FreeBSD/ports 71a75demath/R-cran-alabama Makefile distinfo

math/R-cran-alabama: update 2015.3-1 to 2025.1.0

Upstream changelog: constrOptim.nl now returns a convergence code
when only equality constraints are present.

Submitted by: chris.longros at gmail.com
Differential Revision: https://reviews.freebsd.org/D56058
DeltaFile
+3-3math/R-cran-alabama/distinfo
+1-2math/R-cran-alabama/Makefile
+4-52 files

FreeBSD/ports 69eaa44mail/dovecot24 pkg-descr Makefile, mail/dovecot24/files patch-src_imap_imap-client-hibernate.c pkg-message.in

mail/dovecot24: new port

- adding the new version 2.4 of dovecot, while keeping 2.3 in place
- please note that the config syntax has changed between 2.3
  and 2.4 and needs to be manually adapted, so use/upgrade with care

PR:             286695
Reported by:    Ian Dickens <ian_dickens at icloud.com>
Author:         Jordan Ostreff <jordan at ostreff.info>
Co-authored-by: Sebastian Oswald <sko at rostwald.de>
Discussed with: Sebastian Oswald <sko at rostwald.de>,
                Eugene R <genie at geniechka.ru>,
                Herbert J. Skuhra <herbert at gojira.at>,
                Christos Chatzaras <chris at cretaforce.gr>,
                and others
Tested by:      Jordan Ostreff <jordan at ostreff.info>
DeltaFile
+872-0mail/dovecot24/pkg-plist
+261-0mail/dovecot24/Makefile
+94-0mail/dovecot24/files/dovecot.in
+43-0mail/dovecot24/files/pkg-message.in
+12-0mail/dovecot24/files/patch-src_imap_imap-client-hibernate.c
+9-0mail/dovecot24/pkg-descr
+1,291-02 files not shown
+1,295-08 files

FreeBSD/ports f452b89security/cyberchef Makefile

security/cyberchef: Use INSTALL_DATA for index.html

PR:             297688
Obtained from:  mce@
Sponsored by:   yes
DeltaFile
+2-1security/cyberchef/Makefile
+2-11 files

FreeBSD/ports 9cfb6b0deskutils/podman-desktop Makefile, editors/vscode Makefile

*/*: Bump port revision after electron42 update (49ce10da799e)
DeltaFile
+1-1net-im/signal-desktop/Makefile
+1-1net-im/deltachat-desktop/Makefile
+1-1graphics/drawio/Makefile
+1-1deskutils/podman-desktop/Makefile
+1-0net-im/teams/Makefile
+1-0editors/vscode/Makefile
+6-46 files

FreeBSD/ports 1689928lang/quickjs-ng Makefile distinfo

lang/quickjs-ng: update: 0.16.1 -> 0.16.2

ChangeLog:      https://github.com/quickjs-ng/quickjs/compare/v0.16.1...v0.16.2

Sponsored by:   tipi.work
DeltaFile
+3-3lang/quickjs-ng/distinfo
+1-1lang/quickjs-ng/Makefile
+4-42 files

FreeBSD/ports 49ce10ddevel/electron42 distinfo, devel/electron42/files patch-ui_base_cursor_cursor__factory.cc patch-ui_base_x_x11__cursor__loader.cc

devel/electron42: Update to 42.9.3

Changelog:
- https://github.com/electron/electron/releases/tag/v42.9.1
- https://github.com/electron/electron/releases/tag/v42.9.2
- https://github.com/electron/electron/releases/tag/v42.9.3

Reported by:    GitHub (watch releases)
DeltaFile
+23-23devel/electron42/files/patch-electron_shell_browser_native__window__views.cc
+8-8devel/electron42/files/patch-electron_shell_browser_api_electron__api__web__contents.cc
+7-7devel/electron42/distinfo
+11-0devel/electron42/files/patch-ui_base_cursor_cursor__unittest.cc
+5-5devel/electron42/files/patch-ui_base_x_x11__cursor__loader.cc
+4-4devel/electron42/files/patch-ui_base_cursor_cursor__factory.cc
+58-4712 files not shown
+86-7518 files

FreeBSD/ports f6817b0math/R-cran-acepack Makefile

math/R-cran-acepack: update 1.4.1 to 1.6.3

Submitted by: chris.longros at gmail.com
Reviewed by:  uzsolt
DeltaFile
+1-1math/R-cran-acepack/Makefile
+1-11 files

FreeBSD/src bdfae0fsys/kern subr_epoch.c

epoch: Fix epoch_drain_callbacks()

This function is supposed to wait until all pending callbacks have been
executed.  This is useful in some contexts where we tear down some
context (like a VNET jail and its associated UMA zones) synchronously,
and we want to make sure that all pending asynchronous callbacks (which
may free objects to said UMA zones) have run first.

The implementation schedules a callback on each CPU and waits for them
all to run.  This assumes that, on a given CPU, callbacks are executed
in the order that they are pushed.  This assumption depends on the
implementation of epoch_call_task() and ck_epoch_poll_deferred(), and it
is not true in general.

Callbacks are pushed onto a per-CPU stack in LIFO order.
ck_epoch_poll_deferred() first pulls out the callbacks from epoch - 2,
which are always safe to execute, and in so doing reorders them such
that the oldest callback as at the top of the stack, so in this case,
epoch_call_task() will execute them in order.  However,

    [26 lines not shown]
DeltaFile
+30-20sys/kern/subr_epoch.c
+30-201 files

FreeBSD/src eddae79share/man/man4 ctl.4

ctl.4: Document the assumption that CTL HA runs only on trusted networks

The CTL High Availablity clustering feature allows a pair of hosts to
implement transparent failover.  The implementation uses a TCP
connection to exchange messages.  There is no authentication mechanism
and the protocol itself embeds kernel pointers in the messages exchanged
between HA hosts.  This property (of CTL_MSG_DATAMOVE messages
specifically), as well as insufficient validation of inbound messages,
mean that anyone able to access a CTL HA port is able to remotely
execute code on that host.

Provide a warning to this effect in the CTL man page.

Approved by:    re (cperciva)
Reported by:    Ryan of Calif.io
Reviewed by:    ziaee, ken, mav
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58622

    [3 lines not shown]
DeltaFile
+6-1share/man/man4/ctl.4
+6-11 files

FreeBSD/src 10dd09cusr.sbin/ppp lcp.c

ppp: Reject invalid endpoint discriminator options

Per RFC1717 section 5.1.3, the option length must be at least three.
Processing an undersized option would trigger a large out-of-bounds
write.

Approved by:    re (cperciva)
PR:             271910
Reported by:    Robert Morris
Reported by:    Décio Brandão (0xDBJ)
Reviewed by:    emaste
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58554

(cherry picked from commit b9d07a4308226b683b64827e0aaed1180e0da996)
(cherry picked from commit 30b4bdd451ad4ec2470f9a378bd62e948a85ef81)
DeltaFile
+6-0usr.sbin/ppp/lcp.c
+6-01 files

FreeBSD/src 281fb7dusr.sbin/ppp mp.c

ppp: Avoid overflow when formatting endpoint discriminator options

Each byte of the address is represented by a pair of characters, so we
should be multiplying len by 2 when figuring out how much buffer space
we have.  Previously, a sufficiently large option could cause an
overflow of the global "result" buffer.

Approved by:    re (cperciva)
Reported by:    Joshua Rogers <joshua at joshua.hu>
Tested by:      Décio Brandão (0xDBJ)
MFC after:      3 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58555

(cherry picked from commit e004ff15f87e6aa8f2aa13cd5600ae13457b95f1)
(cherry picked from commit 607c41d8f869243db275a6b1bd6cc66bf58d0f36)
DeltaFile
+6-6usr.sbin/ppp/mp.c
+6-61 files

FreeBSD/src 43bbea2sys/kern kern_fork.c

proc: Copy the p_reapsubtree field explicitly during fork

p_reapsubtree lives in the p_startcopy/p_endcopy block of struct proc,
which is copied during fork without any synchronization.  However, the
field is not stable except when the proctree lock is held, and indeed
may change if p1's reaper exits or explicitly releases its reaper
status.  This state change can race with fork() and leave the child with
an incorrect p_reapsubtree field.

Close the race: explicitly copy the field under the proctree lock during
fork.

Approved by:    re (cperciva)
Reported by:    syzkaller
Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58482


    [2 lines not shown]
DeltaFile
+7-0sys/kern/kern_fork.c
+7-01 files

FreeBSD/src dde5572sys/netinet6 raw_ip6.c

rawip: Fix handling of checksums in rip6_input()

A v6 raw socket may ask the kernel to validate the checksum of an
inbound packet.  If it does, and the validation fails, we discard the
packet, but this isn't really right: other raw sockets may wish to
receive a copy of the packet anyway.

Rework checksum handling to address this problem, and use a flag to
avoid computing the checksum more than once for a given packet.

Approved by:    re (cperciva)
Fixes:          de2d47842e880281 ("SMR protection for inpcbs")
Reviewed by:    pouria, glebius
Reported by:    Yunzhi Ke
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D58559

(cherry picked from commit 196874ce2e97e3e6425493b1d501e716b356bc36)
(cherry picked from commit 1fe3a2897b4ad7a9b9128efd6ec0c24b371bf5bd)
DeltaFile
+15-11sys/netinet6/raw_ip6.c
+15-111 files

FreeBSD/src 9c5f813sys/netinet in_mcast.c, sys/netinet6 in6_mcast.c

in_mcast: Fix uninitialized variable usage in inm_merge()

When the first loop in inm_merge() hits an error, generally because it
hit some limit on the number of source filters for a multicast group,
inm_merge() tries to atomically roll back changes to the group source
filter list.

To roll back, it iterates over the global source filter list for the
multicast group, starting at the last entry that we updated ("nims").
But, if we have not yet updated any entries, this variable is
uninitialized.  Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
doesn't visit any source filters in this case.

All of the above applies to the v6 case.

Approved by:    re (cperciva)
Reported by:    Daniel Birtwhistle
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation

    [3 lines not shown]
DeltaFile
+1-0sys/netinet6/in6_mcast.c
+1-0sys/netinet/in_mcast.c
+2-02 files

FreeBSD/ports 47a6449net-mgmt/icinga2 Makefile pkg-plist

net-mgmt/icinga2: Update to 2.16.5
DeltaFile
+3-3net-mgmt/icinga2/distinfo
+2-2net-mgmt/icinga2/pkg-plist
+1-2net-mgmt/icinga2/Makefile
+6-73 files

FreeBSD/ports 3638b2dmultimedia/jellyfin-ffmpeg7 Makefile pkg-plist

multimedia/jellyfin-ffmpeg7: don't advertise private libraries

The bundled libs install into a private prefix and are loaded by
ffmpeg/ffprobe through --enable-rpath, so nothing else links against them.

Drop USE_LDCONFIG and trim INSTALL_TARGET (no install-headers) to match
upstream's packaging.

Only for archs amd64, aarch64 -- upstream targets 64bit

Suggested by:   arrowd
DeltaFile
+0-150multimedia/jellyfin-ffmpeg7/pkg-plist
+8-25multimedia/jellyfin-ffmpeg7/Makefile
+8-1752 files

FreeBSD/src c4bca1fshare/examples/jails jail.xxx.conf jng

New version of jng (9.2)

Use jail.conf(5) $name in the jail.conf examples so the jail name
need only be set on the stanza. Keep host.hostname as xxx.yyy;
a jail name is not a DNS label. Leave the rc.conf excerpt as xxx.

Suggested by:   jlduran
MFC after:      1 week
Reviewed by:    kfv, jlduran
Differential Revision:  https://reviews.freebsd.org/D59032
DeltaFile
+14-14share/examples/jails/jng
+10-10share/examples/jails/jail.xxx.conf
+24-242 files

FreeBSD/ports e659767net-im/libsignal Makefile

net-im/libsignal: Mark i386 as broken due to upstream issues

PR:             296534
(cherry picked from commit addeb64c09712e5a7fba2fe9e56d1c39d65132d0)
DeltaFile
+2-0net-im/libsignal/Makefile
+2-01 files

FreeBSD/ports eaf1ef5security/cyberchef pkg-plist distinfo

security/cyberchef: Update to 11.4.0

re: https://github.com/gchq/CyberChef/releases/tag/v11.4.0

The naming conventions of the CyberChef project have changed.
Trying to use the build-in GH macros is futile.
This patch stops using them so we can download the right tarball.

My thanks to mce@ for this via via the PR.

PR:             297688
Sponsored by:   yes
DeltaFile
+8-12security/cyberchef/Makefile
+3-3security/cyberchef/distinfo
+4-0security/cyberchef/pkg-plist
+15-153 files

FreeBSD/ports df8ecb1security/howdy Makefile, security/pam_howdy Makefile

security/{pam-,}howdy: Drop maintainership and mark DEPRECATED
DeltaFile
+4-1security/pam_howdy/Makefile
+4-1security/howdy/Makefile
+8-22 files

FreeBSD/ports 0ef1b40devel Makefile, devel/linuxapi distinfo pkg-descr

devel/linuxapi: Linux userspace headers compatibility shim
DeltaFile
+31-0devel/linuxapi/Makefile
+25-0devel/linuxapi/pkg-plist
+5-0devel/linuxapi/pkg-descr
+3-0devel/linuxapi/distinfo
+1-0devel/Makefile
+65-05 files

FreeBSD/ports ff3a3f0devel/glibd Makefile

devel/glibd: Release to pool
DeltaFile
+1-1devel/glibd/Makefile
+1-11 files

FreeBSD/src 0011cd9sys/dev/ice ice_lib.h ice_strings.c

ice(4): Support Total Port Shutdown on E830 devices

When 'Permit Total Port Shutdown' feature in BIOS is enabled then Port
Disable bit is set in the Link Default Override Mask TLV PFA module
in the NVM. In this mode, the driver acts as if the link_active_on_if_down
flag is always disabled and disallow any change to that flag.
This feature applies for E830 and E835 NIC series.

Signed-off-by: Pawel Sobczyk <pawel.sobczyk at intel.com>

Tested by:      Mateusz Moga <mateusz.moga at intel.com>
MFC after:      2 weeks
Sponsored by:   Intel Corporation
Differential Revision:  https://reviews.freebsd.org/D58149
DeltaFile
+10-5sys/dev/ice/ice_lib.c
+9-0sys/dev/ice/if_ice_iflib.c
+2-0sys/dev/ice/ice_strings.c
+1-0sys/dev/ice/ice_lib.h
+22-54 files

FreeBSD/ports f1a8e8cdeskutils/zim Makefile distinfo

deskutils/zim: update to 0.77.2
DeltaFile
+3-3deskutils/zim/distinfo
+1-1deskutils/zim/Makefile
+4-42 files

FreeBSD/ports 5e1acecscience/py-dwave-samplers Makefile, science/py-dwave-samplers/files patch-pyproject.toml

science/py-dwave-samplers: allow newer meson

While here, shore up other version pin relaxations, use
${PYTHONPREFIX_SITELIBDIR} for staging operations, and ${PYTHON_SOABI}
to account for free-threading.

With hat: desktop, python
PR: 294498
DeltaFile
+11-6science/py-dwave-samplers/files/patch-pyproject.toml
+3-3science/py-dwave-samplers/Makefile
+14-92 files

FreeBSD/ports b723f70devel/android-tools/files patch-vendor_e2fsprogs_contrib_android_fsmap.h patch-vendor_e2fsprogs_contrib_android_basefs_allocator.h

devel/android-tools: fix build without devel/linux-headers

while here fix build with old libusb
DeltaFile
+19-11devel/android-tools/files/patch-vendor_adb_client_usb_libusb_device.cpp
+12-0devel/android-tools/files/patch-vendor_e2fsprogs_contrib_android_basefs_allocator.h
+12-0devel/android-tools/files/patch-vendor_e2fsprogs_contrib_android_perms.h
+9-0devel/android-tools/files/patch-vendor_e2fsprogs_contrib_android_fsmap.h
+52-114 files

FreeBSD/ports 68573c5www/chromium Makefile distinfo, www/chromium/files patch-chrome_browser_renderer__context__menu_render__view__context__menu.cc patch-chrome_browser_first__run_first__run.h

www/chromium: update to 151.0.7922.169

Security:       https://vuxml.freebsd.org/freebsd/d14c86b6-9ca3-11f1-bf98-a8a1599412c6.html
DeltaFile
+5-5www/chromium/distinfo
+2-2www/chromium/files/patch-chrome_browser_renderer__context__menu_render__view__context__menu.cc
+2-2www/chromium/files/patch-chrome_browser_first__run_first__run.h
+2-2www/chromium/files/patch-chrome_browser_file__system__access_chrome__file__system__access__permission__context.cc
+1-2www/chromium/Makefile
+12-135 files

FreeBSD/ports 85b5db5devel/jenkins Makefile distinfo

devel/jenkins: Update to 2.578

Sponsored by:   The FreeBSD Foundation
DeltaFile
+3-3devel/jenkins/distinfo
+1-1devel/jenkins/Makefile
+4-42 files

FreeBSD/ports d702e19security/vuxml/vuln 2026.xml

security/vuxml: add www/*chromium < 151.0.7922.169

Obtained from:  https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html
DeltaFile
+61-0security/vuxml/vuln/2026.xml
+61-01 files

FreeBSD/src 81a67bfsys/dev/usb/wlan if_rsu.c

rsu: add a runtime TX buffer bound check for a kernel buffer overflow

The rsu driver currently relies on a `KASSERT` to prove that the mbuf payload
plus TX descriptor fits in the per-transfer USB TX buffer. On production
kernels without `INVARIANTS`, an oversized raw 802.11 frame can reach
`m_copydata()` and overwrite past that buffer, causing local kernel memory
corruption.

This suggested patch replaces the assertion-only guard with a runtime size
check before the copy. Oversized frames return `EMSGSIZE`, leaving the existing
caller cleanup paths responsible for freeing `m0`, `ni`, and the unused
transfer buffer.

Reachable via root / bpf access

Reviewed by:    bz, adrian
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D58898
DeltaFile
+3-1sys/dev/usb/wlan/if_rsu.c
+3-11 files