deskutils/calibre: Add missing dependencies Some runtime python dependencies are missing from the port, causing plugin failures. PR: 299452 MFH: 2026Q4af1be921a1
Port details
deskutils/calibre8.16.2_6
Ebook management application
- Maintainer
- madpilot@FreeBSD.org
- Packages
- calibre 8.16.2_6
- Upstream
- Higher version available: 9.17.0
- CPE
calibre-ebook:calibrefrom the port- WWW
- https://calibre-ebook.com/
- Links
- cgit · VuXML
Unaddressed (8) · The CVE record lists this version as affected, no VuXML entry names the CVE
Updating to 9.6.0 would fix 8 of 8 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 9.2.0 2 · 9.3.0 3 · 9.4.0 5 · 9.5.0 6 · 9.6.0 8
| CVE-2026-26065 | 9.3 | 2026-02-20 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PD… |
| CVE-2026-33206 | 8.2 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Cal… |
| CVE-2026-25636 | 8.2 | 2026-02-06 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existin… |
| CVE-2026-25731 | 7.8 | 2026-02-06 | calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code executi… |
| CVE-2026-27810 | 6.4 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, an HTTP Response Header Injection vulnerabil… |
| CVE-2026-27824 | 5.3 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force pro… |
| CVE-2026-30853 | 5.0 | 2026-03-13 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.r… |
| CVE-2026-33205 | 4.8 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability … |
VuXML only (0) · listed, port not fixed yet
None.
pkg audit reports nothing for this version.Fixed (0)
No VuXML entries for this package.
Commits (478)
*/*: Bump consumers of www/beautifulsoup4 after port rename PR: 297837 Approved by: wen (maintainer via email)45ea4cf85c
deskutils/calibre: Fix build with build with FFmpeg 9.0 Import upstream patch to fix the issue. While here, fix some portclippy/portfmt warnings. PR: 297387 Obtained from: https://github.com/kovidgoyal/calibre/commit/49af1f0904e00351ffbf9ad430a37bfe66226bae08273846dd
deskutils/calibre: Add dependency on py-sqlite3 py-sqlite3 is required for reader device automount to work properly. MFH: 2026Q326fdd7a8b8
deskutils/*: Add CPE info46d21d48bf
*: Bump PORTREVISION on Poppler's consumers7ddc6804bf
multimedia/ffmpeg: bump revision to chase lib version change18ea9c7108
deskutils/calibre: Update to 8.16.240203f254a
graphics/poppler: bump consumers of graphics/poppler PR: 291277 Exp-run by: antoine3076d31cda
deskutils/calibre: Update to 8.15.0ff512aaab6
deskutils/calibre: Update to 8.14.0cc0a504ac5
deskutils/calibre: Update to 8.13.065ee9ac191
deskutils/calibre: Update to 8.12.06072757829
deskutils/calibre: Update to 8.11.1bb114e6924
deskutils/calibre: deskutils/calibre: Update to 8.11.0 - Bump required library versions8297c16223
*/*: switch dependency from devel/py-lxml5 to devel/py-lxml Currently, there are two versions of python XML processing library which conflict each other in the ports tree, namely: - devel/py-lxml5 (now at version 5.4.0) - devel/py-lxml (now at version 6.0.1) To avoid the situation that some ports depend on py-lxml5 and some others do on py-lxml (by switching dependencies individually), this commit switches the dependencies from py-lxml5 to py-lxml at once. Additional note: There are still two ports (textproc/py-rdflib and www/py-draftjs-exporter) depending on py-lxml5 since they limit upper version to less than 6. PR: 289491 Approved by: Michiel van Baak Jansen <michiel@vanbaak.eu>, arrowd, crees, madpilot, delphij, marcus, nivit, kai, skreuzer, fluffy, bofh, thierry, stephen, sunpoet, 0mp, Eric Camachat <eric@camachat.org>a6233e5a2f
deskutils/calibre: Update to 8.10.000a0366dca
all: bump PORTREVISION after updating graphics/libyuv Using the Tools/scripts/bump_revision.pl scriptb304d8ab18
deskutils/calibre: Update to 8.9.0 - Remove patch included upstreamca1fc95840
deskutils/calibre: Update to 8.8.0 - Disabling piper voices plugin unconditionally. It depends on unreleased espeak features and fails to compile at present. - Remove usage of != Makefile operator8c2ae4599b
*/*: update dependency on devel/py-lxml to devel/py-lxml5 www/py-beautifulsoup has switched dependency on devel/py-lxml to devel/py-lxml5. Ports which directly or indirectly depends on both www/py-beautifulsoup and devel/py-lxml must also switch their dependencies on devel/py-lxml to devel/py-lxml5 to avoid conflicts. PR: 288047 Approved by: portmgr (chase dependency change)230fb2661c
deskutils/calibre: Update to 8.7.089ac92be3c
deskutils/calibre: Update to 8.6.0f3797e8862
deskutils/calibre: Update to 8.5.0ff24bce643
deskutils/calibre: Update to 8.4.0 Remove upstreamed patch.970c09afcf
textproc/snowballstemmer: chase shlib version bump0119f8dcd8
deskutils/calibre: Add patch to fix build with Qt 6.9 While here refresh patches. PR: 2860512889b8b22a
deskutils/calibre: Update to 8.3.03ffdcd35dd
graphics/poppler: bump dependent ports78c4bd4996
deskutils/calibre: Convert to 8.2.1002c59c6e356
deskutils/calibre: Update to 8.2.1cbe4bbcb58
deskutils/calibre: Update to 8.1.1 - Remove upstreamed patch754a7c04e5
deskutils/calibre: Update to 8.0.1, add UDisks2 device mounting I submitted the DBus/UDisks2 device mounting code upstream here: https://github.com/kovidgoyal/calibre/pull/2694 PR: 258224ea5a07ded8
*/*: Bump consumers of devel/icu ...to avoid library mismatchesff33dd4700
deskutils/calibre: Update to 7.26.029cd6b11db
deskutils/calibre: Update to 7.25.07a365c6aac
deskutils/calibre: Update to 7.24.084998fa6aa
deskutils/calibre: Update to 7.23.0b91dcb4fe3
deskutils/calibre: Update to 7.22.05b7bf7ee76
deskutils/calibre: Fix build on 13.3 Recent changes depend on an OpenSSL 3.x define. Just define it for older releases. Reported by: pkg-fallout MFH: 2024Q4d450feb023
deskutils/calibre: Update to 7.21.065dcd4746a
*/*: Chase removal of sip from RUN_DEPENDSf3eb2459d7
*/*: Remove qtbuilder and sip from RUN_DEPENDS devel/py-qtbuilder and devel/py-sip should only be used as a BUILD_DEPENDS. (e.g. USE_PYQT=qtbuilder:build sip:build) Usually, these are only used to build the PyQt framework, but a few other ports need them to build. Ports that have them as a BUILD_DEPENDS unnecessarily haven't been audited yet. Sip used to be needed for run, but this hasn't been the case for quite some time. Runtime is provided by the devel/py-qt[56]-sip ports. (USE_PYQT=pysip). The main PyQt ports provide this automatically, so it isn't necessary to add it to individual consumers. While here: www/onionshare: Remove PyQt stuff completely. It uses PySide. With hat: kde@0d0b4d9bb9
deskutils/calibre: Update to 7.20.02ee1ef4fae
deskutils/calibre: Update to 7.19.0ad5c5f5e35
deskutils/calibre: Update to 7.18.0 - Move main MASTER_SITE to https - Sort some variables and plist itemsf400afa462
deskutils/calibre: Update to 7.17.078029bbe79
deskutils/calibre: Update to 7.16.0, fix translations An error introduced in the 7.13.0 update caused translations to not be correctly compiled. Fixes: 82d4e4419621e0db6e1945bc0e56e83f969218ce MFH: 2024Q318580011ff
deskutils/calibre: Update to 7.15.0faaf71a376
deskutils/calibre: Update to 7.14.0b10953cbc9