CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

databases/qt5-sqldrivers-sqlite35.15.19p96

Qt SQLite 3 database plugin (KDE patched)

Maintainer
kde@FreeBSD.org
Packages
qt5-sqldrivers-sqlite3 5.15.19p96
Upstream
Higher version available: 6.12.0
CPE
qt:qt
WWW
https://www.qt.io/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (22)

Jason E. Hale (jhale) · 5.15.19p96
Qt5: Update to 5.15.19

This is the final release of Qt5. If your port still uses Qt5 and could
possibly use Qt6 instead, now would be a good time to make the switch.

PySide2: Update to 5.15.19

Announcement:
https://lists.qt-project.org/pipermail/announce/2026-May/000626.html
Release notes:
https://code.qt.io/cgit/qt/qtreleasenotes.git/tree/qt/5.15.19/release-note.md
1817deda1e
Jason E. Hale (jhale)
Qt5: Update to 5.15.18

This is the penultimate release of Qt5. While Qt5 is EOL, due to the
LGPL releases being a year behind the commercial releases, there will
still be one more patch release in May 2026.

PySide2: Update to 5.15.18

Announcement:
https://lists.qt-project.org/pipermail/announce/2025-October/000592.html
Release notes:
https://code.qt.io/cgit/qt/qtreleasenotes.git/tree/qt/5.15.18/release-note.md

MFH:		2025Q4
bc01cbb5a1
Jason E. Hale (jhale)
Qt5: Update to 5.15.17 (getting down to the end)

Upstream standard support for Qt5 is officially over. [1] In short,
that means get your ports off of Qt5 ASAP, especially end-user
applications. FreeBSD deprecation of Qt5 is coming soon! It will likely
be a year of lead time, but please help in the meantime and remove qt5
flavors and child ports whenever possible.

www/qt5-webengine has been updated to 5.15.19 with security patches up to
Chromium 135.0.7049.95. It's unclear at this point if further security
patches will be publically available. The Qt5 WebEngine component,
however, is and forever will be based on Chromium 87.0.4280.144, which
is over 4 years old. Props to upstream for their backports over all
these years and making them publically available (probably more to do
with licensing constraints than anything, but hey).

We otherwise depend on KDE as our direct upstream to roll our distfiles,
which we have been hosting locally for over 3 years. Since Qt upstream
drops the LGPL releases of Qt 5.15.x a year later, there's no guarantee
KDE will rebase their patchset over the next year for the remaining two
.18 and .19 releases. This might be the last update for Qt5 on FreeBSD.

[1] https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders
9d76916067
Jason E. Hale (jhale)
Qt5: Update to 5.15.16

Update devel/pyside2* and devel/shiboken2 to 5.15.16

Update www/qt5-webengine to include the latest security fixes in
the chromium submodule [1]

Release note:
https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.16/release-note.md

MFH:		2024Q4
Security:	16e472d5-a8aa-11ef-b680-4ccc6adda413 [1]
501ccfe6dd
Jason E. Hale (jhale)
Qt5: Update to 5.15.15

Update devel/pyside2* and devel/shiboken2 to 5.15.15

Update www/qt5-webengine to include the latest security fixes in
the chromium submodule

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.15/release-note.md

MFH:		2024Q3
Security:	66907dab-6bb2-11ef-b813-4ccc6adda413
9e1e9e17c5
Jason E. Hale (jhale)
Qt5: Update to 5.15.14

Update devel/pyside2* and devel/shiboken to 5.15.14

Update devel/qt5-script* and www/qt5-webengine to 5.15.17

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.14/release-note.md
72a628f271
Jason E. Hale (jhale)
Qt5: Update to 5.15.13

Update devel/pyside2* and devel/shiboken to 5.15.13

Update www/qt5-webengine to latest commit. Python 3.x support has been
integrated upstream, so local patches have been removed.

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.13/release-note.md
9793a1e61a
Jason E. Hale (jhale)
Qt5: Update to 5.15.12

Update devel/pyside2* and devel/shiboken2 to 5.15.12

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.12/release-note.md
dc05989834
Jason E. Hale (jhale)
Qt5: Update to 5.15.11

Update devel/pyside2* and devel/shiboken2 to 5.15.11

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.11/release-note.md
7f496af089
Jason E. Hale (jhale)
Qt5: Update to 5.15.10

Update devel/qt5-script* and www/qt5-webengine to 5.15.15-lts
Update devel/pyside2* and devel/shiboken2 to 5.15.10

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.10/release-note.md

PR:		273934
Exp-run by:	antoine
2a5c778173
Tobias C. Berner (tcberner)
Qt: Update Qt 5 to 5.15.8

- update distfiles to be rebased on the Qt 5.15.8 branch

PR:		268773
Exp-run by:	antoine
1fe9749d83
Tobias C. Berner (tcberner)
Qt5: Update Qt 5 to 5.15.7

* rebase the KDE patched Qt5 ontop of the 5.15.7 branch
* update qt5-script to 5.15.11

Exp-run by:	antoine
PR:		268533
3aeb8b79ba
Tobias C. Berner (tcberner)
qt5: Update Qt to 5.15.5 (KDE patched)

- update patch-collection diff to be at the highest patch-level
- update patch-collection diff to be against 5.15.5 instead of 5.15.2
- update devel/qt5-script to 5.15.10
- libressl support by Felix Palmen <felix@palmen-it.de>

PR:			264944
Exp-run by:		antoine
Differential Revision:	https://reviews.freebsd.org/D35619
787e501e3d
Tobias C. Berner (tcberner)
Qt: Switch Qt5 to use KDE's Qt patch collection

From [1]
    What's this?

	This is a set of git repositories based on the last public
	commits available for Qt 5.15 branches with a curated collection
	of patches on top to ensure open source products can be used
	comfortably until users transition to their Qt 6-based ports.

    Which patches does it include?

	This collection of patches includes patches that fix at least
	one of the following:

	    * Security issues
	    * Crashes
	    * Functional defects

	We only include patches that have been approved upstream in the
	Qt project. If a patch cannot be merged upstream for technical
	reasons (e.g. the class no longer exists), it can also be
	merged.

	The patches to merge will be decided based on their relevance
	towards Open Source products and their viability.

PR:		260548
Exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D33446

[1] https://community.kde.org/Qt5PatchCollection
6b3bece75a
Mathieu Arnold (mat)
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat)
Remove # $FreeBSD$ from Makefiles.
305f148f48
Tobias C. Berner (tcberner)
Update Qt5 to 5.12.1

Release announcement:
  https://blog.qt.io/blog/2019/02/01/qt-5-12-1-released/
Changelog:
  https://wiki.qt.io/Qt_5.12.1_Change_Files

- A change was required to qt-dist.mk to always pass LOCALBASE to qmake,
  as Qt5 has been installed to a prefix for some time now, there should
  not be any harm in that, with respect to it picking up installed versions
  of itself during build.

PR:		235622
Exp-run by:	antoine
031fc9bfb6
Tijl Coosemans (tijl)
Fix Qt5 symbol version scripts to put the catch-all clause first.  When a symbol matches multiple clauses the last one takes precedence.  If the catch-all is last it captures everything.  In the case of Qt5 libraries this caused all symbols to have a Qt_5 label while some should have Qt_5_PRIVATE_API.  This only affects lld because GNU ld always gives the catch-all lowest priority.

Older versions of Qt5Webengine exported some memory allocation symbols from
the bundled Chromium.  Version 5.9 stopped exporting these [1] but the
symbols were kept as weak wrappers for the standard allocation functions to
maintain binary compatibility. [2][3]  The problem is that the call to the
standard function in these weak wrappers is only resolved to the standard
function if there's a call to this standard function in other parts of
Qt5Webengine, because only then is there a non-weak symbol that takes
precedence over the weak one.  If there's no such non-weak symbol the call
in the weak wrapper resolves to the weak wrapper itself creating an infinite
call loop that overflows the stack and causes a crash.  Some of the
allocation functions are variants of C++ new and delete and it probably
depends on the compiler whether these variants are used in other parts of
Qt5Webengine.

Remove the weak wrappers (make them Linux specific).  This isn't binary
compatible but we are already breaking that with the changes to the symbol
versions.

[1] https://github.com/qt/qtwebengine/commit/5c2cbfccf9aafb547b0b30914c4056abd25942a4
[2] https://github.com/qt/qtwebengine/commit/2ed5054e3a800fa97c2c9e920ba1e6ea4b6ef2a5
[3] https://github.com/qt/qtwebengine/commit/009f5ebb4bd6e50188671e0815a5dae6afe39db5

Bump all ports that depend on Qt5.

PR:		234070
Exp-run by:	antoine
Approved by:	kde (adridg)
1bf487d3e7
Mathieu Arnold (mat)
Remove USE_SQLITE from bsd.databases.mk, replaced by USES=sqlite.

While there replace USE_SQLITE=x by USES=sqlite:x.

PR:		208971
Submitted by:	mat
Exp-run by:	antoine
With hat:	portmgr
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D5951
21bc5c0345
Raphael Kubo da Costa (rakuco)
Update Qt5 ports to 5.3.2.

Proudly presented by the KDE on FreeBSD team, with several guest stars.

This update took way longer than initially expected due to us previously
accumulating assumptions and changes to Qt's build system that finally bit
us back with the 5.3 release series, so we had to do a fair amount of
cleanup.

New ports:
- comms/qt5-serialport: Qt functions to access serial ports, originally
                        based on work by Fernando Apesteguia. [1]
- devel/qt5-qdoc: Qt documentation generator, the Qt5 equivalent of
                  devel/qt4-qdoc3. Originally worked on by Tobias Berner.
                  It had already been half-split from devel/qt5-buildtools,
                  we just needed to finish the work.

Dead ports:
- devel/qt5-qmldevtools: Merged into lang/qt5-qml.

Minor changes:
- devel/qt5: Add x11/qt5-x11extras and the new ports to the dependency list.
- graphics/qt5-imageformats: The port now supports the JPEG2000, WEBP,
                             Direct Draw Surface and ICNS formats.
- multimedia/qt5-multimedia: The ALSA and PULSEAUDIO options are now
                             mutually exclusive due to changes introduced in
                             Qt 5.3.0 (the ALSA code is now a proper plugin
                             that is only built if PulseAudio is not used).
- x11/qt5-x11extras: Add USE_LDCONFIG since the port installs a shared
                     library.

The big changes:
- bsd.qt.mk: Set QMAKESPEC instead of QMAKEPATH. [3]
  QMAKEPATH does much more than we want now that we call qmake from the top
  of ${WRKSRC}. qmake uses QMAKEPATH when evaluating the QMAKE_MKSPECS
  property, which is in turn used by qt_config.pri to load the .pri files in
  mkspecs/modules.

  In practice, this means that if people have an older Qt installation those
  files will be used and QT_CONFIG will have values such as "gui" even if
  one is building a port like textproc/qt5-xml, which passes -no-gui to the
  configure script. Consequently, unintended code paths may be enabled or
  the configuration step can just fail if the .pro files expect values that
  are not present in the system-wide, older .pri files.

  We avoid all those problems if we use QMAKESPEC, as qmake does not take
  its value into account when evaluating the QMAKE_MKSPECS property and will
  only parse the files in the mkspec's directory (mkspecs/freebsd-clang, for
  example, instead of all the files in mkspecs).

- Stop explicitly passing ${LOCALBASE} to the compiler. [3]
  qmake's behavior has changed in Qt 5, and the paths set in QMAKE_INCDIR
  and QMAKE_LIBDIR in the mkspecs are passed before any others, such as the
  ones in the build directory themselves.

  In practice, this means that we end up with linker calls like this:

  c++ -o libfoo.so foo.o bar.o -L/usr/local/lib -L/wrkdir/build/lib
      -lQt5Gui -lQt5Core

  So if one already has Qt installed in the system, the older, already
  present version of the libraries in /usr/local/lib will be used instead of
  the newly-built ones in /wrkdir/build/lib.

  QTBUG-40825 discusses this behavior upstream, but there has been no
  agreement on a solution yet.

  For now, the solution adopted is to make the compiler and the linker aware
  of those paths but only try them last after all others, and this is
  achieved by setting the CPATH and LIBRARY_PATH environment variables when
  qmake is being used.

  In addition to setting them in CONFIGURE_ENV and MAKE_ENV, we also need to
  stop changing QMAKE_INCDIR and QMAKE_LIBDIR as well as filter those paths
  from the pkg-config calls qtbase's configure script makes.

- Call qmake from the root of the ${WRKSRC}.

  In Qt 5.3, Qt's build infrastructure has undergone some changes that make
  our previous approach of calling qmake from the directories we want to
  build stop working. Things would break even more in Qt 5.4, in which
  qtbase's configure script does not accept the -process, -fully-process and
  -dont-process arguments anymore (it always behaves as if -process had been
  used).

  Bite the bullet and start calling qmake from ${WRKSRC}. The largest part of
  this change involves changing lines in Makefiles from
    WRKSRC_SUBDIR=	foo/bar
  to
    BUILD_WRKSRC=		${WRKSRC}/foo/bar
    INSTALL_WRKSRC=		${WRKSRC}/foo/bar
  as well as adding patches to .pro files to avoid entering other
  subdirectories and removing post-configure targets that are not necessary
  anymore.

  Since qmake needs to be called from the top of ${WRKSRC} anyway, we can
  also simplify the configuration process for the qtbase ports a little.
  Looking at r10019 it is not clear why we started calling qmake in the
  pre-configure target in addition to the post-configure one (while also
  skipping it in do-configure), but we can now drop this call since letting
  configure behave as if -process had been passed means it will call qmake
  on its own and overwrite the files generated by the pre-configure call. We
  still need to call qmake in post-configure though, as the configure script
  does not pass -recursive when calling qmake and we need to be able to call
  make from any subdirectory when building.

PR:		194762 [1]
PR:		194566 # exp-run with base GCC and clang
PR:		194088 [3]
a9662ed949
Tijl Coosemans (tijl)
Bump more ports that depend on libsqlite3.so: - ports that set USE_SQLITE with the *_USE option helper - ports that depend on libsqlite3 indirectly as reported by pkg rquery

Approved by:	portmgr (implicit)
ec94e4d5eb
Max Brazhnikov (makc)
KDE/FreeBSD team is happy to present Qt 5 in ports!

Alberto Villa (avilla@) has done all the hard work to create Qt 5 ports.
Trivial update from 5.2.0-beta1 to 5.2.1 by me.

Special thanks for Adriaan de Groot <groot@kde.org> for his assistance for
Qt-5.2.0 update.

Approved by:	portmgr (bapt) (for Mk/bsd.port.mk)
4cd1e8830e