BSD Commit Log Search

   repair ssh-keysign after pledge changes;
   spotted/tested by naddy@ ok deraadt@

   www/yt-dlp: update to 2026.03.17

   www/py-yt-dlp-ejs: update to 0.8.0

   struct pf_queue_bwspec changed 'absolute' to uint64_t in pfvar.h 1.541

   openssl speed: add benchmarking support for ML-KEM

   Add support for benchmarking ML-KEM key encapsulation mechanisms to
   openssl speed.  The following operations are measured:

   - key generation
   - encapsulation
   - decapsulation

   Two parameter sets are supported:

     mlkem768
     mlkem1024

   The benchmark can be invoked using the following options:

     mlkem       run all ML-KEM benchmarks
     mlkem768    run ML-KEM-768 benchmarks
     mlkem1024   run ML-KEM-1024 benchmarks

    [6 lines not shown]

   sync with Mozilla root CA store, ok tb@

   - remove CommScope CA (they requested it themselves;
   https://bugzilla.mozilla.org/show_bug.cgi?id=1994866)

   - add new cert:
   /C=HU/L=Budapest/O=Microsec Ltd./2.5.4.97=VATHU-23584497/CN=e-Szigno TLS Root CA 2023

   Update to webkitgtk{41,60}-2.52.0.

   update xmlwf to expat 2.7.5

   the "@pkgpath textproc/libxml,-python" marker by itself isn't enough to merge
   any (now removed) py3-libxml-* packages into libxml, so python 3.12 -> 3.13
   updates (i.e. openbsd 7.8 -> -current) were still failing. Add an @conflict
   as well to force the old package to be removed.

   print/ghostscript/gnu: Update to 10.07.0

   ok (with tweaks) sthen@

   cc1: error: unrecognized command line option "-Wvla"

   base-gcc doesn't have -Wvla. Move to ports-gcc to fix build on sparc64

   missed to include vulkan-tools in the vulkan update, spotted by volker@

   devel/intellij: update to 2025.3.4

   remove extra spaces in logs, ok claudio

   update to roundcubemail-1.6.14
   various security fixes, https://github.com/roundcube/roundcubemail/releases/tag/1.6.14

   update to roundcubemail-1.6.14
   various security fixes, https://github.com/roundcube/roundcubemail/releases/tag/1.6.14

   py-omemo-dr was not linked to the build properly

   py-omemo-dr: bump after HOMEPAGE change for pypi

   typo: Extended Nexhop Encoding (Nexthop)

   /dev/null is no longer implicitly permitted by some pledges, so explicitly
   unveil it. fixes calendar -a. ok deraadt
   calendar also needs to unveil cpp / sendmail, I forgot to make install
   when I was testing :(  from James J. Lippard
   sendmail/cpp only need "x" no "rx" unveil; ok deraadt
   from sthen@

   this is errata/7.7/029_calendar.patch.sig

   /dev/null is no longer implicitly permitted by some pledges, so explicitly
   unveil it. fixes calendar -a. ok deraadt
   calendar also needs to unveil cpp / sendmail, I forgot to make install
   when I was testing :(  from James J. Lippard
   sendmail/cpp only need "x" no "rx" unveil; ok deraadt
   from sthen@

   this is errata/7.8/023_calendar.patch.sig

   update to nghttp2-1.68.1
   https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6

   update to nghttp2-1.68.1
   https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6

   update to stayrtr-0.6.4

   Oof, JLS 25 is latest.

   Update JLS to JDK24.

   Minor bump asciidoctor 2.0.23 -> 2.0.26

   Update libexpat to version 2.7.5.

   Relevant for OpenBSD are security fixes #1158 #1161 #1162 #1163,
   other changes #1156 #1153.  Library bump is not necessary.
   CVE-2026-32776 CVE-2026-32777 CVE-2026-32778

   tested and OK tb@

   update to python-3.12.13 and patch for recent security fixes.
   backports from tb, .ok tb@ kmos@

   https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/
   Reject control characters in 'http.cookies.Morsel.update' (CVE-2026-3644)

   https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/
   Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered
   'ElementDeclHandler' parses inline DTD containing deeply nested content model.

   update to python-3.13.12 and patch for recent security fixes. ok tb@ kmos@

   https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/
   Reject control characters in 'http.cookies.Morsel.update' (CVE-2026-3644)

   https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/
   Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered
   'ElementDeclHandler' parses inline DTD containing deeply nested content model.