net/stund 1.0.1
Minimal STUN (RFC 8489) binding server
net/stund: Update to 1.0.1 and assign maintainership
Port been forked, updated and adoped by a new maintainer.
Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
PR: 299433
cad/openscad-devel: Update and enable experimental features
Update to 2026.10.23 and enable experimental features
PR: 299642
Reported by: Arthur Chance
devel/py-evdev 1.9.1_2
Bindings to the Linux input handling subsystem
devel/py-evdev: Use the evdev headers from base
evdev 1.9 expects the UI_FF_* constants from uinput.h, but the port
generated its ecodes module only from devel/evdev-proto's
linux/input.h and linux/input-event-codes.h, so "import evdev" fails
with KeyError: 'UI_FF'.
files/patch-v4l_compat, added with the port in 2015 when base had no
dev/evdev headers, removes upstream's #ifdef __FreeBSD__ branches for
<dev/evdev/...> and makes the port build against evdev-proto instead.
Base now installs dev/evdev/input.h, input-event-codes.h and uinput.h,
which evdev's setup.py uses on FreeBSD by default, and build_ext
generates the ecodes module itself. Drop the patch, the evdev-proto
dependency, USES=localbase and the build_ecodes, --evdev-headers and
--include-dirs arguments, and bump PORTREVISION.
The 14.5 and 15.1 base headers define FF_MAX_EFFECTS; older ones
(13.5, 14.2, 14.3, 14.4 and 15.0) lack it, and evdev falls back for it.
While here, add concurrent to USE_PYTHON and fix portlint warnings.
PR: 299872
www/wordpress 7.1.3,1
State-of-the-art semantic personal publishing platform
*/wordpress*: deprecate localized variants
Localized WordPress tarballs are regenerated in place by upstream
whenever translations are updated, so the distfile checksums keep
breaking without a version change. The language packs have the same
problem, and other distributions only ship the English core and let
WordPress download language packs on its own.
Mark the localized ports deprecated, expiring on 2026-12-31. Users
should switch to www/wordpress and choose the site language in
WordPress.
french/wordpress 7.1.3_2,1
State-of-the-art semantic personal publishing platform
german/wordpress 7.1.3_2
State-of-the-art semantic personal publishing platform
russian/wordpress 7.1.3_1
State-of-the-art semantic personal publishing platform
{french,german,russian}/wordpress: chase upstream distfile re-roll
Upstream re-rolled the 7.1.3 de_DE, fr_FR and ru_RU tarballs again
with refreshed translations under wp-content/languages. The
WordPress core files are unchanged.
Update distinfo and bump PORTREVISION as package contents changed.
net/glib-networking: fix build with LibreSSL
LibreSSL does not have SSL_R_SHUTDOWN_WHILE_IN_INIT and
SSL_CTX_set1_sigalgs_list() yet. Upstream recommends local patches
for this as they strictly support OpenSSL 1.1 and later.
https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/287
www/zoraxy 3.3.4_3
General purpose HTTP reverse proxy and forwarding tool
www/zoraxy: Fix build on non-amd64
sshprox declares UseWinTTY and gotty only for freebsd/amd64, which
breaks the build on all other architectures. amd64 embeds no gotty
binary anyway, so extend the build constraint to all of FreeBSD.
Sponsored by: Netzkommune GmbH
(cherry picked from commit 2ea38e53e6a3434d2cf581813ba80592681c811c)
www/zoraxy 3.3.4_3
General purpose HTTP reverse proxy and forwarding tool
www/zoraxy: Fix build on non-amd64
sshprox declares UseWinTTY and gotty only for freebsd/amd64, which
breaks the build on all other architectures. amd64 embeds no gotty
binary anyway, so extend the build constraint to all of FreeBSD.
Sponsored by: Netzkommune GmbH
x11-wm/dwm 6.8_2
Dynamic, small, fast and simple window manager
x11-wm/dwm: Add a RUNTIMEKEYS option
dwm reads key bindings from the root-window property
_DWM_KEYS while it is running. The option is off by default.
Reviewed by: fuz
Differential Revision: https://reviews.freebsd.org/D60933
devel/go-wire 1.3.1
Compile-time Dependency Injection for Go
devel/go-wire: Update 1.3.0 => 1.3.1
Changelog:
https://github.com/goforj/wire/releases/tag/v1.3.1
Port changes:
- Add pkg-message to inform that it requires a symlink to Go
to be able to launch go-wire which can be solved by installing
the lang/go package.
- Also require Go for runtime via USES.
PR: 299684
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 87202e4f2cc1d0c24a8a7bfb9d938d245dff8c5b)
devel/go-wire 1.3.1
Compile-time Dependency Injection for Go
devel/go-wire: Update 1.3.0 => 1.3.1
Changelog:
https://github.com/goforj/wire/releases/tag/v1.3.1
Port changes:
- Add pkg-message to inform that it requires a symlink to Go
to be able to launch go-wire which can be solved by installing
the lang/go package.
- Also require Go for runtime via USES.
PR: 299684
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
lang/php85 8.5.12_2
PHP Scripting Language (8.5.X branch)
lang/php85: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
(cherry picked from commit d7972094ad2638a4d7cd59da1ae812b8b5f419d1)
lang/php84 8.4.27_2
PHP Scripting Language (8.4.X branch)
lang/php84: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
(cherry picked from commit 1a235373d2661c911465f1ad1f50b5f0e2a1ba42)
lang/php83 8.3.36_2
PHP Scripting Language (8.3.X branch)
lang/php83: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
(cherry picked from commit eb0100f974b604825fd8aee7656233586e1f3827)
lang/php82 8.2.35_2
PHP Scripting Language (8.2.X branch)
lang/php82: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
Changelog: https://www.php.net/ChangeLog-8.php#${NEW_VERSION}
(cherry picked from commit 438e512499a99559cf18ba9119dc3a534af3b2a4)
lang/php85 8.5.12_2
PHP Scripting Language (8.5.X branch)
lang/php85: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
lang/php84 8.4.27_2
PHP Scripting Language (8.4.X branch)
lang/php84: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
lang/php83 8.3.36_2
PHP Scripting Language (8.3.X branch)
lang/php83: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
lang/php82 8.2.35_2
PHP Scripting Language (8.2.X branch)
lang/php82: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
Changelog: https://www.php.net/ChangeLog-8.php#${NEW_VERSION}
net-p2p/jigdo 0.8.2_2
Utility used to retrieve large files over the Internet
net-p2p/jigdo: Attempt to fix functionality issues
* jigdo-file (in configfile.cc) crashes because there is no check
whether text is empty.
* the iso file is not generated (scan.cc) - the port is built with
--without-libdb. In that configuration, JigdoCache leaves its
checkFiles flag uninitialized.
While here, fix LICENSE and pet port{clippy,fmt,lint}.
PR: 298765
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
(cherry picked from commit c29ecfc1d192dd9c7504a13f52c8196d762769e2)
net-p2p/jigdo 0.8.2_2
Utility used to retrieve large files over the Internet
net-p2p/jigdo: Attempt to fix functionality issues
* jigdo-file (in configfile.cc) crashes because there is no check
whether text is empty.
* the iso file is not generated (scan.cc) - the port is built with
--without-libdb. In that configuration, JigdoCache leaves its
checkFiles flag uninitialized.
While here, fix LICENSE and pet port{clippy,fmt,lint}.
PR: 298765
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
net-p2p/go-ethereum: Update 1.17.9 => 1.17.10
Changelog:
* This is a quick release that postpones the Amsterdam fork on the
Hoodi testnet, previously scheduled for Oct 26, 2026, 17:42:48 UTC.
Hoodi node operators running v1.17.9 must upgrade before then.
New date will be set in future release; other networks are unaffected.
* Snap sync now switches to snap/2 automatically once Amsterdam is active.
Use '--snap.v2=false' or '--snap.v2=true' to force a protocol.
* Optimize DUP/SWAP dispatch in the interpreter
https://github.com/ethereum/go-ethereum/releases/tag/v1.17.10
PR: 299947
Approved by: Enrique Fynn <me@enriquefynn.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 85ad0319366a70bd6b9a0d4548e684e469882f23)
net-p2p/go-ethereum: Update 1.17.9 => 1.17.10
Changelog:
* This is a quick release that postpones the Amsterdam fork on the
Hoodi testnet, previously scheduled for Oct 26, 2026, 17:42:48 UTC.
Hoodi node operators running v1.17.9 must upgrade before then.
New date will be set in future release; other networks are unaffected.
* Snap sync now switches to snap/2 automatically once Amsterdam is active.
Use '--snap.v2=false' or '--snap.v2=true' to force a protocol.
* Optimize DUP/SWAP dispatch in the interpreter
https://github.com/ethereum/go-ethereum/releases/tag/v1.17.10
PR: 299947
Approved by: Enrique Fynn <me@enriquefynn.com> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
www/bunkerweb 1.6.17
Self-hosted web application firewall and security platform
www/bunkerweb: Update to 1.6.17
This release fixes several access control issues, among them a URI
rewrite in a custom configuration that skipped the bans, lists, rate
limit, antibot, authentication and ModSecurity checks.
Changelog: https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.17
Sponsored by: Netzkommune GmbH
