HardenedBSD/src 05447ca — sys/dev/mlx5/mlx5_core fs_core.h mlx5_fs_core.c, sys/netipsec xform_ipcomp.c xform_ah.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+27-4sys/dev/mlx5/mlx5_core/mlx5_fs_core.c
+13-17usr.sbin/ppp/ipcp.c
+7-0sys/dev/mlx5/mlx5_core/fs_core.h
+1-0sys/netipsec/xform_ipcomp.c
+1-0sys/netipsec/xform_ah.c
+49-215 files

HardenedBSD/src 310955b — include pthread_np.h, lib/libthr/tests pthread_query_test.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+254-0share/man/man3/pthread_query_np.3
+123-0lib/libthr/tests/pthread_query_test.c
+116-0lib/libthr/thread/thr_query.c
+37-17sys/kern/vfs_syscalls.c
+30-22lib/libthr/thread/thr_mutex.c
+30-0include/pthread_np.h
+590-3915 files not shown
+657-4921 files

HardenedBSD/ports 0577797 — devel/libconfig Makefile, sysutils/vitaly Makefile Makefile.crates

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+253-0sysutils/vitaly/distinfo
+125-0sysutils/vitaly/Makefile.crates
+43-0sysutils/vitaly/files/patch-src_main.rs
+29-0sysutils/vitaly/Makefile
+6-12devel/libconfig/Makefile
+17-0x11/nvidia-kmod/Makefile
+473-1223 files not shown
+534-7029 files

HardenedBSD/ports 7b7df0a — devel/libconfig distinfo pkg-plist

devel/libconfig: Update to 1.8.3

Switch to CMake, simplifies port Makefile and improves support
for consumers

Changelog: https://github.com/hyperrealm/libconfig/blob/v1.8.3/ChangeLog

PR:             299906
Approved by:    maintainer timeout, 2+ weeks
DeltaFile
+6-12devel/libconfig/Makefile
+5-5devel/libconfig/pkg-plist
+3-3devel/libconfig/distinfo
+14-203 files

HardenedBSD/ports bd5ff99 — graphics/jpeg-turbo pkg-plist distinfo

graphics/jpeg-turbo: Update to 3.2.1

Unit tests now passes without -ffp-model=strict (CFLAGS) and
use system zlib instead of bundled

Changelog:
https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/3.2.1

PR:             300235
Reviewed by:    desktop (arrowd)
Security:       CVE-2026-75466
Exp-run by:     antoine
DeltaFile
+3-8graphics/jpeg-turbo/Makefile
+3-5graphics/jpeg-turbo/distinfo
+1-1graphics/jpeg-turbo/pkg-plist
+7-143 files

HardenedBSD/ports e20b100 — www/rubygem-addressable28 Makefile

www/rubygem-addressable28: Mark DEPRECATED

PR:             299358
Approved by:    ruby (maintainer, timeout 2 weeks)
Approved by:    osa, fluffy (mentors, implicit)
MFH:            2026Q4
DeltaFile
+4-0www/rubygem-addressable28/Makefile
+4-01 files

HardenedBSD/ports e1d11ce — devel/py-ty Makefile.crates Makefile, devel/py-ty/files patch-cargo-crates_mio-1.0.4_src_sys_unix_selector_kqueue.rs

devel/py-ty: Update to 0.0.100

Changelog: https://github.com/astral-sh/ty/blob/0.0.100/CHANGELOG.md

Reported by:    portscout
DeltaFile
+0-10devel/py-ty/files/patch-cargo-crates_mio-1.0.4_src_sys_unix_selector_kqueue.rs
+5-5devel/py-ty/distinfo
+1-1devel/py-ty/Makefile.crates
+1-1devel/py-ty/Makefile
+7-174 files

HardenedBSD/ports 8ff8a87 — sysutils Makefile, sysutils/vitaly pkg-descr Makefile

sysutils/vitaly: [NEW PORT] VIA/Vial CLI configuration tool for QMK keyboards

Vial CLI tool allows to configure keyboard through VIA/Vial protocol with
command line interface. It supports QMK keycodes notation together with aliases.

Keys, encoders, combos, macros, tap dances, key overrides and alt repeat keys
are supported. RGB lighting control is supported too.

Non-colored underglow is not supported for now because there is no devices with
such features around me.

Tool support --help for tool as a whole and for all subcommands.

WWW:         https://github.com/bskaplou/vitaly/
DeltaFile
+253-0sysutils/vitaly/distinfo
+125-0sysutils/vitaly/Makefile.crates
+43-0sysutils/vitaly/files/patch-src_main.rs
+29-0sysutils/vitaly/Makefile
+10-0sysutils/vitaly/pkg-descr
+1-0sysutils/Makefile
+461-06 files

HardenedBSD/ports 45d9afb — mail/py-resend Makefile distinfo

mail/py-resend: Update to 2.53.2

Changelog:
- https://github.com/resend/resend-python/releases/tag/v2.53.0
- https://github.com/resend/resend-python/releases/tag/v2.53.1
- https://github.com/resend/resend-python/releases/tag/v2.53.2

Reported by:    portscout
DeltaFile
+3-3mail/py-resend/distinfo
+1-1mail/py-resend/Makefile
+4-42 files

HardenedBSD/src 2af08ab — sys/netipsec xform_ipcomp.c xform_ah.c

netipsec: Release the sahtree lock on the AH and IPComp EAGAIN paths

183513d15f22 made the AH, ESP and IPComp input callbacks hold the
sahtree read lock, but only esp_input_cb() drops it before resubmitting
a request that the crypto framework completed with EAGAIN.
ah_input_cb() and ipcomp_input_cb() return with the lock still held.

crypto_invoke() completes requests with EAGAIN while their driver
detaches.  Detaching ossl(4) under inbound AH traffic then hangs the
next rmlock writer, and the system panics with "spin lock held too
long" in smp_rendezvous_cpus() called from _rm_wlock().

Release the lock as esp_input_cb() does.

Reported by:            llm-postcr
Reviewed by:            kib
Fixes:                  183513d15f22 ("sys/netipsec: ensure sah stability during input callback processing")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D61399
DeltaFile
+1-0sys/netipsec/xform_ipcomp.c
+1-0sys/netipsec/xform_ah.c
+2-02 files

HardenedBSD/ports 08d332b — misc/codex Makefile.crates Makefile, misc/codex/files patch-codex-rs_tui_src_clipboard__copy_worker.rs patch-codex-rs_features_src_lib.rs

misc/codex: Update to 0.167.0

Changelog: https://github.com/openai/codex/releases/tag/rust-v0.167.0

Reported by:    GitHub (watch releases)
DeltaFile
+5-5misc/codex/distinfo
+2-2misc/codex/files/patch-codex-rs_tui_src_clipboard__copy_worker.rs
+2-2misc/codex/files/patch-codex-rs_features_src_lib.rs
+1-1misc/codex/Makefile.crates
+1-1misc/codex/Makefile
+11-115 files

HardenedBSD/src dfdc0cf — usr.sbin/ppp ipcp.c

ppp: bound IPCP IP-Address replies to the reply buffers

`ipcp_ValidateReq()` appended `IP-Address ack/nak/reject` records to the fixed `fsm_decode` buffers without a bound check. A `Config-Request` with ~17 or more `IP-Address` options overran a buffer into its own end pointer, so later writes could go wherever the peer chose.

Emit the option through `fsm_ack()/fsm_nak()/fsm_rej()` like the other options.

Reviewed by:    markj
Approved by:    adrian (mentor)
Signed-off-by:  Nick Price <nprice at FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D61326
DeltaFile
+13-17usr.sbin/ppp/ipcp.c
+13-171 files

HardenedBSD/ports 673c907 — graphics/p5-Image-ExifTool-devel Makefile pkg-plist

graphics/p5-Image-ExifTool-devel: Update 13.61 => 13.62

Changelog:
https://exiftool.org/history.html#v13.62

PR:             300667
Sponsored by:   UNIS Labs (vvd, commit patch)
DeltaFile
+3-3graphics/p5-Image-ExifTool-devel/distinfo
+1-1graphics/p5-Image-ExifTool-devel/Makefile
+2-0graphics/p5-Image-ExifTool-devel/pkg-plist
+6-43 files

HardenedBSD/src 2d5a6bc — sys/dev/mlx5/mlx5_core fs_core.h mlx5_fs_core.c

mlx5: add per-flow-group hash table for FTE lookup

lookup_fte_locked() scanned every FTE in a flow group with xa_next()
and memcmp() on each one.  A new RX TLS session always misses, so the
whole group was walked under the group lock for every insertion.  With
tens of thousands of RX-offloaded sessions in the same IPv6 TCP group
this costs milliseconds per call and grows linearly with the number of
FTEs.

Keep a hash table of the FTEs in each flow group, keyed by a jhash of
the match value.  The table is sized from the group size, capped at
16K buckets.  It is updated in insert_fte() and del_sw_fte(), both of
which hold the group write lock, and read in lookup_fte_locked() under
the group read or write lock.  The xarray is kept for index
allocation.  No lockless reads are introduced.

Reported by:    NetApp
Reviewed by:    kib
Sponsored by:   NVidia networking
MFC after:      1 week
DeltaFile
+27-4sys/dev/mlx5/mlx5_core/mlx5_fs_core.c
+7-0sys/dev/mlx5/mlx5_core/fs_core.h
+34-42 files

HardenedBSD/ports 30ba8dc — graphics/nvidia-drm-kmod Makefile.common, x11/nvidia-kmod Makefile

x11/nvidia-kmod*, graphics/nvidia-drm-*-kmod*: Use sys/stdarg.h

machine/stdarg.h is deprecated and will be removed in due course.
This deorbits machine/stdarg.h and use sys/stdarg.h instead.

Not bumping PORTREVISION, as this is a build fix for future
removal of machine/stdarg.h and shouldn't cause changes
in contents of pkgs.

PR:             300622
Co-authored-by: Brooks Davis <brooks at FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D61415
DeltaFile
+17-0x11/nvidia-kmod/Makefile
+3-0graphics/nvidia-drm-kmod/Makefile.common
+20-02 files

HardenedBSD/src 2b2d62b — crypto/krb5 README, crypto/krb5/src/plugins/preauth/pkinit pkinit_crypto_openssl.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+215-215crypto/krb5/src/po/mit-krb5.pot
+182-0crypto/krb5/README
+123-3sys/dev/acpica/acpi_video.c
+77-32crypto/krb5/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+108-0usr.sbin/pwd_mkdb/tests/pwd_mkdb_test.sh
+66-38sys/dev/axgbe/xgbe-sysctl.c
+771-288157 files not shown
+2,380-990163 files

HardenedBSD/ports 71058bc — security/vuxml/vuln 2026.xml, shells/nu_plugin_polars distinfo

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+0-1,970www/github-release-monitor/pkg-plist
+281-267sysutils/mise/distinfo
+183-179shells/nushell/distinfo
+175-169shells/nu_plugin_polars/distinfo
+140-133sysutils/mise/Makefile
+208-0security/vuxml/vuln/2026.xml
+987-2,718120 files not shown
+2,029-4,429126 files

HardenedBSD/src 3821312 — sys/kern kern_module.c

HBSD: Resolve merge conflict

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-7sys/kern/kern_module.c
+0-71 files

HardenedBSD/src 7cb4d4d — share/man/man4 sched_ule.4, sys/kern sched_ule.c

sched_ule.4: sync current scheduler sysctls

Reviewed by:    bcr, jhb, olce
Approved by:    jhb, olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60002
DeltaFile
+37-6share/man/man4/sched_ule.4
+1-0sys/kern/sched_ule.c
+38-62 files

HardenedBSD/src be25f6d — share/man/man4 sched_4bsd.4, sys/kern sched_4bsd.c

sched_4bsd.4: sync current scheduler sysctls

Reviewed by:    bcr, jhb, olce
Approved by:    jhb, olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60002
DeltaFile
+21-16share/man/man4/sched_4bsd.4
+1-0sys/kern/sched_4bsd.c
+22-162 files

HardenedBSD/src fb797f8 — share/man/man4 Makefile smp.4

scheduler.4: document common scheduler sysctls

Reviewed by:    bcr, jhb, olce
Approved by:    jhb, olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60002
DeltaFile
+61-0share/man/man4/scheduler.4
+5-2share/man/man4/sched_ule.4
+5-2share/man/man4/sched_4bsd.4
+2-1share/man/man4/smp.4
+2-1share/man/man4/dtrace_sched.4
+1-0share/man/man4/Makefile
+76-66 files

HardenedBSD/ports 2229f30 — security/vuxml/vuln 2026.xml

security/vuxml: Document MIT krb5 Security Advisory 2026-001
DeltaFile
+68-0security/vuxml/vuln/2026.xml
+68-01 files

HardenedBSD/src 307e725 — contrib/netbsd-tests/kernel t_mqueue.c, tests/freebsd_test_suite macros.h

Revert "Remove {ATF,PLAIN}_REQUIRE_KERNEL_MODULE macros"

The change breaks the build of tests/sys/net/routing/test_rtsock_l3.c.

This reverts commit e34b159d4c64575aa45763968b6ad01dfd7c2337.
DeltaFile
+13-13tests/freebsd_test_suite/macros.h
+3-15tests/sys/net/routing/rtsock_config.h
+4-0contrib/netbsd-tests/kernel/t_mqueue.c
+0-1tests/sys/kern/Makefile
+20-294 files

HardenedBSD/ports 4691be5 — www/piwigo pkg-plist Makefile

www/piwigo: Update to 16.5.0.
DeltaFile
+3-3www/piwigo/distinfo
+2-2www/piwigo/Makefile
+1-0www/piwigo/pkg-plist
+6-53 files

HardenedBSD/src e34b159 — contrib/netbsd-tests/kernel t_mqueue.c, tests/freebsd_test_suite macros.h

Remove {ATF,PLAIN}_REQUIRE_KERNEL_MODULE macros

These macros predated the `require.kmod` (ATF) and `required_kmods`
(kyua) test metadata and are no longer needed.

Add a hint to freebsd_test_suite/macros.h about the `*FEATURE*` macros
going away soon. See [this kyua issue][kyua-issue] for more details.

MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D61082

[kyua-issue]: https://github.com/freebsd/kyua/issues/346
DeltaFile
+13-13tests/freebsd_test_suite/macros.h
+15-3tests/sys/net/routing/rtsock_config.h
+0-4contrib/netbsd-tests/kernel/t_mqueue.c
+1-0tests/sys/kern/Makefile
+29-204 files

HardenedBSD/src 3d6f886 — sbin/nvmecontrol format.c nvmecontrol.8

nvmecontrol: Range-check the format command's field values

The format command accepted any 32-bit value for -m, -p, -l and
--ses and passed it into the Format NVM command.  Before
eae727676169 an out-of-range value spilled into the adjacent cdw10
fields, which usually drew an error from the controller; after it,
the value is masked to the field width, so a mistyped value is
silently accepted with a different meaning.  Most seriously,
--ses 8 masked to SES=0 and performed a plain format with no erase
at all, exiting 0.  A value like --ses 10 masked to a cryptographic
erase while bypassing the FNA cryptographic erase capability check,
which compares the unmasked value.

Reject values outside the ranges nvmecontrol.8 documents, which are
the values the spec defines: 0-1 for -m and -l, 0-3 for -p, and
0-2 for --ses.  The checks run at option validation time, before
the device is opened, and the capability check now only ever sees
valid values.


    [10 lines not shown]
DeltaFile
+19-1sbin/nvmecontrol/nvmecontrol.8
+10-0sbin/nvmecontrol/format.c
+29-12 files

HardenedBSD/ports 3999e25 — graphics/pdfium distinfo Makefile, graphics/pdfium/files patch-build-config-BUILDCONFIG.gn patch-base_allocator_partition__allocator_src_partition__alloc_partition__alloc__forward.h

graphics/pdfium: update 8066 → 8152

PR:             300011
Approved by:    matias at pizarro.net (maintainer's timeout; 17 days)
DeltaFile
+58-51graphics/pdfium/Makefile
+53-49graphics/pdfium/distinfo
+23-0graphics/pdfium/files/patch-partition_alloc_platform_thread_ref.h
+10-8graphics/pdfium/files/patch-build-config-linux-pkg-config.py
+10-7graphics/pdfium/files/patch-base_allocator_partition__allocator_src_partition__alloc_partition__alloc__forward.h
+5-5graphics/pdfium/files/patch-build-config-BUILDCONFIG.gn
+159-1205 files not shown
+173-13411 files

HardenedBSD/ports 701138d — graphics/py-pypdfium2 distinfo Makefile, graphics/py-pypdfium2/files patch-setupsrc_base.py patch-pyproject.toml

graphics/py-pypdfium2: update 5.13.0 → 5.15.2
DeltaFile
+6-5graphics/py-pypdfium2/Makefile
+0-10graphics/py-pypdfium2/files/patch-pyproject.toml
+4-5graphics/py-pypdfium2/files/patch-setupsrc_base.py
+3-3graphics/py-pypdfium2/distinfo
+13-234 files

HardenedBSD/ports e87c287 — math/gecode Makefile

math/gecode: enable the GIST option by default

It is needed by dependencies.
DeltaFile
+2-1math/gecode/Makefile
+2-11 files

HardenedBSD/ports bc720d5 — math/minizinc/files patch-cmake_support_compiler__setup.cmake

math/minizinc: fix build due to the C++14 requirement

Add the patch enabling C++14.
The upstream is notified.
DeltaFile
+11-0math/minizinc/files/patch-cmake_support_compiler__setup.cmake
+11-01 files