- devel/wasi-compiler-rt19 19.1.7
Clang builtins library for WebAssembly System Interface
devel/wasi-{compiler-rt,libcxx}19: sync to 19.1.7
(cherry picked from commit b2ce97c92a79fdc093a304c49dfca39f3cccf9f2)
1974413
01:02 Adam Weinberger (adamw)  2025Q1
- editors/vim 9.1.1199
Improved version of the vi editor (console flavor)
editors/vim: Update to 9.1.1198 (security)
potential data loss with zip.vim and special crafted zip files
Date: 12.03.2025
Severity: Medium
CVE: CVE-2025-29768
CWE: Improper Neutralization of Argument Delimiters in a Command ('Argument
Injection') (CWE-88)
Summary
potential data loss with zip.vim and special crafted zip files
Description
Vim is distributed with the zip.vim plugin, that allows easy editing and
viewing of zip archives.
To view and extract zip files, vim uses the unzip(1) command, usually
provided by Info-ZIP, latest version on Debian is 6.0 from April 2009.
If an attacker creates an archive which contains a file -d/tmp, and a Vim
user views such a file and tries to extract such filename from
the archive, Vim will essentially run the following unzip command:
unzip -o <archive.zip> member-filename
However, since the member-filename is called -d/tmp, this is seen by
the unzip command as an additional argument and it therefore happily
extracts the whole archive into the mentioned directory, overwriting existing
files because of the -o.
Unfortunately, the latest released unzip version does not support --
as and end-of-argument marker, so we cannot use this to mark the
beginning of the member-files for unzip. Well, apparently there exists
some 6.10 beta release, that hasn't made it to an official release
yet which supports the use of the -- marker since 2010 (but this isn't
widely known).
Therefore, Vim will try to work-around it by using the [-] glob when a
filename starts with a - to protect unzip from parsing the filename as
an argument, which is just an ugly work-around.
Impact
Impact is moderate because a user must be made to view such an archive
with Vim and then press 'x' to extract such a strange filename.
The Vim project would like to thank @Ry0taK (GMO Flatt Security Inc) and
@takumi-san-ai for reporting this issue.
MFH: 2025Q1
Security: GHSA-693p-m996-3rmf
(cherry picked from commit f1e4dac294a4de0cd9dcf6d85d0573a70e2bc2cd)
11f6bb7 |
|
Wednesday, 12 Mar 2025
|
23:58 Jan Beich (jbeich) 2025Q1
games/veloren-weekly: update to s20250312
Changes: https://gitlab.com/veloren/veloren/-/compare/ce0b7f06b...1a99dd269
(cherry picked from commit a5ccdaa9a803e8b236fe54f1e0c89352130b9c5c)
(cherry picked from commit 0ba3161fed90efaeea26438d6fb7815a262f392f)
9044140 |
10:43 Vladimir Druzenko (vvd) Author: Laurent Chardon 2025Q1
- net/openmpi 5.0.6_1
High Performance Message Passing Library
net/openmpi: Fix 16 byte atomic operations on amd64
Clang does not support 16 byte atomic operations without -mcx16 on amd64
Upstream issue: https://github.com/open-mpi/ompi/issues/13134
PR: 285341
MFH: 2025Q1
(cherry picked from commit 07722f6ed2aa26e76ae830cfc26341788f4b7195)
da3c094 |
|
Tuesday, 11 Mar 2025
|
20:36 Vladimir Druzenko (vvd) Author: Jack 2025Q1
audio/audacity: Upgrade 3.7.1 → 3.7.2
Changelog:
https://support.audacityteam.org/additional-resources/changelog/audacity-3.7.2
While here pet portclippy.
PR: 285321
MFH: 2025Q1
(cherry picked from commit 8d80126a5792c5d0d92163f55b8454d475455ba2)
7d07ea7 |
17:39 Christoph Moench-Tegeder (cmt) 2025Q1
- www/firefox 136.0.1,2
Web browser based on the browser portion of Mozilla
www/firefox: update to 136.0.1
Release Notes:
https://www.mozilla.org/en-US/firefox/136.0.1/releasenotes/
(cherry picked from commit 9b96b9c5658628c3226dff57676a7467ec7f771f)
ff80fee |
08:52 Robert Nagy (rnagy) 2025Q1
- www/chromium 134.0.6998.88_1
Google web browser based on WebKit
www/chromium: update to 134.0.6998.88
Security: https://vuxml.freebsd.org/freebsd/a02a6d94-fe53-11ef-85f3-a8a1599412c6.html
(cherry picked from commit 8e1d8416e8b4b3c41908018ce54de731ff9db448)
4df8e73 |
00:04 Colin Percival (cperciva) 2025Q1
misc/freebsd-release-manifests: Add 13.5-RELEASE MANIFEST files
Approved by: re (implicit)
Sponsored by: Amazon
(cherry picked from commit 02dd5021d6f9912e3758381b7b68a26ee70c719c)
d06105d |
|
Monday, 10 Mar 2025
|
09:44 Hiroki Tagato (tagattie) 2025Q1
- devel/electron33 33.4.3
Build cross-platform desktop apps with JavaScript, HTML, and CSS
devel/electron33: update to 33.4.3
Changelog:
- https://github.com/electron/electron/releases/tag/v33.4.1
- https://github.com/electron/electron/releases/tag/v33.4.2
- https://github.com/electron/electron/releases/tag/v33.4.3
Reported by: GitHub (watch releases)
MFH: 2025Q1
Security: f4f3e001-402b-4d6d-8efa-ab11fcf8de2b
Security: 6ba9e26e-c9c6-49f7-ae43-47e5864f0b66
(cherry picked from commit 45204c90a5b707dc96a1c178d593f82cec96b2bc)
4dd4983 |
09:44 Hiroki Tagato (tagattie) 2025Q1
- devel/electron33 33.4.0
Build cross-platform desktop apps with JavaScript, HTML, and CSS
devel/electron33: update to 33.4.0
Changelog: https://github.com/electron/electron/releases/tag/v33.4.0
Reported by: GitHub (watch releases)
(cherry picked from commit 8cac27191424018d59827137aa5fd86c8164ae55)
a4f82df |
07:06 Robert Nagy (rnagy) 2025Q1
www/ungoogled-chromium: update to 134.0.6998.35
Security: https://vuxml.freebsd.org/freebsd/9c62d3f0-f997-11ef-85f3-a8a1599412c6.html
(cherry picked from commit 187fac406338225b76dde1b3f10eddfb0e34b9a9)
b0b974f |
|
Sunday, 9 Mar 2025
|
20:05 Jan Beich (jbeich) 2025Q1
- x11/nwg-look 1.0.3
GTK settings editor adapted to work in the wlroots environment
x11/nwg-look: update to 1.0.3
Changes: https://github.com/nwg-piotr/nwg-look/releases/tag/v1.0.3
Reported by: GitHub (watch releases)
(cherry picked from commit 1ba21b7a2959b7eea1325f387dbf2cf2adaf7330)
0a896c2 |
|
Saturday, 8 Mar 2025
|
21:30 Vladimir Druzenko (vvd) Author: Martin Filla 2025Q1
- www/librewolf 136.0_1
Custom version of Firefox, focused on privacy, security and freedom
www/librewolf: Update 136.0-1 → 136.0-2
Changelog:
https://codeberg.org/librewolf/source/releases/tag/136.0-2
PR: 285258
MFH: 2025Q1
(cherry picked from commit 1c3e9c8f6c576002cad70def8632adbc92a2184e)
ecca3fd |
20:43 Vladimir Druzenko (vvd) Author: Rafael Grether 2025Q1
filesystems/s3fs: Update 1.92 → 1.95, unbreak - fix coredump
Changelogs:
https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.93
https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.94
https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.95
Improve port:
- remove GNU_CONFIGURE_MANPREFIX;
- pet portclippy;
- improve description.
PR: 285261 281071
Approved by: dmgk (maintainer, timeout > 6 months, implicit - unbreak)
MFH: 2025Q1
(cherry picked from commit e26ad835aecd0ffb22bc9f3dec51e097e7138a1a)
36ce604 |
14:37 Vladimir Druzenko (vvd) 2025Q1
- www/librewolf 136.0
Custom version of Firefox, focused on privacy, security and freedom
www/librewolf: Switch to use the builtin icu as devel/icu is too old on 2025Q1
PR: 285169
Reported by: cmt (via email)
Fixes: 189ac8337451 (Update 135.0.1 → 136.0)
MFH: 2025Q1
(cherry picked from commit 4288c5fbf380c14254082cb5326899f8406c3b37)
af39d6b |
13:41 Hiroki Tagato (tagattie) 2025Q1
- devel/electron32 32.3.3
Build cross-platform desktop apps with JavaScript, HTML, and CSS
devel/electron32: update to 32.3.3
Changelog: https://github.com/electron/electron/releases/tag/v32.3.3
Reported by: GitHub (watch releases)
MFH: 2025Q1
Security: 6e27040b-61b7-4989-9471-dfb10c3cd76e
(cherry picked from commit a7e584459773256a77a86470a3117da7314d5af5)
e0c7ff6 |
12:23 Vladimir Druzenko (vvd) Author: Martin Filla 2025Q1
- www/librewolf 136.0
Custom version of Firefox, focused on privacy, security and freedom
www/librewolf: Update 135.0.1 → 136.0
Changelog:
https://www.mozilla.org/en-US/firefox/136.0/releasenotes/
PR: 285169
MFH: 2025Q1
(cherry picked from commit 189ac8337451019f7f07f7590f971257599b9507)
75bfa67 |
07:20 Jan Beich (jbeich) 2025Q1
multimedia/ab-av1: back to 0.9.1 to unbreak build
===> Updating Cargo.lock
error: failed to parse manifest at
`/wrkdirs/usr/ports/multimedia/ab-av1/work/ab-av1-0.9.2/Cargo.toml`
Caused by:
feature `edition2024` is required
The package requires the Cargo feature called `edition2024`, but that feature
is not stabilized in this version of Cargo (1.83.0 (5ffbef321 2024-10-29)).
Consider trying a newer version of Cargo (this may require the nightly
release).
See
https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for
more information about the status of this feature.
*** Error code 101
Reported by: pkg-fallout
This reverts commit 8855350ef13c37f868fa439caf27b16ece0132eb.
a737e47 |
00:22 Jan Beich (jbeich) 2025Q1
games/veloren-weekly: update to s20250306
Changes: https://gitlab.com/veloren/veloren/-/compare/4061ea8c0...ce0b7f06b
(cherry picked from commit 606bcbf2b6dd0d52c24ccda726318634d111d9bb)
cdbc81f |
00:22 Jan Beich (jbeich) 2025Q1
multimedia/ab-av1: update to 0.9.2
Changes: https://github.com/alexheretic/ab-av1/releases/tag/v0.9.2
Reported by: GitHub (watch releases)
(cherry picked from commit c43c1ffb0c24d2be2773d581790b9954357aedd5)
8855350 |
|
Friday, 7 Mar 2025
|
17:47 Michael Osipov (michaelo) 2025Q1
- lang/rust 1.83.0_1
Language with a focus on memory safety and concurrency
lang/rust: Make OpenSSL use the system default truststore in Cargo
Cargo uses curl-rust and git2-rs (which uses curl-rest as well).
Unfortunately, git2-rs calls openssl_probe::init_ssl_cert_env_vars()
unconditionally which breaks the process environment by setting an invalid
value for SSL_CERT_DIR and then the system default truststore is circumvented,
resulting in certificate validation errors even if certctl(8) manages
everything nicely.
Upstream issues:
* https://github.com/alexcrichton/openssl-probe/issues/37
* https://github.com/rust-lang/git2-rs/pull/1130
Reviewed by: jrm (mentor), mikael (rust)
MFH: 2025Q1
Differential Revision: https://reviews.freebsd.org/D49120
(cherry picked from commit 078082660317490b1a2faf93ddce4b49c6b165dc)
093b0eb |
10:06 Vladimir Druzenko (vvd) 2025Q1
audio/lollypop: Update 1.4.16 → 1.4.41, improve port
Changelogs:
https://gitlab.gnome.org/World/lollypop/-/releases
Improve port:
- WWW replace https://wiki.gnome.org/Apps/Lollypop with
https://gitlab.com/lollypop-project/lollypop/ as the site has been
"retired".
- Sort items in USES, USE_GNOME, USE_GSTREAMER.
- Add NO_ARCH - suggested by poudriere.
- Pet portclippy.
The patch is based on the patch form Zoltán Király
<ports@zoltankiraly.com>.
PR: 285208
MFH: 2025Q1
(cherry picked from commit 907e7f6b1eacacbc7d427c5ff62f2143033376ad)
5f31b91 |
07:32 Jan Beich (jbeich) 2025Q1
net/wlvncc: update to s20250218
Changes: https://github.com/any1/wlvncc/compare/e2f6ab7...d37e754
PR: 285207
Reported by: Evgenii Khramtsov
(cherry picked from commit fe60e0f1922ef4d683dda3beb0b605280ae02323)
169d2d2 |
07:30 Jan Beich (jbeich) Author: Brooks Davis 2025Q1
devel/llvm19: reenable AMDGPU and WASM on i386 by default
This is needed (among other reasons) to support wine because wine is
mostly 32-bit.
Requested by: manu
Sponsored by: DARPA, AFRL
(cherry picked from commit f1158a44c0539dad4b07eb1769866118585a6d75)
92bdbb4 |
07:30 Jan Beich (jbeich) Author: Brooks Davis 2025Q1
devel/llvm19: 19.1.7 release
See the release announcement for changes:
https://discourse.llvm.org/t/llvm-19-1-7-released/84062
Sponsored by: DARPA, AFRL
(cherry picked from commit e333e1ef90228d781f3386ad13b2de0f1d5efce4)
838c041 |
07:29 Jan Beich (jbeich) Author: Brooks Davis 2025Q1
devel/llvm19: Fix !CLANG plist and OPENMP
llvm-debuginfo-analyzer isn't part of Clang, but was matched by the
overly broad pattern `-analyzer`. [0]
Fix USE_LDCONFIG for OPENMP. [1]
Reported by: jrtc27 [0], tijl [1]
Sponsored by: DARPA, AFRL
(cherry picked from commit e08503b86df7a69d55575669966a0dae54f84e93)
3f3a150 |
02:49 Wen Heping (wen) 2025Q1
www/py-django42: Update to 4.2.20
(cherry picked from commit 2899f4394ca1a8b20468138ee13d43338e857701)
b87719d |
02:49 Wen Heping (wen) 2025Q1
www/py-django42: Update to 4.2.19
(cherry picked from commit 05fd7c974544aeeb03a6661cb6df661904a30e59)
84a7880 |
02:48 Wen Heping (wen) 2025Q1
www/py-django50: Update to 5.0.13
(cherry picked from commit 883a5ff552dd91ebd022adc66dca39f0aca81394)
a7efaa6 |
02:48 Wen Heping (wen) 2025Q1
www/py-django50: Update to 5.0.12
(cherry picked from commit e8e252d2dc4770c220d5134d771493831eb7534e)
95fe508 |
02:47 Wen Heping (wen) 2025Q1
www/py-django51: Update to 5.1.7
(cherry picked from commit 08d6f4b0d40845b474c505f206458115bcf5a8e5)
683864e |
02:47 Wen Heping (wen) 2025Q1
www/py-django51: Update to 5.1.6
(cherry picked from commit 9445b3f974d2c299fc47510eb46da1df8c2f466d)
29ab538 |
|
Thursday, 6 Mar 2025
|
19:25 Vladimir Druzenko (vvd) Author: FiLiS 2025Q1
- www/gitea 1.23.5
Compact self-hosted Git service
www/gitea: Update 1.23.3 → 1.23.5 (fix security issues)
Changelogs:
https://blog.gitea.com/release-of-1.23.4/
https://blog.gitea.com/release-of-1.23.5/
PR: 285191
Approved by: Stefan Bethke <stb@lassitu.de> (maintainer)
MFH: 2025Q1
(cherry picked from commit 5cbc9c46110d1261669de8e9ca4fddd77d9dcdb6)
01213ea |
19:20 Robert Nagy (rnagy) 2025Q1
- www/chromium 134.0.6998.35
Google web browser based on WebKit
www/chromium: unbreak by adding a patch missed from the previous commit
PR: 285199
(cherry picked from commit c0821946bf4b36ec967bd15d4960d0a174dd7609)
c611682 |
16:42 Vladimir Druzenko (vvd) 2025Q1
www/tomcat-devel: Update 11.0.4 → 11.0.5
Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.5_(markt)
MFH: 2025Q1
(cherry picked from commit ec8c485c895c5e2e465183868f1be9a0c1045aac)
0d57cfc |
16:41 Vladimir Druzenko (vvd) 2025Q1
- www/tomcat110 11.0.5
Open-source Java web server by Apache, 11.0.x branch
www/tomcat110: Update 11.0.4 → 11.0.5
Changelog:
https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.5_(markt)
MFH: 2025Q1
(cherry picked from commit 5de7e074ca6cb8438c3ace0cdb4c8d607e662b09)
f90f5d6 |
16:41 Vladimir Druzenko (vvd) 2025Q1
- www/tomcat9 9.0.102
Open-source Java web server by Apache, 9.0.x branch
www/tomcat9: Update 9.0.100 → 9.0.102
Changelogs:
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.102_(remm)
MFH: 2025Q1
(cherry picked from commit 67a66b196e9ee132a10d93b10c1d02840a97f953)
d6c2467 |
16:41 Vladimir Druzenko (vvd) 2025Q1
- www/tomcat9 9.0.100
Open-source Java web server by Apache, 9.0.x branch
www/tomcat9: Replace PORTVERSION with DISTVERSION
(cherry picked from commit 384b7b44f5fe221fcd4d1934c733b53941d29347)
e1bb7bf |
12:51 Vladimir Druzenko (vvd) Author: Mateusz Wiącek 2025Q1
databases/pecl-redis: Update 5.3.7 → 6.1.0, take maintainership
Original author of the patch: Mark <mark@elpescador.nl>
Changelogs:
https://pecl.php.net/package-changelog.php?package=redis&release=6.1.0
While here replace PORTVERSION with DISTVERSION.
PR: 285154 282573
Approved by: Daniel Ylitalo <daniel@blodan.se> (maintainer)
(cherry picked from commit 8c678f6b7da17ea886fc3459ac5866b695f18d73)
909744f |
09:04 Yuri Victorovich (yuri) 2025Q1
multimedia/obs-studio: Broken on armv7
Reported by: fallout
(cherry picked from commit 660413f40257ca7040108678df157640c86702d8)
319408e |
07:46 Matthias Fechner (mfechner) 2025Q1
security/trivy: update to 0.60.0
Changes: https://github.com/aquasecurity/trivy/releases/tag/v0.60.0
(cherry picked from commit 72028a7f6bd47baf6870cd68b4a42183eb377020)
98ec265 |
02:25 Vladimir Druzenko (vvd) Author: Martin Filla 2025Q1
www/waterfox: Update 6.5.4 → 6.5.5
Changelog:
https://www.waterfox.net/docs/releases/6.5.5/
PR: 285170
MFH: 2025Q1
(cherry picked from commit e5055b802222dd535bb30c5a933d59dcacc3978e)
75da061 |
02:25 Vladimir Druzenko (vvd) Author: Martin Filla 2025Q1
www/tor-browser: Update 14.0.6 → 14.0.7
Changelog:
https://blog.torproject.org/new-release-tor-browser-1407/
PR: 285172
MFH: 2025Q1
(cherry picked from commit ea14ebe0de5e7a6dfea688fae0006a519f20ca00)
74a40bd |
00:53 Jan Beich (jbeich) 2025Q1
games/veloren-weekly: update to s20250305
Changes: https://gitlab.com/veloren/veloren/-/compare/2d62499a5...4061ea8c0
(cherry picked from commit 089b931c8833589e61c4dbe0781c242b4a7ec6f9)
46960d46 |
|
Wednesday, 5 Mar 2025
|
23:59 Cy Schubert (cy) 2025Q1
net/freebsd-telnetd: Update to 14.0.6
Version 14.0.6 corrects the filename referanced in the telnetd.8
man page. The upstream commit log:
The patname listed was the path telnetd was installed in FreeBSD
base. Now that it is a stand-alone app, installed through FreeBSD
ports/pkg, update the pathname.
PR: 284006
(cherry picked from commit ef2452dffb16f8637b6f9e7c55369a3effaf87af)
ed008e8 |
20:11 Christoph Moench-Tegeder (cmt) 2025Q1
- mail/thunderbird 128.8.0_4
Mozilla Thunderbird is standalone mail and news that stands above
mail/thunderbird: update 128.8.0 (rc5)
Release Notes:
https://www.thunderbird.net/en-US/thunderbird/128.8.0esr/releasenotes/
(cherry picked from commit 62fee916f4d17d1d9c44eb05fb54ecc759df1be0)
d23212c |
19:45 Li-Wen Hsu (lwhsu) 2025Q1
devel/jenkins-lts: Update to 2.492.2
Security: cb98d018-f9f5-11ef-a398-00e081b7aa2d
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 604b9a8294d71b6976a058be4642e4a399a700d3)
f9e96d9 |
19:44 Li-Wen Hsu (lwhsu) 2025Q1
devel/jenkins: Update to 2.500
Security: cb98d018-f9f5-11ef-a398-00e081b7aa2d
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 2a33357067fd719ce81986bd3846080886add0d6)
88a3f33 |
As an Amazon Associate I earn from qualifying purchases.
