BSD Commit Log Search

   MFC update to librenms-26.4.0

   update to librenms-26.4.0, ok naddy

   includes fix for cross-site scripting in alert template list, and adds
   missing escaping for a few cli commands etc

   https://github.com/librenms/librenms/releases/tag/26.4.0

   disable pipewire

   ok naddy@

   www/mozilla-firefox: MFC update to 150.0.

   see https://www.firefox.com/en-US/firefox/150.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/

   www/firefox-esr: MFC update to 140.10.0.

   see https://www.firefox.com/en-US/firefox/140.10.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/

   www/firefox-esr: update to 140.10.0.

   see https://www.firefox.com/en-US/firefox/140.10.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/

   ok naddy@

   www/mozilla-firefox: update to 150.0.

   see https://www.firefox.com/en-US/firefox/150.0/releasenotes/
   fixes https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/

   - disable PGO again, fixes wasm crashes seen with element-web (cf #2030583)
   - will need to move to llvm 21 or patch llvm 19 to reenable PGO
   - add workaround to avoid fetching some pip wheels during configure
     (#2026497), another workaround would be to move to ./mach configure ?

   ok naddy@

   avoid picking up doxygen during build, to avoid build failure with dpb junking
   requested by naddy

   Update to rclone-1.73.5

   CVE-2026-41176
   rc: add AuthRequired to options/set to prevent auth bypass
   rc: snapshot NoAuth at startup to prevent runtime auth bypass

   CVE-2026-41179
   operations: add AuthRequired to operations/fsinfo to prevent backend
   creation

   Changelog: https://rclone.org/changelog/#v1-73-5-2026-04-19

   OK sthen@

   graphics/lcms2: Update to 2.19rc2

   Fixes several issues, for reference see
   https://marc.info/?l=oss-security&m=177646929211758&w=2

   pointed out by and ok tb@, ok naddy@

   update to gelatod-1.7;  same fix as 029_v6daemons;  OK naddy

   geo/mapserver: security update to 8.6.2.

   see https://mapserver.org/development/changelog/changelog-8-6.html#changelog-8-6
   fixes https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x

   ok naddy@

   Update to gtk+4-4.22.3.

   ok naddy@

   Patch btop to report active CPU usage correctly

   from upstream https://github.com/aristocratos/btop/pull/1587

   This also allows building on spark64 with gcc 15.

   shells/elvish: Update to 0.21.0

   The current version in ports is broken/non-functional.

   approved by naddy@

   Update to png 1.6.58. ok deraadt@, naddy@.
   Fixes a regression introduced in 1.6.56

   Update to png 1.6.58. ok deraadt@, naddy@.
   Fixes a regression introduced in 1.6.56
   xenocara will be updated after unlock as it's not affected.

   Stop cleaning gem artifacts

   Bulk builds have seen occasional failures building
   textproc/ruby-commonmarker, which is the only reverse dependency. I'm
   not positive the cleaning of gem artifacts is the cause of the failure,
   though I suspect it is.

   Discussed with naddy@

   Update godot/pack3 to latest release 4.6.2, a stable maintenance
   release. No known incompatibilities. Tested with Road to Vostok.

   MFC: luanti 5.15.2 (security update)
   From maintainer izzy Meyer

   Update to exfetch 1.6. From author & maintainer izzy Meyer - thanks!

   archivers/libarchive: update to 3.8.7

   Fixes for a motley collection of NULL pointer dereference,
   out-of-bounds accesses, heap overflow, etc.

   Update to ruff 0.15.11, from maintainer

   https://github.com/astral-sh/ruff/releases/tag/0.15.11
   https://github.com/astral-sh/ruff/releases/tag/0.15.10

   Update to uv 0.11.7

   https://github.com/astral-sh/uv/releases/tag/0.11.7

   pass --jitless to node when minifying js code to avoid random crashes

   idea from volker@

   Update to samba-4.24.1

   Changes: https://www.samba.org/samba/history/samba-4.24.1.html

   Test and OK Ian McWilliam (co-maintainer)

   link web2-module-monitoring to the build, spotted by florian@, thanks!

   Update to libgedit-gtksourceview-299.7.0.

   Update to libgedit-gfls-0.4.1.

   Update to libgedit-amtk-5.10.0.