OpenBSD/src almxoZX — usr.sbin/rpki-client main.c

   re-arrange rtrd 660 AF_UNIX connect(), setgroups/setresuid/setresgid
   privdrop, and first pledge() above the innocuous getopt() block.
   ok tb
VersionDeltaFile
1.315+23-21usr.sbin/rpki-client/main.c
+23-211 files

OpenBSD/src 7OkRLD8 — usr.sbin/rtrd sched.c packets.c

   use err() and warn(), and various knf and include reduction
   (-portable will revisit this in the next round, and then we're good)
VersionDeltaFile
1.9+27-60usr.sbin/rtrd/rtrd.c
1.6+22-37usr.sbin/rtrd/sockets.c
1.5+1-11usr.sbin/rtrd/ip_utils.c
1.5+1-10usr.sbin/rtrd/packets.c
1.3+1-10usr.sbin/rtrd/hash.c
1.6+2-8usr.sbin/rtrd/sched.c
+54-1367 files not shown
+65-16713 files

OpenBSD/src 9mMI0LS — usr.sbin/rpki-client ccr.c

   rpki-client: don't treat a duplicate CCR MFT as fatal

   It is possible to concoct situations where two PPs serve byte identical
   manifests. Then CCR generation errors with "CCR MFT tree corrupted".

   Handle this situation gracefully and only warn about the weird situation.
   There are more problems in the vicinity that need fixing but that's for
   after the release.

   Reported by eur1ka qq com. Diff is a tweaked version of the suggested fix.

   ok job
VersionDeltaFile
1.46+5-3usr.sbin/rpki-client/ccr.c
+5-31 files

OpenBSD/src uaRHfx3 — usr.sbin/rpki-client ccr.c

   rpki-client: hoist ccr_mft_free() next to ccr_mft_new()

   part of a larger diff that was ok job
VersionDeltaFile
1.45+20-20usr.sbin/rpki-client/ccr.c
+20-201 files

OpenBSD/ports fdSivOC — databases/p5-DBI Makefile distinfo, databases/p5-DBI/patches patch-DBI_xs

   Update p5-DBI to 1.654

   1.654 - 2026-09-25, H.Merijn Brand & Robert Rothenberg
       * Fix DBI::sql_type_cast on IV/NV (CVE-2026-88815) (reported by Raj)
       * Fix FetchHashKeyName   on IV/NV (CVE-2026-88816) (reported by Raj)
       * Fix provided in META

   With upstream patch for compilation under gcc.

   ok sthen@
VersionDeltaFile
1.3+18-23databases/p5-DBI/patches/patch-DBI_xs
1.36+2-2databases/p5-DBI/distinfo
1.78+1-1databases/p5-DBI/Makefile
+21-263 files

OpenBSD/ports Fr9aOuY — net/knot Makefile

   There is a hidden dep on databases/libhiredis that can cause a build
   failure when junking between configure and build.  Since enabling this
   feature changes PLIST, disable for now and we can re-evaluate after
   unlock.

   OK lucas@ naddy@
VersionDeltaFile
1.90+2-0net/knot/Makefile
+2-01 files

OpenBSD/ports u24A4Bd — mail/mozilla-thunderbird Makefile distinfo

   mail/mozilla-thunderbird: update to 140.17.0.

   see https://www.thunderbird.net/en-US/thunderbird/140.17.0esr/releasenotes/
VersionDeltaFile
1.312.2.10+2-2mail/mozilla-thunderbird/distinfo
1.525.2.10+1-1mail/mozilla-thunderbird/Makefile
+3-32 files

OpenBSD/ports Ta2EUnK — mail/mozilla-thunderbird Makefile distinfo, mail/thunderbird-i18n Makefile.inc distinfo

   mail/mozilla-thunderbird: update to 153.4.0.

   see https://www.thunderbird.net/en-US/thunderbird/153.4.0esr/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-101/ (404)
VersionDeltaFile
1.311+132-132mail/thunderbird-i18n/distinfo
1.328+2-2mail/mozilla-thunderbird/distinfo
1.285+1-1mail/thunderbird-i18n/Makefile.inc
1.543+1-1mail/mozilla-thunderbird/Makefile
+136-1364 files

OpenBSD/src 9Rt1gu1 — usr.sbin/rpki-client output-rtrx.c

   warning early about rtrd connection failure is nice, even if there
   is a later warning also when it tries to use the socket
VersionDeltaFile
1.6+4-1usr.sbin/rpki-client/output-rtrx.c
+4-11 files

OpenBSD/ports cxfipPX — textproc/groff Makefile, textproc/groff/patches patch-src_roff_troff_input_cpp patch-src_preproc_html_pre-html_cpp

   MFC "Backport three security fixes from the groff-1.24.2 release", ok schwarze@
VersionDeltaFile
1.52.12.1+1-1textproc/groff/Makefile
1.3.2.1+0-0textproc/groff/patches/patch-src_roff_troff_input_cpp
1.1.2.1+0-0textproc/groff/patches/patch-src_preproc_html_pre-html_cpp
1.1.2.1+0-0textproc/groff/patches/patch-src_devices_gropdf_pdfmom_pl
1.1.2.1+0-0textproc/groff/patches/patch-contrib_mm_mmroff_pl
+1-15 files

OpenBSD/src XHZBsnZ — usr.sbin/rpki-client output-rtrx.c

   output-rtrx: add some missing includes to help portable

   with input from deraadt.
   ok claudio
VersionDeltaFile
1.5+12-4usr.sbin/rpki-client/output-rtrx.c
+12-41 files

OpenBSD/src zl9bFfK — sys/dev/ic qwzvar.h qwz.c, sys/dev/pci if_qwz_pci.c

   sys/qwz: unwind cold startup failures

   Based on sys/dev/ic/qwx.c,v 1.134

   Track powerup and completed core initialization so failed cold starts
   reset hardware before reclaiming initialized DMA resources. Release
   partial TX allocations and RX rings; ordinary interface down and up
   continues to retain firmware.

   OK: stsp@
VersionDeltaFile
1.66+100-26sys/dev/ic/qwz.c
1.18+4-2sys/dev/pci/if_qwz_pci.c
1.23+2-1sys/dev/ic/qwzvar.h
+106-293 files

OpenBSD/src VQn7YMy — sys/dev/ic qwzvar.h qwz.c

   sys/qwz: skip uninitialized CE polling

   Based on sys/dev/ic/qwx.c,v 1.135

   Track successful CE initialization to decide whether completion
   polling is valid; provide dircet TX buffer reclamation for cold
   cleanup after hardware reset, when ring polling is no longer safe.

   OK: stsp@
VersionDeltaFile
1.65+22-3sys/dev/ic/qwz.c
1.22+2-1sys/dev/ic/qwzvar.h
+24-42 files

OpenBSD/src TsEHEXf — sys/dev/ic qwzvar.h qwz.c, sys/dev/pci if_qwz_pci.c

   sys/qwz: allocate management maps at attach

   Backport of sys/dev/ic/qwx.c,v 1.139 , sys/dev/ic/qwxvar.h,v 1.39
   and sys/dev/pci/if_qwx_pci.c,v 1.40

   OK: stsp@
VersionDeltaFile
1.17+17-2sys/dev/pci/if_qwz_pci.c
1.64+4-10sys/dev/ic/qwz.c
1.21+5-2sys/dev/ic/qwzvar.h
+26-143 files

OpenBSD/src wkszEze — sys/dev/ic qwzvar.h qwz.c

   sys/qwz: retain the host VIF

   Backport of sys/dev/ic/qwx.c,v 1.138 and sys/dev/ic/qwxvar.h,v 1.38

   OK: stsp@
VersionDeltaFile
1.63+69-101sys/dev/ic/qwz.c
1.20+2-7sys/dev/ic/qwzvar.h
+71-1082 files

OpenBSD/src lonXqon — sys/dev/ic qwz.c

   sys/qwz: initialize QRTR before power-up

   Backport of sys/dev/ic/qwx.c,v 1.132

   OK: stsp@
VersionDeltaFile
1.62+4-4sys/dev/ic/qwz.c
+4-41 files

OpenBSD/src mDl2mmD — sys/dev/ic qwz.c

   sys/qwz: propagate firmware startup errors

   Backport of sys/dev/ic/qwx.c,v 1.128

   OK: stsp@
VersionDeltaFile
1.61+4-5sys/dev/ic/qwz.c
+4-51 files

OpenBSD/src acSCJ5q — sys/dev/ic qwz.c

   sys/qwz: mark running after MAC startup

   Backport of sys/dev/ic/qwx.c,v 1.122 and sys/dev/ic/qwx.c,v 1.134

   OK: stsp@
VersionDeltaFile
1.60+5-6sys/dev/ic/qwz.c
+5-61 files

OpenBSD/src SFcdrSJ — sys/dev/ic qwz.c

   sys/qwz: retain HAL allocations on resume

   Based on sys/dev/ic/qwx.c,v 1.97 and sys/dev/ic/qwx.c,v 1.136

   Preserve HAL allocation pointers across reinitialization: reuse qwz
   allocated ring configuration and claer retained pointer memory. On
   failure, free only allocations made by the current attempt.

   OK: stsp@
VersionDeltaFile
1.59+18-11sys/dev/ic/qwz.c
+18-111 files

OpenBSD/src 11kMeqb — sys/dev/ic qwz.c

   sys/qwz: wait for cookie pool allocations

   Backport of sys/dev/ic/qwx.c,v 1.127

   OK: stsp@
VersionDeltaFile
1.58+8-29sys/dev/ic/qwz.c
+8-291 files

OpenBSD/src o9WHC8v — sys/dev/ic qwz.c

   sys/qwz: wait for startup allocations

   Backport of sys/dev/ic/qwx.c,v 1.127

   OK: stsp@
VersionDeltaFile
1.57+17-29sys/dev/ic/qwz.c
+17-291 files

OpenBSD/ports T0mnlFj — graphics/png distinfo Makefile, graphics/png/patches patch-Makefile_in

   update to png-1.6.59
   https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j
VersionDeltaFile
1.150.2.1+6-3graphics/png/Makefile
1.6.4.1+3-3graphics/png/patches/patch-Makefile_in
1.79.2.1+2-2graphics/png/distinfo
+11-83 files

OpenBSD/ports BKXvJP0 — graphics/png distinfo Makefile, graphics/png/patches patch-Makefile_in

   update to png-1.6.59, fixing use-after-free of zlib input in
   png_read_end() after incomplete zTXt, iTXt or iCCP decompression
   https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j

   ok matthieu who has verified that this is not reachable from xenocara's
   use of the static-linked copy
VersionDeltaFile
1.151+6-3graphics/png/Makefile
1.7+3-3graphics/png/patches/patch-Makefile_in
1.80+2-2graphics/png/distinfo
+11-83 files

OpenBSD/ports tzUvWuF — sysutils/telegraf Makefile, sysutils/telegraf/patches patch-plugins_inputs_unbound_unbound_go patch-plugins_inputs_nsd_nsd_go

   set -u _nsd / _unbound as appropriate when running nsd-control /
   unbound-control through doas, to match the existing pkg-readme.
   from Atanas Vladimirov.
VersionDeltaFile
1.3+6-3sysutils/telegraf/pkg/README
1.6+4-2sysutils/telegraf/patches/patch-plugins_inputs_unbound_unbound_go
1.4+4-2sysutils/telegraf/patches/patch-plugins_inputs_nsd_nsd_go
1.48+2-0sysutils/telegraf/Makefile
+16-74 files

OpenBSD/ports ytOzOeq — meta/tor-browser Makefile, www/tor-browser Makefile.inc

   Tor Browser: update to 15.0.24
VersionDeltaFile
1.118.2.9+6-6www/tor-browser/browser/distinfo
1.67.2.8+2-2www/tor-browser/noscript/distinfo
1.124.2.9+2-2meta/tor-browser/Makefile
1.74.2.8+1-1www/tor-browser/noscript/Makefile
1.197.2.9+1-1www/tor-browser/browser/Makefile
1.121.2.9+1-1www/tor-browser/Makefile.inc
+13-136 files

OpenBSD/ports eQ1CBAh — meta/tor-browser Makefile, www/tor-browser Makefile.inc

   Tor Browser: update to 15.0.24

   OK naddy@
VersionDeltaFile
1.133+6-6www/tor-browser/browser/distinfo
1.77+2-2www/tor-browser/noscript/distinfo
1.138+2-2meta/tor-browser/Makefile
1.84+1-1www/tor-browser/noscript/Makefile
1.216+1-1www/tor-browser/browser/Makefile
1.135+1-1www/tor-browser/Makefile.inc
+13-136 files

OpenBSD/src MU2k9qv — lib/libc/stdlib malloc.c

   For allocations between half a page and a page (which are moved
   towards the end) we don't clear the proper region with freezero().
   Instead, the clearing is done from the start of the page. So fix that.
   Reported by Acts1631

   ok deraadt@
VersionDeltaFile
1.301+5-1lib/libc/stdlib/malloc.c
+5-11 files

OpenBSD/src n0jC4ZF — share/man/man4 qwz.4 qwx.4

   differentiate the two qualcomm wifi drivers by well-understood names
   Wi-Fi 6 and Wi-Fi 7, even if it looks a bit like puke
   discussed with kettenis
VersionDeltaFile
1.11+3-3share/man/man4/qwx.4
1.3+2-2share/man/man4/qwz.4
+5-52 files

OpenBSD/src v29Sly0 — usr.sbin/rpki-client output-rtrx.c

   handle EINPROGRESS and carry errno through.
   OK deraadt@
VersionDeltaFile
1.4+20-5usr.sbin/rpki-client/output-rtrx.c
+20-51 files

OpenBSD/src YJ0ZGH3 — sys/dev softraid.c

   Fix softraid rebuild on disks with 4096-byte sectors.

   Problem found, suggested diffs, and testing by Dariusz Swiderski.

   ok claudio@ "makes release" deraadt@
VersionDeltaFile
1.440+9-6sys/dev/softraid.c
+9-61 files