CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

lang/babashka1.13.226

Fast native Clojure scripting runtime

Maintainer
fox@FreeBSD.org
Packages
babashka 1.13.226
Upstream
Higher version available: 1.13.227
CPE
none, CVEs only via VuXML
WWW
https://babashka.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (9)

Santhosh Raju (fox) · 1.13.226
lang/babashka: Update to 1.13.226

Changes since 1.13.225:

1.13.226 (2026-10-11)

  * Fix clojure.lang.RT/baseLoader and the context classloader
    returning nil in nREPL sessions
  * Bump jline to 4.4.7
  * Support the [opts stream] arity of read+string
  * Add the CIDER debugger to the nREPL server: #dbg, #break,
    C-u C-M-x and the step commands
  * Add CIDER's track-state to the nREPL server: font-lock of loaded
    vars and the box around instrumented functions
  * Fix the cider-nrepl version mismatch warning on cider-connect-clj
  * Allow constructing ThreadDeath
  * SCI: a macro var in call position expands, as in
    (eval (list #'when true 1))
  * SCI: fix stack overflow in clojure.walk/macroexpand-all on a reify
    form
  * SCI: import expands to clojure.core/import*
  * SCI: fix the location of a top-level symbol followed by a newline
    or the end of input
  * SCI: for, if-let, when-let, if-some, when-some, when-first and
    condp name their internal locals with __
  * SCI: instance? on a protocol is false for a type the protocol is
    only extended to, such as nil
  * SCI: ns-aliases keeps the alias of a removed namespace
  * SCI: a var created by intern has the unqualified symbol
  * SCI: ns-map is 6x faster and ns-refers 60x
  * Add babashka.deps.maven with find-versions,
    with-repository-credentials, active-proxy and model-repos
  * Fix version ranges under a disabled :releases or :snapshots
    policy, the order of POM profile repositories and settings.xml
    proxies without a port
4c88510ec6
Santhosh Raju (fox) · 1.13.225
lang/babashka: Update to 1.13.225

Changes since 1.13.224:

1.13.225 (2026-09-28)

  * #2170: Read the docstring and :org.babashka/cli metadata of a var
    as :exec-fn or :fn in a task :cmd tree
  * #2170: A :doc in a task handler's :org.babashka/cli metadata takes
    precedence over its docstring
  * Run BABASHKA_PRELOADS before resolving bb.edn dependencies
  * Add org.jline.terminal.Terminal$Signal and allow reify of
    org.jline.terminal.Terminal$SignalHandler
  * Add org.jsoup.nodes.Document$OutputSettings
  * Bump jline to 4.4.6
  * Bump rewrite-clj to 1.3.58
4b6ac23f4c
Santhosh Raju (fox) · 1.13.224
lang/babashka: Update to 1.13.224

Changes since 1.13.223:

1.13.224 (2026-09-23)

  * Bundle clojure.data.json
  * #2162: Fix clojure.datafy/datafy on a namespace
  * Bump babashka.ffi to 0.1.2
  * Bump jline to 4.4.5
  * Dep resolution improvements
    - Ignore an empty <version/> element in maven-metadata-local.xml
      when listing an artifact's versions
    - Resolve a locally installed -SNAPSHOT version when a repository
      cannot be reached
    - Record metadata update checks in resolver-status.properties
    - Read versions from a snapshots-only repository for LATEST and
      for version ranges
    - Verify the checksum of maven-metadata.xml under the repository
      checksum policy
    - Check metadata for updates once per session
    - Merge the policies of repositories behind one mirror
    - Write the published .sha1 or .md5 next to a downloaded file in
      the local repository
    - Download a file once more after a checksum mismatch
    - Verify a download against the x-checksum-sha1 or x-checksum-md5
      response header if the repository sends one
    - Verify against .md5 if the request for .sha1 fails
    - Key the session cache of an artifact's versions by its
      repositories
    - Fix IllegalStateException: Recursive update when listing an
      artifact's versions
2a506368ca
Santhosh Raju (fox) · 1.13.223
lang/babashka: Update to 1.13.223

Changes since 1.13.222:

1.13.223 (2026-09-15)

  * #2151: An :exec-fn task in the :depends of a task with a :task
    body runs, with its own :exec-args and spec defaults
  * Dep resolution improvements
    - #2152: Read POMs, settings.xml and repository metadata without
      XML namespaces, as Maven does, so an element such as
      <Xlint:-unchecked/> no longer fails resolution
    - Resolve a timestamped snapshot version, such as
      1.0-20240101.123456-3, to that build instead of the newest one
    - Resolve ${project.name} and ${parent.artifactId} in a POM
    - Report a missing artifact with the same message as the Clojure
      CLI
    - Resolve locally installed -SNAPSHOT artifacts and pick the
      snapshot build with the newest metadata, including the local
      repository's, as Maven does
    - Write maven-metadata-local.xml in the version directory when
      install installs a -SNAPSHOT version
    - Download to a unique temp file and lock _remote.repositories,
      so parallel resolves and processes sharing ~/.m2 do not corrupt
      downloads or lose entries
    - Resolve a POM's parent and BOM imports from http: repositories
      the POM declares, as the Clojure CLI does
    - Reuse a file cached from an unlisted repository only if it is
      also available from a listed repository
    - Send the HTTP headers configured for a server in settings.xml,
      such as a GitLab Private-Token
    - Ignore <localRepository> in settings.xml, as the Clojure CLI
      does, and use :mvn/local-repo or ~/.m2/repository
    - Report property, parent or BOM import cycles in POMs with
      Maven's message and resolve the artifact without its
      dependencies
    - Report missing groupId, artifactId or version in a POM's parent
      declaration with Maven's message and resolve the artifact
      without its dependencies
    - Resolve parent version ranges, such as
      <version>[0.3.0,1)</version>, to the highest matching version
      listed by the repositories
    - Reject parent POMs selected by a version range if their version
      is missing or contains an expression such as
      ${project.version}, with Maven's "Version must be a constant"
      message
    - Include versions from the local repository's
      maven-metadata-local.xml when resolving version ranges, RELEASE
      and LATEST
    - Parse booleans in POMs, settings.xml and repository metadata
      regardless of case, such as <optional>TRUE</optional>
    - Give POM properties precedence over unprefixed model
      expressions such as ${version}
    - Read POMs with a byte order mark or HTML character entities
    - Resolve artifacts without their dependencies when their POM is
      missing or cannot be parsed
    - Include dependencies even when their dependencyManagement entry
      is marked optional
    - Resolve local parent POM paths relative to the declaring POM,
      so :local/root projects with more than two POM levels resolve
      without the JVM
6dc23dda3e
Santhosh Raju (fox) · 1.13.222
lang/babashka: Update to 1.13.222

Changes since 1.13.220:

1.13.222 (2026-09-14)

Read the release blog post:
https://blog.michielborkent.nl/babashka-1.13.222.html

  * Fix No :mvn/version specified when resolving dependencies on Jetty
    ee9 and ee10 caused by cached POMs sharing dependency management
    across versions
  * bb nrepl-server writes .nrepl-port on start and removes it on
    exit, so bb repl --connect finds the server without an address
  * Bump org.babashka/cli to 0.12.91

1.13.221 (2026-09-14)

  * Resolve dependencies without a JVM by default. Set :deps-resolver
    :jvm in bb.edn or the add-deps map, or BABASHKA_DEPS_RESOLVER=jvm,
    to use Java as before
  * Make clojure.tools.deps and its script namespaces, including
    clojure.tools.deps.script.make-classpath2, available to scripts
  * Bundle clojure.tools.build.api, with patched install and javac for
    babashka. A tools.build dependency on the classpath takes
    precedence and runs from source
  * Add bb repl --connect [addr] to connect to an nREPL server with
    completion, eldoc, documentation lookup and Ctrl-C interruption.
    Accepts host:port, a port or unix://path. Reads .nrepl-port by
    default.
  * Run nREPL 1.7.0 from bundled source. Make nrepl.core,
    nrepl.server, nrepl.transport, nrepl.middleware and nrepl.misc
    available to scripts
  * Bind the nREPL server to 127.0.0.1 by default instead of 0.0.0.0.
    Use bb --nrepl-server 0.0.0.0:1667 in Docker
  * Replace the :xform option of babashka.nrepl.server/start-server!
    with :middleware, accepting middleware vars with nREPL
    descriptors. See examples/nrepl_middleware.clj
  * Bundle nREPL ops for the CIDER inspector, test runner (C-c C-t)
    and cider-version
  * Add the nREPL interrupt op. Interruption is cooperative and does
    not stop tight loops
  * Run the nREPL server on a Unix domain socket with the :socket
    option of babashka.nrepl.server/start-server!
  * babashka.nrepl#72: Isolate REPL bindings such as *1, *e and *ns*
    per session and preserve them when reconnecting with the same
    session id
  * Show sci stack frames in CIDER's error buffer via
    analyze-last-stacktrace
  * Report the original exception class and source location in nREPL
    eval errors and preserve sci stack frames on *e
  * Keep output from realizing lazy values separate from nREPL
    evaluation results
  * babashka.nrepl#67: Preserve source columns in nREPL evaluations
  * Increase the nREPL eval thread stack size to 8 MB to match the
    main thread and allow deeper recursion
  * #1974: Add clojure.main/ex-triage with sci error phases and source
    locations
  * #1518: Print sci stack frames in clojure.test error reports, both
    inside and outside is
  * babashka.deps/add-deps returns a sorted vector of added libs, or
    nil if none were added, and preserves versions already on the
    classpath
  * Use tools.build for bb uberjar, with the same exclusions as
    depstar. Duplicate files no longer print warnings
  * Fix bb uberjar failing on macOS when dependencies contain both
    META-INF/LICENSE and META-INF/license/
  * A :depends task's :exec-fn receives all parsed options, the
    runner-level :cli defaults included. With :restrict it receives
    only the options it declares
  * #2103: A :depends task's :exec-fn receives its own :exec-args and
    spec defaults, with command line options taking precedence. These
    defaults do not apply to the target task
  * A :depends task's :restrict falls back to the runner-level
    :restrict
  * #2040: allow bulk .get and .put with primitive arrays on typed NIO
    buffers (IntBuffer, FloatBuffer, LongBuffer, DoubleBuffer,
    ShortBuffer)
  * Fix constructor overload selection for (Boolean. false)
  * Add reify support for java.io.Flushable
  * Add clojure.java.process/io-task
  * Add org.jline.utils.Colors
  * Support (.-name ns) on namespaces
  * Report File does not exist for bb "" and bb " " instead of
    StringIndexOutOfBoundsException or FileNotFoundException
  * Smaller binary: the bundled Clojure sources are stored gzipped,
    and jline's class files are no longer embedded a second time as
    resources.
  * Bump Clojure to 1.12.6
  * Bump babashka.cli to 0.12.90
  * Bump clj-yaml to 1.0.30
  * Bump http-client to 0.4.25
  * Bump edamame to 1.6.44
375abc5295
Santhosh Raju (fox) · 1.13.220
lang/babashka: Update to 1.13.220

Changes since 1.13.219:

1.13.220 (2026-08-31)

Read the release blog post:
https://blog.michielborkent.nl/babashka-ffi.html

FFI:

  * Add experimental babashka.ffi
    (https://github.com/babashka/ffi): call C functions in shared
    libraries straight from babashka and JVM Clojure! See the guide:
    https://github.com/babashka/ffi/blob/main/doc/guide.md
  * Linux: dynamic binaries require glibc 2.28. The install script
    selects the static binary on older systems
  * On Linux, the install script installs the dynamic binary by
    default. It installs the static binary on musl systems and on
    systems with glibc older than 2.17. The --static and --dynamic
    options override the automatic selection
  * The dynamic binary for Linux amd64 links every library statically
    except glibc. It no longer needs libz.so.1 at run time
  * On FreeBSD, the install script installs the dynamic binary when the
    Linuxulator has a linux_base with glibc 2.17 or newer, such as
    linux_base-rl9
  * The Linux binaries include zlib 1.2.13. The static binary uses musl
    1.2.6. The build pins both versions and compiles them from source

Tasks:

  * :exec-args can sit directly on a task, not only under :cli, the way
    (exec ...) already reads it. The bare key wins over the one under
    :cli. Before, it was ignored on an :exec-fn or :cmd task
  * A task's :cli :exec-args merge over the :tasks top level
    :exec-args. Before, the task's map replaced the top level's
  * A task's :cli spec adds to the runner-level :tasks {:cli {:spec
    ...}} instead of replacing it. An option from the runner level
    keeps its coercion and default, and --help lists it under Inherited
    options
  * A task with :exec-fn runs when another task :depends on it. Before,
    it did nothing
  * Options declared by an :exec-fn task named in :depends also parse
    for the CLI task that runs, with their coercion and default. --help
    lists them under Inherited options
  * A :depends task's :exec-fn receives only the options that task
    declared, with its defaults, not everything the command line parsed
  * A CLI task cannot name a :cmd task in :depends, unless that task
    also has a :task body: nothing says which of its subcommands to run
  * :cmd can be a symbol naming a var that holds the command tree, like
    :cli. Its namespace loads on demand
  * Shell completion offers inherited options (via :depends) too
  * bb tasks and --help still describe a task when a dependency's
    namespace does not load. Running the task reports the error

Misc:

  * SCI: call site caching for instance and static methods,
    constructors and fields. Interop calls are up to 5x faster
  * #1321: support implementing the clojure.core/Inst protocol on
    records, types and reify, and with extend-protocol and extend-type
  * Fix output of custom clojure.pprint dispatch functions
  * #2054: a proxy of java.io.Writer supports the one-argument write
    and append, so binding *out* to it works. Interop on a proxied
    Writer or Reader finds their own methods instead of only the ones
    on Closeable
  * #1728: Add java.util.TreeMap
  * Fix: the % parameters of a function literal inside a syntax quote
    are no longer namespace-resolved, through edamame 1.6.43
  * Building babashka from source no longer fails when one upstream
    host is unreachable. The build fetches the musl and zlib tarballs
    with retries, from mirrors, and caches them per machine
  * Building from source: the BABASHKA_DYNAMIC build flag is
    BABASHKA_FULLY_DYNAMIC, because it named a different axis than the
    install script's --dynamic

Upgrades:

  * Bump jline to 4.4.0: security hardening, a rewritten signal path
    for the FFM terminal, Kitty keyboard protocol. The ambiguous key
    binding timeout in the REPL drops from 1000 ms to 100 ms
  * Bump GraalVM to 25.0.4. The macOS amd64 binary stays on 25.0.1, the
    last version Oracle ships for that platform
  * #2021: bump http-kit to 2.9.0-beta4, which fixes four security
    advisories
  * Bump babashka.cli to 0.12.88: help shows the dispatch-level spec
    under Inherited options, format-command-help accepts :spec,
    completion no longer offers :positional keys as options, the
    command named on the command line wins over the :exec-args of its
    ancestors, and the fish completion snippet keeps the emitted option
    order
  * babashka.cli 0.12.88 also adds :cmd-aliases, alternative names for
    a command that dispatch like the command itself, and attached short
    option values: -J-Dfoo=bar binds "-Dfoo=bar" when :J declares a
    non-boolean :coerce. An interior hyphen in a cluster of flags is an
    error instead of silently ending option parsing
  * Bump edamame to 1.6.43, which carries the syntax-quote fix listed
    above
  * Bump jsoup to 1.23.2: W3C namespace fixes, URL validation per RFC
    9110, CR and LF escaping in multipart form names
  * Bump hiccup to 2.0.0 final, from 2.0.0-RC1
  * Bump rewrite-clj to 1.2.57
  * Bump selmer to 1.13.5: Twig-style {% embed %}, multiline tags. The
    shipped deps.edn said 1.12.70 while the binary carried 1.13.1; both
    now agree
afdcf81ac4
Santhosh Raju (fox) · 1.13.219
lang/babashka: Update to 1.13.219

Changes since 1.12.218:

1.13.219 (2026-07-27)

Highlights:

  * Tasks get automatic --help and shell completions, through the new
    :exec-fn and :cmd keys. See the blog post:
    https://blog.michielborkent.nl/babashka-tasks-cli.html
    These task keys should be considered experimental and may change in
    a future version of babashka, depending on feedback from the
    community
  * Clojure 1.13 map destructuring with :keys! etc.

Other changes:

  * Tasks: :exec-fn (a function) or :cmd (a command tree) on a task
    routes it through babashka.cli/dispatch, giving it --help, shell
    completion and subcommands. Options, docstring and :enum come from
    the function's :org.babashka/cli metadata, like bb -x
  * Tasks: :cli on a task holds babashka.cli options that have no
    function to live on, such as an :epilog on a command group. A map,
    or a symbol naming a var of one for options that include functions,
    such as an :error-fn. At the :tasks level the same entry applies to
    every CLI task
  * Tasks: :doc may be a vector of lines
  * Tasks: bb <task> --help no longer runs the task's :depends, except
    under bb run --parallel
  * Tasks: bb tasks separates names and docs with two spaces, like
    babashka.cli's help output
  * Clojure 1.13 map destructuring: :keys!, :syms!, :strs!, & inside a
    directive, :select, :all and :defaults. Adds req! and some-vals to
    clojure.core
  * Bump JLine to 4.3.1
  * #2003: add org.jsoup.select.Elements for Element.select
    (@christoph-frick)
  * #1994: fix :eval and :print options of clojure.main/repl being
    ignored in the interactive REPL (@jeroenvandijk)
  * #1918: fall back to $HOME when the OS does not supply a home
    directory, e.g. for LDAP users in the static binary
  * fix *1, *2 and *3 being overwritten by Ctrl+C and :repl/help in the
    interactive REPL
  * #1979: fix with-redefs on copied vars (e.g. org.httpkit.client/get)
    incorrectly treated as inlined
  * nREPL: lock output stream to prevent interleaved bencode frames
    from concurrent writes
  * Add org.jline.keymap.BindingReader for reading key bindings in
    terminal applications
  * #1982: Add the following to :instance-checks in
    babashka.impl.classes/classes (@paintparty)
    - clojure.lang.ChunkedCons
    - clojure.lang.APersistentVector$SubVector
    - clojure.lang.ArraySeq
    - clojure.lang.PersistentVector$ChunkedSeq
    - java.util.AbstractCollection
    - java.util.Queue
  * #1985: Add the following classes to babashka.impl.classes/classes
    (@weavejester)
    - java.util.concurrent.locks.Condition
    - java.util.concurrent.locks.Lock
    - java.util.concurrent.locks.LockSupport
  * #1986: Add the following classes to babashka.impl.classes/classes
    (@weavejester)
    - java.net.StandardSocketOptions
    - java.nio.channels.CancelledKeyException
    - java.nio.channels.Selector
    - java.nio.channels.SelectionKey
  * #1987: Allow the remove method to be used on Iterator
    (@weavejester)
  * #1988: Allow java.io.Closeable and java.lang.AutoCloseable to be
    reified (@weavejester)
  * Bump babashka.cli to 0.12.85: dispatch auto-help and shell
    completions, tree format, :enum; *exit-fn* rebindable from scripts
  * Bump http-client to 0.4.24: :proxy accepts a function of the
    request URI to select a proxy per request (@jeeger)
  * Bump fs to 0.5.34, plus zip accepting absolute source paths mapped
    to relative entries
  * Bump edamame to 1.6.42
  * Bump rewrite-clj to 1.2.55
  * Bump insn to 0.5.4
  * Bump Clojure to 1.12.5
  * #1977: update usage link in README to point to the discussion page
    (@verberktstan)
  * Add FreeBSD installation instructions to the README (@fraggerfox)
  * Publish macOS aarch64 dev builds from GitHub Actions
0ed6e1f215
Santhosh Raju (fox) · 1.12.218
lang/babashka: Fix the FreeBSD 14.x build.
568887eb45
Santhosh Raju (fox) · 1.12.218
lang/babashka: New port: Fast native Clojure scripting runtime

Babashka is a native, fast-starting Clojure interpreter for scripting.
It uses GraalVM native-image to produce a self-contained binary that
starts instantly, making Clojure practical for shell scripting and
command-line tools.

This port installs a statically-linked Linux binary that runs via
FreeBSD's Linux binary compatibility layer (Linuxulator).

WWW: https://babashka.org/
889bac3e13