graphics/openshadinglanguage: Update to 1.15.7.0
The Imageworks BSDF library is now part of OSL as a header-only library.
LLVM 14 is the new minimum, up to LLVM 23 is supported. The OSLQuery
Python bindings no longer pull in the OpenImageIO Python types, so they
work next to an OpenImageIO built with nanobind.
Changelog:
https://github.com/AcademySoftwareFoundation/OpenShadingLanguage/releases/tag/v1.15.7.0
PR: 299659
Sponsored by: Netzkommune GmbH
graphics/openimageio: Update to 3.2.1.1
Writing Ultra HDR images in JPEG, perceptual image comparison through
flip_diff and oiiotool --flipdiff, standardized Color Interop Forum
names and CICP codes in the files that allow them, and better thumbnail
support. The readers were hardened against corrupted image files in
dozens of places. The Python bindings now use nanobind.
Changelog:
https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.2.1.1
PR: 299658
Sponsored by: Netzkommune GmbH
graphics/opencolorio: Update to 2.6.0
This is the base version for the CY2027 VFX Reference Platform. It adds
read and write support for SMPTE ST2136-1 CLF, aliases for displays and
views, new built-in ACES configs and the ociomergeconfigs tool. The
alpha channel now defaults to 1 instead of 0.
Changelog:
https://github.com/AcademySoftwareFoundation/OpenColorIO/releases/tag/v2.6.0
PR: 299657
Sponsored by: Netzkommune GmbH
dns/hesiod 3.2.1_6
Directory service built on DNS and BIND
dns/hesiod: Mark DEPRECATED
This version has multiple vulnerabilities (CVE-2016-10151, CVE-2016-10152)
PR: 300135
Approved by: Chris Hutchinson <portmaster@BSDforge.com> (former maintainer)
Approved by: osa, fluffy (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 9367f6ba7be9aa5f85602512b47ada8277802ae7)
dns/hesiod 3.2.1_6
Directory service built on DNS and BIND
dns/hesiod: Mark DEPRECATED
This version has multiple vulnerabilities (CVE-2016-10151, CVE-2016-10152)
PR: 300135
Approved by: Chris Hutchinson <portmaster@BSDforge.com> (former maintainer)
Approved by: osa, fluffy (mentors, implicit)
MFH: 2026Q4
graphics/aseprite 1.3.18.6
Animated sprite editor and pixel art tool
graphics/aseprite: update 1.3.18.5 → 1.3.18.6
ChangeLog: https://github.com/aseprite/aseprite/releases/tag/v1.3.18.6
Improvements from bug#298426 ware integrated.
PR: 298426 (fix dependencies and improve port - was integrated)
Submitted by: Daniel Engberg <diizzy@FreeBSD.org> (bug#298426)
devel/java-subversion: fix JAR install path, typo, NLS init duplication,
RUN_DEPENDS
Install svn-javahl.jar under JAVAJARDIR (the ports tree's own
convention for JARs) instead of a non-standard lib/svn-javahl/
subdirectory. Fix a --without-siwg-python typo in CONFIGURE_ARGS.
Switch USES=java to java:build: this port installs a native library
and a JAR, it doesn't invoke java itself, so it has no business
pulling a JDK into RUN_DEPENDS -- the caller that actually loads the
library and the JAR decides which JVM to run, not this port.
Add files/patch-native_JNIUtil.cpp: JNIGlobalInit()'s non-Windows NLS
setup hand-rolled a bindtextdomain() call that duplicates
svn_nls_init() (the same helper every svn_cmdline_init()-based CLI
tool uses); call the real function instead, which also picks up
bind_textdomain_codeset() that the duplicated code was missing.
Bump PORTREVISION_LATEST/PORTREVISION_LTS and add an UPDATING entry
for the JAR path change.
graphics/blender4 4.5.14
3D modeling/rendering/animation package -v4.x
graphics/blender4: Update to 4.5.14
Bugfix releases of the 4.5 LTS series. They fix crashes in the Video
Sequencer and in Armature Edit mode and the Extensions tab not loading
because of an SSL problem.
Changelog: https://www.blender.org/download/lts/4-5/
PR: 298728
Sponsored by: Netzkommune GmbH
(cherry picked from commit 76eb4a792b709d94cf39c9fb033d877cd154b21d)
graphics/blender4 4.5.5_7
3D modeling/rendering/animation package -v4.x
graphics/blender4: Unbreak with non-3.11 Python and FFmpeg 9
Blender's CMake defaults to Python 3.11 and fails when that exact
version is missing. Pass the version of the default Python instead,
look up the NumPy 2 headers under numpy/_core/include and backport
FFmpeg 9 support for audaspace from upstream (e3c92c22817d).
PR: 299533
Approved by: Shane <FreeBSD@ShaneWare.Biz> (maintainer)
Sponsored by: Netzkommune GmbH
(cherry picked from commit 0146d7f56262e9f8c7483230b79bee6a3fa9a466)
graphics/blender 5.2.2,1
3D modeling/rendering/animation package
graphics/blender: Update to 5.2.2
Blender 5.2 is the new LTS release, supported until July 2028. It adds
experimental Geometry Nodes based cloth and hair dynamics and a texture
cache in Cycles that lowers memory use on scenes with many image
textures. Since 5.1 Blender no longer loads the Python user site
directory by default.
Blender 5.2 requires Python 3.13. Until that is the default version,
build it with DEFAULT_VERSIONS+=python=3.13.
Changelog: https://developer.blender.org/docs/release_notes/5.2/
PR: 294160
Sponsored by: Netzkommune GmbH
graphics/blender4 4.5.14
3D modeling/rendering/animation package -v4.x
graphics/blender4: Update to 4.5.14
Bugfix releases of the 4.5 LTS series. They fix crashes in the Video
Sequencer and in Armature Edit mode and the Extensions tab not loading
because of an SSL problem.
Changelog: https://www.blender.org/download/lts/4-5/
PR: 298728
Sponsored by: Netzkommune GmbH
graphics/blender4 4.5.5_7
3D modeling/rendering/animation package -v4.x
graphics/blender4: Unbreak with non-3.11 Python and FFmpeg 9
Blender's CMake defaults to Python 3.11 and fails when that exact
version is missing. Pass the version of the default Python instead,
look up the NumPy 2 headers under numpy/_core/include and backport
FFmpeg 9 support for audaspace from upstream (e3c92c22817d).
PR: 299533
Approved by: Shane <FreeBSD@ShaneWare.Biz> (maintainer)
Sponsored by: Netzkommune GmbH
www/mod_subversion 1.14.5_2
Apache HTTP Server modules for Apache Subversion
devel/*-subversion, www/mod_subversion: strip .so and drop .a from stage
libtool's install does not strip shared objects, and none of these
glue/binding libraries ship a static .a anyone would plausibly link
against. Strip the installed .so files in post-install and remove the
.a from the staging tree.
Bump PORTREVISION_LATEST/PORTREVISION_LTS for each touched port.
databases/sqlite3: security update to 3.54.1
Fixes ten vulnerabilities published on 2026-10-30, among them heap
buffer overflows in FTS5, in the session extension and in the R-Tree
module. All of them need an attacker supplied database file or SQL
text.
Changes: https://sqlite.org/changes.html
Security: 84cd82e1-d49f-11f1-bae2-3497f65b111b
With hat: ports-secteam
Sponsored by: Netzkommune GmbH
(cherry picked from commit 57d3d55a29d9c7d43c87ff0d763942cbb10369a4)
databases/sqlite3: security update to 3.54.1
Fixes ten vulnerabilities published on 2026-10-30, among them heap
buffer overflows in FTS5, in the session extension and in the R-Tree
module. All of them need an attacker supplied database file or SQL
text.
Changes: https://sqlite.org/changes.html
Security: 84cd82e1-d49f-11f1-bae2-3497f65b111b
With hat: ports-secteam
Sponsored by: Netzkommune GmbH
x11/zutty 0.18
High-end terminal for low-end systems
x11/zutty: Update 0.17 => 0.18
Changes:
- Apply origin mode to VPA (Line Position Absolute)
- Time out selection transfers whose peer does not respond
- Do not exit on selection events carrying an invalid atom
- Fix font search ignoring directory boundaries
- Do not count scrolling within margins as history
- Clamp cursor position to the scrolling region in origin mode
- Fix crash on OSC 52 selection query falling back to another target
- Prevent pasted content from terminating bracketed paste
- Accept CSI ? and CSI > sequences split across reads
- Preserve RGB foreground across separate SGR bold settings
- Fix crossed-out attribute lost on partial screen updates
PR: 300308
Approved by: osa, vvd (Mentors, implicit)
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Document sqlite3 vulnerabilities fixed in 3.54.0
Ten issues were published on 2026-10-30, with VulnCheck as the
assigning CNA. Four of them corrupt the heap, in FTS5, in the session
extension and in the R-Tree module, and all of them need an attacker
supplied database file or SQL text.
Sponsored by: Netzkommune GmbH
graphics/R-cran-patchwork: New port: The Composer of Plots
patchwork expands the ggplot2 API to allow arbitrarily complex
composition of plots by providing mathematical operators for combining
multiple plots.
PR: 296816
Reviewed by: jrm
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D60942
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Document phpMyAdmin vulnerabilities
Seven issues in phpMyAdmin up to and including 5.2.3 were published on
2026-10-30, with VulnCheck as the assigning CNA. The worst of them is
an authentication bypass in the WebAuthn second factor, and the
request forgery in setup/validate.php needs no authentication at all.
There is no fixed release and no announcement from the project, so the
entry carries an open range for both ports.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
needed on FreeBSD 16.
Security: 24aa87c0-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
(cherry picked from commit eb9d9e871f06cdee326fb4e5b4c5e32fda10d6d5)
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-4.html
Security: 24aa87c0-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
(cherry picked from commit b0ca7090f60efd8457b1e341047f630c5060ffe4)
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
(cherry picked from commit 9ed8b30188ce739e2fcae47fc2e516ead668a97c)
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Document MySQL vulnerabilities of October 2026
Four entries: 8.4 and 9.7, fixed in 8.4.13 and 9.7.4; 26.7, which is
end of life and has no fix, with an open range; and the connectors,
fixed in 26.10.0. mysql-shell is listed with 9.7, it bundles and
statically links the MySQL client code.
The two issues in the bundled curl and OpenSSL copies are left out,
these ports build against the libraries of the system.
Sponsored by: Netzkommune GmbH
databases/mysql-shell: Update the bundled MySQL sources to 9.7.4
The port builds its own copy of the MySQL source tree for the static
client libraries and carried the vulnerabilities of 9.7.1. There is no
source tarball of the shell itself after 9.7.1, the next one is
26.10.0, so only the bundled sources move, by way of a separate
MYSQL_DISTVERSION.
Take the server tarball from the MYSQL mirror, the archive holds only
releases that are no longer current.
Build the inner tree with WITH_FIDO=none and
WITH_AUTHENTICATION_WEBAUTHN=OFF: the bundled libfido2 1.15.0 does not
compile here, and with the system one the shell looks for a bundled
copy next to the plug-ins. The package contents are unchanged.
Drop the tag_plain.h hunk of mysql-server.patch, upstream as of 9.7.4,
and add the cstdlib include for backup_page_tracker.cc. Include
pthread.h in uuid_gen.cc, upstream does so for Apple only. Both are
needed on FreeBSD 16.
Security: 24aa87c0-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
databases/mysql97-{client,server}: Update to 9.7.4
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 73 of the 98 MySQL issues apply to the
9.7 series and to the MySQL Router built from this port.
9.7.3 was published without a source tarball, hence the two-step
jump.
Rebase patch-libmysql_CMakeLists.txt: upstream moved
mysql_native_authentication_client.cc into a subdirectory, dropped
ADD_SUBDIRECTORY(fido_client) and now builds the client-side
authentication plug-ins in the server tree as well. They are skipped
when WITHOUT_CLIENTLIBS is set.
Declare libfido2 and install the server-side WebAuthn plug-in, which
was built so far only when cmake happened to find libfido2 in the
build jail.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-4.html
Security: 24aa87c0-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
databases/mysql84-{client,server}: Update to 8.4.13
This release contains the security fixes of the Oracle Critical
Patch Update of October 2026. 65 of the 98 MySQL issues apply to the
8.4 series and to the MySQL Router built from this port.
8.4.12 was published without a source tarball, hence the two-step
jump.
Changes:
https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html
Security: 24aa62d3-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
MFH: 2026Q4
databases/mysql267-{server|client}: Deprecate and set an expiration date
MySQL 26.7 reached its end of life on 2026-10-20 with the release of
26.10. An Innovation release is maintained only until the next one
appears, so there will be no further 26.7 release.
79 of the 80 MySQL server issues of the Oracle Critical Patch Update
of October 2026 apply to 26.7, five of them only to 26.7, plus five in
the MySQL Router built from this port. None of them will be fixed.
Switch to databases/mysql2610-server. The expiration date is a week
out and not the usual months: the port entered the tree on 2026-10-12
and ships unfixed vulnerabilities.
Security: 24aaad94-d452-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
databases/mysql2610-{server|client}: Add New Port
Welcome MySQL 26.10
MySQL 26.10 is the Innovation release following 26.7, which reached its
end of life with this release.
What is new in MySQL 26.10:
https://dev.mysql.com/doc/relnotes/mysql/26.10/en/news-26-10-0.html
Compared to mysql267:
- Drop seven LibreSSL guards, LibreSSL 4.4.0 has everything they
worked around
- Keep two: SSL_COMP_get_compression_methods() returns void * and
there is no SSL_COMP_get_id() or SSL_COMP_get0_name()
- Add traits to ut0prefix_cache.h and log0parsed_index_lru_cache.h,
libc++ has no character traits for a byte type
- Do not install the client-side authentication plug-ins
- Declare libfido2 and install the WebAuthn plug-in
An Innovation release is not maintained once the next one appears and
is not meant for production use; see pkg-message.
MySQL8.4+ supports only 64-bit platforms!
Sponsored by: Netzkommune GmbH
devel/subversion 1.14.5_2
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_2
Apache Subversion is a full-featured version control system (LTS)
devel/subversion{,-lts}: make apr_memcache opt-out explicit
configure otherwise silently autodetects a standalone apr_memcache installation
on the build host for fs_fs caching (server-side only FSFS repository caching);
this was never actually supported. Pass --without-apr_memcache explicitly
instead of leaving it to autodetection.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
www/mod_dav_svn: rename to www/mod_subversion
The port has always built and installed three Apache modules (mod_dav_svn,
mod_authz_svn, mod_dontdothat), not just DAV support, so a name promising
only one of the three was misleading. Add PKGNAMEPREFIX=${APACHE_PKGNAMEPREFIX},
matching other modules.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
finance/odoo 19.0.20261023
Suite of web based open source business apps
finance/odoo: Update to 20261023
- devel/py-setuptools and devel/py-wheel are added to BUILD_DEPENDS
- SHEBANG_LANG=python is dropped; USES=shebangfix already handles python
- odoo.conf.sample is installed with INSTALL_DATA instead of
INSTALL_SCRIPT, and is generated through SUB_FILES, so its commented
addons_path names the right site-packages (it said python3.11)
- odoo.conf.sample sets http_interface = 0.0.0.0, the 19.0 default, with
a note that 127.0.0.1 fits behind a local proxy and becomes the
default in Odoo 20.0; 19.0 warned at start that the option was
missing. Existing etc/odoo/odoo.conf files are not changed
- the rc script passes --without-demo=True instead of
--without-demo=all, which 19.0 no longer accepts as a boolean (it
logged "invalid boolean value: 'all', assume True"); the meaning, no
demo data, is the same
- portclippy and portfmt warnings are fixed
PR: 300224
Reported by: Patrick Crandol <patrick ___at__ crandol.com>
finance/py-ofxparse: Drop the unused py-nose dependency
- the port switches to USE_PYTHON=pep517 (the package metadata becomes
dist-info)
- concurrent is added to USE_PYTHON
- portlint warnings are fixed
PR: 300225
Reported by: Patrick Crandol <patrick _at__ crandol.com>
