Latest commits

security/tailscale: Update to 1.104.5

MFH:		2026Q4

www/p5-HTML-Gumbo: Update to 0.20.0

PR:		300300
Approved by:	perl (mat@)

graphics/php-qrencode: update to 0.12.

devel/llvm23: 23.1.5 release

See the annoucement for changes:
    https://discourse.llvm.org/t/llvm-23-1-5-released/92716

Sponsored by:	DARPA, AFRL

www/worldmonitor: Update to 2.11.7

Upstream moved to a native TypeScript compiler, so point the build
at it.

Add /usr/local/bin to PATH in the relay rc script, the relay needs
curl at runtime.

Sponsored by:	Netzkommune GmbH

.hooks/pre-commit.d: New hook to validate vuxml

This runs `make validate` in case VuXML entries have been changed.

Approved by:	mat (portmgr), joneum (ports-secteam)
Differential Revision: https://reviews.freebsd.org/D61157

net-mgmt/nagios4: Security update 4.5.12 => 4.5.14

This release fixes many vulnerabilities.

Changelog:
https://www.nagios.org/projects/nagios-core/4x/

While here, drop SourceForge from MASTER_SITES.

PR:		300388
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

devel/ghq: update to 1.12.0

Changes:	https://github.com/x-motemen/ghq/releases/tag/v1.12.0

sysutils/rmlint: Update 2.10.1 => 2.11.0

Changelog:
https://github.com/sahib/rmlint/blob/v2.11.0/CHANGELOG.md

PR:		300443
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

security/tang: Update 15 => 16

Changelog:
https://github.com/latchset/tang/releases/tag/v16

While here, sort Makefile (pet port{clippy,fmt,lint}).

PR:		300489
Approved by:	osa, vvd (mentors, implicit)

multimedia/streamlink: Update 8.6.2 => 8.6.3

Changelog:
https://github.com/streamlink/streamlink/releases/tag/8.6.3

PR:		300495
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

x11/hyprshutdown: Update to 0.1.2

While here, add missing dependencies per stage-qa suggestions.

Changelog: https://github.com/hyprwm/hyprshutdown/releases/tag/v0.1.2

Reported by:	GitHub (watch releases)

x11/hyprlock: Update to 0.9.7

Changelog: https://github.com/hyprwm/hyprlock/releases/tag/v0.9.7

Reported by:	GitHub (watch releases)

devel/google-cloud-cpp: Update to 3.13.0

- opentelemetry-cpp is now a required dependency; crc32c is no
  longer used (Abseil's implementation is used instead).
- Drop CMake options that are no longer used by 3.x.
- Use GOOGLE_CLOUD_CPP_OVERRIDE_GOOGLEAPIS_URL to point at the
  googleapis distfile instead of copying it into the build tree.
- Add patches to use opentelemetry::nostd for opentelemetry-cpp
  types; upstream assumes opentelemetry-cpp is built with WITH_STL,
  which our devel/opentelemetry-cpp is not.

Changes:	https://github.com/googleapis/google-cloud-cpp/blob/v3.13.0/CHANGELOG.md

x11/hyprpaper: Update to 0.8.5

While here, add missing/remove excessive dependencies per stage-qa
suggestions.

Changelog: https://github.com/hyprwm/hyprpaper/releases/tag/v0.8.5

Reported by:	GitHub (watch releases)

www/linux-chrome: Security update to 157.0.8103.38

Fixes buffer overflows in Dawn, memory corruption in ANGLE and use
after free in WebGL, Prerender, Geometry and Core, each of which lets
a crafted page execute code outside the sandbox.

Changelog:	https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

Security:	380c9ad2-d81f-11f1-a214-a0369f7f7be0
Security:	3749ce48-d5ce-11f1-9bfa-a8a1599412c6
Security:	60814125-d630-11f1-9bfa-a8a1599412c6
Sponsored by:	Netzkommune GmbH

www/nextcloud-memories: Update to 11.0.2

www/nextcloud-contacts: Update to 8.9.5

mail/nextcloud-mail: Update to 5.13.1

x11/hyprpicker: Update to 0.4.8

While here, remove upstreamed patch.

Changelog: https://github.com/hyprwm/hyprpicker/releases/tag/v0.4.8

Reported by:	GitHub (watch releases)

ports-mgmt/sbom-generator: create SPDX SBOM files for installed packages

x11/xdg-desktop-portal-hyprland: Update to 1.5.0

Changelog: https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.5.0

Reported by:	GitHub (watch releases)

deskutils/feathernotes: try to fix packaging after recent Qt update

Reported by:	pkg-fallout

devel/thonny: Update to 5.0.1

Thonny now builds with the uv_build PEP 517 backend instead of setup.py,
so switch to USE_PYTHON=pep517 and add uv-build as a build dependency.
Upstream's <0.12 pin is out of reach for the port's uv-build 0.13.x, so
relax it at extract time. Match RUN_DEPENDS from pyproject.toml.

deskutils/crqt-ng: Fix build for linguisttools

audio/qaudiosonar: Migrate to Qt6

The codebase uses no Qt5-only APIs, so this flips the port to qt:6 with
a C++17 compiler floor. One small source patch replaces the deprecated
Qt calls with their current equivalents.

audio/midipp: Migrate to Qt6

The codebase uses no Qt5-only APIs, so this flips the port to qt:6 with
a C++17 compiler floor. Several source patches replace the deprecated Qt
calls with their current equivalents.

audio/hpsjam: Migrate to Qt6

The codebase uses no Qt5-only APIs, so this flips the port to qt:6 with
a C++17 compiler floor. One small source patch replaces the deprecated
Qt calls with their current equivalents.

misc/hwdata: Update to 0.413

Reported by:	portscout!

www/py-django-reversion: Update to 6.5.1

Changelog:

https://github.com/etianen/django-reversion/releases/tag/v6.5.1

www/py-django-mptt: Update to 0.21.1

Changelog:

https://github.com/django-mptt/django-mptt/blob/0.21.1/CHANGELOG.rst

textproc/py-mkdocs-rss-plugin: Update to 1.20.0

Changelog since 1.17.9:

https://github.com/Guts/mkdocs-rss-plugin/blob/1.20.0/CHANGELOG.md

textproc/py-backrefs: Update to 8.2

Changelog:

https://github.com/facelessuser/backrefs/releases/tag/8.2

games/pysolfc: Update to 3.7.0

Changelog:

https://github.com/shlomif/PySolFC/blob/pysolfc-3.7.0/NEWS.asciidoc

security/vuxml: Document chromium security fixes

Add the Chrome 157 entry and list linux-chrome in the two previous
chromium entries, which left it out.

Obtained from:	https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
Sponsored by:	Netzkommune GmbH

x11-wm/hyprland: Update to 0.57.1

Release Annoucement: https://hypr.land/news/update57/
Changelog:
- https://github.com/hyprwm/Hyprland/releases/tag/v0.57.0
- https://github.com/hyprwm/Hyprland/releases/tag/v0.57.1

Reported by:	GitHub (watch releases)

*: fix plist issues with sbom

Mk: generate SBOM .pc files for all ports

Each package and subpackage now installs an SBOM file in pkg-config
format, see pc(5).  The file is installed in ${PREFIX}/share/sbom/pc/.
The framework adds it to the plist automatically.

PR:		300098
Differential Revision:	https://reviews.freebsd.org/D60441

net/cloudflare-speed-cli: Update to 1.0.12

devel/codequery: Add missing qt6-tools build dependency

CMake requires Qt6LinguistTools, which was previously pulled in
indirectly and is no longer available, breaking configure.

MFH:		2026Q4

graphics/heimer: Add missing qt6-tools build dependency

CMake requires Qt6LinguistTools, which was previously pulled in
indirectly and is no longer available, breaking configure.

MFH:		2026Q4

games/trx: Update to 1.12

ChangeLog: https://github.com/LostArtefacts/TRX/releases/tag/trx-1.12

emulators/sameboy: Update to 1.0.5

ChangeLog: https://github.com/LIJI32/SameBoy/releases/tag/v1.0.5

devel/py-ujson: Update to 6.1.0

Changes:	https://github.com/ultrajson/ultrajson/releases/tag/6.1.0

devel/glab: update to 1.128.0

Changes:	https://gitlab.com/gitlab-org/cli/-/releases

*/*: Bump port revision after hyprgraphics shlib version bump (a225535f5768)

graphics/hyprgraphics: Update to 0.6.0

Changelog: https://github.com/hyprwm/hyprgraphics/releases/tag/v0.6.0

Reported by:	GitHub (watch releases)

*/*: Bump port revision after aquamarine shlib version bump (4f44f56ed746)

x11-toolkits/aquamarine: Update to 0.16.0

Changelog: https://github.com/hyprwm/aquamarine/releases/tag/v0.16.0

Reported by:	GitHub (watch releases)

mail/py-resend: Update to 2.51.0

Changelog: https://github.com/resend/resend-python/releases/tag/v2.51.0

Reported by:	Repology

devel/py-ty: Update to 0.0.96

Changelog: https://github.com/astral-sh/ty/blob/0.0.96/CHANGELOG.md

Reported by:	portscout

databases/py-redisvl: Update to 0.30.0

Changelog: https://github.com/redis/redis-vl-python/releases/tag/v0.30.0

Reported by:	portscout

multimedia/jellyfin-ffmpeg: Update to 8.1.3.2

Changelog:	https://github.com/jellyfin/jellyfin-ffmpeg/releases/tag/v8.1.3-2
Reviewed by:	dtxdf
Approved by:	dtxdf (mentor)
Differential Revision:	https://reviews.freebsd.org/D61165

sysutils/py-dbuild: Update to 1.13.1

ChangeLog:

- https://github.com/daemonless/dbuild/releases/tag/v1.13.1

Reviewed by:	dtxdf
Approved by:	dtxdf (mentor, maintainer)
Differential Revision:	https://reviews.freebsd.org/D61171

devel/zizmor: Update to 1.32.0

Changelog: https://github.com/zizmorcore/zizmor/releases/tag/v1.32.0

Reported by:	GitHub (watch releases)

databases/pgbadger: Update to 13.3

Release notes:	https://github.com/darold/pgbadger/releases/tag/v13.3

net-mgmt/omada6: Update to 6.3.0.111

textproc/markterm: Update to 0.17.0

- bump the rebased litehtml submodule at d908f3f8
- regenerate patches against the new sources

Sponsored by:	SkunkWerks, GmbH

ports-mgmt/git-proxy: New port - generic caching repository proxy

- serve pkg(8) repositories at /freebsd/${ABI}/${set}/
- serve custom repositories from upstream.freebsd_repositories at
    /freebsd/{name}/
- https://github.com/git-pkgs/proxy
- cache many different types of asset and package registries

Sponsored by:	SkunkWerks, GmbH

www/monolith: Update to 2.11.6 and take maintainership

While here, claim maintainership after three consecutive maintainer
timeouts.

Changelog: https://github.com/Y2Z/monolith/releases/tag/v2.11.6

PR:		299625
Approved by:	lcook (former maintainer, timeout 2 weeks)

databases/openvoxdb9: Update to 9.2.0

Release notes:
https://github.com/OpenVoxProject/openvoxdb/releases#release-9.2.0

With hat:	puppet

databases/openvoxdb8: Update to 8.18.0

Release notes:
https://github.com/OpenVoxProject/openvoxdb/releases#release-8.18.0

With hat:	puppet

sysutils/openvox-server9: Update to 9.2.0

Release notes:
https://github.com/OpenVoxProject/openvox-server/releases/tag/9.2.0

With hat:	puppet

sysutils/openvox-server8: Update to 8.18.0

Release notes:
https://github.com/OpenVoxProject/openvox-server/releases/tag/8.18.0

With hat:	puppet

sysutils/rubygem-choria-mcorpc-support: Update to 0.28.0

Release notes:
https://github.com/choria-io/choria-mcorpc-support/releases/tag/2.28.0

With hat:	puppet

sysutils/openvox-agent9: Update to 9.3.0

Release notes:
https://github.com/OpenVoxProject/openvox/releases/tag/9.3.0

With hat:	puppet

sysutils/openvox-agent8: Update to 8.32.0

Release notes:
https://github.com/OpenVoxProject/openvox/releases/tag/8.32.0

With hat:	puppet

net/ooni-probe-cli: update to 3.31.1

Security: 	updated brotli dependency [1]
MFH:		2026Q4

[1] https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42

x11-wm/bvwm: Update to 1.1.5.b.10

ChangeLog: https://github.com/FrauBSD/bvwm/blob/1.1.5-bvwm.10/BCHANGELOG.md

x11/bhotkeys-audio: Update to 1.3

ChangeLog: https://github.com/FrauBSD/bhotkeys-audio/blob/1.3/CHANGELOG.md

x11/bosd: Update to 11.0

ChangeLog: https://github.com/FrauBSD/bosd/blob/11.0/CHANGELOG.md

x11/bhotkeys: Update to 1.9

ChangeLog: https://github.com/FrauBSD/bhotkeys/blob/1.9/CHANGELOG.md

java/apache-commons-lang: Remove expired port

2026-10-31 java/apache-commons-lang: Unpatched CVE, last release in 2011, does not compile with Java 11+, not actively maintained. Superseded by port java/apache-commons-lang3.

textproc/lucene: Remove expired port

2026-10-31 textproc/lucene: Release from 2013. Unsupported upstream. Lucene is now at version 10.X. Superseded in ports by textproc/lucene9.

databases/kividb: update: 1.1.3 -> 1.2.0

ChangeLog:	https://github.com/kividbio/kividb/compare/v1.1.3...v1.2.0

Sponsored by:	tipi.work

games/eduke32: Add fullscreen-display patch

In window managers such as dwm, fvwm, bvwm, etc. moving fullscreen
windows should cause resizing to the new output display.

eduke32 automatically resizes in window mode but not when asked to
run fullscreen. This patch causes resize when, for example, a user
in dwm utilizes Alt+Shift+Period (or Alt+Shift+Comma) to send the
game to another screen.

games/eduke32: Switch to using DISTVERSION

games/eduke32: Fixes for portfmt -D Makefile

games/eduke32: Fixes for portclippy Makefile

sysutils/dekit: Remove expired port

2026-11-03 sysutils/dekit: Cannot upgrade due to linuxisms

sysutils/flock: Update to 2.41.6

Sponsored by:	Rubicon Communications, LLC ("Netgate")

net/tcpdump: Update to 4.99.7

Sponsored by:	Rubicon Communications, LLC ("Netgate")

net/igmpproxy: Fix igmpproxy_conf rc.d knob, document user and chroot

- The rc.d script documented igmpproxy_conf but read igmpproxy_config,
  and required_files always pointed to the default path.  Honor
  igmpproxy_conf, keeping igmpproxy_config as a fallback so existing
  setups do not break, and check the file actually in use.
- Add commented user and chroot examples to the sample configuration.
  They allow igmpproxy to drop privileges once sysutils/mac_igmpproxy
  is loaded.

Sponsored by:	Rubicon Communications, LLC ("Netgate")

sysutils/mac_igmpproxy: New port, MAC policy for net/igmpproxy

A MAC framework policy that grants the multicast routing privilege to
a single configurable UID, so net/igmpproxy can drop root and run as
the new igmpproxy user (UID/GID 422).  The policy can be tuned or
disabled with the security.mac.igmpproxy.uid and
security.mac.igmpproxy.enabled sysctls.

PR:		291647

emulators/open-vm-tools: Use fixed name and rcvar in vmware-kmod

vmware-kmod handles two kernel modules by setting name and rcvar from
$kernel_mod and calling run_rc_command twice.  Tools that read rcvar
without running the script, such as service -e, see the unexpanded
variable and check the nonexistent $vmware_guest__enable, warning on
every host where the package is installed.

Give the script a fixed name (vmware_guest_kmod) and rcvar
(vmware_guest_kmod_enable), and have start and status loop over the
modules, each honoring its own knob.  The script name and rc.conf
knobs are unchanged: vmware_guest_kmod_enable (default YES) still
supplies the defaults for vmware_guest_vmmemctl_enable and
vmware_guest_vmblock_enable, either of which can still be enabled on
its own, and rc.conf.d files for the per-module names are still read.

PR:		300431
Sponsored by:	Rubicon Communications, LLC ("Netgate")

net/dhcpdump: Update to 2.00 and switch to the active fork

The original dhcpdump 1.8 has not been maintained for many years.  Move
to the dhcpdump-org fork, which Debian and Fedora already ship.

Changes since 1.8 include VLAN (802.1Q/802.1ad) support, reading from
pcap files, an option to dump the whole packet in hex, option 82/121/
249/93/94/116 decoding, updated IANA option names and several fixes for
out-of-bounds reads on crafted packets.

Add a TUI option, enabled by default, for the new interactive session
tracking interface (-t).  It depends on devel/yascreen.

PR:		297349
Reported by:	diizzy
Sponsored by:	Rubicon Communications, LLC ("Netgate")

devel/yascreen: New port, curses replacement library

yascreen is a small curses replacement library for daemons and embedded
applications.  It has no external dependencies, supports internal and
external event loops, can work over stdin/stdout or a socket (including
basic telnet sequences) and handles Unicode.

It is needed by the interactive TUI of net/dhcpdump 2.x.

Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/sudo: Add LOGSRVD option and rc.d script for sudo_logsrvd

- Add a LOGSRVD option, enabled by default so current users see no
  change, to build sudo_logsrvd and sudo_sendlog.  When disabled the
  server, its sample configuration, rc script and man pages are not
  installed (--disable-log-server).
- Install an rc.d script for sudo_logsrvd.  It is disabled by default,
  enable it with sudo_logsrvd_enable=YES.
- Fix the SSL option description.  It does not affect sudo itself, only
  TLS for sudo_logsrvd and I/O log transfer.

PR:		287631
Reported by:	Anton Saietskii <vsasjason@gmail.com>
Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/sudo: Put base system directories first in secure_path

The default sudoers file installed by the port has an active
secure_path line inherited from upstream's configure.ac, which lists
/usr/local/sbin and /usr/local/bin before the base system directories.
That is a Linux convention.  On FreeBSD, LOCALBASE belongs to
ports/packages and the base system comes first everywhere else, so a
binary under /usr/local/bin could shadow a base utility when run
through sudo.

Set --with-secure-path-value so the default sudoers uses
/sbin:/bin:/usr/sbin:/usr/bin:${LOCALBASE}/sbin:${LOCALBASE}/bin.
Existing installations that edited /usr/local/etc/sudoers are not
affected.

PR:		299746
Sponsored by:	Rubicon Communications, LLC ("Netgate")

mail/dma: Update to upstream master (f4e1d913)

The port pinned GH_TAGNAME to a commit that predates the v0.14 tag, so
the package lacked VERIFYCERT and SNI support in TLS.  Pin the current
upstream master instead, which contains v0.14 plus following changes:

- LMTP: support relaying to an LMTP endpoint
- AUTH PLAIN support, with clearer syslog output when the server
  offers no usable auth mechanism
- HELO fallback when the server rejects EHLO
- Accept "|" as separator between smarthost and password
- Terminate each local mbox message with an empty line (RFC 4155)
- Discard bounce queue items when handling a double bounce
- Cast ctype arguments to unsigned char
- Disambiguate two identical error messages (issue #139)
- Fix building bsd/ after "make obj"; dma.8 and SPDX updates

PR:		299680
Co-Authored by: Philip Dodd <orange.spyderman@gmail.com>
Sponsored by:	Rubicon Communications, LLC ("Netgate")

www/worldmonitor-cli: Add New Port

Command-line client with a terminal dashboard for the World Monitor
service.

WWW: https://github.com/koala73/worldmonitor/tree/main/cli

Sponsored by:	Netzkommune GmbH

www/worldmonitor: Add New Port

World Monitor is a dashboard that brings together news and geopolitical,
infrastructure and market data on one page.  The port installs the
self-hosted web application with its Redis REST proxy, relay and seed
services.

WWW: https://github.com/koala73/worldmonitor

Sponsored by:	Netzkommune GmbH

mail/mailfromd: update the port to version 9.2

Requested by:	maintainer

net/rsync: fix denial of service in the delta-transfer sender

Take the upstream fix, there is no release containing it yet.

Obtained from:	https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04
Security:	c70f21b6-d7b4-11f1-bae2-3497f65b111b
With hat:	ports-secteam
Sponsored by:	Netzkommune GmbH

security/vuxml: Document rsync denial of service

Sponsored by:	Netzkommune GmbH

textproc/py-wcmatch: update to 12.0

Changes:	https://github.com/facelessuser/wcmatch/releases/tag/12.0
Reported-by:	repology

textproc/py-bracex: update to 3.2.1

Changes:	https://github.com/facelessuser/bracex/releases/tag/3.2.1
Reported-by:	repology

textproc/kibana95: Update 9.5.5 => 9.5.6

Changelog:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.5.6-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

sysutils/beats95: Update 9.5.5 => 9.5.6

Changelog:
https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.5.6

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

sysutils/logstash95: Update 9.5.5 => 9.5.6

Changelog:
https://www.elastic.co/docs/release-notes/logstash#logstash-9.5.6-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4