Latest commits

security/tailscale: Update to 1.104.5

MFH:		2026Q4
(cherry picked from commit cf6d07dd825b8d3337c5cedb954d8d5df53b8ab8)

www/p5-HTML-Gumbo: Update to 0.20.0

PR:		300300
Approved by:	perl (mat@)

(cherry picked from commit eae0670a1481a7dfdea3e720203951078b5aa969)

net-mgmt/nagios4: Security update 4.5.12 => 4.5.14

This release fixes many vulnerabilities.

Changelog:
https://www.nagios.org/projects/nagios-core/4x/

While here, drop SourceForge from MASTER_SITES.

PR:		300388
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit 495cd2f705ea910c78bedcc3c967cf991b364ed7)

sysutils/rmlint: Update 2.10.1 => 2.11.0

Changelog:
https://github.com/sahib/rmlint/blob/v2.11.0/CHANGELOG.md

PR:		300443
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit dc8bdde0ac382a848d7586d4890d331f7ba3611b)

security/tang: Update 15 => 16

Changelog:
https://github.com/latchset/tang/releases/tag/v16

While here, sort Makefile (pet port{clippy,fmt,lint}).

PR:		300489
Approved by:	osa, vvd (mentors, implicit)

(cherry picked from commit da7f0928a3052e7ab1bbf6a7d7323026d5308546)

multimedia/streamlink: Update 8.6.2 => 8.6.3

Changelog:
https://github.com/streamlink/streamlink/releases/tag/8.6.3

PR:		300495
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit 329cb3e3de81a717c344e24521086f0f85c36544)

www/linux-chrome: Security update to 157.0.8103.38

Fixes buffer overflows in Dawn, memory corruption in ANGLE and use
after free in WebGL, Prerender, Geometry and Core, each of which lets
a crafted page execute code outside the sandbox.

Changelog:	https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html

Security:	380c9ad2-d81f-11f1-a214-a0369f7f7be0
Security:	3749ce48-d5ce-11f1-9bfa-a8a1599412c6
Security:	60814125-d630-11f1-9bfa-a8a1599412c6
Sponsored by:	Netzkommune GmbH

(cherry picked from commit 64781d7f3a12bc129634c10b3a6977c2041c1129)

www/linux-chrome: update to 156.0.8078.47 release

(cherry picked from commit f6fd9e19025fe642daa82af1113a7c0b834f215b)

audio/qaudiosonar: Migrate to Qt6

The codebase uses no Qt5-only APIs, so this flips the port to qt:6 with
a C++17 compiler floor. One small source patch replaces the deprecated
Qt calls with their current equivalents.

(cherry picked from commit 7c76d9b0a7e4aae8b21f08611fe02d2a534c165d)

deskutils/crqt-ng: Fix build for linguisttools

(cherry picked from commit fe8766b149b7bd8e0dad094d3a0e8a6a8541cabe)

devel/thonny: Update to 5.0.1

Thonny now builds with the uv_build PEP 517 backend instead of setup.py,
so switch to USE_PYTHON=pep517 and add uv-build as a build dependency.
Upstream's <0.12 pin is out of reach for the port's uv-build 0.13.x, so
relax it at extract time. Match RUN_DEPENDS from pyproject.toml.

(cherry picked from commit 6478a856f13dccdb545915fbe7026b162aeafc2e)

audio/midipp: Migrate to Qt6

The codebase uses no Qt5-only APIs, so this flips the port to qt:6 with
a C++17 compiler floor. Several source patches replace the deprecated Qt
calls with their current equivalents.

(cherry picked from commit 379c522c3e25d4a38c6e84637ffe184c07905506)

audio/hpsjam: Migrate to Qt6

The codebase uses no Qt5-only APIs, so this flips the port to qt:6 with
a C++17 compiler floor. One small source patch replaces the deprecated
Qt calls with their current equivalents.

(cherry picked from commit 6bf16d9347d0dc0f4047cc7526c23f157611330f)

www/p5-Starlet: update 0.32 -> 0.33

Changelog: https://metacpan.org/dist/Starlet/changes

Security:	prevent excessive CPU use when parsing malformed chunk-size lines
Security:	bound read allocations for large Content-Length values
Security:	suppress response bodies for HEAD requests and 204/304 responses
Security:	stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes
(cherry picked from commit 2d59ccefc7de23da947d3543c2f78f2355c1af98)

databases/openvoxdb8: Update to 8.18.0

Release notes:
https://github.com/OpenVoxProject/openvoxdb/releases#release-8.18.0

With hat:	puppet

(cherry picked from commit de978c83354d795dd37496acc790f02666a741e9)

sysutils/openvox-server8: Update to 8.18.0

Release notes:
https://github.com/OpenVoxProject/openvox-server/releases/tag/8.18.0

With hat:	puppet

(cherry picked from commit fb12b01bd779d6a0e08c83c2e08cbcff449d9800)

sysutils/openvox-agent8: Update to 8.32.0

Release notes:
https://github.com/OpenVoxProject/openvox/releases/tag/8.32.0

With hat:	puppet

(cherry picked from commit f5f65dd693f988e3f2c8d96eaaf7309ba374ade6)

net/ooni-probe-cli: update to 3.31.1

Security: 	updated brotli dependency [1]
MFH:		2026Q4

[1] https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42

(cherry picked from commit 2dcb31b47481c80b19fa8548883fa3f0dd0bf92c)

net/ooni-probe-cli: update to 3.31.0

(cherry picked from commit 7312c7155241ff90ca5f69382d3dc99cc7f3fca8)

net/rsync: fix denial of service in the delta-transfer sender

Take the upstream fix, there is no release containing it yet.

Obtained from:	https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04
Security:	c70f21b6-d7b4-11f1-bae2-3497f65b111b
With hat:	ports-secteam
Sponsored by:	Netzkommune GmbH

(cherry picked from commit 4db1fd2c615a835c1679328f40b9765c8dd8385f)

textproc/kibana95: Update 9.5.5 => 9.5.6

Changelog:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.5.6-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 365a2c513f0eb1482df70fc556c25014aaac89e1)

sysutils/beats95: Update 9.5.5 => 9.5.6

Changelog:
https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.5.6

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit d9bbd50241bfe216f39b465bc708ce474428b8a3)

sysutils/logstash95: Update 9.5.5 => 9.5.6

Changelog:
https://www.elastic.co/docs/release-notes/logstash#logstash-9.5.6-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 06eb28d521c4c72d737bb5710aea3c0b4046cf6d)

textproc/kibana94: Update 9.4.8 => 9.4.9

Changelog:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.9-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit cee85ea96ac45c0776a53cf3eaef01e3ec3194f7)

sysutils/beats94: Update 9.4.8 => 9.4.9

Changelog:
https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.4.9

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 5c2ad76c09953b0140049040b39557bc380727f2)

sysutils/logstash94: Update 9.4.8 => 9.4.9

Changelog:
https://www.elastic.co/docs/release-notes/logstash#logstash-9.4.9-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 9e32699543ef8133f3e8408d8a844f49174584f3)

textproc/kibana8: Update 8.19.23 => 8.19.24

Changelog:
https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.24.html

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit d37f186c120d847256013d2236d4ebdb107698d3)

sysutils/beats8: Update 8.19.23 => 8.19.24

Changelog:
https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.19.24.html

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 94b45ee211900001a6d370c0d1d7e6bc45377526)

sysutils/logstash8: Update 8.19.23 => 8.19.24

Changelog:
https://www.elastic.co/guide/en/logstash/8.19/logstash-8-19-24.html

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit e061d1158e840f57dda26ceea1c0a6bb5f4c65c8)

emulators/libmt32emu: Update 2.8.3 => 2.8.5

Changelog:
https://github.com/munt/munt/blob/libmt32emu_2_8_5/mt32emu/NEWS.txt

PR:		300485
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit b5c7b23f177968ad8e6f00437b8be0dcd04ad2d2)

net/krill: Update 0.16.0 => 0.16.1

Release Notes:
https://community.nlnetlabs.nl/t/krill-0-16-1-no-small-wonder-released/3498

Changelog:
https://github.com/NLnetLabs/krill/releases/tag/v0.16.1

PR:		300484
Approved by:	osa, vvd (mentors, implicit)
Security:	CVE-2026-109140
Security:	CVE-2026-109141
Security:	CVE-2026-109142
MFH:		2026Q4

(cherry picked from commit 360b2c7c3ebb002e51a4ccacd01a6deff52608b1)

security/netbird: Update 0.81.5 => 0.82.0

This release removes MySQL store and deprecates Rosenpass,
please see pkg-message or the changelog for more details.

Changelog:
https://github.com/netbirdio/netbird/releases/tag/v0.82.0

PR:		300474
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit f0cd3120b45056ae22c134e3df1bb9ab98c34b77)

editors/openoffice-4: Use apache-commons-lang3

apache-commons-lang3 works fine in place of apache-commons-lang for
openoffice-4.  Upstream switched the bundled version in 2014.  Switch
to the newer port and remove DEPRECATED.

MFH:		2026Q4
(cherry picked from commit 6b30840112748709de509668785e795f5ac0686a)

net/rabbitmq: Update 4.3.6 => 4.3.7

Changelog:
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.7

Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit b5e0329e4d26b23789d1c421bcde39426b746a0c)

editors/openoffice-*: system lucene cleanup

Delete the remaining remnants of the system lucene dependency.

Reported by:	Ronald Klop <ronald-lists@klop.ws>

(cherry picked from commit 117941ee407dec8c0b40a926a3cad2de45fa3029)

net/freerdp3: Update 3.32.2 => 3.33.0

Changelog:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.33.0

Security:	GHSA-hhfh-fvm7-7w65
Security:	GHSA-pq35-c472-69w2
Security:	GHSA-v7hr-xh82-79p7
Security:	GHSA-9r9q-9r7p-4mr6
Security:	GHSA-76c4-7552-ffhv
Security:	GHSA-j5pq-cm28-qm6v
Security:	GHSA-2hm9-2h5q-x525
Security:	GHSA-hj6g-r86h-wrcg
Security:	GHSA-fw6x-h8gw-778w
Security:	GHSA-q8p6-8mmj-j4ph
Security:	GHSA-r664-f94r-rgg6
Security:	GHSA-4g67-jhpc-q5xp
Security:	GHSA-8m87-jj8p-2fqc
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit d4fc967cc20bceedb4408c40aac0da0ef41f48e2)

audio/musicpd: Update to upstream release 0.24.18

Details:
- Bugfix release, see
  https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.18/NEWS

MFH:		2026Q4
(cherry picked from commit 081959fb2efcb558af66ec925bf7c3ffe8475dd9)

net-im/snac: Fix fetch for quarterly

I didn't know USE_FORGEJO isn't available in quarterly yet, so
let's switch back to Codeberg MASTER_SITES for quarterly now.

PR:		300295
Approved by:	osa, vvd (mentors, implicit)

net-im/snac: Update 2.96 => 2.97

Changelog:
* Quote-posting your own posts is now allowed.
* The Mastodon API can now be disabled.
* Fixed a crash in chunked transfer encoding code.
* Tweak to JSON loading code to circunvent fmemopen() issues.
* Mastodon API: Fixed error in voting code.
https://codeberg.org/grunfink/snac2/src/tag/2.96/RELEASE_NOTES.md

While here, replace Codeberg MASTER_SITES with USE_FORGEJO.

PR:		300295
Approved by:	Matthew Phillips (maintainer)
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit bd8dfecf26e6686314e90418a726d5be2d3f11fe)

devel/mongo-c-driver: Update 2.5.6 => 2.5.7

Changelog:
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.7

While here, sort Makefile (pet portclippy).

PR:		300403
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit 78a57bdb586dce3f140c29f397f037781acbd018)

devel/libbson: Update 2.5.6 => 2.5.7

Changelog:
https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.7

PR:		300402
Approved by:	osa, vvd (mentors, implicit)

(cherry picked from commit f8724a57669199227cfce3d7da4398c1381be4e9)

databases/opendbviewer: Migrate to Qt6

The following issues were resolved during the switch:
- Upstream CMake files cannot find FreeBSD's nested Qt libraries
- add_definitions() leaks unresolved generator expressions into
  build.ninja
- Install paths do not follow the ports framework

Approved by:	arrowd (co-mentor)
Approved by:	makc (mentor)

(cherry picked from commit cb610e1fede9cfe21fc7b85b7b161417db0691e6)

deskutils/birdtray: Update to 1.12.g20260803 and migrate to Qt6

Approved by:	arrowd (co-mentor)
Approved by:	makc (mentor)

(cherry picked from commit d1a995cdf2c67c7d57165076a0367c81309889be)

science/iboview: Update to 20260917 and migrate to Qt6

Approved by:	arrowd (co-mentor)
Approved by:	makc (mentor)

(cherry picked from commit 3ffde00cb8eb21c41301fdcc808dfebe846d2b17)

www/firefox: update to 159.0.1 (rc1)

Release Notes (soon):
  https://www.firefox.com/en-US/firefox/159.0.1/releasenotes/

(cherry picked from commit 89002ad0cca27e4801d3970b15a0bbf207a17283)

deskutils/merkuro: add missed dependency (+)

Declare implicit (previously hidden by dependencies) requirement on libplasma
Bump PORTREVISION

CMake Warning at src/contacts/applet/CMakeLists.txt:4 (find_package):
  By not providing "FindPlasma.cmake" in CMAKE_MODULE_PATH this project has
  asked CMake to find a package configuration file provided by "Plasma", but
  CMake did not find one.

  Could not find a package configuration file provided by "Plasma" with any
  of the following names:

    PlasmaConfig.cmake
    plasma-config.cmake
[skip]

Reported by:	bulk -t
Approved by:	makc

(cherry picked from commit 86e01d3190874a76efcd8de0c2af3e9cb8f1ed3c)

editors/openoffice-devel: upgrade to new snapshot

Upgrade to a newer snapshot of the upstream trunk branch.

Wiki Publisher no longer uses apache-commons-codec or the insecure
apache-commons-httpclient so unbreak and re-enable the WIKI_PUBLISHER_
option.

These patches have been upstreamed:
  patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_call.s
  patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_cpp2uno.cxx
  patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_share.hxx
  patch-bridges_source_cpp__uno_gcc3__freebsd__powerpc64_uno2cpp.cxx
  patch-jvmfwk_plugins_sunmajor_pluginlib_vendorbase.hxx
  patch-set_soenv.in
  patch-source__soenv.sh

Use bundled lucene instead of the lucene port and remove DEPRECATED.

MFH:            2026Q4
(cherry picked from commit d4fc18190183fcc2c5d1df8e5176082804f3d59a)

editors/openoffice-4: Switch to bundled lucene.

Use bundled lucene instead of the lucene port and amend DEPRECATED.

MFH:            2026Q4
(cherry picked from commit 77dc9dabebd898241d5f641dfb3e58029a7f1298)

editors/openoffice-*: extend deprecation notice

(cherry picked from commit 7998469aac8356fb5aede6fd27a7d6622a15a555)

editors/openoffice-*: don't require libjawt.so

openjdk8 keeps libjawt.so under jre/lib, where pkg doesn't register it
as provided, so pkg add of the package fails with "Missing shlib
libjawt.so". openjdk8 is already a run dependency.

(cherry picked from commit e1c869f4c1d4a0c358c5115b92440c7613c230e3)

editors/openoffice-*: enable on powerpc64le

OpenJDK keeps its libraries in jre/lib/ppc64le on little-endian, and
source_soenv.sh in -devel only knew the big-endian triple.

(cherry picked from commit cfb4eff2c826bcd0a780fe925be1894d4bc1369b)

mail/p5-MIME-Tools: update 5.519 -> 5.522

Changelog: https://metacpan.org/dist/MIME-tools/changes

Security:	CVE-2026-116264
Security:	CVE-2026-116265
Security:	CVE-2026-116266
Security:	CVE-2026-116267
Security:	CVE-2026-116268
Security:	CVE-2026-116269
Security:	CVE-2026-116270
Security:	CVE-2026-116271
Security:	CVE-2026-116272
Security:	CVE-2026-116273
(cherry picked from commit 1a4ce17d67490a368c899fd3e0ccabc7f786dd10)

graphics/p5-Image-ExifTool-devel: Update to 13.60

ChangeLog:	https://exiftool.org/history.html#v13.60

PR:		300420
Approved by:	osa, vvd (mentors, implicit)
MFH:		2026Q4

(cherry picked from commit 38097e96714998c0c03c3501a0077fa1452ea37d)

net-mgmt/py-napalm-logs: Update to 0.11.0

0.9.0 fails on Python 3.12+: napalm_logs.base imports imp (removed
in 3.12) to load the Python device profiles, and it calls yaml.load()
without a Loader, which PyYAML 6 rejects, so no YAML profile loads.
0.11.0 fixes the YAML loading.

Also add some patches to fix the following issues:

* Replace the imp calls with importlib.

* napalm_logs/__init__.py imports pkg_resources to look up its
  version; pkg_resources is deprecated and only available with
  setuptools, which is not a run dependency.  Use importlib.metadata.

* The authenticator process and the ClientAuth helper call
  ssl.wrap_socket(), removed in Python 3.12, so the auth process
  crashes on the first connection and clients cannot authenticate.
  Use SSLContext with the same behaviour.

While here:

* Switch to USE_PYTHON=pep517 to make the port future-proof.
* Fix portlint warnings and document the patches.
* Add LICENSE_FILE and switch to USE_PYTHON=pytest to simplify the
  Makefile.

PR:		300164
MFH:		2026Q4
Co-Authored-By:	Kai Knoblich <kai@FreeBSD.org>
(cherry picked from commit 661a4d62fa69fe29b4f223b6f0824868fb966b4a)

games/dreamchess: Mark deprecated

(cherry picked from commit 91adbc735c928771d345d5147c4c473c7c0e422d)

www/freenginx: Security update to 1.30.2

One of the keys was left uninitialized when using automatic rotation of
TLS session ticket keys, which makes it possible to forge a session and
bypass client certificate verification.

Changes:	https://freenginx.org/en/CHANGES-1.30

Security:	4784aba5-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by:	Netzkommune GmbH

(cherry picked from commit 7ac2e3d6e973bcef7bf45b72656a71e253cd9c75)

www/phpbb3: Security update to 3.3.19

Fixes an unauthenticated SMTP command injection through the contact
form, reflected and stored cross-site scripting, a missing CSRF check
when held private messages are released and several moderator permission
bypasses.

The same fixes were announced for 3.3.18, whose downloads did not carry
them.

Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.19/phpBB/docs/CHANGELOG.html

Security:	4784d4b8-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by:	Netzkommune GmbH

(cherry picked from commit 4d6d2c1680a007e107e49cc4fa9042781a677a61)

databases/openvoxdb8: Update to 8.17.1

ChangeLog:
https://github.com/OpenVoxProject/openvoxdb/blob/8.x/CHANGELOG.md#8171-2026-10-29

With hat:	puppet

(cherry picked from commit 492167db5aae54af8a504ce352f517a2f81caafa)

sysutils/openvox-server8: Update to 8.17.1

ChangeLog:
https://github.com/OpenVoxProject/openvox-server/blob/8.x/CHANGELOG.md#8171-2026-10-29

With hat:	puppet

(cherry picked from commit 459c96924430bf9f661ebe87ad716afcf9b454b5)

sysutils/openvox-agent8: Update to 8.31.2

ChangeLog:
https://github.com/OpenVoxProject/openvox/blob/8.x/CHANGELOG.md#8312-2026-10-29

With hat:	puppet

(cherry picked from commit 7416f8c3e98e11ea3094957e7912ee4caafa8a79)

databases/p5-DBIx-SearchBuilder: Update to 1.86

PR:		300305
(cherry picked from commit 159020b2c6041ec0e8ae43ed17c799b5b6004f70)

sysutils/gh-md-toc: Update to 0.11.0

ChangeLog: https://github.com/ekalinin/github-markdown-toc/releases/tag/0.11.0

MFH:            2026Q4
(cherry picked from commit 88b513de43d78cd20f86e374ea0096ce17e797e1)

www/py-nicegui-highcharts: Update to 3.3.0

ChangeLogs:

- https://github.com/zauberzeug/nicegui-highcharts/releases/tag/v3.3.0
- https://github.com/zauberzeug/nicegui-highcharts/releases/tag/v3.4.0
- https://github.com/zauberzeug/nicegui-highcharts/releases/tag/v3.5.0

MFH:            2026Q4
(cherry picked from commit 2b3f5fb946ed436f42cbde0a27ecd75d04245b88)

net/dataplaneapi: Update to 3.4.6

ChangeLogs:

- https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.4
- https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.5
- https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.6

MFH:            2026Q4
(cherry picked from commit 5e2e4eed8b8718b926860626817cbcf3fd77005b)

www/py-nicegui: Update to 3.18.0

ChangeLogs:

- https://github.com/zauberzeug/nicegui/releases#release-v3.13.0
- https://github.com/zauberzeug/nicegui/releases#release-v3.14.0
- https://github.com/zauberzeug/nicegui/releases#release-v3.15.0
- https://github.com/zauberzeug/nicegui/releases#release-v3.16.0
- https://github.com/zauberzeug/nicegui/releases#release-v3.17.0
- https://github.com/zauberzeug/nicegui/releases#release-v3.17.1
- https://github.com/zauberzeug/nicegui/releases#release-v3.18.0

MFH:            2026Q4
(cherry picked from commit c6401dd185de798dbe5adf0fde59259b80ffd22e)

sysutils/py-dbuild: Update to 1.13.0

ChangeLogs:

- https://github.com/daemonless/dbuild/releases/tag/v1.12.0
- https://github.com/daemonless/dbuild/releases/tag/v1.13.0

MFH:            2026Q4
(cherry picked from commit 1014eb13d984d016c4deedd3e5d517ec988cec56)

sysutils/nginx-ui: Update to 2.9.3

ChangeLogs:

- https://github.com/0xJacky/nginx-ui/releases/tag/v2.9.0
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.9.1
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.9.2
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.9.3

MFH:            2026Q4
(cherry picked from commit b0d5b748d51b2d2a055a50838f9f825ce4ea15b0)

databases/py-valkey: Update to 6.2.0

ChangeLog: https://github.com/valkey-io/valkey-py/releases/tag/v6.2.0

MFH:            2026Q4
(cherry picked from commit cd1fda3f295f77a6cb471e7c8cfaf25abdadd964)

textproc/py-vbuild: Replace pkgutil.find_loader for Python 3.14

pkgutil.find_loader was removed in Python 3.14, so import vbuild fails.
Use importlib.util.find_spec to detect the optional lesscpy, scss and
closure modules.

While here, add concurrent to USE_PYTHON and document the patches.

PR:             299910
Approved by:    dtxdf@ (maintainer)
MFH:            2026Q4

(cherry picked from commit 082580c019a813aa021b5900383c22ffc6437fc8)

sysutils/waitforssh: Update to 0.1.1

ChangeLog: https://github.com/DtxdF/waitforssh/releases/tag/v0.1.1

MFH:            2026Q4
(cherry picked from commit 3a58575f194155dd1e40ce4f8195cac279da69ae)

net/activemq: Update 6.3.2 => 6.3.3

Changelog:
https://github.com/apache/activemq/releases/tag/activemq-6.3.3

Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 1aba608efe7ab1b23b10a52ffc71606d07392a2e)

net-im/tox: Update 0.2.23 => 0.2.24

Changelog:
https://github.com/TokTok/c-toxcore/releases/tag/v0.2.24

Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit f7f895ebedd6af05d8f33e0245f3e16ecca7f5f1)

x11-servers/xlibre-server: Update to 25.1.11

- Fix issues with X/Xorg configure

With hat:       xlibre
PR:		299077
Reported by:	Slawomir Wojciech Wojtczak <vermaden __at__ interia.pl>

(cherry picked from commit 4a26980207881838c0ed9fb2eb86f3668fb89b18)

graphics/yacreader: Update to 10.4.0

ChangeLog: https://github.com/YACReader/yacreader/releases/tag/10.4.0
(cherry picked from commit 7e5362086e65383ef3119036db184f77dca03647)

archivers/unarr: Update to 1.2.0

Fixes four security issues in the rar, zip and tar readers, two of them
with assigned CVEs.

Drop both patches.  Upstream raised the CMake minimum to the same range
the port was patching in, and the bundled LZMA SDK (now v26.05) handles
FreeBSD's elf_aux_info() on arm and aarch64 by itself.

Switch to the release tarball upstream now publishes.

Take maintainership.

ChangeLog:	https://github.com/selmf/unarr/blob/v1.2.0/CHANGELOG.md
MFH:		2026Q4
Security:	6f31f4ab-d5fd-11f1-b2f0-002b67dfc673
(cherry picked from commit 4316186df3ae1b5925af86fce7fe73de8cd084d3)

graphics/yacreader: Fix build with unarr 1.2.0

unarr 1.2.0 made UNARR_API_VERSION an expression containing casts, which
is not valid in #if.  Drop the version guards; the check was for unarr
1.1.0 or newer and the tree is well past that.

Reported upstream: https://github.com/selmf/unarr/issues/40

MFH:		2026Q4
(cherry picked from commit 4a167aaaa8ae931d3076c2ea8b832f787d89b215)

multimedia/baka-mplayer: Deprecate for Qt5 removal

Users could consider multimedia/haruna as an alternative

Approved by:	arrowd (co-mentor)

(cherry picked from commit 418bb29d43f32f0f0595b9154158956c4d1636e0)

security/cryptopp-modern: Update to 2026.11.0

ChangeLog:
https://github.com/cryptopp-modern/cryptopp-modern/releases/tag/2026.11.0

MFH:		2026Q4
(cherry picked from commit 9ff93dc5baec6fe22b0c6796960b6d2ad4eaf2d6)

net/l2tpd: Mark DEPRECATED and expire by end of the year

(cherry picked from commit a7b8b66eb74d79e5dd2fd5b17c0a72649c814418)

databases/foundationdb7{1,3}-server: fix with msgpack-cxx updating.

PR:		299054
(cherry picked from commit bf6afea9d91245966a29ef6cabc6d75910e2acb8)

comms/chirp: update to 20261030

Event: New York City Marathon 2026
(cherry picked from commit 486467ebfadc40ff1b8d5b603152f8b55becfd24)

x11-toolkits/gtk40: fix file generation when BASH option is set

PR: 300317
(cherry picked from commit 93fe26443e4bfcb278f35365b34437b570f79591)

net/traefik: Update to upstream release 3.7.17

Details:
- Bugfix release, see
  https://github.com/traefik/traefik/releases/tag/v3.7.17

MFH:		2026Q4
(cherry picked from commit d79d8065b8f86579daa315161b4c67a56e9b6a5b)

www/phpmyfaq: Update to 4.1.11

(cherry picked from commit 423b95453c18d844262d57cac70ea9fd33405e49)

textproc/htmldoc: update to 1.9.25

A bug fix release.

Changelog: https://github.com/michaelrsweet/htmldoc/releases/tag/v1.9.25

MFH:		2026Q4
(cherry picked from commit 0e94290bdb68289fdcbd60352d82556daae379e7)

graphics/vigra: Drop py-nose from the NUMPY option

It never imports nose and nose is not in its build metadata;
devel/py-nose is dead upstream and broken since Python 3.12.

This commit removes py-nose from NUMPY_BUILD_DEPENDS and
NUMPY_RUN_DEPENDS, leaving only py-numpy, and bumps PORTREVISION since
the package's run dependencies change. It also fixes the NUMPY plist:
the 15 extension modules are installed as <name>%%PYTHON_TAG%%.so, not
vigra/<name>.so, so check-plist reported them as orphaned.

PR:		300279
MFH:		2026Q4
Reported by:	Patrick Crandol <patrick@crandol.com>

(cherry picked from commit 91daff09a59fc40a791a124c317bbaffc5b70dc0)

archivers/lzma: update to 26.05

Upstream changes:

 - minor changes

Changelog: https://www.7-zip.org/sdk.html

MFH:		2026Q4
(cherry picked from commit 7f3a607aedce653d51f8e2b8bbb5fa2f27c49bf4)

net-p2p/rtorrent: Warn about renamed config commands on upgrade

rtorrent 0.16 renamed several configuration commands (e.g.
network.port_range.set -> network.listen.port.range.set), so
configurations from earlier versions may fail at startup.  Add an
upgrade pkg-message pointing users to rtorrent.conf.sample.

PR:		300316
Reported by:	Benoit Felix <benoit.felix@outlook.com>
MFH:		2026Q4

(cherry picked from commit 53c1ff04d4ae1c7ee54af9e3b541f3c0bfc387bd)

graphics/phototonic: Update to 3.3.0

ChangeLog:	https://github.com/luebking/phototonic/releases/tag/v3.3.0
MFH:		2026Q4
(cherry picked from commit c7c7718e2d9e914109b24d8ae5e246578d295066)

security/libressl-devel: Security fix for OCSP

Security:	aafad06c-d519-11f1-8135-8447094a420f
MFH:		2026Q4
(cherry picked from commit 824098cc2559165850e6baab54bf6b87f02ba37d)

security/libressl: Security fix for OCSP

Security:	aafad06c-d519-11f1-8135-8447094a420f
MFH:		2026Q4
(cherry picked from commit dfaafcfe5a58f816a5730ef6c63d31da0bf9f9bf)

net/uriparser: Security update 1.0.2 => 1.0.3

Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog

While here:
- Format LICENSE section to make portfmt happy.
- Remove LICENSE_FILE since it doesn't get installed either.

PR:		300378
Approved by:	osa, vvd (Mentors, implicit)
Security:	CVE-2026-48841
MFH:		2026Q4

(cherry picked from commit f0cdd22deccdb6970769276be6e100b137095cfe)

textproc/kibana95: Update 9.5.4 => 9.5.5

Changelog:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.5.5-release-notes

https://github.com/nodejs/nan/blob/v2.30.0/CHANGELOG.md
https://github.com/uhop/node-re2/compare/1.26.1...1.27.0

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 26f188225a88f9ad1fec363f081e607bbb5336c1)

sysutils/logstash95: Update 9.5.4 => 9.5.5

Changelog:
https://www.elastic.co/docs/release-notes/logstash#logstash-9.5.5-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 0f140f46ca79c04a7c02d9cf356121dbbff766c4)

sysutils/beats95: Update 9.5.4 => 9.5.5

Changelog:
https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.5.5

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 33e2e7a843d6477806641d8ce35e2f9a015a0114)

textproc/kibana94: Update 9.4.7 => 9.4.8

Changelog:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.8-release-notes

https://github.com/nodejs/nan/blob/v2.30.0/CHANGELOG.md
https://github.com/uhop/node-re2/compare/1.26.1...1.27.0

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 162638935f5ff93c943d42d163810391cb5d588d)

sysutils/logstash94: Update 9.4.7 => 9.4.8

Changelog:
https://www.elastic.co/docs/release-notes/logstash#logstash-9.4.8-release-notes

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 88c39c9cdf58f639e690ebc79170f0149869e25d)

sysutils/beats94: Update 9.4.7 => 9.4.8

Changelog:
https://www.elastic.co/docs/release-notes/beats#beats-release-notes-9.4.8

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 4c4dcef91dd60e4232af06d6a08f4849b4d1ca3a)

textproc/kibana8: Update 8.19.21 => 8.19.23

Changelogs:
https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.22.html
https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.23.html

https://github.com/nodejs/nan/blob/v2.30.0/CHANGELOG.md
https://github.com/uhop/node-re2/compare/1.26.1...1.27.0

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 68e1ede8131ff218a6d580c34c449753c46450f2)

sysutils/logstash8: Update 8.19.21 => 8.19.23

Changelogs:
https://www.elastic.co/guide/en/logstash/8.19/logstash-8-19-22.html
https://www.elastic.co/guide/en/logstash/8.19/logstash-8-19-23.html

Approved by:	elastic (implicit, inactive)
Sponsored by:	UNIS Labs
MFH:		2026Q4

(cherry picked from commit 6ce17d9c155631441d427f08e9b179214c6c42d2)