multimedia/jellyfin-ffmpeg: Update to 8.1.3.2 Changelog: https://github.com/jellyfin/jellyfin-ffmpeg/releases/tag/v8.1.3-2 Reviewed by: dtxdf Approved by: dtxdf (mentor) Differential Revision: https://reviews.freebsd.org/D61165

sysutils/py-dbuild: Update to 1.13.1 ChangeLog: - https://github.com/daemonless/dbuild/releases/tag/v1.13.1 Reviewed by: dtxdf Approved by: dtxdf (mentor, maintainer) Differential Revision: https://reviews.freebsd.org/D61171

devel/zizmor: Update to 1.32.0 Changelog: https://github.com/zizmorcore/zizmor/releases/tag/v1.32.0 Reported by: GitHub (watch releases)

databases/pgbadger: Update to 13.3 Release notes: https://github.com/darold/pgbadger/releases/tag/v13.3

net-mgmt/omada6: Update to 6.3.0.111

textproc/markterm: Update to 0.17.0 - bump the rebased litehtml submodule at d908f3f8 - regenerate patches against the new sources Sponsored by: SkunkWerks, GmbH

ports-mgmt/git-proxy: New port - generic caching repository proxy - serve pkg(8) repositories at /freebsd/${ABI}/${set}/ - serve custom repositories from upstream.freebsd_repositories at /freebsd/{name}/ - https://github.com/git-pkgs/proxy - cache many different types of asset and package registries Sponsored by: SkunkWerks, GmbH

www/monolith: Update to 2.11.6 and take maintainership While here, claim maintainership after three consecutive maintainer timeouts. Changelog: https://github.com/Y2Z/monolith/releases/tag/v2.11.6 PR: 299625 Approved by: lcook (former maintainer, timeout 2 weeks)

databases/openvoxdb9: Update to 9.2.0 Release notes: https://github.com/OpenVoxProject/openvoxdb/releases#release-9.2.0 With hat: puppet

databases/openvoxdb8: Update to 8.18.0 Release notes: https://github.com/OpenVoxProject/openvoxdb/releases#release-8.18.0 With hat: puppet

sysutils/openvox-server9: Update to 9.2.0 Release notes: https://github.com/OpenVoxProject/openvox-server/releases/tag/9.2.0 With hat: puppet

sysutils/openvox-server8: Update to 8.18.0 Release notes: https://github.com/OpenVoxProject/openvox-server/releases/tag/8.18.0 With hat: puppet

sysutils/rubygem-choria-mcorpc-support: Update to 0.28.0 Release notes: https://github.com/choria-io/choria-mcorpc-support/releases/tag/2.28.0 With hat: puppet

sysutils/openvox-agent9: Update to 9.3.0 Release notes: https://github.com/OpenVoxProject/openvox/releases/tag/9.3.0 With hat: puppet

sysutils/openvox-agent8: Update to 8.32.0 Release notes: https://github.com/OpenVoxProject/openvox/releases/tag/8.32.0 With hat: puppet

net/ooni-probe-cli: update to 3.31.1 Security: updated brotli dependency [1] MFH: 2026Q4 [1] https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42

x11-wm/bvwm: Update to 1.1.5.b.10 ChangeLog: https://github.com/FrauBSD/bvwm/blob/1.1.5-bvwm.10/BCHANGELOG.md

x11/bhotkeys-audio: Update to 1.3 ChangeLog: https://github.com/FrauBSD/bhotkeys-audio/blob/1.3/CHANGELOG.md

x11/bosd: Update to 11.0 ChangeLog: https://github.com/FrauBSD/bosd/blob/11.0/CHANGELOG.md

x11/bhotkeys: Update to 1.9 ChangeLog: https://github.com/FrauBSD/bhotkeys/blob/1.9/CHANGELOG.md

java/apache-commons-lang: Remove expired port 2026-10-31 java/apache-commons-lang: Unpatched CVE, last release in 2011, does not compile with Java 11+, not actively maintained. Superseded by port java/apache-commons-lang3.

textproc/lucene: Remove expired port 2026-10-31 textproc/lucene: Release from 2013. Unsupported upstream. Lucene is now at version 10.X. Superseded in ports by textproc/lucene9.

databases/kividb: update: 1.1.3 -> 1.2.0 ChangeLog: https://github.com/kividbio/kividb/compare/v1.1.3...v1.2.0 Sponsored by: tipi.work

games/eduke32: Add fullscreen-display patch In window managers such as dwm, fvwm, bvwm, etc. moving fullscreen windows should cause resizing to the new output display. eduke32 automatically resizes in window mode but not when asked to run fullscreen. This patch causes resize when, for example, a user in dwm utilizes Alt+Shift+Period (or Alt+Shift+Comma) to send the game to another screen.

games/eduke32: Switch to using DISTVERSION

games/eduke32: Fixes for portfmt -D Makefile

games/eduke32: Fixes for portclippy Makefile

sysutils/dekit: Remove expired port 2026-11-03 sysutils/dekit: Cannot upgrade due to linuxisms

sysutils/flock: Update to 2.41.6 Sponsored by: Rubicon Communications, LLC ("Netgate")

net/tcpdump: Update to 4.99.7 Sponsored by: Rubicon Communications, LLC ("Netgate")

net/igmpproxy: Fix igmpproxy_conf rc.d knob, document user and chroot - The rc.d script documented igmpproxy_conf but read igmpproxy_config, and required_files always pointed to the default path. Honor igmpproxy_conf, keeping igmpproxy_config as a fallback so existing setups do not break, and check the file actually in use. - Add commented user and chroot examples to the sample configuration. They allow igmpproxy to drop privileges once sysutils/mac_igmpproxy is loaded. Sponsored by: Rubicon Communications, LLC ("Netgate")

sysutils/mac_igmpproxy: New port, MAC policy for net/igmpproxy A MAC framework policy that grants the multicast routing privilege to a single configurable UID, so net/igmpproxy can drop root and run as the new igmpproxy user (UID/GID 422). The policy can be tuned or disabled with the security.mac.igmpproxy.uid and security.mac.igmpproxy.enabled sysctls. PR: 291647

emulators/open-vm-tools: Use fixed name and rcvar in vmware-kmod vmware-kmod handles two kernel modules by setting name and rcvar from $kernel_mod and calling run_rc_command twice. Tools that read rcvar without running the script, such as service -e, see the unexpanded variable and check the nonexistent $vmware_guest__enable, warning on every host where the package is installed. Give the script a fixed name (vmware_guest_kmod) and rcvar (vmware_guest_kmod_enable), and have start and status loop over the modules, each honoring its own knob. The script name and rc.conf knobs are unchanged: vmware_guest_kmod_enable (default YES) still supplies the defaults for vmware_guest_vmmemctl_enable and vmware_guest_vmblock_enable, either of which can still be enabled on its own, and rc.conf.d files for the per-module names are still read. PR: 300431 Sponsored by: Rubicon Communications, LLC ("Netgate")

net/dhcpdump: Update to 2.00 and switch to the active fork The original dhcpdump 1.8 has not been maintained for many years. Move to the dhcpdump-org fork, which Debian and Fedora already ship. Changes since 1.8 include VLAN (802.1Q/802.1ad) support, reading from pcap files, an option to dump the whole packet in hex, option 82/121/ 249/93/94/116 decoding, updated IANA option names and several fixes for out-of-bounds reads on crafted packets. Add a TUI option, enabled by default, for the new interactive session tracking interface (-t). It depends on devel/yascreen. PR: 297349 Reported by: diizzy Sponsored by: Rubicon Communications, LLC ("Netgate")

devel/yascreen: New port, curses replacement library yascreen is a small curses replacement library for daemons and embedded applications. It has no external dependencies, supports internal and external event loops, can work over stdin/stdout or a socket (including basic telnet sequences) and handles Unicode. It is needed by the interactive TUI of net/dhcpdump 2.x. Sponsored by: Rubicon Communications, LLC ("Netgate")

security/sudo: Add LOGSRVD option and rc.d script for sudo_logsrvd - Add a LOGSRVD option, enabled by default so current users see no change, to build sudo_logsrvd and sudo_sendlog. When disabled the server, its sample configuration, rc script and man pages are not installed (--disable-log-server). - Install an rc.d script for sudo_logsrvd. It is disabled by default, enable it with sudo_logsrvd_enable=YES. - Fix the SSL option description. It does not affect sudo itself, only TLS for sudo_logsrvd and I/O log transfer. PR: 287631 Reported by: Anton Saietskii <vsasjason@gmail.com> Sponsored by: Rubicon Communications, LLC ("Netgate")

security/sudo: Put base system directories first in secure_path The default sudoers file installed by the port has an active secure_path line inherited from upstream's configure.ac, which lists /usr/local/sbin and /usr/local/bin before the base system directories. That is a Linux convention. On FreeBSD, LOCALBASE belongs to ports/packages and the base system comes first everywhere else, so a binary under /usr/local/bin could shadow a base utility when run through sudo. Set --with-secure-path-value so the default sudoers uses /sbin:/bin:/usr/sbin:/usr/bin:${LOCALBASE}/sbin:${LOCALBASE}/bin. Existing installations that edited /usr/local/etc/sudoers are not affected. PR: 299746 Sponsored by: Rubicon Communications, LLC ("Netgate")

mail/dma: Update to upstream master (f4e1d913) The port pinned GH_TAGNAME to a commit that predates the v0.14 tag, so the package lacked VERIFYCERT and SNI support in TLS. Pin the current upstream master instead, which contains v0.14 plus following changes: - LMTP: support relaying to an LMTP endpoint - AUTH PLAIN support, with clearer syslog output when the server offers no usable auth mechanism - HELO fallback when the server rejects EHLO - Accept "|" as separator between smarthost and password - Terminate each local mbox message with an empty line (RFC 4155) - Discard bounce queue items when handling a double bounce - Cast ctype arguments to unsigned char - Disambiguate two identical error messages (issue #139) - Fix building bsd/ after "make obj"; dma.8 and SPDX updates PR: 299680 Co-Authored by: Philip Dodd <orange.spyderman@gmail.com> Sponsored by: Rubicon Communications, LLC ("Netgate")

www/worldmonitor-cli: Add New Port Command-line client with a terminal dashboard for the World Monitor service. WWW: https://github.com/koala73/worldmonitor/tree/main/cli Sponsored by: Netzkommune GmbH

www/worldmonitor: Add New Port World Monitor is a dashboard that brings together news and geopolitical, infrastructure and market data on one page. The port installs the self-hosted web application with its Redis REST proxy, relay and seed services. WWW: https://github.com/koala73/worldmonitor Sponsored by: Netzkommune GmbH

mail/mailfromd: update the port to version 9.2 Requested by: maintainer

net/rsync: fix denial of service in the delta-transfer sender Take the upstream fix, there is no release containing it yet. Obtained from: https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04 Security: c70f21b6-d7b4-11f1-bae2-3497f65b111b With hat: ports-secteam Sponsored by: Netzkommune GmbH

security/vuxml: Document rsync denial of service Sponsored by: Netzkommune GmbH

textproc/py-wcmatch: update to 12.0 Changes: https://github.com/facelessuser/wcmatch/releases/tag/12.0 Reported-by: repology

textproc/py-bracex: update to 3.2.1 Changes: https://github.com/facelessuser/bracex/releases/tag/3.2.1 Reported-by: repology

textproc/kibana95: Update 9.5.5 => 9.5.6 Changelog: https://www.elastic.co/docs/release-notes/kibana#kibana-9.5.6-release-notes Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

sysutils/beats95: Update 9.5.5 => 9.5.6 Changelog: https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.5.6 Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

sysutils/logstash95: Update 9.5.5 => 9.5.6 Changelog: https://www.elastic.co/docs/release-notes/logstash#logstash-9.5.6-release-notes Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

textproc/kibana94: Update 9.4.8 => 9.4.9 Changelog: https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.9-release-notes Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

sysutils/beats94: Update 9.4.8 => 9.4.9 Changelog: https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.4.9 Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

sysutils/logstash94: Update 9.4.8 => 9.4.9 Changelog: https://www.elastic.co/docs/release-notes/logstash#logstash-9.4.9-release-notes Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

textproc/kibana8: Update 8.19.23 => 8.19.24 Changelog: https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.24.html Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

sysutils/beats8: Update 8.19.23 => 8.19.24 Changelog: https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.19.24.html Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

sysutils/logstash8: Update 8.19.23 => 8.19.24 Changelog: https://www.elastic.co/guide/en/logstash/8.19/logstash-8-19-24.html Approved by: elastic (implicit, inactive) Sponsored by: UNIS Labs MFH: 2026Q4

emulators/libmt32emu: Update 2.8.3 => 2.8.5 Changelog: https://github.com/munt/munt/blob/libmt32emu_2_8_5/mt32emu/NEWS.txt PR: 300485 Approved by: osa, vvd (mentors, implicit) MFH: 2026Q4

devel/py-assertpy: update to 2.35.0 Changes: https://github.com/assertpy/assertpy/releases/tag/v2.35.0 Reported-by: repology

security/vuxml: Add FreeBSD (base) to the sqlite3 entry

devel/sem: Update to 0.29.1

sysutils/ytop: update to 1.1.0 Remove the ncurses dependency in favor of a built-in VT terminal module. Separate the thread list into a dedicated view with per-thread metrics. Add a CPU usage grid to the thread view. PR: 300469

sysutils/screen*: Add UTMPX option Add a configuration option to log screen PTYs to UTMPX. PR: 299259

devel/raylib: Update 6.0 => 6.2 Changelog: https://github.com/raysan5/raylib/releases/tag/6.2 - Remove unnecessary post-install. - Install includes in include/raylib/ instead if include/. - Parametrize libs version. - Exclude from extract 70+MB examples. PR: 300468 Sponsored by: UNIS Labs (vvd)

net/krill: Update 0.16.0 => 0.16.1 Release Notes: https://community.nlnetlabs.nl/t/krill-0-16-1-no-small-wonder-released/3498 Changelog: https://github.com/NLnetLabs/krill/releases/tag/v0.16.1 PR: 300484 Approved by: osa, vvd (mentors, implicit) Security: CVE-2026-109140 Security: CVE-2026-109141 Security: CVE-2026-109142 MFH: 2026Q4

security/vuxml: Add net/krill vulnerabilities PR: 300484 Approved by: osa, vvd (mentors, implicit)

security/netbird: Update 0.81.5 => 0.82.0 This release removes MySQL store and deprecates Rosenpass, please see pkg-message or the changelog for more details. Changelog: https://github.com/netbirdio/netbird/releases/tag/v0.82.0 PR: 300474 Approved by: osa, vvd (mentors, implicit) MFH: 2026Q4

security/keychain: drop maintainership

databases/mongodb-tools: 100.20.1 Released 2026-11-02 Changes: https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md#100201

deskutils/nextcloudclient: Update to 35.0.2

www/{nginx,nginx-devel,freenginx}: 3rd-party modules management Chase the vod module update, which these ports build in themselves. Sponsored by: Netzkommune GmbH

www/freenginx: Remove stale subs_filter plist entry The option went away with the module, the packing list kept its line. Fixes: 445f9e590a9e ("www/{nginx,nginx-devel,freenginx}: 3rd-party modules management") Sponsored by: Netzkommune GmbH

www/nginx-module-vod: Update to 1.11.2 Changelog: https://github.com/dio-az/nginx-vod-module/blob/v1.11.2/CHANGELOG.md Sponsored by: Netzkommune GmbH

net-mgmt/semaphore: Update to 2.19.18 Adds SEMAPHORE_SESSION_INACTIVITY_HOURS, which expires a login session that stayed unused for that many hours. Changelog: https://github.com/semaphoreui/semaphore/releases/tag/v2.19.18 Sponsored by: Netzkommune GmbH

misc/py-claude-agent-sdk: Update to 0.2.177 Adds an on_failure option to HookMatcher that blocks the action when a hook callback fails, and updates the bundled Claude CLI. Changes: https://github.com/anthropics/claude-agent-sdk-python/blob/v0.2.177/CHANGELOG.md Sponsored by: Netzkommune GmbH

deskutils/vit: Update to 2.3.5 Keeps the command input when quote validation fails, defers the terminal setup until after the screen is cleared and takes calc_width from the public urwid API. Packaging now covers Python 3.11 through 3.15. Changelog: https://github.com/vit-project/vit/releases/tag/v2.3.5 Sponsored by: Netzkommune GmbH

devel/py-maturin: Update to 1.16.0 Changelog: https://github.com/PyO3/maturin/releases/tag/v1.16.0

net-mgmt/telegraf: Update to 1.40.3 Release notes: https://github.com/influxdata/telegraf/releases/tag/v1.40.3

x11-drivers/xf86-video-intel: Update to 2.99.917-939 Update WWW and TOOLS dependencies. Changes: https://gitlab.freedesktop.org/xorg/driver/xf86-video-intel/-/compare/b74b67f0f321...4a64400ec6a7 PR: 279380 Approved by: x11 (maintainer timeout) Approved by: osa, fluffy (mentors, implicit) Co-authored-by: jbeich

security/vuxml: Fix LibreSSL range

security/rustls-ffi: Fix build failure

audio/atunes: deprecate for expiration does not work with jdk11+ last upstream version is from 2014 To keep this in the ports tree, I think it needs a fork with an update to a recent JDK. Approved by: no maintainer

devel/charva: deprecate for expiration does not build with jdk11+ latest upstream is from 2006 no users in the ports tree PR: 300472 Approved by: Alex Dupre <ale@> (maintainer)

graphics/aoi: oops, typo in the new year

textproc/obsidian: Update to 1.15.0

graphics/aoi: deprecate for expiration Version from 2013, 13 years behind on upstream no users in the tree not actively maintained please email the maintainer if you use this Approved by: no maintainer

devel/srell: 2026.07 => 2026.08 * Remove PORTSCOUT:site helper as it didn't help

net/realtek-re-kmod: update to latest commit to get some additional improvements.

cad/abc: g20260925 => g20261102

devel/reflect-cpp: Update 0.26.2 => 0.27.1

editors/openoffice-devel: build using openjdk21 Build openoffice-devel with build using openjdk21. PR: 300455 Reported by: Ronald Klop <ronald@FreeBSD.org>

mail/nextcloud-mail: Update to 5.13.0

www/nextcloud-memories: Update to 11.0.1

www/py-recaptcha: Deprecate Python 2 code for the reCAPTCHA v1 API, which was shut down. While here, fix portlint warnings. Set the EXPIRATION_DATE to the beginning of next month. Since the API has been shut down, I don't expect anyone to care though. PR: 299951