databases/postgresql19-server: Update to 19RC1
The PostgreSQL Global Development Group announces that the first release
candidate of PostgreSQL 19 is now available for download. As a release
candidate, PostgreSQL 19 RC 1 will be mostly identical to the initial
release of PostgreSQL 19, though some more fixes may be applied prior to
the general availability of PostgreSQL 19.
To upgrade to PostgreSQL 19 RC 1 from earlier versions of PostgreSQL,
you will need to use a major version upgrade strategy, e.g. pg_upgrade
or pg_dump / pg_restore. For more information, please visit the
documentation section on upgrading:
https://www.postgresql.org/about/news/postgresql-19-rc-1-released-3409/
www/bunkerweb 1.6.16
Self-hosted web application firewall and security platform
www/bunkerweb: Update to 1.6.16
The web UI now compresses its responses, which adds py-brotli and
py-flask-compress to the run dependencies.
Replace the LUA_VER substitutions makeplist left in pkg-plist: they
stand for parts of bundled version numbers, not for the Lua version.
Changes: https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.16
Sponsored by: Netzkommune GmbH
www/nginx-module-cache-purge: Update to 3.0.4
Fixes a symlink traversal during cache tree traversal: an attacker able to
create symbolic links inside the cache directory could make a purge delete
arbitrary files the worker can reach (CVE-2026-108981).
https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4
Security: CVE-2026-108981
Sponsored by: Netzkommune GmbH
(cherry picked from commit 225227080d2216b2f5ea3d331ad203ed41937520)
www/{nginx,nginx-devel,freenginx}: Bump PORTREVISION for the module updates
The cache_purge, njs and lua modules are built into these ports, and a
BUILD_DEPENDS does not rebuild them by itself.
Sponsored by: Netzkommune GmbH
www/nginx-module-lua: Update to 0.10.31
Two stable releases at once, 0.10.29 is from 2025.
All three local patches are gone: 0.10.31 guards the freenginx cases
upstream, in the client hello handler, in the subrequest start time and in
ngx_http_lua_time.
Sponsored by: Netzkommune GmbH
www/nginx-module-njs 1.0.2
Sources of the njs (JavaScript) module for the NGINX ports
www/nginx-module-njs: Update to 1.0.2
Fixes memory corruption in RegExp operations, crashes after a failed
module compilation, and excessive resource usage when sorting huge sparse
arrays.
Both local patches are gone: njs 1.0.2 carries the indexed fast path fix
for exotic objects itself.
Sponsored by: Netzkommune GmbH
www/nginx-module-cache-purge: Update to 3.0.4
Fixes a symlink traversal during cache tree traversal: an attacker able to
create symbolic links inside the cache directory could make a purge delete
arbitrary files the worker can reach (CVE-2026-108981).
https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4
Security: CVE-2026-108981
Sponsored by: Netzkommune GmbH
chinese/gcin 2.9.4
Traditional Chinese input utility in X
chinese/gcin: fix build on powerpc64*
Build with -fsigned-char: the phrase tables flag mixed-case English
words with a negative length stored in plain char. Also fix the hash
index of 1-byte keys in tsa2d32 on big-endian.
security/kuku 4.0.0
Cuckoo hashing library written in C++
security/kuku: fix build on powerpc64
Upstream rejects big-endian targets because item words and the BLAKE2xb-seeded
tabulation table were read in native byte order, so a big-endian build would
compute a different table layout than little-endian peers. Define both in
little-endian byte order instead (a no-op on little-endian targets) and drop
the guards.
ftp/py-curl-cffi: fix build on powerpc64le
platform.uname().machine is "powerpc" on every FreeBSD PowerPC flavour, so the
"powerpc64" entry introduced by the 0.16.3 update never matched and the build
died with "Unsupported arch".
misc/outside 0.5.0_12
Multi-purpose weather client for your terminal
misc/outside: fix build on powerpc64
The savefile crate refuses to build on big-endian targets with its
bit-vec feature, and its raw-memory fast paths write native byte order
there while the data is read back as little-endian, corrupting the
cache on round-trip. Serialize the BitVec storage words as little-endian
and disable the fast paths on big-endian.
net/tcplog_dumper: fix build on powerpc64
struct tcp_log_bbr lost its ininput member in FreeBSD 14.0 (a370832bec5f);
it was only referenced by the big-endian conversion code.
www/qt6-webengine: add powerpc64le support
The architecture layer is derived from Chimera Linux's qt6-qtwebengine
ppc64le patchset, reduced to the files FreeBSD actually compiles and
adapted to FreeBSD:
- gn: map uname -m "powerpc" to ppc64 in host arch detection
- cmake/QtToolchainHelpers: map power64 to the ppc64 GN arch
- build/config/compiler: don't force a Linux target triple on BSD
- PartitionAlloc: ppc64 GN wiring, dynamic-page-size ASLR variant on BSD
(as for arm64), pin kAlignment to 16 (alignof(max_align_t) is 8 while
long double is 64-bit)
- v8: POWER8 baseline with AltiVec/VSX; make
Assembler::kMaximalBufferSize public, as the 6.11.2 baseline compiler
needs it
- base: define kThreadPriorityToNiceValueMapForTest on BSD; on ppc64 the
TOC reference survives --gc-sections
- blink/webaudio: fix the stale scalar ProcessARateVector fallback
signature in delay.cc
- devtools: don't create a zero-sized @rollup/plugin-terser worker pool
when os.cpus() is empty (libuv lacks hw.clockrate on powerpc)
- boringssl, dav1d (HAVE_ELF_AUX_INFO), dawn, highway, libaom, libvpx,
pffft, webrtc, ui/gl, abseil cycleclock, MUSTTAIL: ppc64 support
No functional change for the other architectures.
Approved by: kde (maintainer timeout)
Differential Revision: https://reviews.freebsd.org/D59520
devel/jetbrains-rustrover: fix pty4j and sqlite paths on powerpc64le
The IDE looks up libsqliteij.so under linux-x86_64 on anything that is
not arm64, and pty4j uses JNA arch name ppc64le.
devel/jetbrains-clion: enable on powerpc64le
JetBrains provides no build of its clangd fork for powerpc64le, and the
IDE refuses a stock clangd, so the bundled clang tools are not installed
there.
biology/hmmer 3.4
Profile hidden Markov models for biological sequence analysis
biology/hmmer: add powerpc64le support
Swap vec_sld operands on little-endian so the Altivec code keeps its
big-endian element order, and drop the configure check that rejects
VMX on little-endian.
www/newsboat 2.45
RSS feed reader for the text console
www/newsboat: Update 2.44 => 2.45
This release includes some security fixes.
While here, build with -DNCURSES_WIDECHAR by default.
Changelog:
https://github.com/newsboat/newsboat/blob/r2.45/CHANGELOG.md
PR: 299303
Approved by: Marko Turk <mt-bugs@markoturk.info> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Security: Remote code execution via manual OPML import (CVE pending)
Security: GHSA-4m8m-vj3m-hfxx: Remote code execution via OPML import
Security: GHSA-pvg7-gjxf-23c9: Podboat could write at arbitrary paths
MFH: 2026Q4
(cherry picked from commit e2442c39a64af21782ca70f1f1f8cc23d84eef27)
www/newsboat 2.45
RSS feed reader for the text console
www/newsboat: Update 2.44 => 2.45
This release includes some security fixes.
While here, build with -DNCURSES_WIDECHAR by default.
Changelog:
https://github.com/newsboat/newsboat/blob/r2.45/CHANGELOG.md
PR: 299303
Approved by: Marko Turk <mt-bugs@markoturk.info> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
Security: Remote code execution via manual OPML import (CVE pending)
Security: GHSA-4m8m-vj3m-hfxx: Remote code execution via OPML import
Security: GHSA-pvg7-gjxf-23c9: Podboat could write at arbitrary paths
MFH: 2026Q4
www/freenginx-devel: third-party modules management
- update njs module to 1.0.2
Bump PORTREVISION.
Sponsored by: tipi.work
<ChangeLog>
nginx modules:
*) Bugfix: fixed response body framing and keepalive connection reuse
in ngx.fetch(). Responses with conflicting Content-Length fields,
with both Transfer-Encoding and Content-Length, or with 1xx status
codes are now rejected.
*) Bugfix: fixed enforcement of max_response_body_size for chunked
responses in ngx.fetch().
*) Bugfix: fixed parsing of js_periodic options following
worker_affinity in HTTP and Stream configurations.
*) Bugfix: fixed memory leaks and false unhandled promise rejection
reports when formatting rejection reasons in the QuickJS engine.
Core:
*) Security: fixed a memory leak when parsing malformed XML in the
njs engine. Repeated malformed input could exhaust worker process
memory.
*) Security: fixed incomplete XML attribute values containing entity
references. JavaScript accessors could return values different
from those used by XML canonicalization, affecting signed XML
validation.
*) Feature: added XMLNode.getAttributeNS() and XMLNode.getChildNS()
methods for namespace-aware attribute and child element lookup.
*) Improvement: reduced compilation memory consumption in the njs
engine and released temporary parser and generator data after
compilation.
*) Improvement: switched to constant-time HMAC signature verification
in WebCrypto.
*) Change: XML node mutation and canonicalization now reject detached
nodes, and a removed child node has an undefined $parent.
Text and attribute values must be primitive strings; null and
undefined retain their deletion semantics for these values.
addChild() and $tags reject source trees with namespaces.
Assigning to $tag$name now throws TypeError in the QuickJS engine;
deletion is still supported.
*) Change: the "test262" make target was renamed to "js_test".
The "test262" target now runs the official Test262 suite and
requires NJS_TEST262_DIR.
*) Bugfix: fixed stale XML node references after tree mutations and
a crash when repeatedly modifying a node in the QuickJS engine.
*) Bugfix: fixed XML node methods being hidden by child elements with
matching names in the QuickJS engine.
*) Bugfix: fixed XML document leaks during property existence checks
in the QuickJS engine.
*) Bugfix: fixed out-of-bounds reads and invalid frees when formatting
unhandled promise rejection reasons in the QuickJS shell.
*) Bugfix: fixed crashes and incorrect error reporting when importing
modules after a failed module compilation in the njs engine.
*) Bugfix: fixed oversized Buffer allocation lengths being truncated
instead of rejected in the QuickJS engine.
*) Bugfix: fixed use of invalidated zlib dictionary memory during
argument conversion in the QuickJS engine.
*) Bugfix: fixed UTC Date setters applying the local timezone offset
in the njs engine.
*) Bugfix: fixed Promise.any() with empty input resolving with
AggregateError instead of rejecting in the njs engine.
*) Bugfix: fixed excessive execution time and memory consumption in
Array.prototype.sort() with huge sparse arrays in the njs engine.
This closes #1095 issue on Github.
*) Bugfix: fixed Array.prototype.concat() with sparse arrays in the
njs engine.
This closes #1095 issue on Github.
*) Bugfix: fixed initialization of array literals with more than
32760 elements in the njs engine.
*) Bugfix: fixed invalid memory accesses when enumerating typed arrays
with Object.values() and Object.entries() in the njs engine.
This closes #1098 issue on Github.
*) Bugfix: fixed invalid memory accesses in Object.defineProperty()
with reentrant property descriptors in the njs engine.
This closes #1089 issue on Github.
*) Bugfix: fixed object-to-primitive conversion when user code
replaced the input value during conversion in the njs engine.
This closes #1094 issue on Github.
*) Bugfix: fixed memory corruption in RegExp replace and split
operations with custom exec() results in the njs engine.
This closes #1090, #1091, #1092, #1093, #1096, and #1097 issues
on Github.
*) Bugfix: fixed out-of-bounds reads in RegExp replacement with
inconsistent match objects in the njs engine.
Thanks to Basavaraj S m.
*) Bugfix: fixed out-of-bounds reads in RegExp named capture lookup
in the njs engine.
This closes #1088 issue on Github.
*) Bugfix: fixed parsing of for loop initializers and preservation of
lexical bindings across nested declarations in the njs engine.
*) Bugfix: prevented stack overflow when compiling deeply nested
expressions in the njs engine by limiting recursive analysis.
<ChangeLog>
science/py-chempy 0.10.1_6
Package useful for solving problems in chemistry
science/py-libpysal 4.15.0_1
Core components of PySAL A library of spatial analysis functions
*/*: fix build broken by PuLP rename
PuLP was renamed to pulp in the port math/py-PuLP and by the upstream.
Reported by: fallout
Approved by: portmgr (unbreak; blanket)
www/nginx: Security update to 1.30.6
Five security fixes: a buffer overflow with "alias" after "rewrite"
(CVE-2026-15176), a buffer overflow while evaluating string expressions
with variables (CVE-2026-93479), an HTTP/3 frame treated as the request
body (CVE-2026-95101), an uninitialized TLS session ticket key
(CVE-2026-97629), and a use-after-free with AIO and SSI "include virtual"
(CVE-2026-97205).
https://nginx.org/en/CHANGES-1.30
Security: CVE-2026-15176
Security: CVE-2026-93479
Security: CVE-2026-95101
Security: CVE-2026-97629
Security: CVE-2026-97205
Sponsored by: Netzkommune GmbH
devel/compiler-rt: remove ancient blocks runtime
The base system now contains a much more up to date blocks runtime
and this port will break when CMake is updated to version 4 so skip
deprecation and delete it.
PR: 297944
www/nginx-devel: Security update to 1.31.7
The same five security fixes as 1.30.6: CVE-2026-15176, CVE-2026-93479,
CVE-2026-95101, CVE-2026-97629 and CVE-2026-97205.
1.31.7 also lets the bundled geoip modules read MaxMind DB databases, which
the new HTTP_GEOIP and STREAM_GEOIP options enable; both are off by default
and pull net/libmaxminddb.
https://nginx.org/en/CHANGES
Security: CVE-2026-15176
Security: CVE-2026-93479
Security: CVE-2026-95101
Security: CVE-2026-97629
Security: CVE-2026-97205
Sponsored by: Netzkommune GmbH
www/nginx: Security update to 1.30.6
Five security fixes: a buffer overflow with "alias" after "rewrite"
(CVE-2026-15176), a buffer overflow while evaluating string expressions
with variables (CVE-2026-93479), an HTTP/3 frame treated as the request
body (CVE-2026-95101), an uninitialized TLS session ticket key
(CVE-2026-97629), and a use-after-free with AIO and SSI "include virtual"
(CVE-2026-97205).
https://nginx.org/en/CHANGES-1.30
Security: CVE-2026-15176
Security: CVE-2026-93479
Security: CVE-2026-95101
Security: CVE-2026-97629
Security: CVE-2026-97205
Sponsored by: Netzkommune GmbH
devel/llvm-devel: new snapshot, aarch64 improvements
Enable COMPILER_RT, FLANG, and OPENMP options. Flang requires a
patch to make not compile quadmath functions requiring C11 functionality
FreeBSD hasn't implemented. It's unclear to me why we're attemping
to compile them on aarch64 and not other targets, but it's easy to
just ifdef out the file and this should match x86.
audio/neuralrack-lv2 0.4.1
NeuralRack is a Neural Model and Impulse Response File loader
audio/neuralrack-lv2: fix packaging on non-amd64
Name the VST3 bundle directory after the compiler target instead of
uname -m, which is the platform (powerpc, arm64) on FreeBSD, and make
pkg-plist follow ARCH.
(cherry picked from commit 6e11c236419afce9175df1daa5b2fb9518f69622)
graphics/photivo 0.0.2015.03.21_15
Free and open source photo processor
graphics/photivo: the port had been slightly improved (+)
- Stretch out CMAKE_MINIMUM_REQUIRED() version range to
accommodate for upcoming CMake 4.x and beyond
- Drop `dos2unix' from USES in favor of PATCH_ARGS+=-l
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: add FreeBSD SAs issued on 2026-10-14
FreeBSD-SA-26:70.tcp affects 15.1R
FreeBSD-SA-26:71.sound affects all supported releases
FreeBSD-SA-26:72.bhyve affects all supported releases
x11/bhotkeys: Update to 1.4
Several improvements and bug fixes.
Update XDM examples and XDM section in bhotkeys-greeter(1) to provide the
typical location of Xsetup/GiveConsole files
Add a Listener checkbox to the panel footer to allow toggling overall
functionality (both to facilitate quick comparison of default window manager
functionality versus bhothkeys as well as quick-disable to prevent distraction
during certain games)
Fix incorrect default sort order. Should be category-then- alphabetic instead
of alphabetic
Add support for remembering scroll position and sort order in greeter mode
Fix an issue that prevented root window click from dismissing the session panel
Make close X present on session panel (as-in greeter panel)
Fix characters leaking to display manager in greeter panel
Always place built-in Panel entries at top of panel list
Changelog: https://github.com/FrauBSD/bhotkeys/blob/1.4/CHANGELOG.md
Reviewed by: jrm
Differential Revision: https://reviews.freebsd.org/D60737
net-mgmt/semaphore: Update to 2.19.16, take maintainership
Bug fixes only since 2.19.7, among them a fix for the SQLite migration.
Runners can now be given a check interval instead of polling the server
every second.
Release notes: https://github.com/semaphoreui/semaphore/releases/tag/v2.19.16
Sponsored by: Netzkommune GmbH
net-mgmt/semaphore: reset maintainer
egypcio@ has not responded to any port issue for over three months. His
last ports commit is from 2026-03-10, and 22 bugs assigned to him are
open, the oldest from 2024-02-25.
Three PRs for this port went without a maintainer reply: 297378, 298453
and 298817.
Sponsored by: Netzkommune GmbH
