version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (1)
The CVE record lists the packaged version 15.5.35.25 as affected, and no VuXML entry names the CVE. What does this mean?
Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security…
VuXML only (0)
Listed in VuXML, the packaged version 15.5.35.25 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
lang/v8: fails with kern.elf64.allow_wx=0 but elfctl -e +wxneeded doesn't help
New
2026-07-01
Commits (118)
Xin LI (delphij) · 15.6.75.19
lang/v8: update to 15.6.75.19 (Chrome 156 stable)
- Update the dependency pins from DEPS and the Temporal crates to the
versions in Chromium's third_party/rust.
- Read time zone data from devel/icu through the new upstream
v8_enable_temporal_systemicu option instead of a local patch.
- Port PartitionAlloc's zero segment, which keeps the low 4 GB of the
address space inaccessible, to FreeBSD. V8 no longer reserves this
range itself, and d8 refuses to start without it. Hinted mappings
are not honored with ASLR, so reserve the range with a guard mapping.
lang/v8: update to 15.5.35.25
- Initialize the attribute object before passing it to
pthread_attr_get_np() in PartitionAlloc's GetStackTop(), which
FreeBSD requires.
lang/v8: Misc build fixes
- aarch64: do not enable PartitionAlloc's ARM memory tagging support,
which needs Linux's <asm/hwcap.h>. It was enabled because the port
makes FreeBSD pass for Linux in GN.
- i386: V8 only uses PartitionAlloc together with pointer compression,
so its libraries are not built there. Do not try to install them.
- d8 refuses to start when the first 4 GB of the address space can not
be reserved. Only have it do so when ASLR is active, as
position-independent executables are loaded below 4 GB otherwise.
- Drop patches for files the build does not use, the EXAMPLES
leftovers and a substitution that no longer matches anything.
lang/v8: update to 15.5.35.20 (Chrome 155 stable)
- Enable Temporal. GN can only build the temporal_capi Rust crate with
the Chromium Rust toolchain, so build it with cargo as a static
library through a small wrapper crate (temporal_capi is no_std) and
have GN link that. Crate versions follow Chromium's Cargo.lock.
Time zone data is read from devel/icu; use the accessors libicuuc
exports instead of ICU's internal udatamem.h, which is not installed.
- Use libclang and its Python bindings from the llvm port for the new
metagen instance-types generator, and work around Cursor being
unhashable in the bindings before LLVM 21.
- Ignore check_includes_strict, which devel/gn does not know yet.
- Add the licenses of the statically linked crates.
- Depend on libicuuc.so, which is what gets linked, instead of
libicudata.so, and stop depending on glib, which was never linked.
- Drop DIST_SUBDIR; distfile names have been unique since the switch
to the GitHub mirror.
lang/v8: Fix fetch by fetching sub-dependencies from GitHub mirror
The +archive tarballs on chromium.googlesource.com are generated on
the fly with the time of the request as the mtime of every entry,
and the generated tarballs are not reproducible, so their size and
checksum change with each download and fetch fails with a size
or checksum mismatch.
To address this, fetch all sub-dependencies with GH_TUPLE from the
unofficial chromium-full-mirror organization on GitHub, which carries
the same commits and produces stable tarballs.
Because the chromium-full-mirror is an unofficial mirror, a new
verify-mirror target is added, which downloads every sub-dependency
from chromium.googlesource.com and compares the extracted tree with
the mirror distfile.
This new target is run as part of "make makesum" so distinfo can only
be generated when comparison passing.
Drop the hand written post-extract step as the framework now handles
the sub-dependencies.
verify-mirror passed for all 27 sub-dependencies. The patched source
tree is identical to the previous one except for the line endings of
two unused files in jsoncpp's devtools, so no PORTREVISION bump.
lang/v8: update to 15.4.80.20 (Chrome 154 stable)
- Update to 15.4.80.20 (Chrome 154.0.8037.97 stable pin)
- Update sub-dependency revisions from DEPS
- Add patch-.gn: use python3 from PATH instead of the hermetic
CPython CIPD package, which is not fetched; this also avoids a
host_cpu reference unsupported by devel/gn in the dotfile
- Add USES=llvm:min=20,build for proper LLVM toolchain selection
- Add 3 new sub-dependencies: cpu_features (chromium wrapper),
disarm, fadec
- Add ObtainCurrentThreadStackReservedLimit() for FreeBSD
- Remove upstreamed wasm-shuffle-reducer.cc patch
- Remove libcppgc.so and libthird_party_protobuf_protobuf_lite.so
(merged/removed upstream)
- Remove stale v8_use_libm_trig_functions GN arg (removed upstream)
- Specify explicit ALL_TARGET to avoid building test targets
- Regenerate all patches for new version
- Use USES=elfctl to mark d8, v8_shell, mksnapshot and mkgrokdump
as wxneeded: V8's JIT maps its code range read+write+execute and
has no W^X mode usable on FreeBSD, so isolate creation aborted
when kern.elf64.allow_wx=0. The kernel reads the flag from the
main executable only, so consumers embedding libv8 need to mark
their own binaries the same way
- Add patch-src_base_virtual-address-space.cc: allocate guard
regions with MAP_FIXED | MAP_EXCL, as with ASLR enabled FreeBSD
does not honor the mmap hint even when the range is free
- Take maintainership
lang/v8: fix build with libc++ 19
As noted in the libc++ 19 release notes [1], std::char_traits<> is now
only provided for char, char8_t, char16_t, char32_t and wchar_t, and any
instantiation for other types will fail.
This causes lang/v8 to fail to compile with clang 19 and libc++ 19,
resulting in errors similar to:
/usr/include/c++/v1/string:820:42: error: implicit instantiation of undefined template 'std::char_traits<unsigned short>'
820 | static_assert(is_same<_CharT, typename traits_type::char_type>::value,
| ^
../../src/inspector/v8-string-conversions.cc:387:26: note: in instantiation of template class 'std::basic_string<unsigned short>' requested here
387 | std::basic_string<UChar> UTF8ToUTF16(const char* stringStart, size_t length) {
| ^
/usr/include/c++/v1/__fwd/string.h:23:29: note: template is declared here
23 | struct _LIBCPP_TEMPLATE_VIS char_traits;
| ^
Upstream v8 has fixed this in commit 182d9c05e78 [2], so add it as a
backported patch, until the next version of v8 is released.
[1] https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals
[2] https://chromium.googlesource.com/v8/v8.git/+/182d9c05e78
PR: 282514
Approved by: sunpoet (maintainer)
MFH: 2024Q4
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
lang/v8: Update to 10.0.139.8
- Use v8 tarball from GitHub mirror
Changes: https://v8.dev/blog/v8-release-100
https://chromium.googlesource.com/v8/v8.git/+log/refs/heads/10.0-lkgr
lang/v8: Update to 9.6.180.12
- Use v8 tarball from chromium.googlesource.com since GitHub mirror has been stopped over 25 days
Changes: https://v8.dev/blog/v8-release-96
https://chromium.googlesource.com/v8/v8.git/+log/refs/heads/9.7-lkgr