BSD Commit Log Search

   Mark cataclysm-dda BROKEN-sparc64

   /usr/obj/ports/cataclysm-dda-0.H-no_x11/Cataclysm-DDA-0.H-RELEASE/src/third-party/flatbuffers_int/util.h:267:12: error: 'strtoll_l' was not declared in this scope; did you mean 'strcoll_l'?
     267 |     *val = __strtoll_impl(str, endptr, base);
         |            ^~~~~~~~~~~~~~

   'strtoull_l' 'strtod_l' 'strtof_l' all also not declared in scopr

   csound: hidden dep on audio/liblo

   regen PLIST for libosc.so plugin and static libcsound64.a

   u-boot-asahi needs C11

   Move to ports-gcc on base-gcc arches to fix build on sparc64

   sync

   www/hugo: update to 0.159.2

   Changes:
    - https://github.com/gohugoio/hugo/releases/tag/v0.159.2

   Update to perl 5.42.2

   The two main changes are both from 5.42.1, a timezone fix and a
   corner case for auto-vivification.

   The CVE from 5.42.1 we had already patched and the zlib update in
   5.42.2 is in code we don't use because we link against the system
   zlib.

   https://metacpan.org/release/SHAY/perl-5.42.1/view/pod/perldelta.pod
   https://metacpan.org/release/SHAY/perl-5.42.2/view/pod/perldelta.pod

   I'm not concerned -- sthen@
   I think you can just commit this -- naddy@
   good timing -- deraadt@
   OK -- blumh@

   update p5-NetAddr-MAC to 1.00
   from maintainer Mikolaj Kucharski

   schismtracker: switch to upstream provided tarball.

   This removes the need to run autoconf and makes the version number patch
   unnecessary.

   Add SA state check for CREATE_CHILD_SA exchange, similar to what we do
   for INFORMATIONAL exchanges. iked currently assumes that IKE_AUTH always
   results in valid child SAs, so IKEV2_STATE_ESTABLISHED means we have
   successfully completed the IKE_AUTH exchange for the SA.

   Independently found by Dirk Loss and Daniel Polak (SYS.nl)
   from tobhe@; ok and discussed with markus@ stsp@

   Add ikev2_validate_ef() to validate fragment payload header size field
   as we do for other IKEv2 payloads.

   Reported by Dirk Loss
   from tobhe@; ok markus@

   iked only ever handles one exchange at a time so we can drop the
   entire fragment queue instead of doing a lookup based on the msgid

   Found by Dirk Loss
   from tobhe@; ok markus@ hshoexer@

    [11 lines not shown]

   Add SA state check for CREATE_CHILD_SA exchange, similar to what we do
   for INFORMATIONAL exchanges. iked currently assumes that IKE_AUTH always
   results in valid child SAs, so IKEV2_STATE_ESTABLISHED means we have
   successfully completed the IKE_AUTH exchange for the SA.

   Independently found by Dirk Loss and Daniel Polak (SYS.nl)
   from tobhe@; ok and discussed with markus@ stsp@

   Add ikev2_validate_ef() to validate fragment payload header size field
   as we do for other IKEv2 payloads.

   Reported by Dirk Loss
   from tobhe@; ok markus@

   iked only ever handles one exchange at a time so we can drop the
   entire fragment queue instead of doing a lookup based on the msgid

   Found by Dirk Loss
   from tobhe@; ok markus@ hshoexer@

    [11 lines not shown]

   Update to openssl-ruby-tests 20260401

   editors/neovim: update to v0.12.0.

   Diff from Laurent Cheylus, thanks!

   editors/emacs: patch to fix linkage with tree-sitter-0.26.x

   OK from maintainer, jca@, thanks.

   textproc/tree-sitter: update to v0.26.8.

   Diff from Laurent Cheylus, thanks!

   Update to openvpn-2.7.1

   https://github.com/OpenVPN/openvpn/blob/v2.7.1/Changes.rst

   Security update to mbedtls-3.6.6

   Fixes for:
   Client impersonation while resuming a TLS 1.3 session (CVE-2026-34873)
   Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
   PSA random generator cloning CVE-2026-25835
   Compiler-induced constant-time violations (CVE-2025-66442)
   Null pointer dereference when setting a distinguished name (CVE-2026-34874)
   Buffer overflow in FFDH public key export (CVE-2026-34875)
   FFDH: lack of contributory behaviour due to improper input validation (CVE-2026-34872)
   Signature Algorithm Injection CVE-2026-25834
   CCM multipart finish tag-length validation bypass (CVE-2026-34876)
   Risk of insufficient protection of serialized session or context data
   leading to potential memory safety issues (CVE-2026-34877)
   Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)

   If we receive a response it must have the exact same msgid as the last
   request we sent, so make sure they match exactly rather than allowing
   higher msgids.
   We can't handle out of order responses and if we don't receive a response
   in time we retransmit our request until we get one or run into a timeout.

   Found by Dirk Loss
   ok markus@ hshoexer@

   iked only ever handles one exchange at a time so we can drop the
   entire fragment queue instead of doing a lookup based on the msgid

   Found by Dirk Loss
   ok markus@ hshoexer@

   Add ikev2_validate_ef() to validate fragment payload header size field
   as we do for other IKEv2 payloads.

   Reported by Dirk Loss
   ok markus@

   Add SA state check for CREATE_CHILD_SA exchange, similar to what we do
   for INFORMATIONAL exchanges. iked currently assumes that IKE_AUTH always
   results in valid child SAs, so IKEV2_STATE_ESTABLISHED means we have
   successfully completed the IKE_AUTH exchange for the SA.

   Independently found by Dirk Loss and Daniel Polak (SYS.nl)
   ok and discussed with markus@ stsp@

   update p5-Devel-NYTProf to 6.15

   chars[] array needs to be sized 256 because it is indexed at many places
   by (unsigned char) from input data.
   from Renaud Allard

   Use an unsigned sum value to provide deterministic overflow behaviour,
   for input to the hash.
   from Renaud Allard

   Range-check fields inside the file to ensure they don't exceed the size
   of the file and cause later crashes.
   from renaud allard

   Do the unveil() after the daemon() call, because otherwise we wouldneed
   "/dev/null" "rw" and "/" "r", in particular the second is ugly.
   pointed out by bluhm, discussion also with dgl.

   Revert the WRKDIST diff. This breaks at least some of the ports that
   use DIST_TUPLE and set DISTNAME and needs a bit more work.

   Adjust depth check to match change in verifier.

   Restore the previous behaviour with maximum verification depth.

   The maximum depth is not expected to include the leaf certificate - restore
   the decrement prior to checking, which means the previous behaviour is
   retained for the callback depth and the maximum depth. Reduce the maximum
   depth by one in order to avoid the overwrite that could previously occur.

   Thanks to anton@ for flagging the rust-openssl failure in regress.

   ok tb@

   update p5-XML-Parser to 2.54

   update to 146.0.7680.177