BSD Commit Log Search

   rpki-client: p -> mft in proc_parser_mft_check()

   Missed in a previous pass. No binary change.

   rpki-client: rewrap a line in proc_parser_mft_check()

   uhidev: the report size when doing USB_GET_REPORT could exceed the size
   of ucr_data. Check that report size doesn't exceed ucr_data, preventing
   heap overflow. Also for USB_SET_REPORT.

   From Acts1631

   "looks correct" deraadt@

   sys/ofw: replace a few malloc by variables on stack

   OK: deraadt@

   Reminder to all developers:
   *** SLEEP IS NOT ALLOWED DURING DVACT_SUSPEND or DVACT_RESUME ***

   devel/codex: add support of codex daemon

   By default it won't autostart but codex app-server daemon start/stop works

   net/curl: update to 8.23.0

   Includes fixes for
   CVE-2026-87863: HSTS response erases persisted entries
   CVE-2026-87862: HSTS cache import drops longer-lived child
   CVE-2026-87861: cross-origin reuse of a Negotiate connection
   CVE-2026-86414: leaking host credentials to HTTP proxy
   CVE-2026-86413: Negotiate credentials sent to redirected origin
   CVE-2026-86412: server-set cookie erases cookie jar
   CVE-2026-92392: HTTP/2 upload Use-After-Free
   CVE-2026-92391: curl_mime_free stack overflow by recursion
   CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints
   CVE-2026-92389: TFTP direction confusion
   CVE-2026-92388: FTP wildcard write callback mixup
   CVE-2026-92387: never-ending loop via server response omission
   CVE-2026-92386: server-set cookie aborts cookie jar load
   CVE-2026-94265: Authorization: Negotiate sent to foreign origin
   CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL
   CVE-2026-107929: local interface connection reuse mixup

   Update qt-creator to 20.0.2

   Update krita to 6.0.4.1

   lang/erlang: Update to 27.3.4.19, 28.5.0.8 and 29.1.2

   Fixes
   CVE-2026-105236
   CVE-2026-42789
   CVE-2026-48856
   CVE-2026-94200
   CVE-2026-96596

   net/lagrange: Update to 1.21.2

   From Maintainer Florian Viehweger, thanks

   lang/erlang: Update to 27.3.4.19, 28.5.0.8 and 29.1.2

   Fixes
   CVE-2026-105236
   CVE-2026-42789
   CVE-2026-48856
   CVE-2026-94200
   CVE-2026-96596

   bump ports with MODPHP_VERSION=8.3 deps

   update to pear-1.10.18, from go-pear-1.10.26.phar
   switch versioning to the pear version rather than the go-pear version
   (the repo used for this is now archived so will need a new method for
   further updates, that can happen later)

   switch php ports default to 8.4, bumps etc to follow

   rpki-client: change to sizeof(*ent) rather than using the type

   requested by job

   rpki-client: normalize on ent for struct entity in main.c

   ok job

   update to shotcut-26.9.27

   update to shotcut-26.9.27, from Josh Grosse (maintainer)

   "This release fixes flaws in Shotcut's network downloads:

   A failed HTTPS fetch was retried over cleartext HTTP.
   Shotcut offered to ignore certificate errors.
   An upgrade URL was accepted from a host other than shotcut.org.
   A Whisper model was kept even when its SHA-256 did not match the digest shipped with Shotcut.
   Refresh Models loaded a downloaded descriptor as QML."

   err(3) family functions should not be used with trailing \n
   ok tb florian

   Tidy up APC function.

   Update kstars to 3.8.5

   sysutils/firmware/arm64-qcom-dtb: update DTS for Honor MagicBook

   1. Enabel dma-coherent for ufshci

   2. Define actually used panel as edo1455

   rpki-client: split entity_new() out of entityq_add()

   Upcoming work by job will use this small helper and doing this now reduces
   the size of the diff.

   ok job

   switch to the proper uploaded tarball now that it's available.
   no contents/pkg change.

   update to caddy-2.11.7, shorten DESCR a bit, add a very short MESSAGE
   mentioning the "tcp4/" / "tcp6/" syntax in binds, which pvpdmail at
   gmail found necessary in order to get it to bind to v6 (though I don't
   see the same here for some reason..)

   sys/simplepanel: add suspend and resume power control

   Enable this only for EDO1455.

   OK: deraadt@

   sys/qcdpc: save and restore panel state on suspend and resume

   Enable it only for EDO1455.

   OK: deraadt@

   Update catch2 to 3.16.1

   Rename repo_stat_count_nonfunc to repo_stat_count_ca

   Alignment: this function is no longer being passed a 'nonfunc_ca' but a 'ca'

   OK tb@