mail/rspamd: Update to 4.2.3
Bug fix release. ARC forwarders whose seal fails verification are no
longer trusted (a whitelisted d= with a broken seal used to produce
ARC_ALLOW_TRUSTED and could lower DMARC), HTML and URL parsing now
follows browser rules so content after comments, CDATA or SVG/MathML
is no longer hidden from the scan, and a milter session use-after-free
on connection close is fixed.
Incompatible changes: phishtank.rspamd.com is disabled by default, and
duplicate RBL queries are merged so a rule now scores once per matched
value (set merge_checks = false to keep the old behaviour).
ChangeLog: https://github.com/rspamd/rspamd/blob/4.2.3/ChangeLog
security/x11appjail 2.1.0
FreeBSD application sandboxing and distribution framework
security/x11appjail: Update to 2.1.0
* Update COMMENT to match upstream.
ChangeLog: https://github.com/DtxdF/x11appjail/releases/tag/v2.1.0
MFH: 2026Q4
(cherry picked from commit d05b0b7b9c16101b2f0fff6396db467a50088175)
games/xray-16 2921.j.2025.r1.20261001_2
Improved version of the X-Ray Engine (used for run S.T.A.L.K.E.R.)
games/xray-16: Fix g_actor assertion in minimap update
Since the CUIZoneMap::Update(const CActor*) refactor the minimap radar
is updated even when the current view entity is not an actor. Map
locations then call Actor() from CMapLocation::UpdateSpot(), which
asserts (debug) or dereferences NULL (release). Skip the radar update
when there is no actor.
PR: 299743
Sponsored by: UNIS Labs (vvd)
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
MFH: 2026Q4
(cherry picked from commit 7ffddc938047e2dce2d47424585ceb4a5e6179a0)
games/xray-16 2921.j.2025.r1.20261001_2
Improved version of the X-Ray Engine (used for run S.T.A.L.K.E.R.)
games/xray-16: Fix g_actor assertion in minimap update
Since the CUIZoneMap::Update(const CActor*) refactor the minimap radar
is updated even when the current view entity is not an actor. Map
locations then call Actor() from CMapLocation::UpdateSpot(), which
asserts (debug) or dereferences NULL (release). Skip the radar update
when there is no actor.
PR: 299743
Sponsored by: UNIS Labs (vvd)
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
MFH: 2026Q4
mail/mail-expire: Update to 0.9.3
Changelog:
* Safeguard to not run into --delete mode by mistake and lose messages without
any warning (by adding a delay and hint and --yes option to override it)
* Best-effort attempt to restore original ownership and permissions of
recreated Mbox files after filtering (closes: #344222)
devel/php80-arcanist: New port
Arcanist is the command-line tool for Phabricator. It allows you to interact
with Phabricator installs to send code for review, download patches, transfer
files, view status, make API calls, and various other things. You can find
a complete library reference here:
* THIS IS A LIMITED PORT. DO NOT USE IT UNLESS YOU KNOW WHY IT EXISTS. *
PHP 8.0 has been end of life since 2023-11-26 and receives no upstream
security fixes. This port is kept in the tree only for a single
deployment that still requires PHP 8.0. It is IGNOREd by default and is
not built on the official package builders. It is only built when the
builder operator explicitly sets WITH_PHP80_ALLOW_TECHNICAL_DEBTS=yes
in make.conf.
WWW: https://secure.phabricator.com/book/arcanist/
devel/php80-APCu: New port
APCu - APC User Cache
* THIS IS A LIMITED PORT. DO NOT USE IT UNLESS YOU KNOW WHY IT EXISTS. *
PHP 8.0 has been end of life since 2023-11-26 and receives no upstream
security fixes. This port is kept in the tree only for a single
deployment that still requires PHP 8.0. It is IGNOREd by default and is
not built on the official package builders. It is only built when the
builder operator explicitly sets WITH_PHP80_ALLOW_TECHNICAL_DEBTS=yes
in make.conf.
WWW: https://github.com/krakjoe/apcu
mail/php80-mailparse: New port
Mailparse is an extension for parsing and working with email messages.
It can deal with rfc822 and rfc2045 (MIME) compliant messages.
Mailparse is stream based, which means that it does not keep in-memory
copies of the files it processes - so it is very resource efficient
when dealing with large messages.
* THIS IS A LIMITED PORT. DO NOT USE IT UNLESS YOU KNOW WHY IT EXISTS. *
PHP 8.0 has been end of life since 2023-11-26 and receives no upstream
security fixes. This port is kept in the tree only for a single
deployment that still requires PHP 8.0. It is IGNOREd by default and is
not built on the official package builders. It is only built when the
builder operator explicitly sets WITH_PHP80_ALLOW_TECHNICAL_DEBTS=yes
in make.conf.
WWW: https://github.com/php/pecl-mail-mailparse
lang/php80-legacy: New port
PHP, which stands for "PHP: Hypertext Preprocessor" is a widely-used
Open Source general-purpose scripting language that is especially suited
for Web development and can be embedded into HTML. Its syntax draws
upon C, Java, and Perl, and is easy to learn. The main goal of the
language is to allow web developers to write dynamically generated
webpages quickly, but you can do much more with PHP.
* THIS IS A LIMITED PORT. DO NOT USE IT UNLESS YOU KNOW WHY IT EXISTS. *
PHP 8.0 has been end of life since 2023-11-26 and receives no upstream
security fixes. This port is kept in the tree only for a single
deployment that still requires PHP 8.0. It is IGNOREd by default and is
not built on the official package builders. It is only built when the
builder operator explicitly sets WITH_PHP80_ALLOW_TECHNICAL_DEBTS=yes in
make.conf.
Differences from the other lang/phpXX ports:
- PHP is built statically with only the extensions needed by that
deployment. There are no separate php80-<extension> packages, and this
port does not use the USE_PHP framework or php.mk.
- Extensions cannot be added at runtime through extension= lines. Adding
an extension requires changing the port and rebuilding it.
- It may not build against current versions of its dependencies without
local patches (for example, recent libxml2 releases).
- Security fixes for libraries PHP links against are only picked up when
this port is rebuilt.
- No support is offered. Do not report problems with this port to the
PHP maintainers, and do not make other ports depend on it. For
anything else, use a supported PHP version.
WWW: https://www.php.net/
net-p2p/{lib,r}torrent-devel: New ports
LibTorrent is a BitTorrent library written in C++ for *nix, and
rtorrent is a ncurses BitTorrent client built on top of it.
These ports track the development series leading up to 1.0, starting
with 0.16.26. net-p2p/{lib,r}torrent stay at 0.16.25, the last release
of the stable series.
Changes in 0.16.26:
- Cascading logging categories replaced by errors/events/debug_trace,
which may break existing configuration files and web frontends
- log_subsystem removed from the logging API
- torrent::Rate reimplemented with a per-second ring buffer
- Library version bumped to libtorrent.so.54
Add CONFLICTS_INSTALL to net-p2p/{lib,r}torrent accordingly.
ChangeLog: https://github.com/rakshasa/rtorrent/releases/tag/v0.16.26
ports-mgmt/optique: New port: Fast ports options configurator for poudriere,
synth and local builds
optique reviews and maintains ports OPTIONS files for poudriere, synth or
local builds: it resolves a package list's whole dependency closure in
parallel, reading the options directory, make.conf layers and blacklist
the build would use, shows every port in one TUI with those needing a
decision first, and writes every options file atomically on apply.
scan, sync, decide and clean cover scripting and cron.
WWW: https://github.com/sdalu/optique
Co-authored-by: Michael Osipov <michaelo@FreeBSD.org>
PR: 299700
net-p2p/py-libtorrent-rasterbar: fix build of net-p2p/deluge-cli
net-p2p/py-libtorrent-rasterbar was building a fresh copy of
libtorrent-rasterbar.so* which was built, linked to from the
Python module's shared library, and then discarded.
The built shared lib had a different SONAME for whatever reason,
possibly due to bugs in b2, so this package wasn't finding a
compatible libtorrent-rasterbar.so* library at the run-time.
This caused a failure in deluge-cli because it couldn't install
a dependency.
This change removes the build of libtorrent-rasterbar.so* and uses
the one that is built by the dependency port.
PR: 294658
dns/unbound 1.26.2
Validating, recursive, and caching DNS resolver
dns/unbound: Security update 1.26.1 => 1.26.2
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Release Notes:
https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495
Changelog:
https://github.com/NLnetLabs/unbound/releases/tag/release-1.26.2
PR: 299682
Approved by: osa, vvd (Mentors, implicit)
Security: CVE-2026-35501
Security: CVE-2026-50106
Security: CVE-2026-96405
Security: CVE-2026-97206
Security: CVE-2026-109125
MFH: 2026Q4
(cherry picked from commit 87c1aa735f603476821e3ee1634b612e119ba653)
dns/unbound 1.26.2
Validating, recursive, and caching DNS resolver
dns/unbound: Security update 1.26.1 => 1.26.2
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106,
CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
Release Notes:
https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495
Changelog:
https://github.com/NLnetLabs/unbound/releases/tag/release-1.26.2
PR: 299682
Approved by: osa, vvd (Mentors, implicit)
Security: CVE-2026-35501
Security: CVE-2026-50106
Security: CVE-2026-96405
Security: CVE-2026-97206
Security: CVE-2026-109125
MFH: 2026Q4
