security/vuxml: FreeBSD private sqlite3 is not vulnerable
Although the FreeBSD base system does ship the vulnerable version of
sqlite3, it is only used internally as a private library. None of the
use cases in the base system is realistically vulnerable.
Approved by: so (gordon)
Discussed with: secteam
Fixes: 2d614195fc56 ("security/vuxml: Add FreeBSD (base) to the
sqlite3 entry")
security/vuxml: Complete the immich entry
The entry listed six of the sixteen advisories that close with 3.4.0.
Add the missing ones, among them a symlink-following library import, path
traversal through unsanitized EXIF fields and a bypass of the plugin host
check, as well as the code execution through an uploaded SVG file that
versions before 3.2.4 allow.
Sponsored by: Netzkommune GmbH
www/immich: Security update to 3.4.0
An attacker-chosen OAuth state cookie allowed forced account linking and
takeover of any account. Further fixes cover a partner reading locked
folder metadata, read-scoped API keys resetting cluster group people
data, an unbounded motion photo offset exhausting memory and disk, and a
share link revealing whether the owner has a given file.
Adds JPEG XL support, two new match types for the EXIF metadata filter
and a trigger that runs a workflow once OCR processing has finished.
Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0
Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
www/immich-cli: Security update to 3.4.0
A malicious or intercepted server could read, exfiltrate and delete
arbitrary local files through the duplicate check.
Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0
Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
net-mgmt/semaphore: Update to 2.20.23
Keeps the chosen language per user, fixes deleting a user and no longer
submits the CLI argument dialog on Enter.
The vendored modernc.org/sqlite now carries current FreeBSD bindings for
every architecture, so the restriction to aarch64 and amd64 can go.
Changelog:
https://github.com/semaphoreui/semaphore/releases/tag/v2.20.23
Sponsored by: Netzkommune GmbH
security/doas: Do not install sample as doas.conf
The doas.conf.sample was not installed as sample intentionally.
PR: 300634
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 86deb2ebd4f97e44078e6145bf4e169940a06e5c)
security/doas: Do not install sample as doas.conf
The doas.conf.sample was not installed as sample intentionally.
PR: 300634
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
security/py-keepkey: Fix Python 3 and protobuf compatibility
Regenerate protobuf modules at build time to fix import failures with
current protobuf. Use the device-protocol revision matching upstream
7.2.1, which includes the required Tendermint definitions.
Fix Python 2 remnants in keepkeyctl and protobuf_json, and support
the protobuf descriptor API changes. Remove the unused exchange
module, which depends on the obsolete protobuf3 library.
Switch to PEP 517, correct the package version metadata, add the
python category, and expand the port description. Bump PORTREVISION.
PR: 300278
