security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: FreeBSD private sqlite3 is not vulnerable
Although the FreeBSD base system does ship the vulnerable version of
sqlite3, it is only used internally as a private library. None of the
use cases in the base system is realistically vulnerable.
Approved by: so (gordon)
Discussed with: secteam
Fixes: 2d614195fc56 ("security/vuxml: Add FreeBSD (base) to the
sqlite3 entry")
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Complete the immich entry
The entry listed six of the sixteen advisories that close with 3.4.0.
Add the missing ones, among them a symlink-following library import, path
traversal through unsanitized EXIF fields and a bypass of the plugin host
check, as well as the code execution through an uploaded SVG file that
versions before 3.2.4 allow.
Sponsored by: Netzkommune GmbH
www/immich 3.4.0
High performance self-hosted photo and video management solution
www/immich: Security update to 3.4.0
An attacker-chosen OAuth state cookie allowed forced account linking and
takeover of any account. Further fixes cover a partner reading locked
folder metadata, read-scoped API keys resetting cluster group people
data, an unbounded motion photo offset exhausting memory and disk, and a
share link revealing whether the owner has a given file.
Adds JPEG XL support, two new match types for the EXIF metadata filter
and a trigger that runs a workflow once OCR processing has finished.
Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0
Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
www/immich-cli: Security update to 3.4.0
A malicious or intercepted server could read, exfiltrate and delete
arbitrary local files through the duplicate check.
Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0
Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
net-mgmt/semaphore: Update to 2.20.23
Keeps the chosen language per user, fixes deleting a user and no longer
submits the CLI argument dialog on Enter.
The vendored modernc.org/sqlite now carries current FreeBSD bindings for
every architecture, so the restriction to aarch64 and amd64 can go.
Changelog:
https://github.com/semaphoreui/semaphore/releases/tag/v2.20.23
Sponsored by: Netzkommune GmbH
security/doas 6.4_1
Simple sudo alternative to run commands as another user
security/doas: Do not install sample as doas.conf
The doas.conf.sample was not installed as sample intentionally.
PR: 300634
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 86deb2ebd4f97e44078e6145bf4e169940a06e5c)
security/doas 6.4_1
Simple sudo alternative to run commands as another user
security/doas: Do not install sample as doas.conf
The doas.conf.sample was not installed as sample intentionally.
PR: 300634
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
security/py-keepkey 7.2.1_3
Library for communicating with KeepKey Hardware Wallet
security/py-keepkey: Fix Python 3 and protobuf compatibility
Regenerate protobuf modules at build time to fix import failures with
current protobuf. Use the device-protocol revision matching upstream
7.2.1, which includes the required Tendermint definitions.
Fix Python 2 remnants in keepkeyctl and protobuf_json, and support
the protobuf descriptor API changes. Remove the unused exchange
module, which depends on the obsolete protobuf3 library.
Switch to PEP 517, correct the package version metadata, add the
python category, and expand the port description. Bump PORTREVISION.
PR: 300278
security/py-social-auth-core: Update to 5.2.0
* Adjust testsuite accordingly so that the results are successful
depending on the configuration.
* Note: This is an interim update to create a py-social-auth-core5 port
based on this, which is limited to the 5.x release series and adjust
CONFLICTS_INSTALL for future variants of py-social-auth-core.
Changelog since 5.0.1:
https://github.com/python-social-auth/social-core/blob/5.2.0/CHANGELOG.md
Approved by: ultima (maintainer, implicit)
MFH: 2026Q4
(cherry picked from commit f2ac829b1de5ba6aad4f98b553859f9ced4a1d73)
www/py-dj60-strawberry-graphql-django: Update to 0.91.0
* Note: There are already a few recent releases, but they require
py-dj60-strawberry-graphql version 0.328.0+, which in turn requires
py-graphql-core version 3.3.0 or later - which is not yet in the ports
tree.
Changelog since 0.88.0:
https://github.com/strawberry-graphql/strawberry-django/blob/0.91.0/CHANGELOG.md
www/py-strawberry-graphql-django: Update to 0.91.0
* Note: There are already a few recent releases, but they require
py-strawberry-graphql version 0.328.0+, which in turn requires
py-graphql-core version 3.3.0 or later - which is not yet in the
ports tree.
Changelog since 0.88.0:
https://github.com/strawberry-graphql/strawberry-django/blob/0.91.0/CHANGELOG.md
devel/py-dj61-strawberry-graphql: Fix with Python 3.13 and the deps
Apply the same changes as to py-dj60-strawberry-graphql in 1287f912f000.
* The asgi and fastapi extras need python-multipart (starlette's
request.form()), but the ASGI and FASTAPI options pulled in
devel/py-multipart, an unrelated package with the same import name.
Depend on www/py-python-multipart instead.
* Upstream's cli extra also requires python-multipart, starlette,
uvicorn and websockets: the "strawberry dev" command runs a Starlette
app with WebSocket routes under uvicorn. Add them to
CLI_RUN_DEPENDS.
* strawberry/ext/dataclasses/dataclasses.py is a vendored helper for
Python < 3.10 that nothing imports (strawberry requires 3.10+ and
uses dataclass(kw_only=True)). On Python 3.13 it cannot be
imported, because dataclasses._create_fn was removed. Remove it.
* The CLI option is off by default, but bin/strawberry is installed
anyway and only raises MissingOptionalDependenciesError. Do not
install it (and drop it from the autoplist list) when CLI is off.
While here, fix portlint warnings and bump PORTREVISION due changed
dependencies.
devel/py-dj60-strawberry-graphql: Update to 0.327.7
* Note: There are already quite a few newer releases, but starting with
version 0.328.0, py-graphql-core 3.3.0+ is required, which is not yet
in the ports tree.
Changelog since 0.327.3:
https://github.com/strawberry-graphql/strawberry/blob/0.327.7/CHANGELOG.md
devel/py-strawberry-graphql: Update to 0.327.7
* Note: There are already quite a few newer releases, but starting with
version 0.328.0, py-graphql-core 3.3.0+ is required, which is not yet
in the ports tree.
Changelog since 0.327.3:
https://github.com/strawberry-graphql/strawberry/blob/0.327.7/CHANGELOG.md
security/openpgp-card-ssh-agent: Update 0.3.7 => 0.3.8
- Pulls in openpgp-card-state 0.4.2, which adds the "Ephemeral" PIN
storage backend for non-Linux systems. On FreeBSD it caches the User
PIN in memory via git credential-cache, with a configurable expiry.
- Updated ssh-agent-lib and openpgp-card, moved to the 2024 edition.
Upstream has not tagged v0.3.8 yet, so FJ_TAGNAME points at the
"chore: release 0.3.8" commit, which matches the crates.io release.
Changes:
https://codeberg.org/openpgp-card/ssh-agent/compare/v0.3.7...e92466566a40
PR: 300665
security/openpgp-card-tools-git: Update 0.1.8 => 0.1.9
- Pulls in openpgp-card-state 0.4.2, which adds the "Ephemeral" PIN
storage backend for non-Linux systems. On FreeBSD it caches the User
PIN in memory via git credential-cache, with a configurable expiry.
- Upstream moved to the 2024 edition and bumped dependencies.
Changes:
https://codeberg.org/openpgp-card/oct-git/compare/v0.1.8...v0.1.9
PR: 300664
math/R-cran-corpcor: New port: Efficient estimation of covariance and partial
correlation
Implements a James-Stein-type shrinkage estimator for the covariance
matrix, with separate shrinkage for variances and correlations. The
approach is both computationally as well as statistically very efficient,
it is applicable to "small n, large p" data, and always returns a positive
definite and well-conditioned covariance matrix. In addition to inferring
the covariance matrix the package also provides shrinkage estimators for
partial correlations and partial variances. The inverse of the covariance
and correlation matrix can be efficiently computed, as well as any
arbitrary power of the shrinkage correlation matrix. Furthermore,
functions are available for fast singular value decomposition, for
computing the pseudoinverse, and for checking the rank and positive
definiteness of a matrix.
PR: 296812
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D61259
