devel/etcd37: Update to 3.7.1
MAKE_ENV=GOWORK=off allows us to get rid of the following error:
```
go: 'go mod vendor' cannot be run in workspace mode.
Run 'go work vendor' to vendor the workspace or
set 'GOWORK=off' to exit workspace mode.
```
mail/exim: 4.100 -> 4.100.1
Security: GCVE-25-2026-09-50-1, GCVE-25-2026-09-51-1,
GCVE-25-2026-09-55-1, GCVE-25-2026-09-56-1
Requested-by: The Doctor <doctor at doctor.nl2k.ab.ca>
net/pimd: update to 3.1.0
troglobit/pimd, the upstream this port tracked, has not seen a commit since
August 2022 and its last release, 2.3.2, is from 2016. The port was pinned
to an unreleased master snapshot (2.3.2b, commit 17ae62f) because there was
nothing newer to move to.
This new fork continues the tree and releases from it. 3.1.0 brings
Anycast-RP (RFC 4610), accept-nbr-from and register-accept-from, and rescans
interfaces at runtime so a link that comes up after the daemon started becomes
a vif without a restart.
Revert "virtual_oss(8): Fix cuse.ko check"
parse_options() was moved above cuse_init(), which makes every single
regular virtual_oss invocation which uses cuse_dev_create() fail.
This reverts commit f014795ec3bd5efb88dfc249599e9665dc10a59e.
www/angie-module-jwt: Update to 3.4.6
This bugfix release fixes the module's test suite:
test_conf forwarded an unquoted $@, so the expected message was split
on spaces and only its first word was ever grepped. Two expectations
were pointing at the wrong configuration file, unnoticed.
PR: 298635
Changes: https://github.com/max-lt/nginx-jwt-module/releases/tag/v3.4.6
Sponsored by: Netzkommune GmbH
www/angie-module-auth-jwt: Update to 0.15.0
This new release adds the nxe-phase submodule and bumps the version of
nxe-jwx from 0.2.0 to 0.4.0.
PR: 298634
Changes: https://github.com/kjdev/nginx-auth-jwt/releases
Sponsored by: Netzkommune GmbH
www/angie-module-njs: Security update to 1.0.1
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body
continuation threw an exception or produced an unhandled rejection
(CVE-2026-18329). Previously, nginx could continue processing the
request as though the js_access check had succeeded. Affects
0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an
upstream server returned a status line with an empty reason phrase
(CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to
xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
[3 lines not shown]
www/angie: Security update to 1.12.2
This maintenance release fixes CVE-2026-90439:
When using an OpenSSL version without native HTTP/3 support (3.5.0
or earlier), if the default server for the address that accepted a
regular HTTPS request also used HTTP/3 (the listen directive with the
quic parameter, possibly on a different port), while a server block
without HTTP/3 was selected by domain name (SNI), limited worker process
memory corruption or a worker process crash could occur
(CVE-2026-90439); the fix was ported from nginx 1.31.6.
PR: 298632
Changes: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-2
Security: 6cf2ff4b-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
