FreeBSD/ports 01be6afsysutils/py-pywatchman Makefile distinfo

sysutils/py-pywatchman: Update 2026.08.17.00 => 2026.09.14.00

Changelogs:
- https://github.com/facebook/watchman/releases/tag/v2026.08.24.00
- https://github.com/facebook/watchman/releases/tag/v2026.08.31.00
- https://github.com/facebook/watchman/releases/tag/v2026.09.07.00
- https://github.com/facebook/watchman/releases/tag/v2026.09.14.00
Commit log:
https://github.com/facebook/watchman/compare/v2026.08.17.00...v2026.09.14.00

PR:             298110
Approved by:    no maintainer
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+3-3sysutils/py-pywatchman/distinfo
+1-1sysutils/py-pywatchman/Makefile
+4-42 files

FreeBSD/ports 6467152security/crowdsec-firewall-bouncer Makefile distinfo

security/crowdsec-firewall-bouncer: Update 0.0.34 => 0.0.36

Changelog:
https://github.com/crowdsecurity/cs-firewall-bouncer/releases/tag/v0.0.36

PR:             298102
Approved by:    Manuel Sabban <manuel at crowdsec.net> (maintainer timeout, 2 weeks)
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+5-5security/crowdsec-firewall-bouncer/distinfo
+2-3security/crowdsec-firewall-bouncer/Makefile
+7-82 files

FreeBSD/ports fd8236ceditors/openoffice-devel distinfo Makefile, editors/openoffice-devel/files patch-testtools_source_bridgetest_makefile.mk patch-framework_Library__fwk.mk

editors/openoffice-devel: Upgrade to a new snapshot

Upgrade to a new snapshot of the upstream AOO42X branch.

Switch from system textproc/libtextcat to bundled libtextcat.
The system version probably never worked properly because it
lacks UTF-8 support, whereas the bundled version has been patched
to support UTF-8.  Longer term, libtextcat should be replaced
by libexttextcat.

Disable WIKI_PUBLISHER and mark BROKEN.  It relies on
apache-commons-httpclient which has an open MITM CVE.  It should
be upgraded to Apache HttpComponents, but that requires a newer
java.

Disable bridgetest on i386 due to a uno core dump in testtools.

Removed old code optimization tweak that is probably left over
from when we used the buggy -Os compiler optimization flag.

    [4 lines not shown]
DeltaFile
+12-14editors/openoffice-devel/Makefile
+0-15editors/openoffice-devel/files/patch-framework_Library__fwk.mk
+13-0editors/openoffice-devel/files/patch-testtools_source_bridgetest_makefile.mk
+5-3editors/openoffice-devel/distinfo
+30-324 files

FreeBSD/src fa848d4libexec/rtld-elf rtld.c

rtld: more caution when parsing in digest_notes()

Incorrect ELF might have PT_NOTE slightly larger than the needed to
contain all notes, and the PT_NOTE size could be larger than one page.
Then rtld mmaps just the notes bytes to parse.  After the last note,
we iterate past the mapped region trying to read the Elf_Note header.
This was found in wild.

Require full elf note to fit into the [start_note, end_note) region to
continue the parsing.  Check it in stages, first verifying the Elf_Note
header structure fits, to be able to read the name and data length.
After that, check the whole note against limit.

Reported and tested by: makc
Reviewed by:    emaste
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D59635
DeltaFile
+10-5libexec/rtld-elf/rtld.c
+10-51 files

FreeBSD/src 2ef9731libexec/rtld-elf rtld.c

rtld.c: fix indent

Sponsored by:   The FreeBSD Foundation
MFC after:      3 days
DeltaFile
+1-1libexec/rtld-elf/rtld.c
+1-11 files

FreeBSD/ports 0eabba8x11/bosd distinfo Makefile

x11/bosd: Update to 10.3

Harden the warm-daemon IPC path. Switch the TESTS option to
TESTS_MAKE_ARGS helpers so the port no longer includes
bsd.port.options.mk.

Changelog:      https://github.com/FrauBSD/bosd/compare/10.2...10.3

Approved by:    fuz (mentor)
Reviewed by:    fuz (mentor)
Differential Revision:  https://reviews.freebsd.org/D59671
DeltaFile
+3-8x11/bosd/Makefile
+3-3x11/bosd/distinfo
+6-112 files

FreeBSD/ports 60c4ec8mail/thunderbird-esr Makefile distinfo

mail/thunderbird-esr: update to 153.3.0 (rc1)

Release Notes:
  https://www.thunderbird.net/en-US/thunderbird/153.3.0esr/releasenotes/

(cherry picked from commit b3ecd66fdfaf12ad21079105cd97b0a722550fef)
DeltaFile
+3-3mail/thunderbird-esr/distinfo
+1-1mail/thunderbird-esr/Makefile
+4-42 files

FreeBSD/ports b3ecd66mail/thunderbird-esr Makefile distinfo

mail/thunderbird-esr: update to 153.3.0 (rc1)

Release Notes:
  https://www.thunderbird.net/en-US/thunderbird/153.3.0esr/releasenotes/
DeltaFile
+3-3mail/thunderbird-esr/distinfo
+1-2mail/thunderbird-esr/Makefile
+4-52 files

FreeBSD/ports 4b703c5multimedia/ffmpeg4 distinfo Makefile

multimedia/ffmpeg4: Update 4.4.7 => 4.4.8

Changelog:
https://git.ffmpeg.org/gitweb/ffmpeg.git/blob_plain/n4.4.8:/Changelog
https://github.com/FFmpeg/FFmpeg/blob/n4.4.8/Changelog

While here replace spaces with tabs.

PR:             298492
Sponsored by:   UNIS Labs (vvd, commit patch)
MFH:            2026Q3

(cherry picked from commit 41af21de2d1b8205cee5f38d6b410e9964e3e4cd)
DeltaFile
+63-63multimedia/ffmpeg4/Makefile
+3-3multimedia/ffmpeg4/distinfo
+66-662 files

FreeBSD/ports c6ba817net/ucx/files patch-src_ucm_util_replace.c patch-src_ucs_type_float8.h

net/ucx: Update 1.20.1 => 1.22.0

Changelog:
https://github.com/openucx/ucx/releases/tag/v1.21.0
https://github.com/openucx/ucx/releases/tag/v1.22.0

PR:             298500
Sponsored by:   UNIS Labs (vvd, commit patch)
DeltaFile
+132-13net/ucx/files/patch-test_gtest_common_test__helpers.cc
+112-24net/ucx/files/patch-src_ucs_sys_sys.c
+118-0net/ucx/files/patch-src_uct_sm_mm_posix_mm__posix.c
+19-83net/ucx/files/patch-configure.ac
+41-26net/ucx/files/patch-src_ucs_type_float8.h
+3-55net/ucx/files/patch-src_ucm_util_replace.c
+425-20135 files not shown
+597-48041 files

FreeBSD/ports 41af21dmultimedia/ffmpeg4 distinfo Makefile

multimedia/ffmpeg4: Update 4.4.7 => 4.4.8

Changelog:
https://git.ffmpeg.org/gitweb/ffmpeg.git/blob_plain/n4.4.8:/Changelog
https://github.com/FFmpeg/FFmpeg/blob/n4.4.8/Changelog

While here replace spaces with tabs.

PR:             298492
Sponsored by:   UNIS Labs (vvd, commit patch)
MFH:            2026Q3
DeltaFile
+63-64multimedia/ffmpeg4/Makefile
+3-3multimedia/ffmpeg4/distinfo
+66-672 files

FreeBSD/ports 95fab0egames/torcs Makefile pkg-plist, games/torcs/files patch-src_drivers_olethros_driver.cpp patch-torcs.desktop

games/torcs: Update 1.3.7 => 1.3.9

Changelog:
https://torcs.sourceforge.net/changelog/

PR:             298488
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+194-2games/torcs/pkg-plist
+18-20games/torcs/Makefile
+0-20games/torcs/files/patch-Make-default.mk
+0-18games/torcs/files/patch-src_libs_musicplayer_OpenALMusicPlayer.cpp
+0-11games/torcs/files/patch-src_drivers_olethros_driver.cpp
+11-0games/torcs/files/patch-torcs.desktop
+223-713 files not shown
+228-879 files

FreeBSD/ports 386860cnet/rustconn Makefile Makefile.crates

net/rustconn: Update to 0.21.13

ChangeLog:

1. https://github.com/totoshko88/RustConn/releases/tag/v0.21.13

Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+9-11net/rustconn/distinfo
+3-4net/rustconn/Makefile.crates
+1-1net/rustconn/Makefile
+13-163 files

FreeBSD/poudriere 92ed04bsrc/share/poudriere image_zfs.sh

image: Use msg_n/done idiom for ZFS image build status messages

zfs send/recv, zpool create, and zfs create/snapshot are all silent
on success and can take a noticeable amount of time (especially for
larger images), but were reported via standalone msg() calls with no
completion signal. Switch to the msg_n "...done" idiom used elsewhere
for silent, potentially slow operations.
DeltaFile
+10-5src/share/poudriere/image_zfs.sh
+10-51 files

FreeBSD/poudriere b22f1fbsrc/share/poudriere image.sh

image: Use msg_n/done idiom for install_world tar status

install_world() reported "Installing world with tar" and "Installing
world done" as two separate msg() lines, even though both the tar
pipeline and make -s are always silent on success and the operation
(copying the full world plus delete-old) can take a while. Switch to
the msg_n "...done" idiom used elsewhere for silent, potentially slow
operations.
DeltaFile
+2-2src/share/poudriere/image.sh
+2-21 files

FreeBSD/ports a0760a8www/librewolf/files patch-toolkit_components_remote_nsXRemoteServer.cpp patch-build_moz.configure_toolchain.configure

www/librewolf: Update 154.0.1-3 => 155.0.1-1

Release Notes:
https://www.firefox.com/en-US/firefox/155.0.1/releasenotes/

PR:             298478
Sponsored by:   UNIS Labs (vvd, commit patch)
MFH:            2026Q3

(cherry picked from commit 17e40b092b4f18b37a8434be80a99d4e4240fdf6)
DeltaFile
+2,020-854www/librewolf/files/patch-libwebrtc-generated
+73-19www/librewolf/files/patch-third__party_libwebrtc_build_config_BUILDCONFIG.gn
+73-0www/librewolf/files/patch-enable-webserial
+29-0www/librewolf/files/patch-third__party_pipewire_spa_param_audio_layout-types.h
+8-9www/librewolf/files/patch-build_moz.configure_toolchain.configure
+0-11www/librewolf/files/patch-toolkit_components_remote_nsXRemoteServer.cpp
+2,203-8932 files not shown
+2,209-8998 files

FreeBSD/poudriere 4257d54src/share/poudriere jail.sh

jail: Add trailing ellipsis to make/freebsd-update status messages

Each of these msg() calls is immediately followed by an unredirected
external command (make or freebsd-update) whose own real-time output
streams directly to the console right after the header, with no
paired completion message -- the command's own output, or the
err()/msg_warn() on failure, is what signals progress/completion.
Add a trailing "..." so the header reads as in-progress rather than
a standalone statement, consistent with msg_n() callers elsewhere.
DeltaFile
+8-8src/share/poudriere/jail.sh
+8-81 files

FreeBSD/ports 17e40b0www/librewolf/files patch-toolkit_components_remote_nsXRemoteServer.cpp patch-build_moz.configure_toolchain.configure

www/librewolf: Update 154.0.1-3 => 155.0.1-1

Release Notes:
https://www.firefox.com/en-US/firefox/155.0.1/releasenotes/

PR:             298478
Sponsored by:   UNIS Labs (vvd, commit patch)
MFH:            2026Q3
DeltaFile
+2,020-854www/librewolf/files/patch-libwebrtc-generated
+73-19www/librewolf/files/patch-third__party_libwebrtc_build_config_BUILDCONFIG.gn
+73-0www/librewolf/files/patch-enable-webserial
+29-0www/librewolf/files/patch-third__party_pipewire_spa_param_audio_layout-types.h
+8-9www/librewolf/files/patch-build_moz.configure_toolchain.configure
+0-11www/librewolf/files/patch-toolkit_components_remote_nsXRemoteServer.cpp
+2,203-8932 files not shown
+2,209-9008 files

FreeBSD/poudriere 17a2953src/share/poudriere image.sh

image: Use msg_n/done idiom for miniroot creation status

mkminiroot() reported "Making miniroot" as a standalone msg() even
though the function is mostly silent and can take a noticeable
amount of time (copying files, resolving shared library deps, and
running makefs/gzip). Of its steps, only makefs writes unredirected
output to stdout; gzip -9 without -v is already silent. Redirect
makefs's output to /dev/null, matching the same treatment already
used for its sibling make_esp_file(), and switch to the msg_n
"...done" idiom used elsewhere for silent, potentially slow
operations so the whole function reports as one in-progress status
line instead of a header with no matching completion.
DeltaFile
+4-2src/share/poudriere/image.sh
+4-21 files

FreeBSD/poudriere 21d009asrc/share/poudriere common.sh

build_port: Add trailing ellipsis to shared library dependency check

The readelf/grep output for the NEEDED library list prints directly
after this status line, so it should read as in-progress like other
such messages instead of a standalone statement.
DeltaFile
+1-1src/share/poudriere/common.sh
+1-11 files

FreeBSD/ports d89b033sysutils/treemd Makefile Makefile.crates

sysutils/treemd: Update to 0.9.0

Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+11-21sysutils/treemd/distinfo
+4-9sysutils/treemd/Makefile.crates
+1-1sysutils/treemd/Makefile
+16-313 files

FreeBSD/src 7e2a425share/man/man4 iflib.4, sys/net iflib.c

iflib: Use a bounded buf_ring for simple_tx

Implement buf_ring/drbr deferred transmit in iflib. This is intended
to allow the new simpler code path to replace mp_ring. This patch
makes the simple_tx outperform mp_ring by a wide margin when CPU is
the bottleneck (eg, cannot fill the NIC). See graphs at:
https://people.freebsd.org/~gallatin/mpring_vs_simple_tx

Note that the buf ring is used for contention, not capacity. Eg,
it is used as a place for contending threads to put packets without
waiting for a mutex. It is not designed to act as a software ring
on top of the hardware descriptors provided by the underlying NIC
driver. "stranded packets" are exceedingly rare due to the fact that
if there is enough load to use the buf_ring, there will probably be
more load coming that can be a drainer. Not scheduling a gtask to
drain is intentional, and we really on the timer as a fallback.

One thing I noticed while developing this patch is that a simple mutex
with no deferral generally outperformed both mp_ring and drbr at high

    [28 lines not shown]
DeltaFile
+570-39sys/net/iflib.c
+48-3share/man/man4/iflib.4
+618-422 files

FreeBSD/ports dbedc4fdeskutils/py-trash-cli Makefile distinfo

deskutils/py-trash-cli: Update to 0.26.9.14

ChangeLog:

1. https://github.com/andreafrancia/trash-cli/releases/tag/0.26.9.14

Reported by:    Andrea Francia <notifications at github.com>
DeltaFile
+3-3deskutils/py-trash-cli/distinfo
+1-1deskutils/py-trash-cli/Makefile
+4-42 files

FreeBSD/src c1fa70csys/dev/virtio/network if_vtnet.c

vtnet: offer VIRTIO_NET_F_GUEST_CSUM

Always offer the VIRTIO_NET_F_GUEST_CSUM feature to the host, and not
only if RXCSUM is enabled on vtnet. Instead of using RXCSUM to control
whether this feature will be negotiated with the host, just use it to
control whether the VIRTIO_NET_HDR_F_DATA_VALID flag on an incoming
packet is processed (i.e., translated to the corresponding mbuf flag
only if RXCSUM is enabled on the vtnet interface).
This has two benefits:
1. Enabling/disabling RXCSUM on vtnet does not require feature
   renegotiation.
2. The host is always allowed to send locally generated TCP or UDP
   packets to the guest without computing a full checksum (by setting
   the VIRTIO_NET_HDR_F_NEEDS_CSUM flag) and not only if the guest has
   enabled RXCSUM on vtnet. Since locally generated packets do not
   require a checksum, this saves otherwise unnecessarily wasted
   computing power.
If a user of a FreeBSD guest really does not want to negotiate the
VIRTIO_NET_F_GUEST_CSUM feature with the host, it still can disable

    [6 lines not shown]
DeltaFile
+42-47sys/dev/virtio/network/if_vtnet.c
+42-471 files

FreeBSD/ports 75789a3sysutils/siegfried Makefile distinfo

sysutils/siegfried: Update to 1.11.7

ChangeLog:
https://github.com/richardlehane/siegfried/blob/main/CHANGELOG.md#v1117-2026-09-14

MFH:            2026Q3
(cherry picked from commit 1b36c384dc1b0cd7c3a02a21d0c1768b08532abe)
DeltaFile
+5-5sysutils/siegfried/distinfo
+1-2sysutils/siegfried/Makefile
+6-72 files

FreeBSD/ports c92bffaprint/publisher-devel Makefile pkg-plist, print/publisher-devel/files modules.txt

print/publisher-devel: Update 5.7.5 => 5.9.4

While here, remove duplicate modules.txt.

Changelog:
https://doc.speedata.de/publisher/en/manual/changelog/version-5/#594-2026-09-04

PR:             298495
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+0-114print/publisher-devel/modules.txt
+3-3print/publisher-devel/pkg-plist
+3-3print/publisher-devel/distinfo
+3-0print/publisher-devel/files/modules.txt
+1-1print/publisher-devel/Makefile
+10-1215 files

FreeBSD/src 5fb3aeasys/compat/linuxkpi/common/include/asm cpu_device_id.h, sys/compat/linuxkpi/common/include/linux bits.h mod_devicetable.h

linuxkpi: Add x86 CPU ID matching functions and macros

There are two parts that go together:
* `X86_MATCH_VFM()` to declare a matching pattern
* `x86_match_cpu()` to check if the current CPU matches one of the
  patterns in an array.

The i915 DRM driver started to use this in Linux 6.14.

Reviewed by:    kib
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57700
DeltaFile
+37-0sys/compat/linuxkpi/common/src/linux_compat.c
+25-0sys/compat/linuxkpi/common/include/asm/cpu_device_id.h
+17-0sys/compat/linuxkpi/common/include/linux/mod_devicetable.h
+2-0sys/compat/linuxkpi/common/include/linux/bits.h
+81-04 files

FreeBSD/poudriere d92fb7csrc/share/poudriere common.sh

Reject unsafe package names from ports metadata

PKGNAME is used to construct host-side package staging paths. A port
can supply traversal components and cause those paths to escape the
staging directory.

Validate package names when reading port metadata and before a build
worker uses one. This prevents path separators and dot traversal
components from reaching host filesystem operations.

(cherry picked from commit e90c7ba59dbb1b42b9e83029e88c570caf29d632)

Conflicts:
        src/share/poudriere/common.sh

Issue #1363
DeltaFile
+22-0src/share/poudriere/common.sh
+22-01 files

FreeBSD/doc bea0478documentation/content/en/books/porters-handbook/versions _index.adoc

Document __FreeBSD_version bumps 1600021..1600025

Document __FreeBSD_version bumps 1600021..1600025 for
emaste, kbowling (2x), and seuros (mentor adrian, 2x).
DeltaFile
+25-0documentation/content/en/books/porters-handbook/versions/_index.adoc
+25-01 files

FreeBSD/ports 679b26amisc/crush Makefile distinfo

misc/crush: Update to 0.94.2

Changelog: https://github.com/charmbracelet/crush/releases/tag/v0.94.2

Reported by:    GitHub (watch releases)
DeltaFile
+5-5misc/crush/distinfo
+1-1misc/crush/Makefile
+6-62 files