDeltaFile
1.6+4-4graphics/pixelorama/distinfo
1.8+1-1graphics/pixelorama/Makefile
+5-52 files

OpenBSD/ports 5O6BfcBlang/gleam Makefile crates.inc, lang/gleam/patches patch-compiler-core_src_error_rs patch-compiler-core_src_build_project_compiler_rs

   lang/gleam: Update to 1.18
VersionDeltaFile
1.34+98-82lang/gleam/distinfo
1.25+48-40lang/gleam/crates.inc
1.5+10-20lang/gleam/patches/patch-compiler-cli_src_beam_compiler_rs
1.12+1-1lang/gleam/patches/patch-compiler-core_src_error_rs
1.3+1-1lang/gleam/patches/patch-compiler-core_src_build_project_compiler_rs
1.40+1-1lang/gleam/Makefile
+159-1452 files not shown
+161-1478 files

OpenBSD/src uYyhIAcusr.sbin/vmd vioqcow2.c

   vmd(8): validate qcow2 l1 table extents before allocation.

   Report and diff by Andrew Griffiths.

   ok hshoexer@
VersionDeltaFile
1.32+12-7usr.sbin/vmd/vioqcow2.c
+12-71 files

OpenBSD/src Evdmvavusr.sbin/vmd vioqcow2.c

   vmd(8): restrict qcow2 cluster shifts at parse time.

   Qcow2 minimum is 9 (512 bytes). Cap a maximum at 21 (2 MiB).

   Report and diff by Andrew Griffiths.

   ok hshoexer@
VersionDeltaFile
1.31+4-1usr.sbin/vmd/vioqcow2.c
+4-11 files

OpenBSD/src ZZGRQQ5usr.sbin/vmd vioqcow2.c

   vmd(8): reject short qcow2 l2 metadata reads.

   Prevents use of partially initialized buffer if the read is short.

   Report and diff by Andrew Griffiths.

   ok hshoexer@
VersionDeltaFile
1.30+4-2usr.sbin/vmd/vioqcow2.c
+4-21 files

OpenBSD/src cxG1APIusr.sbin/vmd loadfile_elf.c

   vmd(8): cap ELF section string table allocations.

   Report and diff by Andrew Griffiths.

   ok hshoexer@
VersionDeltaFile
1.58+20-1usr.sbin/vmd/loadfile_elf.c
+20-11 files

OpenBSD/ports CwKIHnnlang/erlang/28 distinfo Makefile

   lang/erlang/28: Update to 28.5.0.4

   Fixes
   CVE-2026-42792, CVE-2026-47078,
   CVE-2026-54890, CVE-2026-55737,
   CVE-2026-55953, CVE-2026-58227

   ok sthen@
VersionDeltaFile
1.16.2.5+9-12lang/erlang/28/Makefile
1.15.2.3+4-4lang/erlang/28/distinfo
+13-162 files

OpenBSD/src zbVh07eusr.bin/tmux tmux.h grid-reader.c

   Correctly skip padding at end of line, GitHub issue 5411.
VersionDeltaFile
1.155+21-1usr.bin/tmux/grid.c
1.424+4-7usr.bin/tmux/window-copy.c
1.11+3-6usr.bin/tmux/grid-reader.c
1.1418+2-1usr.bin/tmux/tmux.h
+30-154 files

OpenBSD/ports NkB9mdgdevel/mercurial Makefile

   MODTK_VERSION=8.6


   ok sthen@
VersionDeltaFile
1.141+3-0devel/mercurial/Makefile
+3-01 files

OpenBSD/ports Wzsc9N6security/vaultwarden Makefile distinfo

   Update to vaultwarden-1.37.1

   Changes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.1
VersionDeltaFile
1.38+2-2security/vaultwarden/distinfo
1.58+1-1security/vaultwarden/Makefile
+3-32 files

OpenBSD/ports ExhBdCjemulators/frodo Makefile

   MODTK_VERSION=8.6


   ok sthen@
VersionDeltaFile
1.36+2-1emulators/frodo/Makefile
+2-11 files

OpenBSD/src Q8ZkDSGusr.sbin/vmd loadfile_elf.c

   vmd(8): validate ELF32 section names before string table lookup.

   Report and diff by Andrew Griffiths.

   ok hshoexer@
VersionDeltaFile
1.57+8-2usr.sbin/vmd/loadfile_elf.c
+8-21 files

OpenBSD/ports hGrxnbPx11/bwidget Makefile

   MODTK_VERSION=8.6
VersionDeltaFile
1.21+8-0x11/bwidget/Makefile
+8-01 files

OpenBSD/src XmZgeYBusr.sbin/ntpd ntp_dns.c control.c

   Convert ntpd to use imsgbuf_get. Also convert some trivial messages to
   use imsg_get_data.

   OK florian@
VersionDeltaFile
1.184+7-9usr.sbin/ntpd/ntp.c
1.146+4-4usr.sbin/ntpd/ntpd.c
1.63+3-3usr.sbin/ntpd/constraint.c
1.38+2-2usr.sbin/ntpd/ntp_dns.c
1.29+2-2usr.sbin/ntpd/control.c
+18-205 files

OpenBSD/src Fe46zVyusr.bin/tmux tmux.h window-panes.c

   Add a flag to turn off scrollbars for display-panes; GitHub issue 5440
   from David Marte.
VersionDeltaFile
1.369+14-4usr.bin/tmux/window.c
1.4+3-2usr.bin/tmux/window-panes.c
1.1417+3-1usr.bin/tmux/tmux.h
+20-73 files

OpenBSD/src QnibyjQusr.sbin/vmctl main.c

   Convert to imsgbuf_get

   OK dv@
VersionDeltaFile
1.90+3-3usr.sbin/vmctl/main.c
+3-31 files

OpenBSD/src 3xwo7VNusr.sbin/vmd vm.c virtio.c

   Convert vmd over to imsgbuf_get.

   OK dv@
VersionDeltaFile
1.32+5-5usr.sbin/vmd/vioscsi.c
1.31+5-5usr.sbin/vmd/vionet.c
1.31+5-5usr.sbin/vmd/vioblk.c
1.126+3-3usr.sbin/vmd/vm.c
1.145+3-3usr.sbin/vmd/virtio.c
1.38+3-3usr.sbin/vmd/proc.c
+24-243 files not shown
+31-319 files

OpenBSD/src Adda8cgusr.sbin/relayd hce.c relay.c

   relayd: Use imsg_get_data(3) to access imsg-data and add error handling

   Hint and OK tb
VersionDeltaFile
1.268+16-10usr.sbin/relayd/relay.c
1.87+10-6usr.sbin/relayd/hce.c
+26-162 files

OpenBSD/src hQ8uER6usr.sbin/relayd relayd.c

   relayd: Use imsg_get_type(3) to get imsg type

   OK tb
VersionDeltaFile
1.205+5-5usr.sbin/relayd/relayd.c
+5-51 files

OpenBSD/ports iO5VwV3devel/jdk/11 Makefile, devel/jdk/11/patches patch-src_hotspot_os_posix_os_posix_cpp patch-src_hotspot_os_bsd_os_bsd_cpp

   * Fix SIGBUS on sparc64 w/gcc 16
   * Fix os::naked_short_nanosleep on OpenBSD when < 20 miliseconds
VersionDeltaFile
1.8+10-47devel/jdk/11/patches/patch-make_hotspot_lib_JvmOverrideFiles_gmk
1.7+35-2devel/jdk/11/patches/patch-src_hotspot_os_bsd_os_bsd_cpp
1.3+13-23devel/jdk/11/patches/patch-src_hotspot_os_posix_os_posix_cpp
1.73+2-0devel/jdk/11/Makefile
+60-724 files

OpenBSD/ports Ilk4xpumisc/remind distinfo Makefile

   misc/remind: update to 6.2.9

   from Martin Ziemer (maintainer)
VersionDeltaFile
1.105+4-3misc/remind/Makefile
1.74+2-2misc/remind/distinfo
+6-52 files