security/vuxml: Document sqlite3 vulnerabilities fixed in 3.54.0
Ten issues were published on 2026-10-30, with VulnCheck as the
assigning CNA. Four of them corrupt the heap, in FTS5, in the session
extension and in the R-Tree module, and all of them need an attacker
supplied database file or SQL text.
Sponsored by: Netzkommune GmbH
graphics/R-cran-patchwork: New port: The Composer of Plots
patchwork expands the ggplot2 API to allow arbitrarily complex
composition of plots by providing mathematical operators for combining
multiple plots.
PR: 296816
Reviewed by: jrm
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D60942
security/vuxml: Document phpMyAdmin vulnerabilities
Seven issues in phpMyAdmin up to and including 5.2.3 were published on
2026-10-30, with VulnCheck as the assigning CNA. The worst of them is
an authentication bypass in the WebAuthn second factor, and the
request forgery in setup/validate.php needs no authentication at all.
There is no fixed release and no announcement from the project, so the
entry carries an open range for both ports.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
[7 lines not shown]
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
[8 lines not shown]
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
(cherry picked from commit 9ed8b30188ce739e2fcae47fc2e516ead668a97c)
security/vuxml: Document MySQL vulnerabilities of October 2026
Four entries: 8.4 and 9.7, fixed in 8.4.13 and 9.7.4; 26.7, which is
end of life and has no fix, with an open range; and the connectors,
fixed in 26.10.0. mysql-shell is listed with 9.7, it bundles and
statically links the MySQL client code.
The two issues in the bundled curl and OpenSSL copies are left out,
these ports build against the libraries of the system.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
[5 lines not shown]
databases/mysql267-{server|client}: Deprecate and set an expiration date
MySQL 26.7 reached its end of life on 2026-10-20 with the release of
26.10. An Innovation release is maintained only until the next one
appears, so there will be no further 26.7 release.
79 of the 80 MySQL server issues of the Oracle Critical Patch Update
of October 2026 apply to 26.7, five of them only to 26.7, plus five in
the MySQL Router built from this port. None of them will be fixed.
Switch to databases/mysql2610-server. The expiration date is a week
out and not the usual months: the port entered the tree on 2026-10-12
and ships unfixed vulnerabilities.
Security: 24aaad94-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
[6 lines not shown]
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
