games/anki: Update to 26.08
* Switch to USES=npm and adjust/remove the relevant parts.
Although Yarn v4 is already being used according to "package.json",
stick with Yarn v1 for now to complete a 1:1 migration from the before
to the after state with respect to the used tools during build.
Changelog:
https://github.com/ankitects/anki/releases/tag/26.08
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
(cherry picked from commit 87d11fd7305cb245dff284e34be3a5c0c423aa60)
net/turnserver: Update 4.14.0 => 4.16.0
Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).
PR: 297251, 296810
Reported by: Frank Wall <freebsd at moov.de>
Reported by Zixu Wu <zx at bv3.dev>
Approved by: Chris Hutchinson <portmaster at bsdforge.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Co-authored-by: Frank Wall <freebsd at moov.de>
Co-authored-by: Zixu Wu <zx at bv3.dev>
Security: GHSA-5538-7cxj-5jcc
MFH: 2026Q3
pseudofs: Don't purge the cache on shutdown
This is a waste of time and results in a use-after-free if linsysfs is
loaded and a USB network interface is in use, since USB devices are
disconnected at shutdown, which triggers a call into linsysfs, which
then tries to destroy a pseudofs node which has already been purged.
MFC after: 1 week
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D58359
lang/ldc: add new bootstrap for powerpc64le after long double switch
Two new patches:
1. Don't use glibc's dual long double mechanism - we don't support
IBM long double.
2. Use proper mangling.
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Fix build and loading of the 3rd party gridfs module after the
devel/mongo-c-driver 2.x update.
The module config now obtains include and linker flags from
pkg-config instead of deriving them from the ports tree's
DISTVERSION. The previous approach ran a recursive make into
devel/mongo-c-driver on every make invocation, even with GRIDFS
unset, and derived the libbson include path from the mongo-c-driver
version although devel/libbson is a separate port with its own
DISTVERSION. Both directories happen to carry the same version
today, so the mismatch was not visible yet.
While here, add the missing assert.h include. The module calls
assert() without declaring it, which left an unresolvable symbol
"assert" in the shared object -- libc only exports __assert. Since
nginx dlopen()s modules with RTLD_NOW, load_module refused to load
the module at runtime.
[5 lines not shown]
igc: defer sysctl-driven reinit to the admin task
igc_sysctl_eee() and igc_sysctl_dmac() called igc_if_init() directly.
Request the reset through iflib instead, and skipping while the interface
is down; the new value is picked up by the next init.
Unlike e1000, igc has no ASSERT_CTX_LOCK_HELD and no acquire_swflag
path, so the defect is silent here rather than an assertion failure.
While here also remove unnecessary igc_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58629
e1000: defer sysctl-driven reinit to the admin task
Request the reset through iflib and let the admin task perform the
stop/init under the context lock, matching what the VF and SR-IOV paths
already do.
The assertion is compiled out without INVARIANTS, where the same write
instead resets the MAC and takes the ICH software flag while the queues
stay live and an ioctl or the admin task may be running.
While here also remove unnecessary em_if_init uses:
iflib_if_init_locked() already runs after IFDI_RESUME and
IFDI_MEDIA_CHANGE, so the trailing *_if_init() only added an unstopped
IFDI_INIT that the following iflib_stop() undoes.
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D58628
fusefs: fix error handling when reading a directory's sticky bit
When trying to delete or rename a file, fuse_vnop_lookup must check
whether its parent directory's sticky bit is set. Realistically, the
parent directory's attributes will almost always be cached. But it's
possible that they won't be, and in that case we must send a new
FUSE_GETATTR request to the server. If that request fails for some
reason, then we must fail the lookup. Prior to this change fusefs would
ignore failure of that request.
Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
and Ke Xu of Tsinghua University
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D57588
(cherry picked from commit b4af6a4cccc3b4b0ea461463196c258eb92ad2e5)
security/vuxml: Fix affected port version of mail/thunderbird by CVE-2026-6778
Although mail/thunderbird does not actually have PORTEPOCH, one is included in vuxml.
As a result, even fixed versions were still incorrectly reported as vulnerable.
The incorrect report was as follows:
===> thunderbird-153.0.2 has known vulnerabilities:
thunderbird-153.0.2 is vulnerable:
Mozilla -- Invalid pointer
CVE: CVE-2026-6778
WWW: https://vuxml.FreeBSD.org/freebsd/5124ce36-430a-11f1-a627-b42e991fc52e.html
