installs 2.8.99.4 from latest; from quarterly (2026Q4) 2.8.99.1
Port
# cd /usr/ports/ports-mgmt/pkg-devel && make install clean
# make -C /usr/ports/ports-mgmt/pkg-devel config # change options first
Size
6.0 MiB download · 24 MiB installed
Depends on
nothing
License
BSD2CLAUSE
Options
1 of 2 on in the package: DOCSShow the 1 options that are off
SAN
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
2.8.99.4
2.8.99.1
–
FreeBSD 15
2.8.99.4
2.8.99.2
–
FreeBSD 14
✗
2.8.99.1
✗
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
2.8.99.1
2.8.99.1
–
FreeBSD 14
2.8.99.1
2.8.99.1
2.8.99.1
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 2.8.99.4.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
maintainer-feedback? ports-mgmt/pkg-devel: runs from cron simultaneously 9 hours and 7 hours
New
2026-05-20
Commits (366)
Baptiste Daroussin (bapt) · 1.21.99.3
ports-mgmt/pkg-devel: update to 1.21.99.3
Changes from 1.21.99.2 to 1.21.99.3
- alias: prime-origins is now uniq
- curl: improve debug output
- file protocol now respects rfc8089 definition
- fix glob search case sensitive support
- update curl to latest version
- update sqlite to latest version
- update lua to latest version
- time: remove usage of deprecated functions
- allow to build against an external libcurl
- fix build with external libarchive
- improve portability
- add support to use an external 3-way merge tool for @config files
Sponsored by Future Crew, LLC
- rework the job scheduler, the new jobs scheduler:
all known to date scheduler issues are fixed with this new scheduler
Sponsored by the FreeBSD Foundation
ports-mgmt/pkg-devel: update to 1.21.99.2
Changes from 1.21.99.1 to 1.21.99.2
- audit: add -d to audit packages in a specified directory
- bug fix: fix upgrade with symlinks becoming directories
- debug: implement debug flags to allow to cherrypick the debug flags to print
- check: remove -B and -r options
- compression: allow to defined the number of threads to use with zstd and xz
- curl: update to 8.9.0
- http: add support for HTTP_PROXY_AUTH
- periodic: remove compat_vars
- info: fix json formatted output
- manpages: lots of fixes and improvements
- install/upgrade: now removed packaages are printed at the bottom of the list of changes
- using -r <repo> now always enable the repository specified
- periodic: provide a mechanism to ignore jails via prefix matching
- upgrade: allow the used to ignore options changes in the triggers to reinstall a package
- lock/unlock: fix batch operations
- osversion: fix confusing message
- new attempt at better handling vital during upgrades
- sqlite: update to 3.46.0
ports-mgmt/pkg-devel: update to 1.20.99.12
Changes from 1.20.99.11 to 1.20.99.12
- ECC signature: plenty of fixes
- plist now have a "@var key value" to deal with %%KEY%% variables
- upgrade sqlite to latest version
ports-mgmt/pkg-devel: update to 1.20.99.11
Last release before 1.21!
Changes:
- the solver now excludes from its plan the removal of packages marked
as locked or vital
ports-mgmt/pkg-devel: update to 1.20.99.10
Changes:
- fix trigger validation schema
- use data.pkg instead of packagesite.pkg if available
- update bundled curl to 8.6.0
- update bundled libucl to latest version
- data.pkg now receives the groups
- lock and meta files are now saved under /var/db/repos/<reponame>/<file>
- remote databases are now stored under /var/db/repos/<reponame>/db
- pkg search now supports groups
- pkg rquery now supports groups
- pkg now support elfhints on any byte-order on FreeBSD
- behaviour change: pkg lock/unlock errors if the package stated is unavailable
- pkg now supports ECDSA and EdDSA for all its signature mechanism
- new pkg key command which allows to generate keys.
- plenty of minor code cleanup and bug fixes.
ports-mgmt/pkg-devel: update to 1.20.99.9
Changes from 1.20.99.8 to 1.20.99.9
- pkgbase: .snap now comes after .alpha in versionning
- update: lock pkg update to avoid concurrent instance of pkg update to compete
- bundled sqlite: update to 3.45.0
- bootstrap now accepts -y
- update bundled curl to 8.5.0
- New PKG_ISCHROOTED env var for scripts so they can grow the knowledge they
are being run in a pkg -c chroot environement
- update autosetup to 7.1
- lots of small code optimizations
- remove now unsupported arm architectures
- refactor pkg_repo_create API to make it more flexible, while here document it
- repo: to not generate anymore the meta.{pkg,txz} which is unused since pkg 1.13
- manpages have been moved to share/man
ports-mgmt/pkg-devel: update to 1.20.99.8
Changes:
- fix a race in vulnxml fetch trigger
- add a new data.pkg which contains a fully valid json and aim at replacing
packagesite.pkg because extensible, continue to produce packagesite.pkg
- repo: remove ability to provide v1 repository format
- deduplicate code directly using libucl exporters instead of home backed ones
- undocument ftp support
- provide FreeBSD native sandboxing function in the library directly (packagekit)
- curl: provide libfetch compatiblity about HTTP_USER_AGENT
- New keywork: @override_prefix (pkgbase)
- repo: using threads instead of forks
- add: only generates .pkgsave when really needed
ports-mgmt/pkg-devel: update to 1.20.99.7
- update curl to 8.4.0
- plug some memory leak
- plug a db transaction leak
- refactoring of the repository generation code
ports-mgmt/pkg-devel: update to 1.20.99.6
Changes:
- enable netrc support to be compatible with libfetch variable
- enable by default all supported kind of authentication for curl
- Fix duplicated rquery
- Make missing plugins non fatal (needed for smooth packagekit support)
- Do not complain about Last-Modified head if the fetch was a failure
- Support for jobs cancellation (needed for packagekit support)
- update sqlite3 to 3.43.0
- update lua to 5.4.6
- plug plenty of memory leaks
- improve debug output in particular for sql statements
- exclude locked package early from autoremove candidates
- fix very slow orphan test computation consuming 100% of CPU in autoremove
ports-mgmt/pkg-devel: update to 1.20.99.5
Changes:
- fix a regression introduce with switch to libcurl which results in
the remote db mtime being badly set
- fix a regression which makes pkg query report twice some packages
when configured in multirepository mode.
- fix a compatibility issue with http_proxy env var (lowercase)
- update libcurl to latest version
- introduce PKG_EVENT_PKG_ERRNO new event type
pkg*: new regression fixes release
Changes:
- speed up pkg add again, and greatly reduce its memory footprint
- more compatibility with libfetch (SSL_* variables)
- fixed FETCH_TIMEOUT adaptation to libcurl
pkg*: fix regressions from 1.20 release
- reduce memory usage for pkg add
- fix regression in url parsing for ssh
- fix some more compatibility with libfetch
- update pkg-triggers manpage
ports-mgmt/pkg-devel: update to 1.19.99.3
Changes from 1.19.99.2 to 1.19.99.3
- fix memory leaks
- fix regression: implement cancelling with libcurl
- new event PKG_EVENT_INCREMENTAL_UPDATE_BEGIN
- fix signature generation with openssl3
- allow reading pre and post openssl3 signatures
pkg: revert openssl3 support
This change makes pkg generate a signature that is incompatible with
previous keys, it is better to have pkg broken for openssl3 and die
instead of having a backward incompatibility
ports-mgmt/pkg-devel: update to 1.19.99.2
The main change here is the replacement of libfetch by libcurl,
this fixes many of the issues that were related to libfetch itself.
This gives us also a better debug informations
Changes from 1.19.99.1
- Update libucl to latest version
- Allow to configure COMPRESSION_FORMAT in pkg.conf
- Remove support for legacy (pkg_* tools)
- kill useless pkg_manifest_key API
- pkg add (respect provide/require)
- pkg autoremove: properly process provides/requires
- pkg now requires C11
- remplace pkg_set(3) API with a _Generic based API
- periodic script: Use locale-agnostic (ISO 8601)
- complete refactoring of the fetch code
- new pkgdb_all_search to search local and remote DBs at the same time
- fix plenty of memory leaks
- fix a regression in -e
- improve the plugin API
- replace libfetch with libcurl
- add support for http pipelining
- improve SRV and HTTP mirroring, reducing the number of round trips
- only keep one version of HTTP mirroring the one that respects the repo url
ports-mgmt/pkg-devel: update to 1.19.99.1
changes
- fix regression in pkg autoremove
- fix regression preventing tracking files with path longer than 64
chars
- fix build out of tree
- fix spelling issues in pkg-trigger(8)
ports-mgmt/pkg-devel: update to 1.18.99.7
Changes:
- reduce the number of filedescriptors opened at the same time
- update sqlite to 3.40.0
- fix regression in pkg lock
- fix annotate --modify
ports-mgmt/pkg-devel: update to 1.18.99.6
Changes:
- remove backup command, do backup pkg shell .dump should be preferred
as already done via periodic script
- (r)query: stricter command line validation
- (r)query: new operators: =~ ==~ and !=~
- fix merging of config files accross split upgrades
- fix a regression when executing a shell script (introduced in
1.18.99.4)
ports-mgmt/pkg-devel: release 1.18.99.4
Changes from 1.18.99.3 to 1.18.99.4
- Accept '~' in the version or name of a package
- Autoremove will not remove anything which is required
by another installed package (via provides or via shlibs_provides)
- Update linenoise to latest version
- Update sqlite to 3.39.3
- Update lua to 5.4.4
- doc: add example on how to restore a package
- query: fix unicity issue
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
ports-mgmt/pkg-devel: update to 1.18.99.2
Fix a regression introduced with the new ewtraction code which
results in some bad directory path matching, creating "hidden" to pkg
leftovers
Reported by: tcberner
ports-mgmt/pkg-devel: update to 1.18.99.1
Main change is a refactoring of the extraction process to fix a case
where during an upgrade a file becomes a directory
ports-mgmt/pkg-devel: update to 1.17.99.11 aka 1.18.0rc2
Changes:
- fix a regression about shlibs detected as changed wrongly
- fix performance issue with pkg upgrade
ports-mgmt/pkg-devel: update to 1.17.99.10
Changes from 1.17.99.9 to 1.17.99.10
- greatly improve test coverage
- many improvements in error handling for pkg fetch
- Remove the deprecated pkg_get() function from the API
- prevent @config files to be verified from pkg checksums checking
- Remove ftp(s):// support
- add tcp:// protocol support which allows to server packages form inetd
and secure it via spiped for example
- triggers can now be trigger when empty directories are added/removed
- Add "orphans" aliases
- speed up pkg which
- Reduce the possibility to have a temporary file during package extraction
which exceed NAME_MAX (maxium file name length)
- If the pattern has a '/' in it, it now search origin and all other categories
as well
for example graphics/zathura and print/zathura will both match the zathura
package
- If the pattern has a '/' in it and a @ it will also search for the flavor
<category>/<portname>@<flavor>
# pkg install "editors/vim@tiny" # will install the vim-tiny package
$ pkg search -g "editors/vim@*"
vim Improved version of the vi editor (console flavor)
vim-gtk2 Improved version of the vi editor (gtk2 flavor)
vim-gtk3 Improved version of the vi editor (gtk3 flavor)
vim-motif Improved version of the vi editor (motif flavor)
vim-tiny Improved version of the vi editor (tiny flavor)
vim-x11 Improved version of the vi editor (x11 flavor)
- portability: build and run on alpine (musl)
ports-mgmt/pkg-*: fix symbol collisions
while we fixed the symbol collision between libmd and libcrypto long
ago in dynamic linked program, the collision is still there somehow for
statically build programs.
The manual check for liblzma_libs for static linking that was added long
ago brings in a link to libmd before a link to libcrypto (this is since
FreeBSD 13.0+
This manual check is not necessary anymore anyway, so let's drop it.
Reported by: Franco Fitchner (from Opnsense)
ports-mgmt/pkg-devel: Update to 1.17.99.9
Changes
- pkg add: only runs triggers at the end of the equivalent of a transaction
- pkg search: fix the combinaison of -q and -o
- pkg fetch: correctly exit with error on fetch failures
- Improve error message when failing to drop privileges
- Ensure no temporary files are left overs when ignoring some files in package
ports-mgmt/pkg-devel: update to 1.17.99.8
Changes:
- ensure pkg waits for the programs executed by the triggers
- bring back the fallback on the pkg add with mismatched version (with
regression fixed)
ports-mgmt/pkg-devel: update to 1.17.99.5
- document triggers
- add pkg.readdir to lua scripts
- reduce memory usage for hashes
- fix memory corruption which can happen in some corner cases
- run triggers for pkg add and pkg register
ports-mgmt/pkg-devel: update to 1.17.99.4
Changes from 1.17.99.3 to 1.17.99.4
- pkg version: fix regression from conversion to pkghash
- allow filtering files at install time
- add periodic script to check vulnerabilities in base
- fix pkg failing to find its db if run from a directory which does not
exists anymore
- fix ubsan reported issues
- fix priorization upgrade-removal along with other deletion
- fix plenty of memory leaks
ports-mgmt/pkg-devel: Fix packaging from poudriere
If there is no pkg(8) installed in the jail/host pkg-static will be used
but we don't have pkg-static with SAN so add a link in the WRKSRC.
Also poudriere just extract pkg-static from the pkg archive so cp
instead of symlink
ports-mgmt/pkg-devel: Add an option for building with sanitizer
Sanitizers helps finding problems, add an option to pkg-devel to be
able to compile with them.
ports-mgmt/pkg-devel: update to 1.17.99.3
- make pkg/audit.h C++ friendly
- fix build with libressl
- Enable aarch64 support for linux
- plenty of portability fixes for linux with musl libc
- autoremove: respect -q
- version: report an error if the provided INDEX file does not exist
- periodic: allow users so provide an ignore list of jails
- periodic: reduce audit script verbosity
- arch: to not consider .h as potentially arch specific
- query: allow -e to be used with other filter options
- register: implement a -N to disable registration in the database
- rework internal hash tables
- plenty of memory leak fixed
- fetch; do not count cached files as files to be fetched
ports-mgmt/pkg-devel: update to 1.17.99.2
Changes from 1.17.99.1 to 1.17.99.2
- by default only create .txz symlinks for metadata
- only consider the .pkg when creating a repository
add an option REPO_ACCEPT_LEGACY_PKG to keep index old pkg
- Reduce usage of memory stack
ports-mgmt/pkg*: Release 1.17.0
TL;DR: new uniq package file extension: '.pkg'
Full changelog for pkg:
- add a new "snap" prefix, to deal with pkg base snapshots
- pkg repo now accepts packages with different compression formats
- pkg now have a single extension: ".pkg" and a backward compatible
symlink is created when the package is created to help transitioning
- Default compression level for zstd is now set to 19
- the default compression level is now a configuration option
- plenty of portability fixes
- fix plenty of typos
- expose the name of the package to lua and shell scripts
- plist:
remove internal support for @*exec (this is now in the ports tree)
remove support for @ignore
remove support for @dirrm/@dirrmtry
remove support for @pkgdep
remove stub support for @stopdaemon
remove stub support for @display
remove stub support for @mtree
remove stub support for @conflict
- VUXML: fetch .xz compressed version of the file by default
- triggers are deferred to later command (firstboot is planned) if run
with pkg -r
- pkg triggers commands has been added and can execute the deferred
triggers for example at firstboot
Changes in the framework:
- Add a backward compatibility layer, so people are not forced to move
to pkg 1.17 yet (new quarter we will enforce the switch for triggers
anyway, but it gives time to people to switch)
- Introduce a new PKG_COMPRESSION_FORMAT for users to specify the
compression format they are willing to use when creating packages:
txz, tar, tgz, tbz, tzst are the valid ones (note that tzst is only
usable on FreeBSD 13 and 14)
- Add a backward compatibility for people who specified the compression
format already via PKG_SUFX and issue a warning to tell them about the
deprecation of PKG_SUFX
Update to 1.16.99.5
Changes:
- allow to execute programs from lua script and triggers
- fetch vuln.xml.xz by default
- triggers detected by pkg -r are now deferred for firstboot
- pkg triggers command can be executed at first boot to run the
deferred triggers
Note this is expect to be the last release before 1.17 (depending on
how many new bugs has been introduced)