www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the dav_ext, auth_digest, subs_filter, link and upload modules from
their own source ports. freenginx drops HTTP_SUBS_FILTER, which needs a
structure field freenginx does not provide.
Sponsored by: Netzkommune GmbH
www/nginx-module-link: Add New Port
Sources of the link_func module, which dispatches a request to a function
in a C library loaded at run time. The nginx ports build it from here
when their LINK option is set.
Sponsored by: Netzkommune GmbH
www/nginx-module-subs-filter: Add New Port
Sources of the subs_filter module, which rewrites strings in the response
body. The nginx ports build it from here when their HTTP_SUBS_FILTER
option is set.
Sponsored by: Netzkommune GmbH
www/nginx-module-auth-digest: Add New Port
Sources of the auth_digest module, which adds RFC 2617 HTTP digest
authentication. The nginx ports build it from here when their
HTTP_AUTH_DIGEST option is set.
Sponsored by: Netzkommune GmbH
www/nginx-module-dav-ext: Add New Port
Sources of the dav_ext module, which adds the PROPFIND, OPTIONS, LOCK and
UNLOCK WebDAV methods on top of the standard dav module. The nginx ports
build it from here when their HTTP_DAV_EXT option is set.
Sponsored by: Netzkommune GmbH
www/nginx-module-upload: Add New Port
Sources of the upload module, a maintained fork that adds multipart and
resumable file uploads. The nginx ports build it from here when their
UPLOAD option is set.
Sponsored by: Netzkommune GmbH
x11/xpra 6.5.5
Persistent remote applications for X
x11/xpra: Update to 6.5.5
Changes: https://github.com/Xpra-org/xpra/releases/tag/v6.5.5
Make the OPTIONS work. The port builds with pep517 but passed its
--with-X/--without-X switches through PYDISTUTILS_*ARGS, which pep517
ignores, so setup.py autodetected everything. Pass them through
XPRA_EXTRA_BUILD_ARGS in MAKE_ENV, which setup.py reads.
- Every OPTION maps to a switch: AVAHI=mdns, CUPS=printing, DOCS=docs,
GSTREAMER=gstreamer (never passed before), LIBYUV=csc_libyuv,
WEBCAM=webcam. pandoc is only needed for DOCS.
- Drop dec_avcodec2 and enc_ffmpeg (6.5.5 has no FFmpeg codecs), the
unused libavcodec LIB_DEPENDS and their DESCs.
- GSTREAMER off removes xpra/codecs/gstreamer; xpra/gstreamer is always
installed (--without-gstreamer only turns off gstreamer_audio and
gstreamer_video).
Changes in the default package (AVAHI CUPS DOCS GSTREAMER), which was
autodetected so far:
- csc_libyuv (xpra/codecs/libyuv) was built whenever libyuv was in the
build environment; it now needs LIBYUV (off by default).
- xpra/webcam was always built; it now needs WEBCAM (off by default),
and conf.d/35_webcam.conf now says "webcam = no".
- Xdummy and Xdummy_wrapper are now passed as off, as the port intended;
this only silences a build-time Xdummy detection warning.
- vpx and uinput stay on: the port asked for --without-vpx and
--without-uinput, but that was ignored and the package (pkg-plist,
LIB_DEPENDS libvpx) ships both; they are now enabled explicitly.
enc_x264 stays on, pam (Linux only) and strict stay off.
- mdns, printing, gstreamer and docs are unchanged by default, but
turning their OPTION off now really removes them (GSTREAMER: only
xpra/codecs/gstreamer, see above).
Also fixed:
- xpra.codecs.gstreamer.capture imports CSC_ALIAS from
xpra.codecs.constants, which 6.5.4 and 6.5.5 do not define, so the
optional gstreamer capture codec failed to import. Drop the import
and map NV12 to YUV420P inline, as CSC_ALIAS did. Upstream v6.5.x
has the same code; master replaced the module (e7c3c948a5).
- AudioSource took the first PulseAudio monitor device with
monitor_devices.items()[0][0], a TypeError on Python 3; use
next(iter(monitor_devices)).
- Drop the unused py-pyinotify dependency, and bencode.py, brotli, lz4
and rencode, which nothing imports (xpra builds its own Cython
modules against liblz4 and libbrotli).
While here, add python to CATEGORIES and fix portlint warnings.
PR: 300172
graphics/yacreader: Fix build with unarr 1.2.0
unarr 1.2.0 made UNARR_API_VERSION an expression containing casts, which
is not valid in #if. Drop the version guards; the check was for unarr
1.1.0 or newer and the tree is well past that.
Reported upstream: https://github.com/selmf/unarr/issues/40
MFH: 2026Q4
archivers/unarr 1.2.0
Decompression library for RAR, TAR, ZIP and 7z* archives
archivers/unarr: Update to 1.2.0
Fixes four security issues in the rar, zip and tar readers, two of them
with assigned CVEs.
Drop both patches. Upstream raised the CMake minimum to the same range
the port was patching in, and the bundled LZMA SDK (now v26.05) handles
FreeBSD's elf_aux_info() on arm and aarch64 by itself.
Switch to the release tarball upstream now publishes.
Take maintainership.
ChangeLog: https://github.com/selmf/unarr/blob/v1.2.0/CHANGELOG.md
MFH: 2026Q4
Security: 6f31f4ab-d5fd-11f1-b2f0-002b67dfc673
www/serendipity: 2.5.0 -> 2.6.1
Changelog:
https://github.com/s9y/Serendipity/releases/tag/2.6.0https://github.com/s9y/Serendipity/releases/tag/2.6.1
Security: A critical bug in the username logic, allowing existing usernames to
be duplicated and to capture the rights of existing accounts
Security: XSS injection vector on the search page, the search term was not
properly (or rather, twice) escaped
Security: An outdated blacklist for downloads into the media library, making
network resources available that ought to be blocked.
Security: An open redirect in exit.php when the trackexit plugin was installed
and the blog used for URL redirects via an option in the plugin
devel/subversion 1.14.5_8
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_7
Apache Subversion is a full-featured version control system (LTS)
www/mod_subversion 1.14.5_2
Apache HTTP Server modules for Apache Subversion
devel/{,java-}subversion{,-lts}: misc low-risk cleanups
- java-subversion: document the real cause of MAKE_JOBS_UNSAFE (build.conf's
Java-target add-deps only thread into the phony aggregate target, not the
javac -h compile rule, so -j can run javahl-types-java before
javahl-java's NativeResources.class exists).
- subversion{,-lts}: drop GPG_AGENT_BUILD_DEPENDS; --with-gpg-agent is a
pure configure-time #define with no build-time dependency on the gpg-agent
binary, only a runtime one (already covered by GPG_AGENT_RUN_DEPENDS).
- subversion{,-lts}: remove the dead .if ${PREFIX} != "/usr" guard around two
REINPLACE_CMD calls in post-patch; PREFIX defaults to LOCALBASE and is never
literally /usr in a standard ports build, so the guard was always true.
- mod_subversion: remove the dead PLIST_SUB+= SED=${SED} token;
pkg-plist has no %%SED%% reference.
Bump PORTREVISION for subversion and subversion-lts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
devel/subversion 1.14.5_7
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_6
Apache Subversion is a full-featured version control system (LTS)
devel/subversion{,-lts}: install real bash completion instead of dead DATADIR
copy
Install tools/client-side/bash_completion to
share/bash-completion/completions/svn, the real path
shells/bash-completion's framework scans, and symlink the other five
commands it defines completions for (svnadmin, svndumpfilter, svnlook,
svnsync, svnversion) to it. No dependency on shells/bash-completion is
added; an admin who wants completion installs that port themselves.
Bump PORTREVISION for both ports since this adds new plist content.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
devel/subversion 1.14.5_6
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_5
Apache Subversion is a full-featured version control system (LTS)
devel/subversion{,-lts}: fix GNOME Keyring post-configure to target
SVN_HAVE_LIBSECRET
security/subversion-gnome-keyring provides the library for
--with-gnome-keyring (SVN_HAVE_LIBSECRET), not the legacy
--with-old-gnome-keyring (SVN_HAVE_GNOME_KEYRING). The REINPLACE_CMD in
post-configure was patching the wrong macro (SVN_HAVE_GNOME_KEYRING /
SVN_HAVE_KWALLET), which had no effect on what the installed keyring
support package actually needs enabled.
Bump PORTREVISION for both ports since this changes build behavior.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
net/389-ds-base 3.2.3_2
Enterprise-class LDAP directory server
net/389-ds-base: Fix CPE information
Current advisories are filed under the redhat vendor, the fedoraproject
entry has been dead for years.
Sponsored by: Netzkommune GmbH
www/freenginx-acme-module: Align CPE_PRODUCT with the NVD naming scheme
Same change as in www/nginx-acme, both ports build the same upstream
module.
Sponsored by: Netzkommune GmbH
www/nginx-acme: Align CPE_PRODUCT with the NVD naming scheme
The NVD has no dictionary entry for this module yet, so the name is a
prediction. Every F5 product in the dictionary spells its name with
underscores, from nginx_open_source to nginx_modsecurity_waf, so
nginx_acme is the form the entry will most likely take.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Switch CPE_PRODUCT to nginx_open_source
The NVD files current nginx vulnerabilities under f5:nginx_open_source
rather than f5:nginx.
Sponsored by: Netzkommune GmbH
www/nginx: Switch CPE_PRODUCT to nginx_open_source
The NVD changed the product name it files nginx vulnerabilities under.
All 26 advisories published since February 2024 use f5:nginx_open_source,
while f5:nginx has received a single one in that time, CVE-2025-23419.
The two sets of CVE identifiers do not overlap at all, so the old name
no longer matches current advisories.
Sponsored by: Netzkommune GmbH
www/nginx-module-passenger: Add CPE information
Passenger is listed in the NVD as phusion:passenger with 456 dictionary
entries. The port name does not match the upstream product name, so
both CPE_VENDOR and CPE_PRODUCT need to be set explicitly.
Sponsored by: Netzkommune GmbH
net-mgmt/semaphore: Add CPE information
The NVD lists this software as ansible-semaphore:ansible_semaphore with
136 dictionary entries, so the port can be matched against advisories
once they appear. The cpe.mk defaults would have produced
semaphore:semaphore, which does not exist.
Sponsored by: Netzkommune GmbH
sysutils/lxqt-config: Use sonic-screen-library instead of plasma6-libkscreen
- Next version of plasma6-libkscreen on FreeBSD will remove xrandr backend
support so it is needed for lxqt-config works without issues on
FreeBSD (xorg/xlibre).
- Bump PORTREVISION
With hat: lxqt
PR: 300261
x11/sonic-screen-library: New port: Sonic's screen management software
sonic-screen-library is the screen management library for SonicDE
Workspaces. Its primary consumer is the SonicDE screen management
application sonic-screen/
lxqt-config port will consume this port too because next plasma6 update
will remove support for xrandr.
devel/subversion 1.14.5_5
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_4
Apache Subversion is a full-featured version control system (LTS)
devel/subversion{,-lts}: replace the TEST option with the native test target
Drop OPTIONS_DEFINE=TEST and the custom test: build / -@make check -C
${WRKSRC} target; declare TEST_DEPENDS unconditionally and set
TEST_TARGET=check instead, run via the framework's native make test.
devel/subversion 1.14.5_5
Apache Subversion is a full-featured version control system
devel/subversion-lts 1.14.5_4
Apache Subversion is a full-featured version control system (LTS)
devel/subversion{,-lts}: regenerate build-outputs.mk live instead of a frozen
snapshot
Replace the hand-maintained files/build-outputs.mk.addons snapshot
(copied into WRKSRC verbatim at pre-patch time) with a live
gen-make.py --release run in post-patch, after build.conf has already
been patched. The frozen snapshot is dated 2015 and drifts from
upstream's actual build.conf on every new release; regenerating it
live means build.conf is the single source of truth for what gets
built and installed.
