java/apache-commons-lang: Remove expired port
2026-10-31 java/apache-commons-lang: Unpatched CVE, last release in 2011, does
not compile with Java 11+, not actively maintained. Superseded by port
java/apache-commons-lang3.
textproc/lucene: Remove expired port
2026-10-31 textproc/lucene: Release from 2013. Unsupported upstream. Lucene is
now at version 10.X. Superseded in ports by textproc/lucene9.
games/eduke32 20260807_1
Duke Nukem 3D Port based on JFDuke and EDuke
games/eduke32: Add fullscreen-display patch
In window managers such as dwm, fvwm, bvwm, etc. moving fullscreen
windows should cause resizing to the new output display.
eduke32 automatically resizes in window mode but not when asked to
run fullscreen. This patch causes resize when, for example, a user
in dwm utilizes Alt+Shift+Period (or Alt+Shift+Comma) to send the
game to another screen.
net/igmpproxy: Fix igmpproxy_conf rc.d knob, document user and chroot
- The rc.d script documented igmpproxy_conf but read igmpproxy_config,
and required_files always pointed to the default path. Honor
igmpproxy_conf, keeping igmpproxy_config as a fallback so existing
setups do not break, and check the file actually in use.
- Add commented user and chroot examples to the sample configuration.
They allow igmpproxy to drop privileges once sysutils/mac_igmpproxy
is loaded.
Sponsored by: Rubicon Communications, LLC ("Netgate")
sysutils/mac_igmpproxy: New port, MAC policy for net/igmpproxy
A MAC framework policy that grants the multicast routing privilege to
a single configurable UID, so net/igmpproxy can drop root and run as
the new igmpproxy user (UID/GID 422). The policy can be tuned or
disabled with the security.mac.igmpproxy.uid and
security.mac.igmpproxy.enabled sysctls.
PR: 291647
emulators/open-vm-tools: Use fixed name and rcvar in vmware-kmod
vmware-kmod handles two kernel modules by setting name and rcvar from
$kernel_mod and calling run_rc_command twice. Tools that read rcvar
without running the script, such as service -e, see the unexpanded
variable and check the nonexistent $vmware_guest__enable, warning on
every host where the package is installed.
Give the script a fixed name (vmware_guest_kmod) and rcvar
(vmware_guest_kmod_enable), and have start and status loop over the
modules, each honoring its own knob. The script name and rc.conf
knobs are unchanged: vmware_guest_kmod_enable (default YES) still
supplies the defaults for vmware_guest_vmmemctl_enable and
vmware_guest_vmblock_enable, either of which can still be enabled on
its own, and rc.conf.d files for the per-module names are still read.
PR: 300431
Sponsored by: Rubicon Communications, LLC ("Netgate")
net/dhcpdump 2.00
Decode and diagnose sniffed DHCP packets
net/dhcpdump: Update to 2.00 and switch to the active fork
The original dhcpdump 1.8 has not been maintained for many years. Move
to the dhcpdump-org fork, which Debian and Fedora already ship.
Changes since 1.8 include VLAN (802.1Q/802.1ad) support, reading from
pcap files, an option to dump the whole packet in hex, option 82/121/
249/93/94/116 decoding, updated IANA option names and several fixes for
out-of-bounds reads on crafted packets.
Add a TUI option, enabled by default, for the new interactive session
tracking interface (-t). It depends on devel/yascreen.
PR: 297349
Reported by: diizzy
Sponsored by: Rubicon Communications, LLC ("Netgate")
devel/yascreen: New port, curses replacement library
yascreen is a small curses replacement library for daemons and embedded
applications. It has no external dependencies, supports internal and
external event loops, can work over stdin/stdout or a socket (including
basic telnet sequences) and handles Unicode.
It is needed by the interactive TUI of net/dhcpdump 2.x.
Sponsored by: Rubicon Communications, LLC ("Netgate")
security/sudo 1.9.17p2_4
Allow others to run commands as root
security/sudo: Add LOGSRVD option and rc.d script for sudo_logsrvd
- Add a LOGSRVD option, enabled by default so current users see no
change, to build sudo_logsrvd and sudo_sendlog. When disabled the
server, its sample configuration, rc script and man pages are not
installed (--disable-log-server).
- Install an rc.d script for sudo_logsrvd. It is disabled by default,
enable it with sudo_logsrvd_enable=YES.
- Fix the SSL option description. It does not affect sudo itself, only
TLS for sudo_logsrvd and I/O log transfer.
PR: 287631
Reported by: Anton Saietskii <vsasjason@gmail.com>
Sponsored by: Rubicon Communications, LLC ("Netgate")
security/sudo 1.9.17p2_3
Allow others to run commands as root
security/sudo: Put base system directories first in secure_path
The default sudoers file installed by the port has an active
secure_path line inherited from upstream's configure.ac, which lists
/usr/local/sbin and /usr/local/bin before the base system directories.
That is a Linux convention. On FreeBSD, LOCALBASE belongs to
ports/packages and the base system comes first everywhere else, so a
binary under /usr/local/bin could shadow a base utility when run
through sudo.
Set --with-secure-path-value so the default sudoers uses
/sbin:/bin:/usr/sbin:/usr/bin:${LOCALBASE}/sbin:${LOCALBASE}/bin.
Existing installations that edited /usr/local/etc/sudoers are not
affected.
PR: 299746
Sponsored by: Rubicon Communications, LLC ("Netgate")
mail/dma 0.14_1,1
DragonFly Mail Agent, a small MTA for local/outbound mail
mail/dma: Update to upstream master (f4e1d913)
The port pinned GH_TAGNAME to a commit that predates the v0.14 tag, so
the package lacked VERIFYCERT and SNI support in TLS. Pin the current
upstream master instead, which contains v0.14 plus following changes:
- LMTP: support relaying to an LMTP endpoint
- AUTH PLAIN support, with clearer syslog output when the server
offers no usable auth mechanism
- HELO fallback when the server rejects EHLO
- Accept "|" as separator between smarthost and password
- Terminate each local mbox message with an empty line (RFC 4155)
- Discard bounce queue items when handling a double bounce
- Cast ctype arguments to unsigned char
- Disambiguate two identical error messages (issue #139)
- Fix building bsd/ after "make obj"; dma.8 and SPDX updates
PR: 299680
Co-Authored by: Philip Dodd <orange.spyderman@gmail.com>
Sponsored by: Rubicon Communications, LLC ("Netgate")
www/worldmonitor: Add New Port
World Monitor is a dashboard that brings together news and geopolitical,
infrastructure and market data on one page. The port installs the
self-hosted web application with its Redis REST proxy, relay and seed
services.
WWW: https://github.com/koala73/worldmonitor
Sponsored by: Netzkommune GmbH
net/rsync: fix denial of service in the delta-transfer sender
Take the upstream fix, there is no release containing it yet.
Obtained
from: https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04
Security: c70f21b6-d7b4-11f1-bae2-3497f65b111b
With hat: ports-secteam
Sponsored by: Netzkommune GmbH
(cherry picked from commit 4db1fd2c615a835c1679328f40b9765c8dd8385f)
sysutils/ytop 1.1.0
Minimal process monitor for FreeBSD
sysutils/ytop: update to 1.1.0
Remove the ncurses dependency in favor of a built-in VT terminal module.
Separate the thread list into a dedicated view with per-thread metrics.
Add a CPU usage grid to the thread view.
PR: 300469
security/netbird 0.82.0
Peer-to-peer VPN that seamlessly connects your devices
security/netbird: Update 0.81.5 => 0.82.0
This release removes MySQL store and deprecates Rosenpass,
please see pkg-message or the changelog for more details.
Changelog:
https://github.com/netbirdio/netbird/releases/tag/v0.82.0
PR: 300474
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit f0cd3120b45056ae22c134e3df1bb9ab98c34b77)
security/netbird 0.82.0
Peer-to-peer VPN that seamlessly connects your devices
security/netbird: Update 0.81.5 => 0.82.0
This release removes MySQL store and deprecates Rosenpass,
please see pkg-message or the changelog for more details.
Changelog:
https://github.com/netbirdio/netbird/releases/tag/v0.82.0
PR: 300474
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Chase the vod module update, which these ports build in themselves.
Sponsored by: Netzkommune GmbH
www/freenginx: Remove stale subs_filter plist entry
The option went away with the module, the packing list kept its line.
Fixes: 445f9e590a9e ("www/{nginx,nginx-devel,freenginx}: 3rd-party modules
management")
Sponsored by: Netzkommune GmbH
net-mgmt/semaphore: Update to 2.19.18
Adds SEMAPHORE_SESSION_INACTIVITY_HOURS, which expires a login session
that stayed unused for that many hours.
Changelog:
https://github.com/semaphoreui/semaphore/releases/tag/v2.19.18
Sponsored by: Netzkommune GmbH
deskutils/vit: Update to 2.3.5
Keeps the command input when quote validation fails, defers the terminal
setup until after the screen is cleared and takes calc_width from the
public urwid API. Packaging now covers Python 3.11 through 3.15.
Changelog:
https://github.com/vit-project/vit/releases/tag/v2.3.5
Sponsored by: Netzkommune GmbH
audio/atunes 3.2.0_1
Full-featured audio player and manager developed in Java
audio/atunes: deprecate for expiration
does not work with jdk11+
last upstream version is from 2014
To keep this in the ports tree, I think it needs a fork with an update to a
recent JDK.
Approved by: no maintainer
devel/charva 1.1.4_10
Java Windowing Toolkit for Text Terminals
devel/charva: deprecate for expiration
does not build with jdk11+
latest upstream is from 2006
no users in the ports tree
PR: 300472
Approved by: Alex Dupre <ale@> (maintainer)
graphics/aoi 3.0_8
Open source Java written 3D modelling and rendering studio
graphics/aoi: deprecate for expiration
Version from 2013, 13 years behind on upstream
no users in the tree
not actively maintained
please email the maintainer if you use this
Approved by: no maintainer
editors/openoffice-devel: build using openjdk21
Build openoffice-devel with build using openjdk21.
PR: 300455
Reported by: Ronald Klop <ronald@FreeBSD.org>
