CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

multimedia/jellyfin10.11.11_1

Jellyfin Server Component with WebUI

Maintainer
bapt@FreeBSD.org
Packages
jellyfin 10.11.11_1
Upstream
Higher version available: 12.3
CPE
none, CVEs only via VuXML
WWW
https://jellyfin.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (2)

VuXML entries whose affected range this version has left.

Commits (45)

Baptiste Daroussin (bapt) · 10.11.11_1
multimedia/jellyfin: fix the harfbuzz dependency
093eccf276
Baptiste Daroussin (bapt) · 10.11.11_1
multimedia/jellyfin: fix text rendering

Jellyfin uses libHarfBuzzSharp.so to render text on thumbnails, like
it uses libskiasharp. After analyses it appears nothing in jellyfin
is calling any symbols out of the symbols exposed by vanilla
libharfbuzz.so, instead of building a full libHarfBuzzSharp.so, just
resuse the share libarfbuz.so create a symlink in a place where jellyfin
will be able to dlopen it.

PR:		297316
Reported by:	freebsd.geography231@slmails.com
fbe153d008
Florian Smeets (flo) · 10.11.11
multimedia/jellyfin: Fix distinfo after last update

PR:		296306
fabc9b0d31
Baptiste Daroussin (bapt) · 10.11.11
multimedia/jellyfin: update to 10.11.11
aa0c8a5d8f
Florian Smeets (flo) · 10.11.10
multimedia/jellyfin: Fix distinfo and pkg-plist after 10.11.10 update

Discussed with:	bapt
a9b20a75cb
Baptiste Daroussin (bapt) · 10.11.10
multimedia/jellyfin: webpack is a memory hog on arm64

allow more heap for v8, to try to prevent an OOM on arm64 cluster
3b53751dd2
Baptiste Daroussin (bapt) · 10.11.10
multimedia/jellyfin: update to 10.11.10

Release notes:
- Fix GHSA-f47c-m7gr-q92j, GHSA-jg92-mrxq-vv75, GHSA-wwwm-px48-fpvq (security)
- Fix stale UserData cache
- Fix/user manager collation
- Fix XSS in listview (jellyfin-web)
88ee059d8d
Baptiste Daroussin (bapt) · 10.11.8
multimedia/jellyfin: update to 10.11.8
fb5be16962
Baptiste Daroussin (bapt) · 10.11.7
multimedia/jellyfin: update to 10.11.7
bb3cd6a7ce
Baptiste Daroussin (bapt) · 10.11.6
multimedia/jellyfin: simplify tarball generation and verification
a218714bf5
Baptiste Daroussin (bapt) · 10.11.6
multimedia/jellyfin: udpate to 10.11.6

While here split amd64 and arm64 node archives (like done in navidrome)
to fix build on arm64

Fix thunbnail and trickplay creation on fresh install by making sure
/tmp/jellyfin is created at start [1]

PR:	290908 [1]
Submitted by:	ek@purplehat.org [1]
11e0a695af
Baptiste Daroussin (bapt) · 10.11.5
multimedia/jellyfin: update to 10.11.5
505d116cda
Baptiste Daroussin (bapt) · 10.11.3
multimedia/jellyfin: update to 10.11.3
0af1154d60
Baptiste Daroussin (bapt) · 10.11.2
multimedia/jellyfin: update to 10.11.2
602975bf98
Baptiste Daroussin (bapt) · 10.11.1
multimedia/jellyfin: update to 10.11.1

Changes: https://github.com/jellyfin/jellyfin/releases/tag/v10.11.1
fad2294abb
Baptiste Daroussin (bapt) · 10.11.0
multimedia/jellyfin: update to 10.11.0

ports related changes:
- move to node24
- move to dotnet9 (meaning support for aarch64!)
- semi automatically generate nugets dependencies.

Changes:
- server: https://github.com/jellyfin/jellyfin/releases/tag/v10.11.0
- frontend: https://github.com/jellyfin/jellyfin-web/releases/tag/v10.11.0
dfaad9d283
Baptiste Daroussin (bapt) · 10.10.7
multimedia/jellyfin: attempt to fix package building

pin again nodejs version instead of using lts as each time a node
version changes the "prefetch" distfile also changes.

Add the node version used in the distfile name to ensure that if we
change the node version we use the distfile name is also changed.

PR:	288572
8f25eaf146
Baptiste Daroussin (bapt) · 10.10.7
multimedia/jellyfin: update distinfo

Due to npm/node changes the node module package has to be regenerated.
a6ae886b3d
Baptiste Daroussin (bapt) · 10.10.7
multimedia/jellyfin: update to 10.10.7
6f9e709af7
Baptiste Daroussin (bapt) · 10.10.6
multimedia/jellyfin: update to 10.10.6
e8e2cf6442
Baptiste Daroussin (bapt) · 10.10.5
multimedia/jellyfin: add missing entry in plist
80f9e5488c
Baptiste Daroussin (bapt) · 10.10.5
multimedia/jellyfin: update to 10.10.5
c549d53727
Baptiste Daroussin (bapt) · 10.10.3_1
multimedia/jellyfin: fix build after default node has been upgraded

PR: 	283307
3b25e417a1
Baptiste Daroussin (bapt) · 10.10.3_1
multimedia/jellyfin: fix typo
3e47fee1f3
Baptiste Daroussin (bapt) · 10.10.3
multimedia/jellyfin: fix missing file in plist
db1d0b8c1c
Gleb Popov (arrowd) · 10.10.3
lang/dotnet: Update to 9.0.0

Move .NET 8 to lang/dotnet8

Co-authored-by:	Gleb Popov <arrowd@FreeBSD.org>
cbf4344824
Baptiste Daroussin (bapt) · 10.10.3
multimedia/jellyfin: update to 10.10.0.3
95a2d7d0e4
Baptiste Daroussin (bapt) · 10.10.1
multimedia/jellyfin: update to 10.10.1

Unbundle libskiasharp
Workaround in package*.json the fact that sass-embeded does not provide
sass binaries for FreeBSD yet, and use sass now.
ee6eb83a0e
Baptiste Daroussin (bapt) · 10.9.11
multimedia/jellyfin: take maintainership
1aca3f0c44
Zsolt Udvari (uzsolt) · 10.9.11
multimedia/jellyfin: Drop maintainership

PR:		282398
Approved by:	submitter is (ex-)maintainer
5de2b07a0f
Baptiste Daroussin (bapt) · 10.9.11
multimedia/jellyfin: update the distinfo for the node modules

Reported by:	driesm
7cddc85218
Baptiste Daroussin (bapt) · 10.9.11
multimedia/jellyfin: update to 10.9.11

PR:		281791
Approved by:	maintainer
f47dfcc111
Fernando Apesteguía (fernape) · 10.9.6
multimedia/jellyfin: Update to 10.9.6 and switch to source build

This patch moves the jellyfin port to build from source using lang/dotnet.
The only binary part is libskia, like it always has been. Building this one from
source is not as easy and will be looked into later.

PR:		279926
Reported by:	michiel@vanbaak.eu (maintainer)
28d47d8ca8
Baptiste Daroussin (bapt) · 10.9.4
multimedia/jellyfin: Update to 10.9.4

PR:	279464
e0d2a69662
Baptiste Daroussin (bapt) · 10.9.2
multimedia/jellyfin: Update to 10.9.2

PR:	279317
2448c58ee1
Baptiste Daroussin (bapt) · 10.8.13_1
multimedia/jellyfin: Fix pkg-descr, pkg-plist perms

PR:	277871
377ef0d715
Dries Michiels (driesm) · 10.8.13_1
multimedia/jellyfin: export PATH so jellyfin can find ffmpeg

PR:	277161
76e58290d7
Rodrigo Osorio (rodrigo) · 10.8.13
multimedia/jellyfin: Update to 10.8.13

Changelog: https://github.com/jellyfin/jellyfin/releases/tag/v10.8.11
           https://github.com/jellyfin/jellyfin/releases/tag/v10.8.12
           https://github.com/jellyfin/jellyfin/releases/tag/v10.8.13

PR:		275249
Approved by:	Michiel van Baak Jansen <michiel@vanbaak.eu> (maintainer)
eed3524ad2
Dries Michiels (driesm) · 10.8.10_3
.NET ports: improve IPv6 detection in rc script

An IPv6 address on the localhost does not mean a jail has IPv6.
Also remove two credit lines as he is now credited in the git log.

PR:		273542
Reported by:	michiel@vanbaak.eu
Approved by:	michiel@vanbaak.eu (maintainer)
5cf4242d5f
Robert Clausecker (fuz) · 10.8.10_2
multimedia/jellyfin: adjust pkg-message to include proper jail parameters

In order to run in a jail, jellyfin needs the jail's parameter
`allow.mlock` to be set, the pkg-message.in mentions this to be
`allow_mlock=1`, which won't work.  Fix this and also use
`service jellyfin enable` instead of the `sysrc` line.

PR:		273973
Approved by:	michiel@vanbaak.eu
67de7f3af9
Dries Michiels (driesm) · 10.8.10_2
multimedia/jellyfin: switch to USES for sqlite and openssl

PR:	272266
8eaad5a117
Christian Weisgerber (naddy) · 10.8.10_1
audio/opus: bump consumers after update to 1.4
feb1fa34f5
Fernando Apesteguía (fernape) · 10.8.10
multimedia/jellyfin: update to 10.8.10

ChangeLog: https://github.com/jellyfin/jellyfin/releases/tag/v10.8.10

jellyfin:

 * Throw exception on path traversal in WriteDocumentAsync
 * Fix the canvas size for DVBSUB and DVDSUB subtitles
 * Fix the brightness of VPP tonemap and add the tonemap mode
 * Fix nvenc preset order
 * Fix Live TV hardware decoding
 * Fix stream map when using filter_complex with unlabeled output
 * Fix codec checking in CodecProfiles conditions
 * Multiple HLS codec and bitrate fixes (10.8.z)
 * Fix H.264 baseline hwaccel and enable enhanced Nvdec by default
 * Some VAAPI VPP and OpenCL fixes
 * Fix EqualsAny condition check for int and double

jellyfin-web

 * Escape device id in raw HTML
 * Add the tonemap mode options
 * Fix dead documentation link
 * Fix installed plugin version html
 * Drop progressive transcoding in web client
 * Fix subtitle offset reset when seeking progressive stream
 * Babelify @jellyfin/libass-wasm
 * Fix navigation for some types of INPUT
 * Backport PR #4150 to 10.8.z branch
 * Backport PR #4147 to 10.8.z branch

PR:		271041
Reported by:	debdrup@freebsd.org
MFH:		2023Q2 (security fixes)
Security:	CVE-2023-30626 CVE-2023-30627
c679dca304
Jan Beich (jbeich) · 10.8.9_1
devel/icu: update to 73.1

- Temporarily switch to GitHub auto archive (release artifacts are N/A atm)

Changes:	https://github.com/unicode-org/icu/releases/tag/release-73-1
Reported by:	GitHub (watch releases)
PR:		270422
Exp-run by:	antoine
f1f1a8be88
Robert Clausecker (fuz) · 10.8.9
multimedia/jellyfin: Add port

Jellyfin is the volunteer-built media solution that
puts you in control of your media.
Stream to any device from your own server, with no strings attached.

Your media, your server, your way.

WWW: https://jellyfin.org/

Maintainer becomes submitter.  Already maintainer of other ports.

Port installs binaries downloaded from a website without any
local compilation.  The submitter has done the same for numerous
previous ports due to difficulties in locally building .NET based
ports.  See PR for some discussion.

PR:		269754
Approved by:	flo (mentor)
Differential Revision: https://reviews.freebsd.org/D38861
92747e09c4