net/uriparser: Security update 1.0.2 => 1.0.3
Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog
While here:
- Format LICENSE section to make portfmt happy.
- Remove LICENSE_FILE since it doesn't get installed either.
PR: 300378
Approved by: osa, vvd (Mentors, implicit)
Security: CVE-2026-48841
MFH: 2026Q4
(cherry picked from commit f0cdd22deccdb6970769276be6e100b137095cfe)
net/uriparser: Security update 1.0.2 => 1.0.3
Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog
While here:
- Format LICENSE section to make portfmt happy.
- Remove LICENSE_FILE since it doesn't get installed either.
PR: 300378
Approved by: osa, vvd (Mentors, implicit)
Security: CVE-2026-48841
MFH: 2026Q4
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: more cleanup
Remove duplicate cvename and url entries, and add the missing PORTEPOCH
to three ranges so pkg audit matches the affected packages at all.
Sponsored by: Netzkommune GmbH
emulators/dosbox-x: fix build on powerpc64*
dosbox-x assumes long double is the x87 80-bit type on everything that
isn't x86 or ARM. It isn't on powerpc64*, so the FPU register union is
wrong there and 2026.10.01 doesn't even compile. Use the float80 path
like aarch64 does. Also fix the bundled lzma endianness check, FreeBSD
defines _LITTLE_ENDIAN on big-endian too.
misc/agtop 2.5.0_2
Process monitor for AI coding agents
misc/agtop: fix build on powerpc64* and crash when an agent is running
c_char is unsigned there (and on aarch64, which fails the same way),
so the i8 errbuf doesn't match libprocstat's prototype. The FreeBSD
filestat mirror in net_count.rs also has an extra leading pointer, so
the list link is read from fs_cap_rights and the second entry is
garbage; that one dies on every arch as soon as one agent is found.
The bundled sysinfo reads the u_int vm.stats.vm page counters into
u64, which on big-endian lands them in the wrong half and turns every
memory figure into u64::MAX. Read them as u32, as sent upstream.
graphics/qgis-ltr 3.44.15_3
Free and Open Source Geographic Information System
graphics/qgis-ltr: make qt6-webengine optional, drop the unused qt6-pdf
dependency
QtWebEngine is only used by the documentation panel and the
QgsWebEnginePage class. Keep it on where www/qt6-webengine exists and off
elsewhere, so the port can build on powerpc64. Nothing uses QtPdf, the
bundled PDF4QT only needs Core, Gui, Svg and Xml.
graphics/qgis 4.2.3_3
Free and Open Source Geographic Information System
graphics/qgis: make qt6-webengine optional, drop the unused qt6-pdf dependency
QtWebEngine is only used by the documentation panel and the
QgsWebEnginePage class. Keep it on where www/qt6-webengine exists and off
elsewhere, so the port can build on powerpc64. Nothing uses QtPdf, the
bundled PDF4QT only needs Core, Gui, Svg and Xml.
devel/bcc 1995.03.12_4
Bruce's C compiler (with as and ld); can do 16-bit code
devel/bcc: fix on powerpc64le and aarch64
The code wasn't 64-bit clean, so -m32 was forced, and that only works where
lib32 exists. Fix the actual bugs instead (pointer truncation, a negative
unsigned array index, 4-byte types) and drop -m32. Also fix the two big-endian
issues, the old as86 looped forever on powerpc64.
sysutils/UEFITool: fix build with WITH_FORTIFY=yes
FreeBSD's fortify headers turn vsnprintf into a macro and the old gcc
prototype in bstrlib doesn't survive that. Skip it when vsnprintf is a
macro. The same change is going upstream.
comms/sdrangel 7.27.1_2
Software defined radio application and signal analyzer
comms/sdrangel: make qt6-webengine optional
Only the 3D map and the sky map feature need it. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
x11-toolkits/plasma6-kdeplasma-addons: make qt6-webengine optional
Only the dictionary and web browser applets need it. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
math/cantor 26.08.2
Mathematical software frontend by KDE
math/cantor: make qt6-webengine optional
Only the embedded documentation panel needs it. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
editors/calligra: make qt6-webengine optional
Only the braindump web shape needs it. Keep it on where www/qt6-webengine
exists and off elsewhere, so the port builds on powerpc64.
audio/amarok: make qt6-webengine optional
Only the Wikipedia applet needs it. Keep it on where www/qt6-webengine
exists and off elsewhere, so the port builds on powerpc64.
net-im/kaccounts-providers: make qt6-webengine optional
Only the Nextcloud plugin needs it. Keep it on where www/qt6-webengine
exists and off elsewhere, so the port builds on powerpc64.
net-mgmt/seafile-gui: make qt6-webengine optional, add gl to USES
Only the Shibboleth single sign-on login needs QtWebEngine. Keep it on
where www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64. Add the qt6-tools build dependency, CMake always wants
LinguistTools and it only came in through qt6-webengine before.
USE_GL was set without USES=gl, so it did nothing and the libglvnd
dependency was never declared.
finance/skrooge: make qt6-webengine optional
Upstream has SKG_WEBENGINE for this, without it the reports and dashboards
fall back to plain widgets. Keep it on where www/qt6-webengine exists and
off elsewhere. The powerpc64 package still waits for www/py-yt-dlp-ejs
(a dependency of woob).
science/paraview 6.2.0_4
Powerful scientific data visualization application
science/paraview: drop the unused qt6-webengine dependency
ParaView only uses QtWebEngine with PARAVIEW_USE_QTWEBENGINE, which the
port doesn't enable.
audio/jacktrip 3.0.1
Multi-machine audio network performance over the Internet
audio/jacktrip: make qt6-webengine optional
Only the Virtual Studio mode needs it. novs is set unconditionally in
CMakeLists.txt, so flip it with REINPLACE_CMD. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
irc/quassel 0.14.50_1
Qt 6 based distributed IRC client (client and monolithic binary)
irc/quassel-core 0.14.50
Qt 6 based distributed IRC client (core/server only)
irc/quassel: make qt6-webengine optional
Only the URL previews in the chat view need it. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64. quassel-core excludes it like the other GUI options.
editors/texmaker: make qt6-webengine optional
Only the built-in browser for the manual and the check results needs it.
The CMake switch for it isn't a cache variable, so flip it with
REINPLACE_CMD. Keep it on where www/qt6-webengine exists and off
elsewhere, so the port builds on powerpc64.
print/py-frescobaldi: make py-qt6-webengine optional
Frescobaldi checks at runtime whether PyQt6.QtWebEngine is there and only
loses the documentation browser and the SVG view without it. Keep it on
where www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
chinese/fcitx5-chinese-addons: make qt6-webengine optional
Only the built-in browser in the dictionary manager needs it. Keep it on
where www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
astro/gpsbabel: make qt6-webengine optional
Only the map preview in the GUI needs it. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
deskutils/syncthingtray: enable WEBENGINE only where qt6-webengine exists
So the port builds on powerpc64 and the other arches without
www/qt6-webengine.
misc/parley: make qt6-webengine optional
Only the Internet dock in the editor needs it. Keep it on where
www/qt6-webengine exists and off elsewhere, so the port builds on
powerpc64.
sysutils/k3b: make qt6-webengine optional
It's only used for a prettier disk info view and there is a QTextBrowser
fallback. Keep it on where www/qt6-webengine exists and off elsewhere, so
the port builds on powerpc64.
astro/merkaartor: drop the unused qt6-webengine dependency
The CMake build never looks for QtWebEngine, the WEBENGINE switch only
defines a macro that nothing checks.
(Only the first 10 of 14 items in this commit are shown above. )
*/*: enable webengine on powerpc64le
www/qt6-webengine builds on powerpc64le now, so enable it by default
on these ports like on the other arches that have it. py-qt6-pyqt
gets QtPdf, which comes from the same port.
net-p2p/amule 3.2.0
All-platform P2P client based on eMule
net-p2p/amule: Update to 3.2.0
This is a security release fixing 15 vulnerabilities reported through
GitHub Security Advisories, affecting all previous 3.x releases.
Some defaults changed for safety and may affect users of amuled,
amulegui, amulecmd or amuleweb:
- Remote clients can only set download and shared folders listed in
allowed-remote-dirs.dat (empty by default).
- amuleweb guest access must be enabled explicitly (--allow-guest).
- amuled now enforces the chat spam filter and CAPTCHA.
Changelog: https://github.com/amule-org/amule/releases/tag/3.2.0
MFH: 2026Q4
Security: ac97113e-d514-11f1-b2f0-002b67dfc673
(cherry picked from commit 244b2a0928715fe925611f267a481928e5fa5ad6)
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Validate url elements and blockquote cite attributes
make validate now rejects values that are not an http or https URL:
placeholders, empty values, a missing scheme, and typos such as ihttps.
Sponsored by: Netzkommune GmbH
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Replace ftp and mailto references with http URLs
Ten entries pointed at ftp sites or a mailing list address, which no
browser follows any more. Use the project's own http source, or the
advisory the entry already lists where the ftp host is gone.
Also repair two broken url values, a leftover "HERE" and an empty
element.
Sponsored by: Netzkommune GmbH
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Fix malformed URLs and misplaced CVE IDs
Repair 23 url, cite and href values that cannot work as a URL, and move
49 CVE IDs from url elements to cvename.
PR: 300379
Sponsored by: Netzkommune GmbH
lang/puffin: New port - AWK-derived language with multiple backends
- link host libcrypto, libsodium, sqlite3, zstd and base bzip2 and
delete the vendored copies in post-extract
- record those libraries in the runtime link flags so emit-C programs
built by puffincc and auto-AOT still link
- keep foreign keys on by default now that the sqlite build flags no
longer apply
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Fix malformed blockquote cite URLs
Thirteen entries carried a cite attribute that is not a URL: six were
empty or the string "null", three had lost their scheme and start with
"://", and four have no scheme at all. Use the URL from the references
of the same entry. One entry has no url at all, drop its empty
attribute there.
PR: 300379
Sponsored by: Netzkommune GmbH
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Fill in missing blockquote cite URLs
Six entries kept the "INSERT URL HERE" placeholder that newentry.sh puts
into the cite attribute, which ends up verbatim in the generated pages.
Each of them quotes a source that is already linked in its own references
block, so use that URL.
PR: 300379
Reported by: dvl
Sponsored by: Netzkommune GmbH
deskutils/merkuro 26.08.2_1
Calendar application using Akonadi and QML for online calendars
deskutils/merkuro: add missed dependency (+)
Declare implicit (previously hidden by dependencies) requirement on libplasma
Bump PORTREVISION
CMake Warning at src/contacts/applet/CMakeLists.txt:4 (find_package):
By not providing "FindPlasma.cmake" in CMAKE_MODULE_PATH this project has
asked CMake to find a package configuration file provided by "Plasma", but
CMake did not find one.
Could not find a package configuration file provided by "Plasma" with any
of the following names:
PlasmaConfig.cmake
plasma-config.cmake
[skip]
Reported by: bulk -t
Approved by: makc
multimedia/tvheadend 4.3.0.20261028
TV streaming server supporting DVB, IPTV, SAT>IP and more
multimedia/tvheadend: Update to 4.3.0.20261028 and various fixes
The various fixes are:
- fix iconv issue at startup (fix provided by Martin Rehak <rehak@tekkirk.org)
- add new DBUS option (patch provided by Martin Rehak <rehak@tekkirk.org)
- add dependency for pcre2 (patch provided by Martin Rehak <rehak@tekkirk.org)
- remove unused dependency on libcurl
- replace dependency on gettext with gettext-tools
- fix avahi option to properly disable it
PR: 299440
mail/mlmmj 2.2.3
Simple and slim mailing list manager
mail/mlmmj: update to 2.2.3
Changes:
- Security: do not expand $variables$ or %directives% in substituted
values or formatted sources; a crafted Subject: or subscriber address
could leak control files into notices, digests and +list replies, or
loop forever.
- Security: strip CR, LF and NUL from decoded headers to block header
injection (e.g. Bcc:).
- Security: refuse bouncing addresses containing '/', which could
delete or append to files outside bounce/, subconf/ and unsubconf/.
- Security: fix a heap overflow with a wide prefix before an included
source (e.g. "- %listsubs%").
- Bounces: where FD_RESOLVE_BENEATH is available, confine lookups
relative to bounce/, subconf/, unsubconf/ and the queue to those
directories.
- control/access: a deny-<qualifier> rule reports its listtext only
when it matches; a bare deny-<qualifier> rule matches every mail.
- Moderation: no control/moderators is no longer fatal; the post is
held for manual moderation and the poster is notified when notifymod.
- Digests: same List-* and Precedence headers as posts, unless
control/nolistheaders is set.
- Digests: do not repeat "Subject:" in the digest subject.
- Digests: give each attached message a unique filename.
- Bounces: a probe that does not bounce in time puts the record to sleep
instead of deleting it; a probe bouncing later still unsubscribes the
address. Dormant records are removed after 30 days.
- Fix %moderators% in the moderation notice: list each moderator on
its own line, they were concatenated on a single line by mistake.
- $disarmedfrom$: replace a comma or semicolon in the From: display
name by a space and drop the double quotes around it. Some providers
see more than one address and reject the mail otherwise, even when
the value is an RFC 2047 encoded word.
- Build: add an uninstall target.
devel/subversion 1.14.5_3
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_3
Apache Subversion is a full-featured version control system (LTS)
devel/{,java-,ruby-}subversion{,-lts}: drop compiler-specific flags
Remove every compiler-conditional/workaround flag from this port
family, relying on stock Clang/libc++ behavior instead:
- devel/subversion, devel/subversion-lts: drop the amd64-only
CFLAGS+=-fpic -DPIC block and USES=compiler. Add files/patch-configure:
configure's "additional flags to link C++ libraries" check only
special-cases *freebsd10* as needing no extra -lstdc++; every later
FreeBSD release falls through to the default case and gets -lstdc++
added, which fails to link since FreeBSD has shipped Clang/libc++
(no libstdc++.so) since 10.0. Broaden the match to *freebsd*.
- devel/java-subversion: drop the post-configure block that blanked
out LT_CXX_LIBADD by hand when COMPILER_TYPE == clang, superseded
by the configure-level fix above; drop the now-unused
USES=compiler. Also drop JAVA_OS=native, matching www/tomcat-native
(another native-JNI port with --with-java-home=${JAVA_HOME}), which
carries no such restriction either.
- devel/ruby-subversion: drop CFLAGS+=-fdeclspec and the
-Wno-error=int-conversion/-Wno-error=incompatible-function-pointer-types
workaround -- warnings that no longer occur with the current
toolchain.
Bump PORTREVISION/PORTREVISION_LATEST/PORTREVISION_LTS for every
touched port.
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Fix whitespace issues breaking the validate target
Drop a whitespace-only line before the amule entry and replace space
indentation with a tab in the uriparser entry.
PR: 300377
Sponsored by: Netzkommune GmbH
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
security/vuxml: Fix invalid range in py-setuptools entry
A stray greater-than sign in front of the lt element made the range
invalid against the DTD, which broke the validate target for everyone.
PR: 300377
Sponsored by: Netzkommune GmbH
net-p2p/amule 3.2.0
All-platform P2P client based on eMule
net-p2p/amule: Update to 3.2.0
This is a security release fixing 15 vulnerabilities reported through
GitHub Security Advisories, affecting all previous 3.x releases.
Some defaults changed for safety and may affect users of amuled,
amulegui, amulecmd or amuleweb:
- Remote clients can only set download and shared folders listed in
allowed-remote-dirs.dat (empty by default).
- amuleweb guest access must be enabled explicitly (--allow-guest).
- amuled now enforces the chat spam filter and CAPTCHA.
Changelog: https://github.com/amule-org/amule/releases/tag/3.2.0
MFH: 2026Q4
Security: ac97113e-d514-11f1-b2f0-002b67dfc673
