dns/dnsmasq2.93,1

dns/dnsmasq: update to v2.93 stable release

This release improves DNSSEC and inotify related matters, see

Changelog:	https://thekelleys.org.uk/dnsmasq/CHANGELOG

PR:		295851

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/529

dns/dnsmasq: Update 2.92 => 2.92rel2 (6 CVEs)

Including privilege escalation, cache poisoning/rediction, information
leak, and denial of service.

See https://www.kb.cert.org/vuls/id/471747
See https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

PR:		295204
Security:	eeb4d69a-4d74-11f1-9a9c-994b98c88011
Security:	CVE-2026-2291
Security:	CVE-2026-4890
Security:	CVE-2026-4891
Security:	CVE-2026-4892
Security:	CVE-2026-4893
Security:	CVE-2026-5172
Sponsored by:	UNIS Labs
MFH:		2026Q2

dns/dnsmasq: Backport upstream commit to fix PXEBOOT regression

Reference:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=84415a87be571a6da82c910c1b87b194e5f54727

MFH:		2026Q1

dns/dnsmasq: fix DBUS option

I'd overlooked that I need to remove the src/dbus.c patch in v2.92,
fixed now. Thanks for the report.

Reported by:	Igor Pavlov
PR:		292674

dns/dnsmasq: update to v2.92 + inotify patch

Changelog:	https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q1/018380.html

We keep the local patch to enable inotify on FreeBSD 15,
which was only merged after the release but had been in this port
already.

Make it so the pkg-message is printed on new installs and upgrades.

dns/dnsmasq*: don't force -O2 into CFLAGS

Reported by:	diizzy@
MFH:		2025Q3

dns/dnsmasq: harden build

MFH:		2025Q3

dns/dnsmasq: backport fix for leftover child processes

For details, see
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=15841f187d2b208a6113d4e2d479d3af4275bb1c

Reported by:	novel@ (Roman Bogorodskiy)
Obtained from:	Simon Kelley via upstream Git repo
PR:		287324

dns/dnsmasq-devel already has the fix as of v2.92test14.

Thanks to Roman for the report, upstream communication, and test.

dns/dnsmasq: update to v2.91

Changelog:	https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.91

*: Bump revisions after dbus update

PR:		285253
Reported by:	Martin Birgmeier <d8zNeCFG@aon.at>

dns/dnsmasq: update pkg-message and fix a few compiler warnings

...which v2.91 will also fix.

net/chrony: dns/dnsmasq: change rcfile ordering

Make sure that these services start in proper order, and sooner
such that chrony can synchronize time before other services need it.

Note that there is a circular dependency or bootstrapping problem
here in that the system time needs to be halfway correct if you
require your time servers to be looked up through DNS with DNSSEC
enabled because crypto usually needs correct clocks for expiration
checks on signatures to work so the name service needs a correct time,
and looking up the time server needs a working name service.

So be sure you can bootstrap with a skewed time.

Reported by:	Lexi Winter
PR:		282566

I am not MFHing this, it's too intrusive.

dns/dnsmasq: Fix --dhcp-relay not working on FreeBSD

PR:		283138
MFH:		2024Q2
Reported by:	Harald Schmalzbauer
Obtained from:	Simon Kelley, https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=5a1f2c577db58ea47727f1b6900c0be25e6db205

dns/dnsmasq*: add a checkconfig option to rcfile

and automatically invoke it before restart or stop.
Under the hood, this runs dnsmasq --test.

Bump PORTREVISION of dnsmasq only, the -devel port is not
built regularly.

[commit message by Matthias Andree <mandree@FreeBSD.org>]

dns/dnsmasq: fix pkg-plist order

Approved by:	portmgr (blanket)

dns/dnsmasq: Move man pages to share/man

Approved by:	portmgr (blanket)

dns/dnsmasq: security update to 2.90 (fixes dnssec validation DoS)

ChangeLog:	https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.90
Security:       21a854cc-cac1-11ee-b7a7-353f1e043d9a
Security:       CVE-2023-50387
Security:       CVE-2023-50868
MFH:		2024Q1

dns/dnsmasq: cherry-pick several upstream fixes

all from dnsmasq's Git repository hosted by Simon Kelley:

+ Fix DHCPv6 "use multicast" response
+ Avoid undefined behaviour with the ctype(3) functions.
+ Document suppressing default options in --dhcp-option.
+ Fix --rev-server option.
+ Set the default maximum DNS UDP packet size to 1232.
+ Generalise cached NXDOMAIN replies.
+ Fix possible SEGV when no servers defined.

and bump PORTREVISION. This is so we can let it mature
for two weeks before 2023Q2 and because the upstream
release schedule is unforeseeable.

Obtained from: Simon Kelley <simon@thekelleys.org.uk>
Obtained from: Dominik Derigs <dl6er@dl6er.de>
Obtained from: Taylor R Campbell <campbell+dnsmasq@mumble.net>

dns/dnsmasq*: update to v2.89, and disable -devel port

Changelog: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.89

MFH:		2023Q1

dns/dnsmasq: fix rare cache corruption problem

Simon Kelley sent an advisory that in rare circumstances, the cache can
become corrupted and the DNS subsystem then became disfunctional.
This is reported as regression in 2.88.
Chances seem higher this happens with DNSSEC enabled, but seems not limited
to it.  For details, please see the patch contained in this commit, or
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q1/016821.html

The symptom of this happening is apparently a cache internal error.

2.89 with this fix and a few others is slated for release in a week.
Let's fix the patch already and MFH to 2023Q1 so we keep our liberties
to decide whether we need to move quarterly to 2.89 or rather stick
with 2.88_1.

originally
Reported by:	Timo van Roermund (to Simon Kelley in private)
Reported by:	Simon Kelley (upstream maintainer, through mailing list)
Obtained from:	Simon Kelley (upstream maintainer, Git repository)
MFH:		2023Q1

dns/dnsmasq*: update to 2.88, and ignore -devel port

ChangeLog:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.88

dns/dnsmasq*: update to v2.87

and set dnsmasq-devel port to IGNORE.

Changelog:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.87
https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg16445.html

MFH:		2022Q3

Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)

dns: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Allan Jude <allanjude@freebsd.org>
  *  Amar Takhar <verm@drunkmonk.net>
  *  Anders Nordby <anders@fix.no>
  *  Andrew Greenwood <greenwood.andy@gmail.com>
  *  Anton Berezin <tobez@FreeBSD.org>
  *  Ashish SHUKLA <ashish@FreeBSD.org>
  *  Attila Nagy <bra@fsn.hu>
  *  Bas Kruit <baskruit@bsltwr.dhis.org>
  *  Bruce M. Simpson <bms@FreeBSD.org>
  *  Carlos J Puga Medina <cpm@fbsd.es>
  *  Chris St Denis (<chris@ctgameinfo.com>)
  *  Clement Laforet <clement@FreeBSD.org>
  *  Clement Laforet <sheepkiller@cultdeadsheep.org>
  *  Dan Langille <dvl@FreeBSD.org>
  *  Dan Pelleg <daniel+mdnsd@pelleg.org>
  *  Dan Smith <dan@algenta.com>
  *  David O'Brien (obrien@NUXI.com)
  *  Dean Hollister <dean@odyssey.apana.org.au>
  *  Dirk Froemberg <dirk@FreeBSD.org>
  *  Dmitry Pryadko <d.pryadko@rambler-co.ru>
  *  Dmitry Sivachenko <mitya@yandex-team.ru>
  *  Dominik Brettnacher <domi@saargate.de>
  *  Douglas Thrift <douglas@douglasthrift.net>
  *  Edwin Groothuis (edwin@mavetju.org)
  *  Edwin Groothuis <edwin@mavetju.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Eyal Soha <esoha@attbi.com>
  *  Filip Parag <filip@parag.rs>
  *  Filippo Natali <filippo.natali@gmail.com>
  *  Frank Behrens
  *  Gea-Suan Lin <gslin@gslin.org>
  *  Geoffroy Desvernay <dgeo@centrale-marseille.fr>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Goran Mekić <meka@tilda.center>
  *  Hajimu UMEMOTO <ume@FreeBSD.org>
  *  Herve Quiroz <hq@FreeBSD.org>
  *  Hirohisa Yamaguchi <umq@ueo.co.jp>
  *  Hye-Shik Chang <perky@fallin.lv>
  *  Jaap Akkerhuis <jaap@NLnetLabs.nl>
  *  James FitzGibbon <jfitz@FreeBSD.org>
  *  Jase Thew <freebsd@beardz.net>
  *  Jimmy Bergman jimmy@sigint.se
  *  Jin-Shan Tseng <tjs@cdpa.nsysu.edu.tw>
  *  Joe Barbish
  *  Jov <amutu@amutu.com>
  *  Jui-Nan Lin <jnlin@freebsd.cs.nctu.edu.tw>
  *  Karl Dietz (Karl.Dietz@frankfurt.netsurf.de)
  *  Kirill Ponomarew <ponomarew@oberon.net>
  *  Koen Martens <gmc@sonologic.nl>
  *  Konstantin Saurbier <saurbier@math.uni-bielefeld.de>
  *  Kostya Lukin <lukin@okbmei.msk.su>
  *  Kris Kennaway <kris@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Kurt Jaeger <fbsd-ports@opsec.eu>
  *  Leo Vandewoestijne <freebsd@dns-lab.com>
  *  Leo Vandewoestijne <freebsd@dns.company>
  *  MIHIRA Yoshiro <sanpei@jp.FreeBSD.org>
  *  Marcin Gondek <drixter@e-utp.net>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Linimon <linimon@lonesome.com>
  *  Mark Pulford <mark@kyne.com.au>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Matthew Hunt <mph@pobox.com>
  *  Matthew Seaman
  *  Michael Cardell Widerkrantz <mc@hack.org>
  *  Moritz Warning <moritzwarning@web.de>
  *  Natacha Porte <natbsd@instinctive.eu>
  *  Neil Blakey-Milner
  *  Olivier Duchateau
  *  Paul Chvostek <paul@it.ca>
  *  Paul Dlug <paul@aps.org>
  *  Philippe Pepiot <phil@philpep.org>
  *  Piotr Kubaj <pkubaj@FreeBSD.org>
  *  Piotr Kubaj <pkubaj@anongoth.pl>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Rafal Lesniak <fbsd@grid.einherjar.de>
  *  Roman Shterenzon <roman@xpert.com>
  *  Rong-En Fan <rafan@FreeBSD.org>
  *  Roy Marples <roy@marples.name>
  *  Ryan Steinmetz <rpsfa@rit.edu>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sahil Tandon <sahil@tandon.net>
  *  Seamus Venasse <svenasse@polaris.ca>
  *  Sergei Kolobov <sergei@FreeBSD.org>
  *  Sergei Kolobov <sergei@kolobov.com>
  *  Sergey Matveychuk <sem@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Simon Dick <simond@irrelevant.org>
  *  Stefan Esser <se@FreeBSD.org>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steve Wills <swills@freebsd.org>
  *  Steven Honson
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net>
  *  Timothy Beyer <beyert@cs.ucr.edu>
  *  Waitman Gobble <waitman@waitman.net>
  *  Wen Heping <wen@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Zane C, Bowers <vvelox@vvelox.net>
  *  adamw
  *  alexis
  *  andrew@ugh.net.au
  *  bkhl
  *  clsung
  *  clsung@dragon2.net
  *  dglo@ssec.wisc.edu
  *  dnscheckengine-port@academ.com (Stan Barber)
  *  fenner
  *  geniusj@ods.org
  *  ijliao
  *  ismail.yenigul@endersys.com.tr
  *  krion
  *  mark@foster.cc
  *  n@nectar.com
  *  roam@FreeBSD.org
  *  rodrigc@FreeBSD.org
  *  rpsfa@rit.edu
  *  sten@blinkenlights.nl

With hat:	portmgr

dns/dnsmasq: fix CVE-2022-0934 DHCPv6 vuln

Security:	3f321a5a-b33b-11ec-80c2-1bb2c6a00592
Security:	CVE-2022-0934
MFH:		2022Q2

dns/dnsmasq: cherry-pick 2.86-related man update

https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=10cd342f5c847a5e0226d6f0f9ff4ca16db610a5

Obtained from:	Simon Kelley's upstream git repository

dns/dnsmasq: pull in three more upstream fixes

Cherry-pick these Git commits from the upstream:

--local should behave as --server, not as --address [...]
Fix confusion in DNS retries and --strict-order.
Fix confusion with log-IDs and DNS retries.

loosely prompted by Olivier's
PR:		260331

dns/dnsmasq: fix error "config error is REFUSED (EDE: not ready)"

Fix --address=/#/...... which was lost in 2.86

ML message:
https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg15508.html

Git commit:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=26bbf5a314d833beaf0f147d24409969f05f3dba

PR:		260331
Obtained from:	Simon Kelley (upstream maintainer)

*/*: Remove redundant '-*' from CONFLICTS definitions

The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").

Approved by: portmgr (blanket)

dns/dnsmasq: update to v2.86, ignore dnsmasq-devel

Changelog:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.86

*: Clean up some things

- Fix typos
- Remove duplicate variables
- Remove nop variables
- Sort categories
- Add missing USES

Reported by:	portscan

dns/dnsmasq: cherry-pick upstream-fixes

*  Handle DHCPREBIND requests in the DHCPv6 server.
 *  Fix bug in TCP process handling.

Clean up some things

- Remove duplicate variables
- Remove nop variables
- Sort categories
- Remove redundant option descriptions that match the default ones

Reported by:	portscan

dns/dnsmasq: security update to v2.85 release

Changelog:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob_plain;f=CHANGELOG;hb=v2.85

Configurations where server lines contain a @ character,
f.i. server=1.1.1.1@em0 or server=1.1.1.1@192.0.2.1, disabled
source port randomization, making cache poisoning attacks possible.
v2.85 mitigates this.

MFH:		2021Q2
Security:	CVE-2021-3448
Security:	5b72b1ff-877c-11eb-bd4f-2f1d57dafe46 (VuXML)

all: Remove all other $FreeBSD keywords.

Remove # $FreeBSD$ from Makefiles.

dnsmasq-devel: add test release 2.85rc1

This is to fix a port randomization flaw that subjects dnsmasq to a cache poisoning attack.

ChangeLog:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG;h=155fc966f9542259596b41594f4b85775d1f9c9a;hb=023ace8e54c2e83e88082a1073a281d659f2a860#l1

Add CONFLICTS_INSTALL markers.

Security: CVE-2021-3448
Security: 5b72b1ff-877c-11eb-bd4f-2f1d57dafe46

dns/dnsmasq: upgrade to v2.84 (regression fixes)

Upstream blessed v2.84 rc2 (which 2.83_1 effectively already was)
into v2.84 release, so take it (and patch the upstream bug of
leaving "rc2" in the version out).

MFH:		2021Q1 (regression fixes for security fix release)

dns/dnsmasq: regression fixes from upstream Git

Apparently there are situations where dnsmasq 2.83 can confuse
its peers or sockets, and the upstream Git contains fixes for them.

These four fixes essentially take dnsmasq to 2.84test3.

Obtained from:	Simon Kelley <simon@thekelleys.org.uk>'s Git repository

dns/dnsmasq: security update to 2.83

CHANGELOG of version 2.83:

        Use the values of --min-port and --max-port in outgoing
        TCP connections to upstream DNS servers.

        Fix a remote buffer overflow problem in the DNSSEC code. Any
        dnsmasq with DNSSEC compiled in and enabled is vulnerable to this,
        referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683
        CVE-2020-25687.

        Be sure to only accept UDP DNS query replies at the address
        from which the query was originated. This keeps as much entropy
        in the {query-ID, random-port} tuple as possible, to help defeat
        cache poisoning attacks. Refer: CVE-2020-25684.

        Use the SHA-256 hash function to verify that DNS answers
        received are for the questions originally asked. This replaces
        the slightly insecure SHA-1 (when compiled with DNSSEC) or
        the very insecure CRC32 (otherwise). Refer: CVE-2020-25685.

        Handle multiple identical near simultaneous DNS queries better.
        Previously, such queries would all be forwarded
        independently. This is, in theory, inefficent but in practise
        not a problem, _except_ that is means that an answer for any
        of the forwarded queries will be accepted and cached.
        An attacker can send a query multiple times, and for each repeat,
        another {port, ID} becomes capable of accepting the answer he is
        sending in the blind, to random IDs and ports. The chance of a
        succesful attack is therefore multiplied by the number of repeats
        of the query. The new behaviour detects repeated queries and
        merely stores the clients sending repeats so that when the
        first query completes, the answer can be sent to all the
        clients who asked. Refer: CVE-2020-25686.
MFH:		2021Q1
Security:	5b5cf6e5-5b51-11eb-95ac-7f9491278677
Security:	CVE-2020-25684
Security:	CVE-2020-25685
Security:	CVE-2020-25686
Security:	CVE-2020-25681
Security:	CVE-2020-25682
Security:	CVE-2020-25683
Security:	CVE-2020-25687

dns/dnsmasq: update to 2.82 (regression and bug fixes)

Quoting Simon Kelley "This fixes a nasty problem
introduced in 2.81 which causes random crashes on systems where there's
significant DNS activity over TCP. It also fixes DNSSEC validation
problems with zero-TTL DNSKEY and DS records."

Changelog:
<http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG;h=e6a223119ffcd9ead6cb15153cd49bd3c61e114f;hb=f60fea1fb0a288011f57a25dfb653b8f6f8b46b9#l1>

MFH:		2020Q3 (regression and bug fixes)

Bump PORTREVISION for security/nettle shlib change

dns/dnsmasq: repair damage from UNAUTHORIZED UCL conversion of pkg-message

The pkg-message contains a security note that is necessary on
new installs and on updates alike.

Since per the porter's handbook, the UCL does not support enumeration
of types, and this is not relevant on removal, the UCL change must be
reverted.  While here, remove formatting.

Failure inducing commit:
|------------------------------------------------------------------------
|r508835 | mat | 2019-08-13 18:01:59 +0200 (Tue, 13 Aug 2019) | 2 lines
|
|Convert to UCL & cleanup pkg-message (categories d)
|
|------------------------------------------------------------------------

NOTE: The UCL conversion of files/pkg-message.in was not authorized
and damaging and no heads-up was sent to the maintainer.

portmgr@ MUST act more carefully with sweeping changes and hand them out
for review first.

dns/dnsmasq: update to 2.81, unlink dnsmasq-devel

Update dns/dnsmasq to the new upstream version 2.81.
The Makefile has been rearranged with portfmt, except the
LDFLAGS+=..._intllibs... line that portfmt does not recognize.

Changelog:
<http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=CHANGELOG;h=60b08d015b2d5a979f39b8ad43633b419135cb64;hb=7ddb99d251c3f5870c8c308a98bb8f283c831872#l1>
(or see CHANGELOG in the package)

Unlink dnsmasq-devel from the build, but keep the sources,
and mark it IGNORE and list dnsmasq-devel in MOVED.

dns/dnsmasq: Remove obsolete REINPLACE_CMD line.

Reported by:	swills@ (IRC)

dns/dnsmasq: Fix TFTP regression on recent FreeBSD versions.

Add a patch taken from upstream. Tested successfully on 11.3-RELEASE amd64.

The upstream fix is an extended version of a fix proposed by
Dave Mueller in the PR.

See also:
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2019q4/013412.html

PR:		241068
Reported by:	Phil Chadwick
Obtained from:	Simon Kelley, http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=936bd82755e8f75fc09c1e9a67fb390175b157d4
MFH:		2019Q4

Drop the ipv6 virtual category for d* category as it is not relevant anymore

Convert to UCL & cleanup pkg-message (categories d)

Update security/nettle to 3.5.1

- Bump PORTREVISION of dependent ports for shlib change
- Fix build of devel/pijul [1]

Changes:	https://git.lysator.liu.se/nettle/nettle/blob/master/NEWS
PR:		238991
Exp-run by:	antoine
Thanks to:	tobik [1]