BSD Commit Log Search

   re-arrange rtrd 660 AF_UNIX connect(), setgroups/setresuid/setresgid
   privdrop, and first pledge() above the innocuous getopt() block.
   ok tb

   use err() and warn(), and various knf and include reduction
   (-portable will revisit this in the next round, and then we're good)

   rpki-client: don't treat a duplicate CCR MFT as fatal

   It is possible to concoct situations where two PPs serve byte identical
   manifests. Then CCR generation errors with "CCR MFT tree corrupted".

   Handle this situation gracefully and only warn about the weird situation.
   There are more problems in the vicinity that need fixing but that's for
   after the release.

   Reported by eur1ka qq com. Diff is a tweaked version of the suggested fix.

   ok job

   rpki-client: hoist ccr_mft_free() next to ccr_mft_new()

   part of a larger diff that was ok job

   Update p5-DBI to 1.654

   1.654 - 2026-09-25, H.Merijn Brand & Robert Rothenberg
       * Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj)
       * Fix FetchHashKeyName   on IV/NV (CVE-2026-88816) (reported by Raj)
       * Fix provided in META

   With upstream patch for compilation under gcc.

   ok sthen@

   There is a hidden dep on databases/libhiredis that can cause a build
   failure when junking between configure and build.  Since enabling this
   feature changes PLIST, disable for now and we can re-evaluate after
   unlock.

   OK lucas@ naddy@

   mail/mozilla-thunderbird: update to 140.17.0.

   see https://www.thunderbird.net/en-US/thunderbird/140.17.0esr/releasenotes/

   mail/mozilla-thunderbird: update to 153.4.0.

   see https://www.thunderbird.net/en-US/thunderbird/153.4.0esr/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-101/ (404)

   warning early about rtrd connection failure is nice, even if there
   is a later warning also when it tries to use the socket

   MFC "Backport three security fixes from the groff-1.24.2 release", ok schwarze@

   output-rtrx: add some missing includes to help portable

   with input from deraadt.
   ok claudio

   sys/qwz: unwind cold startup failures

   Based on sys/dev/ic/qwx.c,v 1.134

   Track powerup and completed core initialization so failed cold starts
   reset hardware before reclaiming initialized DMA resources. Release
   partial TX allocations and RX rings; ordinary interface down and up
   continues to retain firmware.

   OK: stsp@

   sys/qwz: skip uninitialized CE polling

   Based on sys/dev/ic/qwx.c,v 1.135

   Track successful CE initialization to decide whether completion
   polling is valid; provide dircet TX buffer reclamation for cold
   cleanup after hardware reset, when ring polling is no longer safe.

   OK: stsp@

   sys/qwz: allocate management maps at attach

   Backport of sys/dev/ic/qwx.c,v 1.139 , sys/dev/ic/qwxvar.h,v 1.39
   and sys/dev/pci/if_qwx_pci.c,v 1.40

   OK: stsp@

   sys/qwz: retain the host VIF

   Backport of sys/dev/ic/qwx.c,v 1.138 and sys/dev/ic/qwxvar.h,v 1.38

   OK: stsp@

   sys/qwz: initialize QRTR before power-up

   Backport of sys/dev/ic/qwx.c,v 1.132

   OK: stsp@

   sys/qwz: propagate firmware startup errors

   Backport of sys/dev/ic/qwx.c,v 1.128

   OK: stsp@

   sys/qwz: mark running after MAC startup

   Backport of sys/dev/ic/qwx.c,v 1.122 and sys/dev/ic/qwx.c,v 1.134

   OK: stsp@

   sys/qwz: retain HAL allocations on resume

   Based on sys/dev/ic/qwx.c,v 1.97 and sys/dev/ic/qwx.c,v 1.136

   Preserve HAL allocation pointers across reinitialization: reuse qwz
   allocated ring configuration and claer retained pointer memory. On
   failure, free only allocations made by the current attempt.

   OK: stsp@

   sys/qwz: wait for cookie pool allocations

   Backport of sys/dev/ic/qwx.c,v 1.127

   OK: stsp@

   sys/qwz: wait for startup allocations

   Backport of sys/dev/ic/qwx.c,v 1.127

   OK: stsp@

   update to png-1.6.59
   https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j

   update to png-1.6.59, fixing use-after-free of zlib input in
   png_read_end() after incomplete zTXt, iTXt or iCCP decompression
   https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j

   ok matthieu who has verified that this is not reachable from xenocara's
   use of the static-linked copy

   set -u _nsd / _unbound as appropriate when running nsd-control /
   unbound-control through doas, to match the existing pkg-readme.
   from Atanas Vladimirov.

   Tor Browser: update to 15.0.24

   Tor Browser: update to 15.0.24

   OK naddy@

   For allocations between half a page and a page (which are moved
   towards the end) we don't clear the proper region with freezero().
   Instead, the clearing is done from the start of the page. So fix that.
   Reported by Acts1631

   ok deraadt@

   differentiate the two qualcomm wifi drivers by well-understood names
   Wi-Fi 6 and Wi-Fi 7, even if it looks a bit like puke
   discussed with kettenis

   handle EINPROGRESS and carry errno through.
   OK deraadt@

   Fix softraid rebuild on disks with 4096-byte sectors.

   Problem found, suggested diffs, and testing by Dariusz Swiderski.

   ok claudio@ "makes release" deraadt@