security/krb5-122 1.22.3
MIT implementation of RFC 4120 network authentication service
security/krb5-122: Update to 1.22.3
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
application servers, were it not for the two bugs noted above.
* Check for the lockdown_keys attribute when processing password
change protocol requests in kadmind [CVE-2026-107884].
* In libgssrpc, when processing RPC messages using the RPCSEC_GSS
flavor, use the verified service type included in the RPC request to
determine how to unwrap arguments and wrap return values, instead of
the unverified service type included during authentication
[CVE-2026-118380].
* In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the
"GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI
is only needed for very old (pre-1.4) clients [CVE-2026-112322]
[CVE-2026-112323].
* Fix numerous null pointer deferences, read overruns, unbounded
memory allocations, and memory leaks that could be used as denial of
service attacks against the KDC, kadmind, application servers, or
client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200]
[CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778]
[CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316]
[CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319]
[CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323]
[CVE-2026-119079].
* Fix a client crash when a KKDCP proxy daemon closes the TLS session
without supplying any response data.
* Shut down kpropd gracefully when a termination signal is received,
when operating in incremental propagation mode.
* Detect when an incremental propagation update is applied to a
nonexistent principal; when this happens, force a full resync
instead of crashing.
* Fix a KDC crash when the LDAP KDB module loses its connection to the
LDAP server.
* Avoid a crash on macOS when the native API ccache type is used
before and after forking a process.
* When an application accepts a GSS context without asking for
delegated credentials, discard any credentials sent by the initiator
without parsing them first.
Security: https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt
(cherry picked from commit 2282c3b0f32f0bc15a623d59c712b22896fd6b6f)
emulators/libmt32emu 2.8.6
Emulate Roland MT-32, CM-32L and LAPC-I synthesiser modules
emulators/libmt32emu: Update 2.8.5 => 2.8.6
This release contains fixes and improvements for the floating point
audio renderer and exposes an option to specify its performance level.
The port defaults to upstream's default value "Fast".
Changelog:
https://github.com/munt/munt/blob/libmt32emu_2_8_6/mt32emu/NEWS.txt
PR: 300657
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 56230ee8a26f741f9118f9c0eb9788b038e3bb8e)
emulators/libmt32emu 2.8.6
Emulate Roland MT-32, CM-32L and LAPC-I synthesiser modules
emulators/libmt32emu: Update 2.8.5 => 2.8.6
This release contains fixes and improvements for the floating point
audio renderer and exposes an option to specify its performance level.
The port defaults to upstream's default value "Fast".
Changelog:
https://github.com/munt/munt/blob/libmt32emu_2_8_6/mt32emu/NEWS.txt
PR: 300657
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
mail/hydroxide 0.2.33
Free ProtonMail bridge for using with any email client you prefer
mail/hydroxide: Restrict PORTSCOUT to 0.2.x range
Since portscout falsely detected a version for another
project that is something like "v1.5.2-proton".
Approved by: osa, vvd (mentors, implicit)
math/R-cran-matrixcalc: New port: Collection of functions for matrix
calculations
A collection of functions to support matrix calculations
for probability, econometric and numerical analysis. There are
additional functions that are comparable to APL functions which
are useful for actuarial models such as pension mathematics.
PR: 296813
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D61240
devel/R-cran-furrr: New port: Apply mapping functions in parallel using futures
Implementations of the family of map() functions from 'purrr'
that can be resolved using any 'future'-supported backend, e.g.
parallel on the local machine or distributed on a compute cluster.
PR: 296815
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D61239
java/openjdk25 25.0.5.0.3+1.f.1_2
Java Development Kit 25
java/openjdk25: set wxneeded on bootstrap jdk
The upstream fix to Bug 296945 set the wxneeded flag for executables;
however, it did not do so for the bootstrap jdk.
This patch fixes that.
PR: 300566
Reported by: mondo.debater_0q@icloud.com
Reviewed by: haraldei
Approved by: haraldei
emulators/open-vm-{kmod,tools}: machine/stdarg.h -> sys/stdarg.h
machine/stdarg.h is deprecated and will be removed in due course.
Use a different method of patching each port to work around
WKRSRC_SUBDIR in emulators/open-vm-kmod.
PR: 300600
Approved by: garga (maintainer)
Sponsored by: DARPA, AFRL
math/blacs 1.7_42
BLACS (Basic Linear Algebra Communication Subprograms)
math/blacs: use MPI compiler wrappers
Use the compiler wrappers and installation path provided by mpi.mk.
Use MPI-2 communicator conversion for MPICH and OpenMPI.
Merge their identical build configuration patches.
Approved by: thierry (mentor, implicit)
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the dynamic_upstream, ip2location and auth_krb5 modules from their own
www/nginx-module-* ports instead of inline GH_TUPLE sources, like the other
3rd-party modules. The auth_krb5 GSSAPI substitution moves to pre-configure,
where the sources now arrive. Put the BROTLI option block in the same order
as the rest.
Sponsored by: Netzkommune GmbH
www/nginx-module-auth-krb5: Add New Port
Sources of the auth_krb5 module, which authenticates HTTP clients with
SPNEGO/GSSAPI (Kerberos), so a browser that already holds a valid ticket is
logged in without a password prompt. The nginx ports build
ngx_http_auth_spnego_module.so from here when their HTTP_AUTH_KRB5 option is
enabled.
www: https://github.com/stnoonan/spnego-http-auth-nginx-module
Sponsored by: Netzkommune GmbH
www/nginx-module-ip2location: Add New Port
Sources of the ip2location module, which looks up the client address in an
IP2Location BIN database and exposes country, region, city, coordinates and
more as nginx variables. The nginx ports build ngx_http_ip2location_module.so
from here when their HTTP_IP2LOCATION option is enabled.
www: https://github.com/ip2location/ip2location-nginx
Sponsored by: Netzkommune GmbH
www/nginx-module-dynamic-upstream: Add New Port
Sources of the dynamic_upstream module, which reconfigures the peers of an
nginx upstream at run time over an HTTP API -- add, remove, up, down,
weight -- and keeps DNS-named peers in sync in the background, for http and
stream upstreams. The nginx ports build ngx_http_dynamic_upstream_module.so
from here when their DYNAMIC_UPSTREAM option is enabled.
www: https://github.com/sysadmin-labs/nginx-dynamic-upstream-module
Sponsored by: Netzkommune GmbH
games/anki 26.09.4
Flashcard trainer with spaced repetition
games/anki: Attempt to fix build on aarch64
Architecture-specific prebuilt binaries of "esbuild" and "rollup" are
used for the amd64/aarch64 platforms. Therefore, add NPM_PREFETCH_ARCHS
to use separate NodeJS module tarballs for amd64 and aarch64.
Fixes: 65434f71218e games/anki: Update to 26.09
MFH: 2026Q4
(cherry picked from commit 92401c33b734706f98c64b21338745f9d3f7b06d)
games/anki 26.09.4
Flashcard trainer with spaced repetition
games/anki: Attempt to fix build on aarch64
Architecture-specific prebuilt binaries of "esbuild" and "rollup" are
used for the amd64/aarch64 platforms. Therefore, add NPM_PREFETCH_ARCHS
to use separate NodeJS module tarballs for amd64 and aarch64.
Fixes: 65434f71218e games/anki: Update to 26.09
MFH: 2026Q4
www/rustfs: New port: High-performance distributed S3-compatible object storage
RustFS is a high-performance, distributed object storage system built in
Rust, with broad S3 API compatibility.
The Console is released separately by upstream and embedded into the
binary at build time.
WWW: https://rustfs.com/
Approved by: jrm (mentor)
Differential Revision: https://reviews.freebsd.org/D61304
security/krb5-122 1.22.3
MIT implementation of RFC 4120 network authentication service
security/krb5-122: Update to 1.22.3
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
application servers, were it not for the two bugs noted above.
* Check for the lockdown_keys attribute when processing password
change protocol requests in kadmind [CVE-2026-107884].
* In libgssrpc, when processing RPC messages using the RPCSEC_GSS
flavor, use the verified service type included in the RPC request to
determine how to unwrap arguments and wrap return values, instead of
the unverified service type included during authentication
[CVE-2026-118380].
* In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the
"GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI
is only needed for very old (pre-1.4) clients [CVE-2026-112322]
[CVE-2026-112323].
* Fix numerous null pointer deferences, read overruns, unbounded
memory allocations, and memory leaks that could be used as denial of
service attacks against the KDC, kadmind, application servers, or
client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200]
[CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778]
[CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316]
[CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319]
[CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323]
[CVE-2026-119079].
* Fix a client crash when a KKDCP proxy daemon closes the TLS session
without supplying any response data.
* Shut down kpropd gracefully when a termination signal is received,
when operating in incremental propagation mode.
* Detect when an incremental propagation update is applied to a
nonexistent principal; when this happens, force a full resync
instead of crashing.
* Fix a KDC crash when the LDAP KDB module loses its connection to the
LDAP server.
* Avoid a crash on macOS when the native API ccache type is used
before and after forking a process.
* When an application accepts a GSS context without asking for
delegated credentials, discard any credentials sent by the initiator
without parsing them first.
Security: https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt
MFH: 2026Q4
news/sabnzbd 5.1.3
Web-interface based binary newsgrabber in python, with nzb support
news/sabnzbd: Update 5.1.2 => 5.1.3, cleanup dependencies
Changelog:
https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.3
Make some adjustments to the the test behavior so that no more tests
fail. Skips Selenium Tests, Wiki Tests and tests that do not have
necessary files in tarball. Patches permission test that behaves
differently from linux.
Results: 13345 passed, 41 skipped, 28 deselected, 2 xfailed, 1 xpassed,
8 warnings
PR: 298693
Approved by: Nicholas Kirby <nick@kirby.cx> (maintainer, timeout 7+ weeks)
Security: GHSA-q326-jpxx-jmjc
Security: GHSA-mjwj-v5mr-cmcg
Security: GHSA-rgqj-28c2-gxwp
Security: GHSA-75g3-96fr-7p2r
Security: GHSA-xrfq-jhgh-wqch
Sponsored by: UNIS Labs (vvd)
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
MFH: 2026Q4
(cherry picked from commit 279269028344c5cdde8927767ac3e0512fd71976)
news/sabnzbd 5.1.3
Web-interface based binary newsgrabber in python, with nzb support
news/sabnzbd: Update 5.1.2 => 5.1.3, cleanup dependencies
Changelog:
https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.3
Make some adjustments to the the test behavior so that no more tests
fail. Skips Selenium Tests, Wiki Tests and tests that do not have
necessary files in tarball. Patches permission test that behaves
differently from linux.
Results: 13345 passed, 41 skipped, 28 deselected, 2 xfailed, 1 xpassed,
8 warnings
PR: 298693
Approved by: Nicholas Kirby <nick@kirby.cx> (maintainer, timeout 7+ weeks)
Security: GHSA-q326-jpxx-jmjc
Security: GHSA-mjwj-v5mr-cmcg
Security: GHSA-rgqj-28c2-gxwp
Security: GHSA-75g3-96fr-7p2r
Security: GHSA-xrfq-jhgh-wqch
Sponsored by: UNIS Labs (vvd)
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
MFH: 2026Q4
x11/nvidia-kmod{-deve]}: Fix loading GSP firmwares for non-legacy variants
Add missing 2 firmware files to x11/nvidia-kmod/pkg-plist
and fixup x11/nvidia-kmod/Makefile not to pick them for
legacy variants that don't have them.
Bumped non-legacy variants only, as pkg for legacy variants
shouldn't be affected with this.
Co-authored by: O. Hartmann
Differential Revision: https://reviews.freebsd.org/D61364
net/libpfctl 0.17
Library for interaction with pf(4)
net/libpfctl: add 15.2, remove 15.0
15.0 is end-of-life, remove it from this port.
Add 15.2, which is in the process of being released.
Deliberately do not bump PORTVERSION, because we don't change existing
libpfctl versions, we only add a new supported FreeBSD version.
PR: 300134
Sponsored by: Rubicon Communications, LLC ("Netgate")
