CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

devel/qt5-core5.15.19p96

Qt core non-graphical module (KDE patched)

Maintainer
kde@FreeBSD.org
Packages
qt5-core 5.15.19p96
Upstream
Higher version available: 6.12.0
CPE
qt:qt
WWW
https://www.qt.io/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range this version has left.

Commits (96)

Jason E. Hale (jhale) · 5.15.19p96
Qt5: Update to 5.15.19

This is the final release of Qt5. If your port still uses Qt5 and could
possibly use Qt6 instead, now would be a good time to make the switch.

PySide2: Update to 5.15.19

Announcement:
https://lists.qt-project.org/pipermail/announce/2026-May/000626.html
Release notes:
https://code.qt.io/cgit/qt/qtreleasenotes.git/tree/qt/5.15.19/release-note.md
1817deda1e
Jason E. Hale (jhale)
Qt5: Update to 5.15.18

This is the penultimate release of Qt5. While Qt5 is EOL, due to the
LGPL releases being a year behind the commercial releases, there will
still be one more patch release in May 2026.

PySide2: Update to 5.15.18

Announcement:
https://lists.qt-project.org/pipermail/announce/2025-October/000592.html
Release notes:
https://code.qt.io/cgit/qt/qtreleasenotes.git/tree/qt/5.15.18/release-note.md

MFH:		2025Q4
bc01cbb5a1
Gleb Popov (arrowd)
devel/qt5-core: Fix build on CURRENT with native inotify impl

Reported by:	fluffy
590be71494
Jason E. Hale (jhale)
Qt5: Update to 5.15.17 (getting down to the end)

Upstream standard support for Qt5 is officially over. [1] In short,
that means get your ports off of Qt5 ASAP, especially end-user
applications. FreeBSD deprecation of Qt5 is coming soon! It will likely
be a year of lead time, but please help in the meantime and remove qt5
flavors and child ports whenever possible.

www/qt5-webengine has been updated to 5.15.19 with security patches up to
Chromium 135.0.7049.95. It's unclear at this point if further security
patches will be publically available. The Qt5 WebEngine component,
however, is and forever will be based on Chromium 87.0.4280.144, which
is over 4 years old. Props to upstream for their backports over all
these years and making them publically available (probably more to do
with licensing constraints than anything, but hey).

We otherwise depend on KDE as our direct upstream to roll our distfiles,
which we have been hosting locally for over 3 years. Since Qt upstream
drops the LGPL releases of Qt 5.15.x a year later, there's no guarantee
KDE will rebase their patchset over the next year for the remaining two
.18 and .19 releases. This might be the last update for Qt5 on FreeBSD.

[1] https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders
9d76916067
Daniel Engberg (diizzy)
*/*: Bump consumers of devel/icu

...to avoid library mismatches
ff33dd4700
Jason E. Hale (jhale)
Qt5: Update to 5.15.16

Update devel/pyside2* and devel/shiboken2 to 5.15.16

Update www/qt5-webengine to include the latest security fixes in
the chromium submodule [1]

Release note:
https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.16/release-note.md

MFH:		2024Q4
Security:	16e472d5-a8aa-11ef-b680-4ccc6adda413 [1]
501ccfe6dd
Jason E. Hale (jhale)
Qt5: Update to 5.15.15

Update devel/pyside2* and devel/shiboken2 to 5.15.15

Update www/qt5-webengine to include the latest security fixes in
the chromium submodule

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.15/release-note.md

MFH:		2024Q3
Security:	66907dab-6bb2-11ef-b813-4ccc6adda413
9e1e9e17c5
Jason E. Hale (jhale)
Qt5: Update to 5.15.14

Update devel/pyside2* and devel/shiboken to 5.15.14

Update devel/qt5-script* and www/qt5-webengine to 5.15.17

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.14/release-note.md
72a628f271
Jason E. Hale (jhale)
Qt5: Update to 5.15.13

Update devel/pyside2* and devel/shiboken to 5.15.13

Update www/qt5-webengine to latest commit. Python 3.x support has been
integrated upstream, so local patches have been removed.

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.13/release-note.md
9793a1e61a
Muhammad Moinur Rahman (bofh)
sysutils/etc_os-release: Remove expired port

2023-12-31 sysutils/etc_os-release: No longer required after the EOL of 12
141df258e7
Jason E. Hale (jhale)
Qt5: Update to 5.15.12

Update devel/pyside2* and devel/shiboken2 to 5.15.12

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.12/release-note.md
dc05989834
Jan Beich (jbeich)
devel/icu: update to 74.1

Changes:	https://github.com/unicode-org/icu/releases/tag/release-74-1
Reported by:	GitHub (watch releases)
PR:		274317
Exp-run by:	antoine (incomplete)
Approved by:	fluffy
e55b80195e
Jason E. Hale (jhale)
Qt5: Update to 5.15.11

Update devel/pyside2* and devel/shiboken2 to 5.15.11

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.11/release-note.md
7f496af089
Jason E. Hale (jhale)
Qt5: Update to 5.15.10

Update devel/qt5-script* and www/qt5-webengine to 5.15.15-lts
Update devel/pyside2* and devel/shiboken2 to 5.15.10

Release note: https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/5.15.10/release-note.md

PR:		273934
Exp-run by:	antoine
2a5c778173
Jan Beich (jbeich)
devel/icu: update to 73.1

- Temporarily switch to GitHub auto archive (release artifacts are N/A atm)

Changes:	https://github.com/unicode-org/icu/releases/tag/release-73-1
Reported by:	GitHub (watch releases)
PR:		270422
Exp-run by:	antoine
f1f1a8be88
Tobias C. Berner (tcberner)
Qt: Update Qt 5 to 5.15.8

- update distfiles to be rebased on the Qt 5.15.8 branch

PR:		268773
Exp-run by:	antoine
1fe9749d83
Tobias C. Berner (tcberner)
Qt5: Update Qt 5 to 5.15.7

* rebase the KDE patched Qt5 ontop of the 5.15.7 branch
* update qt5-script to 5.15.11

Exp-run by:	antoine
PR:		268533
3aeb8b79ba
Jan Beich (jbeich)
devel/icu: update to 72.1

Changes:	https://github.com/unicode-org/icu/releases/tag/release-72-1
Reported by:	GitHub (watch releases)
PR:		266582
Exp-run by:	antoine
dfe25d73e7
Felix Palmen (zirias)
Mk/Uses: always use colon for build/run suffix

Most USES use a colon for build/run(/test) suffixes. Change kde.mk,
qt.mk and pyqt.mk to do the same, and update all ports using that.

Document in CHANGES.

PR:			266034
Exp-run by:		antoine
Approved by:		tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D36349
ddae4e92d8
Tobias C. Berner (tcberner)
qt5: Update Qt to 5.15.5 (KDE patched)

- update patch-collection diff to be at the highest patch-level
- update patch-collection diff to be against 5.15.5 instead of 5.15.2
- update devel/qt5-script to 5.15.10
- libressl support by Felix Palmen <felix@palmen-it.de>

PR:			264944
Exp-run by:		antoine
Differential Revision:	https://reviews.freebsd.org/D35619
787e501e3d
Jan Beich (jbeich)
devel/icu: update to 71.1

Changes:	https://github.com/unicode-org/icu/releases/tag/release-71-1
Reported by:	GitHub (watch releases)
PR:		262654
Exp-run by:	antoine
Approved by:	fluffy
268cee3b02
Adriaan de Groot (adridg)
devel/qt5-core: add upstream security patch
7c60f16624
Tobias C. Berner (tcberner)
Qt: Switch Qt5 to use KDE's Qt patch collection

From [1]
    What's this?

	This is a set of git repositories based on the last public
	commits available for Qt 5.15 branches with a curated collection
	of patches on top to ensure open source products can be used
	comfortably until users transition to their Qt 6-based ports.

    Which patches does it include?

	This collection of patches includes patches that fix at least
	one of the following:

	    * Security issues
	    * Crashes
	    * Functional defects

	We only include patches that have been approved upstream in the
	Qt project. If a patch cannot be merged upstream for technical
	reasons (e.g. the class no longer exists), it can also be
	merged.

	The patches to merge will be decided based on their relevance
	towards Open Source products and their viability.

PR:		260548
Exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D33446

[1] https://community.kde.org/Qt5PatchCollection
6b3bece75a
Jan Beich (jbeich)
devel/icu: update to 70.1

Changes:	https://github.com/unicode-org/icu/releases/tag/release-70-1
Reported by:	GitHub (watch releases)
PR:		258794
Exp-run by:	antoine
f34ece3aa6
Adriaan de Groot (adridg)
[Qt, GNOME] Handle os-release a little more smartly

Synth -- and therefore not all FreeBSD installations that *could*
have an /etc/os-release, or that *ought* to have an os-release
file at runtime -- doesn't have the RC script installed, so
was triggering the "depend on ports os-release" clause.

Partly revert, to checking for existence, but **also** assume
that sufficiently-new 13 (or later) releases have os-release in
base. This means that 12.2 (which ought to have it) will rely
on base, while 12.1 and 11.4 and other legacy releases will
rely on the port.

PR:	255354 251073
c237911a72
Adriaan de Groot (adridg)
Handle os-release more smartly

The Qt ports, and GNOME control center, can read /etc/os-release,
and have patches to read /usr/local/etc/os-release -- however,
the two files update differently, and /etc/os-release is preferred.
Tighten up the .if to select when to depend on the extra
port for /usr/local/etc/os-release (basically: pre 11.4 and 12.1)

- Bumps PORTREVISION because dependencies may change.
- Note that I used the --author command-line option to
  set that mikael@ wrote this patch.

PR:		251073
1ef5284b23
Jan Beich (jbeich)
devel/icu: update to 69.1

Changes:	https://github.com/unicode-org/icu/releases/tag/release-69-1
Reported by:	GitHub (watch releases)
69d24a727d
Mathieu Arnold (mat)
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat)
Remove # $FreeBSD$ from Makefiles.
305f148f48
Adriaan de Groot (adridg)
Fix Qt5 ports

Thanks to antoine@ for figuring out that ${REINPLACE_CMD} does not
handle '\t' in all supported versions -- so replacing the tabs in
the script kept the tabs, but called /usr/bin/ca and /usr/bin/sor
instead. Switched to indenting with spaces instead, so and only
strip leading spaces at that, so the scripts can be slightly
easier to indent / layout. Add comment pointing out how to
easily read the shellscript among all the minifying-magic.

danfe@ pointed to a naming mix-up; because the variables were
used consistently, this had no effect but a weirdly-named temporary
file in ${WRKSRC}. Swapped the names the right way around.

Bump PORTREVISION on qt5-core again to force another round of
rebuilds.

Reported by:	danfe, antoine
2e6999b9c0
Adriaan de Groot (adridg)
Bump devel/qt5-core PORTREVISION to force a rebuild

This follows up changes to qt-dist.mk, and builds a new qt5-core.
The new package will get a new pkg install and deinstall script
which will clean up existing qconfig-modules which may have gathered
hundreds of update lines over the years of Qt5.
e9477b9b96
Loïc Bartoletti (lbartoletti)
Update Qt/PySide2 to 5.15.2 / PyQt to 5.15.1 / SIP to 5.4.0 This commit combines several updates.

- Update Qt to 5.12.2
- Update PyQt to 5.15.1
- Since PySide 5.15.1 is broken with Qt 5.15.2, so PySide and Shiboken are also updated to 5.15.2.
- Update sip to 5.4.0

SIP is a collection of tools  to create Python bindings for C and C++ libraries and used by PyQt and wxPython. There are some changes with sip5 [1]:
- python 3.5+ is required
- sip drops support of old deprecated methods as sipdistutils & cie.
- this version breaks also PyQt5 extension ABI. SIP files will be installed in ${PYTHON_SITELIBDIR}/PyQt${_PYQT_VERSION}/bindings
- some ports will use the new pyqtbuilder package with the pyproject.toml setup. Instead if the project have a setup.py, you should use sip-build to build it.
- if a port needs sip, it should also needs pysip. BTW, py-qt5-core requires pysip, so that should be enough for PyQt packages.

List of ports impacted by this change. Most of the patches have been integrated or are in the process of being integrated upstream:

- devel/libsavitar
- graphics/py-python-poppler-qt5
- net-im/scudcloud
- net/libarcus
- print/py-frescobaldi
- science/py-veusz
- graphics/qgis and graphics/qgis-ltr
- deskutils/calibre

A special note regarding calibre. New versions require sip>=5, we update it to the latest version (thanks to madpilot@)

science/scidavis will remove the PyQt binding soon and there is no patch planned, so we remove the python option (ok makc@)

While here, convert some ports to USE_PYQT (cad/cura, cad/uranium, devel/eric6, ...)

Thanks to tcberner and adridg!

[1] https://www.riverbankcomputing.com/static/Docs/sip/

PR:                250853
Exp-run by:        antoine
47b26d9293
Jan Beich (jbeich)
devel/icu: update to 68.1

Changes:	http://site.icu-project.org/download/68
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
Reported by:	GitHub (watch releases)
6d5d6429d5
Alexey Dokuchaev (danfe)
Pull upstream patch for QTBUG-87010 which fixes a regression in Qt 5.15 causing QByteArray's that are returned by QIODevice::readLine() to consume large amounts of memory.  This is required to unbreak `astro/stellarium' on e.g. i386, where `lconvert' utility runs out of 32-bit address space.

Reference:	https://bugreports.qt.io/browse/QTBUG-87010
Approved by:	kde (tcberner)
9ef49d081b
Adriaan de Groot (adridg)
Make qt5-core and qt5-webengine depend explicitly on double-conversion.

In a dirty build-environment, double-conversion was being picked up
automatically (as "system double-conversion"). We could bung in
a configure flag to ignore it, so that Qt would always build its
own copy. Or we could depend explicitly on it, dropping the build
of the bundled copy.

Do the latter, because:
- it's the same code, but now extracted from V8 JS into a separate
  library by upstream (that is, by Chromium / Google),
- the dependency package is only 168kB.
- this reduces code-bundling and improves reuse when other things
  also use double-conversion.

(This is the opposite of what I originally intended; using the flag
is harder to implement, and since the dependency is small ..)

I've taken the patch from Andy Mender and applied it in two cases.
Perhaps adding it to qt5-core would have been enough, duplication
here can't hurt.

PR:		245946 248020
Submitted by:	Andy Mender
Reported by:	Andy Mender, yuri
f4a64c52c6
Adriaan de Groot (adridg)
Fix an off-by-one in TZ determination

For the systems where /etc/localtime is not a symlink, the patch
for reading /var/db/zoneinfo was chopping off one letter too many.
So you'd end up with "Europe/Amsterda" as timezone, which isn't valid.
e6acc33749
Tobias C. Berner (tcberner)
Update Qt5 to 5.15

This is a major upgrade of the Qt libraries [1], [2].

* People that use upgrading mechanisms with incomplete dependency handling
  (portmaster & Co) should make sure to manually remove the existing Qt
  packages to guarantee a safe upgrade. Keep in mind, that Qt does not like if
  you have an incomplete upgrade.

* This version of Qt drops support for OpenSSL 1.0 -- this means that there
  won't be any binary packages for Qt5 provided by the FreeBSD package builders
  for FreeBSD 11.x anymore -- and the same for *all* the ports depending on
  net/qt5-network [3]. If you cannot upgrade to a more recent FreeBSD
  version (12.x, 13.x), you will need to build Qt5 from ports while switching
  to an SSL implementation from ports.

Big thanks are due for
* kai@ for updating webengine (also mikael@)
* Felix Palmen for providing LibreSSL support patches
* adridg@ and lbartoletti@ for helping me fix the fallout

[1] https://www.qt.io/blog/qt-5.15-released
[2] https://wiki.qt.io/New_Features_in_Qt_5.15
[3] https://www.freshports.org/net/qt5-network

PR:		247010
Exp-run by:	antoine
5f34284e7c
Gleb Popov (arrowd)
devek/qt5-core: Add dependency on archivers/zstd.

PR:		242026
Approved by:	tcberner
1f90be8760
Jan Beich (jbeich)
devel/icu: update to 67.1

Changes:	http://site.icu-project.org/download/67
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
Reported by:	GitHub (watch releases)
ffb8eb82e5
Tobias C. Berner (tcberner)
devel/qt5-core: add upstream patch to fix grpahics/krita at runtime

Qt5-5.14.2 introduced a regression which lead to krita deadlocking on start.

[1] https://bugreports.qt.io/browse/QTBUG-83207
[2] https://code.qt.io/cgit/qt/qtbase.git/commit/?h=5.14&id=276fa8383a7535765be7182883ef4aade17ce013
61453a3fcf
Tobias C. Berner (tcberner)
Update Qt5 to 5.14.2

Very big thanks go again to kai@ who provided the www/qt5-webengine upgrade (to 5.14.0).
Notably, video capture support was re-enabled.

Announcement:
        https://www.qt.io/blog/qt-5.14-has-released

PR:		244964
Exp-run by:	antoine
a25eafc3bc
Jan Beich (jbeich)
devel/icu: update to 66.1

Changes:	http://site.icu-project.org/download/66
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
f821cdc347
Tobias C. Berner (tcberner)
misc/qtchooser: do not create unnecessary wrappers

misc/qtchooser provides a wrapper binary bin/qtchooser, that when called with
name foo, will lauch the corresponding binary from lib/qt${current_qt_version}/bin/foo.

Previously qtchooser would install a list of 30-ish symlinks to itself automatically.
Now we switch this around.

qt-dist ports that define QT_BINARIES will now have a @postexec and @postunexec
entry added to their plist to run the shell-script update-qtchooser-wrapper
(installed by qtchooser).

update-qtchooser-wrapper removes all symlinks to bin/qtcreator that have no
corresponding binary in lib/qt*/bin, and readds links that are missing.

Exp-run by:	antoine
PR:		242905
PR:		243443
Reported by:	grarpamp@gmail.com
Reviewed by:	adridg
Differential Revision:	https://reviews.freebsd.org/D22991
93eea426e8
Tobias C. Berner (tcberner)
sysutils/etc-os-release: use the one provided by base if the system is new enough

PR:		238953
Reviewed by:	zeising
Differential Revision:	https://reviews.freebsd.org/D22488
526bffc5ef
Tobias C. Berner (tcberner)
Update Qt5 to 5.13.2

Announcement:
        https://www.qt.io/blog/qt-5.13.2-released

Thanks to kai@ for updating webengine.

PR:		241649
Exp-run by:	antoine
a008399a74
Jan Beich (jbeich)
devel/icu: update to 65.1

Changes:	http://site.icu-project.org/download/65
ABI:		https://abi-laboratory.pro/tracker/timeline/icu4c/
4bbb4133b2
Tobias C. Berner (tcberner)
Qt5 update to 5.13.0

For new features, check: https://wiki.qt.io/New_Features_in_Qt_5.13

Thanks to adridg who helped to fix a lot of packages.

Exp-run by:	antoine
PR:		238782
c45de9579f
Gerald Pfeifer (gerald)
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330
ea8c8ec7da
Tobias C. Berner (tcberner)
devel/qt5-core: depend on newly added sysutils/etc_os-release

This makes QSysInfo::prettyProductName() will return a correct string,
for example now "FreeBSD 13.0-CURRENT".

Differential Revision:	https://reviews.freebsd.org/D19866
261ca51f16
Tobias C. Berner (tcberner)
Update Qt5 to 5.12.2

- Thanks to kai for updating webengine.

Exp-run by:	antoine
PR:		236895
1c35361b47