Changelog

What changed on portstatus, newest first. Dates are the day the change went live. Only what a visitor can notice is listed here; rebuilds, measurements and the quality gate are documented in the project wiki.

• The VuXML generator was rebuilt. The CVEs on a port page can be selected and turned into a ready-made entry for security/vuxml to copy. It lists the package names the port actually builds and, for each of them, the affected range in pkg notation with epoch and revision. The entry says what is left for the maintainer to fill in.
• Affected ranges are kept per port and CVE and merged into their union, one range per epoch the port actually had.
• Fewer wrong matches: an epoch belongs to the upper bound of a range, and a CVE record row that only concerns another platform no longer contributes a bound at all.

• Every page of a port in the tree carries a CPE line. It says which of five cases applies and, where the port declares nothing, names a suggestion with the evidence URL it rests on and the Makefile lines to copy. A missing line no longer has to be read as "nobody looked".
• The CPE dictionary of the NVD is read daily, around 50,000 vendor and product pairs.
• CVEs that NVD or the CVE record marks as disputed are shown as disputed and are no longer counted as unaddressed.
• A VuXML entry that covers a package and reaches up to the fixing version now counts as "VuXML only" even when it does not name the CVE.
• The CNA records (cvelistV5) are used as a second source wherever NVD has nothing for a CVE and product yet.

• Port pages got a Dependencies tab: what the package depends on, and which packages depend on it.
• Port pages show the pkg-descr of the port next to the port info.
• The CVE list can be sorted by every column, and the subpackages of one port are collapsed into a single row.
• Recent CVEs in the sidebar got two tabs, Ports and CVEs.

• Port pages got tabs: Port info, Install, and Packages by version and architecture, plus a Quarterly section with the version on the quarterly branch and merges that are still missing.
• Open problem reports from FreeBSD Bugzilla are listed on the port page.
• Ports that were moved or removed say where they went and what they were called before.
• Wrong data can be reported through the issue tracker; port and CVE pages fill the form in.
• A port without a package says why: a dependency has none, the port is not built although its dependencies are, or it waits for its first build.

• First public version: commit list for main and the quarterly branch, CVE list, port pages, updates, search, maintainer pages, and the commit history of the ports tree since 1994.