www/redmine70 7.0.3
Flexible project management web application
www/redmine70: update to 7.0.3
Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
www/redmine61 6.1.6
Flexible project management web application
www/redmine61: update to 6.1.6
Security and bug fix release: fixes a ReDoS in wiki macro argument
parsing, a reflected XSS and open redirect via back_url, and OAuth
token scope bypasses.
www/redmine60 6.0.12
Flexible project management web application
www/redmine60: update to 6.0.12
Security release: fixes a ReDoS in wiki macro argument parsing, a
reflected XSS and open redirect via back_url, and two private data
leaks via the REST API.
devel/subversion 1.15.0_1
Apache Subversion is a full-featured version control system
devel/subversion: fix svnserve rc.d status/stop when SVNSERVE_WRAPPER is on
When SVNSERVE_WRAPPER is enabled (now the default), bin/svnserve is
the umask-setting wrapper, which execs straight into bin/svnserve.bin
-- same PID, but the running process image is svnserve.bin, not
svnserve. rc.subr's run_rc_command built-ins (status, stop, restart,
poll) match running processes against procname, defaulting to
command's basename when procname is unset; since command is still the
wrapper path, every one of those built-ins fails to find the actually
running daemon ("svnserve is not running" even while it is).
Set procname explicitly to the real binary path, swapping in .bin via
a new SUB_LIST token when the wrapper is active, same pattern already
used for BINS_TO_STRIP.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reported by: vvd
Tcl/Tk: prepare for supporting one version only
Rename lang/tcl90 -> lang/tcl, and x11-toolkits/tk90 -> x11-toolkits/tk.
This is in preparation for sunsetting Tcl/Tk 8.6 and providing one
single version of Tcl/Tk in the ports tree.
PR: 300092 (exp-run)
mail/stalwart-proxy: [NEW PORT] e-mail migration proxy for Stalwart
Stalwart Proxy is a multi-protocol e-mail migration proxy from the
Stalwart Labs team (the authors of mail/stalwart). It routes IMAP,
POP3, ManageSieve, SMTP submission, SMTP/LMTP and HTTP (JMAP) sessions
per account to the right backend, based on the credentials the client
already presents. It is meant for migrating from Dovecot, Cyrus or
older Stalwart versions to Stalwart one mailbox at a time.
PR: 300326
x11-fonts/nordwand-mono-ttf: New port, Compact monospace neo-grotesque font
Nordwand Mono is a compact monospace neo-grotesque font designed for
developers (and adventurers)
PR: 299967
mail/stalwart-migrate: Add new port
stalwart-migrate moves a Stalwart Mail Server v0.16.27 data store to
Stalwart v1 and can roll the migration back if needed.
WWW: https://github.com/stalwartlabs/stalwart-migrate
PR: 300418
net-im/kaidan 0.16.0_3
User-friendly XMPP client for every device
net-im/libquotient 0.9.6.1_2
Matrix IM support library using Qt technologies
(Only the first 10 of 29 items in this commit are shown above. )
*/*: Bump PORTREVISION for known Qt private API abusers
Qt 6.11.3 edition.
These ports are known to directly use or link to a library that uses the
Qt private API and must be rebuilt with every Qt update.
Qt *public* API/ABI compatability is excellent, so most consumers don't
need to necessarily be rebuilt between patch or even minor releases, but
use of the private API breaks this compatibility between even patch
releases and its use is highly discouraged.
This list [1] is based on histortical data. We don't have time to
revisit every port on the list with each Qt update, so if your port has
dropped Qt private headers and was bumped in error, please remove it
yourself if you have write access to the Wiki or alert someone on kde@.
[1] https://wiki.freebsd.org/KDE/Qt
MFH: 2026Q4
devel/qt6-base 6.11.3_1
Qt base (core, gui, widgets, network,...)
(Only the first 10 of 51 items in this commit are shown above. )
Qt6: Update to 6.11.3
Oct 26, 2026 by Jani Heikkinen
The last release from Qt 6.11 series, Qt 6.11.3, is now available for
download. As a patch release, Qt 6.11.3 doesn’t introduce new features,
but it delivers around 200 bug fixes, security improvements, and quality
enhancements on top of Qt 6.11.2. For a full overview of the most
notable changes, take a look at the Qt 6.11.3 release notes.
Announcement:
https://www.qt.io/blog/qt-6.11.3-released
Release notes:
https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/6.11.3/release-note.md
PySide6: Update to 6.11.3
FreeBSD ports changes:
www/qt6-webengine: Improve security patch generation. Add GitHub as a
backup if code.qt.io is down, and strip out unneeded git metadata and
irrelevant files from the patch.
MFH: 2026Q4
Security: 7c872fa8-d4ee-11f1-b09c-33a9d17da5dc
mail/spamassassin-devel: Enable two modules
Enable these modules:
- lib/Mail/SpamAssassin/URI.pm, used by Plugin::Redirectors
- lib/Mail/SpamAssassin/Util/Zip.pm, used by Plugin::OLEVBMacro
and Handler::Archive
textproc/py-vbuild 0.8.2_2
Simple module to extract html/script/style from a VueJS file
textproc/py-vbuild: Replace pkgutil.find_loader for Python 3.14
pkgutil.find_loader was removed in Python 3.14, so import vbuild fails.
Use importlib.util.find_spec to detect the optional lesscpy, scss and
closure modules.
While here, add concurrent to USE_PYTHON and document the patches.
PR: 299910
Approved by: dtxdf@ (maintainer)
MFH: 2026Q4
(cherry picked from commit 082580c019a813aa021b5900383c22ffc6437fc8)
mail/py-minismtpd: New port: Minimal SMTP server
minismtpd is a library based on now-discontinued smtpd module from
the Python 3.11 standard library. The original module and its tests
are licensed under Python Software Foundation License Version 2.
The modifications and new code is licensed under the BSD-3-Clause
license.
WWW: https://github.com/cuu508/minismtpd/
textproc/py-vbuild 0.8.2_2
Simple module to extract html/script/style from a VueJS file
textproc/py-vbuild: Replace pkgutil.find_loader for Python 3.14
pkgutil.find_loader was removed in Python 3.14, so import vbuild fails.
Use importlib.util.find_spec to detect the optional lesscpy, scss and
closure modules.
While here, add concurrent to USE_PYTHON and document the patches.
PR: 299910
Approved by: dtxdf@ (maintainer)
MFH: 2026Q4
editors/openoffice-devel: upgrade to new snapshot
Upgrade to a newer snapshot of the upstream trunk branch.
Wiki Publisher no longer uses apache-commons-codec or the insecure
apache-commons-httpclient so unbreak and re-enable the WIKI_PUBLISHER_
option.
These patches have been upstreamed:
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_call.s
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_cpp2uno.cxx
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_share.hxx
patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_uno2cpp.cxx
patch-jvmfwk_plugins_sunmajor_pluginlib_vendorbase.hxx
patch-set_soenv.in
patch-source__soenv.sh
Use bundled lucene instead of the lucene port and remove DEPRECATED.
MFH: 2026Q4
devel/svn_load_dirs 1.8.4_1
Perl script to load directories into a Subversion repository
devel/svn_load_dirs: deprecate, superseded by svn-vendor.py
Upstream itself documents tools/client-side/svn-vendor.py as the
replacement for svn_load_dirs.pl. devel/subversion no longer bundles
any of tools/client-side/ (dropped in the 1.15.0 rework), so there's
no FreeBSD port shipping the replacement either; anyone who needs it
fetches svn-vendor.py directly from a matching upstream release
tarball.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
dns/register-dnsclient 20261101
Dynamically register hostnames with a DNS server using GSS-TSIG
dns/register-dnsclient: use mktemp for KRB5CCNAME, destroy ticket on exit, quote
vars
KRB5CCNAME was a predictable, fixed path (/tmp/krb5cc_$name), shared by
every invocation and never cleaned up; use mktemp to get a private,
per-run ccache and destroy it via kdestroy in clean_exit. Quote
$KRB5_CLIENT_PRINCIPAL and the tr arguments to avoid word-splitting/glob
expansion and fix the broken backslash-escaped tr "\"[:lower:]\""
quoting, which only worked by accident under sh.
Bump PORTVERSION.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
sysutils/michaelo-periodic 20260101_1
Scripts for the FreeBSD periodic(8) system from michaelo@FreeBSD.org
sysutils/michaelo-periodic: add DOCS option to install README
The README documents all periodic.conf knobs for the included scripts
(weekly_gitup_enable, weekly_make_src_targets, etc.) but was never
installed, mirroring net/gitup's existing DOCS pattern.
devel/subversion: update to 1.15.0, full rework of master and slave ports
devel/subversion:
- Bump to 1.15.0 (DISTVERSION).
- Replace the opt-in WITH_REPOSITORY_CREATION pw useradd/groupadd
logic with framework USERS=/GROUPS=, mirroring devel/git's
git_daemon pattern; register the svn account in UIDs/GIDs with
HOME=/var/db/svn to match svnserve's own rc.d default. Repository
creation itself is dropped as out of scope for a port to manage.
Documented in UPDATING, since it affects existing installs with a
manually-created svn account.
- TOOLS now only gates genuinely niche binaries; drop it from
OPTIONS_DEFAULT, add SVNSERVE_WRAPPER instead. svnauthz/
svnauthz-validate/svnbench move into core via a patch-build.conf
hunk, matching Debian. svnmover, fsfs-access-map, and x509-parser
are no longer shipped; fsfs-stats is renamed to svnfsfs-stats via a
new patch-Makefile.in.
- DATADIR now installs only xslt/ unconditionally and hook-scripts/
(flattened, no mailer/ subdirectory) behind a new HOOKS option;
dist/, buildbot/, po/, dev/, examples/, client-side/, server-side/,
backup/ are no longer shipped. All C/C++ source is excluded from
DATADIR via EXTRACT_AFTER_ARGS.
- SVNSERVE_WRAPPER now activates automatically when enabled (installs
as bin/svnserve directly, no manual rename from a .sample file) and
is in OPTIONS_DEFAULT.
- Update files/patch-build.conf and files/patch-configure for 1.15.0's
line-number/context shifts.
Slave ports (devel/java-/py-/ruby-/p5-subversion,
security/subversion-gnome-keyring, www/mod_subversion):
- Drop the dead SVN_BUILD_BINDINGS=yes assignment from all four
bindings ports.
- devel/java-subversion: add the --with-junit requirement introduced
by upstream r1933892 (BUILD_DEPENDS on java/junit).
- devel/py-subversion: apply extra-patch-check-swig-py314 only when
building against LTS; upstream already fixes this for 1.15.0, and
the patch file itself moved to devel/subversion-lts/files/ in a
separate commit.
- PORTREVISION_LATEST reset to 0 for all affected slave ports (the
version bump itself forces the upgrade signal); PORTREVISION_LTS
bumped where a port's own Makefile logic changed independent of it.
Verified against real poudriere jail builds (configure/build/stage/
check-plist/stage-qa/install/pkg info -d), not just Makefile review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
