security/openssl: Security upgrade to 3.5.9
OpenSSL 3.0 is end-of-life and has known vulnerabilities.
Upgrade port to OpenSSL 3.5 by renaming security/openssl35
Security: 0d183075-bcb5-11f1-b09d-8447094a420
MFH: 2026Q3
www/mod_wsgi: Update to 6.1.0
mod_wsgi has been upgraded to major version 6 with several potentially
breaking changes. Read the release notes very carefully:
https://modwsgi.readthedocs.io/en/latest/release-notes.html
PR: 298961
Approved by: douglas@douglasthrift.net (maintainer)
audio/deadbeef: split GTK-based GUI plugins into separate port
- This allows to 1) simplify the main Makefile by removing
fragile and incoherent logic to handle the codependencies
between four GUI plugins; 2) consistently flavorize them
against supported GTK versions. Users can now switch GUI
without having to reconfigure and rebuild the main port
- Drop custom NOTIFY_DESC in favor of standard description
which is shorter and less cryptic (more user-oriented)
databases/openldap*: move from net/
Move all OpenLDAP ports (openldap25-client, openldap25-server,
openldap26-client, openldap26-server) from net/ to databases/ to be
consistent with OpenLDAP 2.7 which was already in databases/.
Bump PORTREVISION for all moved ports. Simplify Mk/Uses/ldap.mk now
that all OpenLDAP versions live under databases/.
mail/py-notmuch2: Fix value of PKGNAMESUFFIX
In commit db96db170fc4, the value of PKGNAMESUFFIX was accidentally
changed from 2 to 0. Fix this by setting it back to the correct value,
2, which renames the package back to py*-notmuch2.
Bump PORTREVISION, so the renamed package is reinstalled with a
corrected plist.
PR: 298122
Reported by: John Hein <jcfyecrayz@liamekaens.com>
Fixes: db96db170fc4 (mail/notmuch*: Update to 0.34.2)
Sponsored by: The FreeBSD Foundation
net-mgmt/semaphore: update to 2.19.7, restore web UI
The port was frozen at 2.9.2 and installed only the REST API server; the
bundled web UI was never built, so every UI route returned 404. Update
to
2.19.7 and restore the embedded Vue UI.
Upstream dropped BoltDB support in 2.19; the supported dialects are now
mysql, postgres and sqlite. BoltDB installations must import their data
with a Semaphore 2.18 binary before the upgrade, because 2.19 no longer
ships the import tool. Changing the dialect without importing silently
creates an empty database and all projects, templates, access keys and
the
task history are lost. Add a pkg-install check that warns during
PRE-INSTALL when the configuration still selects the bolt dialect or a
database.boltdb is present, a pkg-message for upgrades from before 2.19,
and an UPDATING entry documenting the procedure.
Further changes:
- Repository moved from ansible-semaphore/semaphore to
semaphoreui/semaphore.
- The Vue frontend is embedded via go:embed (was packr). The built
api/public and the vendored subset of the in-tree "pro" module (with a
consistent vendor/modules.txt) are supplied as supplemental distfiles,
because upstream publishes neither and neither can be produced in the
network-isolated build jail.
- Go module dependencies are split across GH_TUPLE (GitHub) and GL_TUPLE
(GitLab, the modernc.org SQLite driver).
- Version is set via -ldflags -X util.Ver and the SQL migrations are
embedded via go:embed; the version_gen and DATADIR patches are
removed.
- Fix the rc script: 2.x needs "semaphore server --config".
- A minimal sqlite config.json.sample replaces the old mysql/redis one.
PR: 297378
Approved by: egypcio (maintainer timeout)
Sponsored by: Netzkommune GmbH
net/freeipa-server: Update to 4.13.2
Upstream moved to Codeberg, follow it in MASTER_SITES.
Use the samba framework instead of a hardcoded samba416 dependency [1].
Require sssd2 2.13.1_2 or newer. Earlier revisions leave ${prefix}
unexpanded in SSSDConfig, which makes ipa-server-install fail.
Own the HTTP keytab by www. httpd runs with GSS_USE_PROXY=no and reads
the keytab itself, so a root-owned one left mod_auth_gssapi without
server credentials.
Keep the rc(8) program paths of the Kerberos services in place so a
running kadmind stays visible to rc(8) while it is disabled. Without
them ipactl reported it as stopped and ipactl restart waited forever.
Make the D-Bus system bus a prerequisite of certmonger and oddjobd.
Without it certmonger does not start and oddjobd retries forever, which
stalls the boot before sshd.
Point the ACME configuration templates at the FreeBSD instance path.
Add an UPDATING entry for the Java 21 switch of security/dogtag-pki and
for the ACME paths of already deployed instances.
PR: 297655 [1]
Submitted by: fluffy [1]
Changes: https://www.freeipa.org/release-notes/4-13-2.html
Sponsored by: Netzkommune GmbH
sysutils/screen*: MULTIUSER is now non-default
MULTIUSER requires a setuid root screen binary. Not many people use
this feature anymore so let's disable it by default. If people do want
MULTIUSER screen they should either set the option or manually add the
setuid bit to the screen binary.
Reported by: sjg
security/openssh-portable: Use blocklist
Starting from FreeBSD version 1500000, prefer the new blocklist
nomenclature.
Once older versions are no longer supported, we should use blocklist
exclusively.
This also fixes a regression with UseBlacklist not being properly
read from the config in commit 516c0db3f73b for the 10.4 update.
PR: 294082
news/inn, news/inn-current: Switch BERKELEYDB to db18
databases/db5 is EOL. Depend on databases/db18 instead and document
the in-place ovdb_init -u upgrade for ovdb overview users.
PR: 279151
security/openssh-portable: Update to 10.4p1
Deprecate the HPN patch. It was removed in base in 2016. It has not
matched the upstream patch in many years, which has been renamed
to "hpn-ssh". Bringing it back as a separate port could make sense
but won't be done in this port.
Release notes: https://www.openssh.org/txt/release-10.4
mail/bogofilter*: Prepare LMDB 1.0 transition
Here's what we do now:
- mail/bogofilter currently depends on lmdb0, a 0.9.X port, so
it continues to work as before
- add a new mail/bogofilter-lmdb1 port that depends on lmdb, the 1.0
version of the LMDB database.
- add the upstream patch for bogofilter 1.3.0.rc1 that I made and
that delphij@ prepared for integration into the ports tree - thanks!
Here's the plan for end of 2026:
- AT THE SAME TIME:
- upgrade mail/bogofilter to depend on LMDB 1.0
- portrm mail/bogofilter-lmdb1
- add a MOVED entry to redirect from bogofilter-lmdb1 to bogofilter.
While here, clean up and rearrange the Makefiles.
PR: 296519
Reviewed by: arrowd
Pull Request: https://github.com/freebsd/freebsd-ports/pull/551
databases/lmdb: add migration notice for 0.9.x -> 1.0.0 upgrade
LMDB 1.0 introduced an incompatible on-disk file format; v0.9 databases
must be exported with mdb_dump and re-imported with mdb_load before use.
Add a pkg-message (install always, upgrade only from <1.0.0) and an
UPDATING entry documenting the required migration procedure.
Suggested by: Kevin Bowling <kevin.bowling@kev009.com>
net-mgmt/librenms: Update to 26.6.0
re: https://github.com/librenms/librenms/releases/tag/26.6.0
This release requires a database update and a new configuration item
Add this entry to $PREFIX/librenms.env
XDG_CACHE_HOME=/var/db/librenms/font-cache
dns/dnsmasq-devel: remove port, dns/dnsmasq is newer
Due to administrative issues effectuated earlier in 2026 that have been
unresolved to date, this port been unable to move usefully fast enough.
Let's not pretend otherwise and remove the dnsmasq-devel port,
as announced in its DEPRECATED tag, now that dns/dnsmasq is newer
than this dns/dnsmasq-devel; the DEPRECATED has announced for months
this would happen after dnsmasq's v2.93 release. (There was no
EXPIRATION_DATE because the v2.93 release wasn't fixed to a date.)
Add MOVED and UPDATING entries to suggest that
users should install the stable dns/dnsmasq port instead.
In order to minimize disruption on the quarterly branch, this shall not
be MFH'd, I will propose to update dnsmasq-devel to 2.93 release for
2026Q2 by direct commit instead.
PR: 295851
Pull Request: https://github.com/freebsd/freebsd-ports/pull/529
net/rsync: update 3.4.1 -> 3.4.2
Changelog: https://download.samba.org/pub/rsync/NEWS#3.4.2
Major changes:
- Fixed a signed integer overflow in the PROXY protocol v2 header parser
- Fixed an invalid access to the files array
- Reject negative token values in the compressed-stream token decoder
- Fixed the element count passed to the xattr qsort()
- Fixed a buffer underflow in clean_fname()
- Fixed an uninitialized mul_one in the AVX2 get_checksum1 path (undefined
behaviour)
- Fixed an uninitialized buf1 on the first call to get_checksum2() in the
MD4 path
- Zero all new memory from internal allocations
- Removed support for the unmaintained rsync-patches archive
Port changes:
- Remove File system flags support (--fileflags)
PR: 295044
Reported by: Sven Siegmund <sven.siegmund@gmail.com>
shells/bash-completion: Don't depend on shells/bash{,-static}
Depending on the shell itself during build time create a large dependency
chain. E.g., using the pc file of this port requires bash being built although
technically not required at all. Have the user install bash as a direct
dependency.
PR: 292501
Tested by: michaelo
Approved by: sunpoet (maintainer)
security/openssh-portable: Disable X11Forwarding by default.
This syncs with src and upstream.
Submitted by: jlduran
Differential Revision: https://reviews.freebsd.org/D53268
net/rsync: revert to single package without Python dependency
Restore the previous setup with a single net/rsync package that includes
the rrsync script but does not depend on Python.
Users who require the rrsync script must install Python separately,
as indicated in the install message.
Bump PORTREVISION
This reverts commit fc42790ae011acedf0195c7d31b1cf63b8c02155.
This reverts commit f02bc3be718072b75bd291f81f66b7f15865f535.
PR: 286073
UPDATING: Add guidance to 20260411 Elisp entry for unclean builds
The new text helps users avoid conflicts when building in an unclean
environment.
Reported by: rhurlin
Sponsored by: The FreeBSD Foundation
Emacs Lisp ports framework: Overhaul
This overhaul introduces four key changes to the elisp ports framework:
1. Remove support for packaged byte-compiled elisp.
The primary motivation is to remove a large number of flavor-specific
packages and to simplify the ports tree. As an example, supporting
byte-compiled elisp for devel/tablist required six packages, one for
each flavor of editors/emacs and editors/emacs-devel. With over 100
elisp ports and requests for new Emacs flavors, this was
unmanageable.
2. Install configuration to integrate with Emacs's native compilation
machinery, allowing elisp from ports to be compiled into the standard
cache under the user's home directory.
This matches the behavior of GNU ELPA packages and generally results
in a faster experience. Speedups vary depending on the
characteristics of the elisp code, but are often reported to be 2.5
to 5 times faster than byte-compiled code.
3. Perform byte compilation on the target host, but only when native
compilation is unavailable. Compilation is initiated when Emacs
starts, and the resulting .elc files are cached under the user's
home directory.
4. Load all autoload files installed by FreeBSD elisp ports. This
mirrors what package.el does for ELPA packages, ensuring that
autoloaded functions are available without requiring users to
explicitly load each package.
Users with elisp packages (*-emacs_*) installed should consult the
2026-04-11 UPDATING entry for instructions on handling the transition.
Reviewed by: ashish, Benjamin Jacobs <freebsd@dev.thsi.be>, dinoex,
mandree, mce, nobutaka, Pat Maddox <pat@patmaddox.com>,
rhurlin
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56001
security/openvpn: Update to 2.7.1
This changes installed scripts, openvpn-client.up and .down scripts
are no longer installed into libexec/, but instead a dns-updown script
is placed into libexec/openvpn/ (all under $PREFIX).
Based on a patch provided by Marek Zarychta.
Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1
PR: 293138, 286263
UPDATING: Add note for java/openjdk{25,26} package renames
The jre-flavored packages were renamed in ad618043f3d. Instruct users
on how to rename their installed packages, so `pkg upgrade` will
correctly replace them with the new package names.
Reviewed by: haraldei
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56123
x11/nvidia-driver, x11/nvidia-kmod, x11/linux-nvidia-libs,
graphics/nvidia-drm*-kmod, x11/nvidia-settings, x11/nvidia-xconfig: Update to
595.58.03
Update to latest Production Branch of drivers 595.58.03:
https://www.nvidia.com/en-us/drivers/details/265873/
Linux counterparts for x11/linux-nvidia-libs:
https://www.nvidia.com/en-us/drivers/details/265870/
Also bump -devel variant to match with master ports, as Production
Branch [PB] of drivers have now higher version than New Feature
Branch [NFB] of drivers.
As this update drops a bunch of old (pre-Turing generation of
architectures) GPUs as done in -devel variants updated 20260103,
add -580 variant of legacy branch of driver.
Currently, this is exactly the same version before this update.
(580.142)
PR: 294038
Differential Revision: https://reviews.freebsd.org/D56077
Mk/bsd.default-version.mk: Update default MySQL version to 8.4
Change the default version of MySQL to 8.4
PR: 291336
Exp-run-by: antoine
Sponsored by: Netzkommune GmbH
sysutils/symon: Improve port, take maintainership
- Convert to modern OPTIONS.
- Add record to UPDATING about options.
- "Samplefy" configs.
- Fix warnings from portclippy.
- "Unbreak" on 15+ - disable PF support (patches gratefully received!).
PR: 292366
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
Mk/bsd.default-versions.mk: bump java default to 21
After an extensive time of testing OpenJDK 21 LTS is now the default
java version on FreeBSD.
Some major ports already used Java 21 and some olders ports are now
pinned to OpenJDK 8 or other versions.
For armv6/armv7 OpenJDK 11 is the latest version with support
for these platforms on FreeBSD.
Thanks to everybody involved in making Java a vivid environment on
FreeBSD.
PR: 272855
Relnotes: yes
devel/freebsd-git-arc: Improve discoverability with new port name
Split the old devel/freebsd-git-devtools port into two separate ports,
including this one, to improve discoverability.
Requested by: adrian, ziaee
Reviewed by: des, ziaee
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55129
Revert "textproc/libxml2*: update to 2.15.1, split -core"
The design of this update was repeatedly rejected in the linked PR
with a prescribed different design. This commit is therefore
unauthorised.
This reverts commit 099bd713e09ebdd02d73fde770c50706f980404f.
With hat: desktop (textproc/libxml2), gnome (USES=gnome)
PR: 291316
textproc/libxml2*: update to 2.15.1, split -core
libxml2 now requires xsltproc from libxslt to build,
yet libxslt depends on libxml2,
so we need to break a dependency cycle.
documentation needed to be split out to a separate port.
libxml2 has therefore been split into two ports,
* libxml2 builds the documentation (unless disabled),
* library and executables in libxml2-core.
Pull in one contributor patch suggested by the former libxml2 maintainer
to address one downstream security issue in recent libxslt versions.
This should address arrowd@'s hint that installing libxml2 should
provide a full-featured package.
While here, deprecate libxml2-python according to upstream plans, we
have very few users in the ports tree, and expire end of 2026Q1.
PR: 291316
dns/ddclient: Update 3.11.2 => 4.0.0
Changelog:
https://github.com/ddclient/ddclient/releases/tag/v4.0.0
This release moves the default configuration file location from
/usr/local/etc/ to /usr/local/etc/ddclient/. Please move your
existing ddclient.conf to the new location before restarting ddclient.
- Fix warnings from portclippy.
- Parametrize ddclient with PORTNAME.
- Simplify and optimize do-install.
- Move docs installation to do-install-DOCS-on.
PR: 292669
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
UPDATING: Document lang/cython* and USE_PYTHON=cython* changes
lang/cython has been updated to 3.2.4.
USE_PYTHON=cython* has been updated to reflect lang/cython* changes.
net-mgmt/librenms: Allow for use of mariadb
Remove the run-time dependency upon a mysql client.
This update allows the mysql client to be removed and replaced by a
mariadb client.
PR: 292266
x11/nvidia-driver-devel, x11/nvidia-kmod-devel, x11/linux-nvidia-libs-devel,
graphics/nvidia-drm*-kmod-devel, graphics/externalplatform,
graphics/egl-wayland, graphics/egl-x11 : Update to 590.48.01
Update "-devel" variants to latest New Feature Branch [NFB]
of drivers 590.48.01:
https://www.nvidia.com/en-us/drivers/details/259269/
Linux counterparts for x11/linux-nvidia-libs:
https://www.nvidia.com/en-us/drivers/details/259267/
! Important note !
As already notified by HEADSUP at freebsd-ports ML [1],
this version drops support for a bunch of old GPUs
prior to Turing Generation of the architecture.
Anyone using dropped GPUs need to switch to master ports,
currently at 580.119.02.
Note that once 590 series or later drivers become Production
Branch of drivers, new legacy branch -580 would be created.
See "Appendix A. Supported NVIDIA GPU Products" in README [2]
whether or not your GPU is still supported or not before
upgrading.
While here, update underlying EGL components as below:
graphics/externalplatform: 1.2.1
graphics/egl-wayland : 1.1.20
And added one more EGL component that Linux version already has:
graphics/egl-x11
One more EGL component to come in the future if it is tagged
with non-RC number on hopefully next driver ports upgrade.
[1] https://lists.freebsd.org/archives/freebsd-ports/2025-December/008804.html
[2]
https://us.download.nvidia.com/XFree86/FreeBSD-x86_64/590.48.01/README/supportedchips.html
PR: 292027
Differential Revision: https://reviews.freebsd.org/D54414
net/rsync: Fix stealth dependency on Python
net/rsync includes a Python script installed as sbin/rrsync
without declaring a dependency on Python.
Adds a port option, PYTHON, that controls whether rrsync is
installed and adds the necessary dependency and remove the
pkg-message who advises that Python might be needed.
By default this option is off (updating the package will remove rrsync).
PR: 286073
Reported by: Christian Ullrich <chris@chrullrich.net>
net/unison: Update to 2.53.8
With this release unison added an install target.
This install target always installs the text only executable as
unison, and the UI as unison-gui. The port is modified to follow
suit.
pkg-message has been modified to document this change when upgrading,
and an entry is added to UPDATING.
UPDATING: Document possible build error of seculity/clamav and how to work
around it
PR: 290150
Reported by: Piotr Zmudzinsk, Xavier Humbert, Sigi, Fabian Wenk
x11/nvidia-driver: Split kmod into x11/nvidia-kmod
Split out kmod part of x11/nvidia-driver into x11/nvidia-kmod,
including slave ports, to allow FreeBSD-kmods repo builders building
nvidia-related kmod ports.
In this update,
* split out *.ko from x11/nvidia-driver[-304|-340|-390|470|-devel]
into corresponding x11/nvidia-kmod[-304|-340|-390|470|-devel],
* switch dependency of graphics/nvidia-drm-*-kmod upon
x11/nvidia-driver[-devel] to newly introduced
x11/nvidia-kmod[-devel],
* make x11/nvidia-driver[-304|-340|-390|470|-devel] depend upon
newly introduced x11/nvidia-kmod[-304|-340|-390|470|-devel],
* bump consumers directly depending upon x11/nvidia-driver*
as of dependency switches,
* and hook x11/nvidia-kmod[-304|-340|-390|470|-devel] to build.
Note that upgrading x11/nvidia-driver* from monolithic version
requires deinstallation of x11/nvidia-driver* before starting,
as both previous version of x11/nvidia-driver* and newly introduced
x11/nvidia-kmod* installs *.ko into same place.
PR: 288314
Approved by: bapt (kmod repo)
Differential Revision: https://reviews.freebsd.org/D52178
sysutils/py-mitogen: update to 0.3.27
Ansible 12 has deprecated third-party strategy plugins. This is
currently how Mitogen integrates with Ansible (e.g.
ANSIBLE_STRATEGY=mitogen_linear). Running Ansible 12 + Mitogen will
currently print a deprecation warning
Changelog: https://github.com/mitogen-hq/mitogen/blob/master/docs/changelog.rst#v0327-2025-08-20
Sponsored by: SkunkWerks, GmbH
Revert "security/py-fail2ban: Remove unneeded filter.d files"
While some users want the upstream sshd filters to have the
contents the BSD sshd filters, others use them as is. Revert
this change. Let users decide which to use.
PR: 288849
This reverts commit d906503fb22992a7a92d46365b9f2af31454dee6.
security/py-fail2ban: Remove unneeded filter.d files
There is some confusion whether to use the sshd.conf, bsd-sshd.conf.
or the bsd-sshd-session.conf filters. bsd-sshd-session.conf is the
correct and only filter to use on FreeBSD systems. Using the others
will result in incorrect operation on a FreeBSD system with a supported
sshd installed.
PR: 288849
