CVE and update status of the FreeBSD ports tree3,298 unaddressed CVEs in 671 portsAll times are CET
Port details

ports-mgmt/pkg 2.8.4

Package manager

Port info

Maintainer
pkg@FreeBSD.org
Packages
latest: 2.8.4
Upstream
up to date
Last update
to 2.8.4 · 7e1abc7fc9
Quarterly
2026Q4: 2.8.4
Formerly
security/base-audit until 2022-07-17
WWW
https://github.com/freebsd/pkg
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install pkg
installs 2.8.4 from latest; from quarterly (2026Q4) 2.8.4
Port
# cd /usr/ports/ports-mgmt/pkg && make install clean
# make -C /usr/ports/ports-mgmt/pkg config  # change options first
Size
13 MiB download · 52 MiB installed
Depends on
nothing
License
BSD2CLAUSE
Options
1 of 1 on in the package: DOCS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.8.42.8.4–
FreeBSD 152.8.42.8.4–
FreeBSD 142.8.42.8.42.8.4

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.8.42.8.4–
FreeBSD 142.8.42.8.42.8.4

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 2.8.4.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (34) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297757maintainer-feedback? ports-mgmt/pkg: pkg query for list variables produces output on empty listsNew2026-08-22
297065maintainer-feedback? ports-mgmt/pkg: pkg-2.8.1: pkg update -r FreeBSD-ports creates the db file with a size of 1.6 Giga(!)bytesNew2026-08-10
297219maintainer-feedback? ports-mgmt/pkg: 'pkg upgrade' lists all locked packages every time despite no updates being available for themNew2026-08-01
296272maintainer-feedback? ports-mgmt/pkg: does not autoremove automatic, non-vital, leaf packagesNew2026-06-25
296168ports-mgmt/pkg: pkg fetch -d fails to download pkgbase dependenciesNew2026-06-21
Show all 34
PRSummaryStatusChanged
295672ports-mgmt/pkg: "getgrnam_r(wheel): Result too large" with many users in wheelNew2026-05-30
280345maintainer-feedback? ports-mgmt/pkg: pkg segfault when OpenSSL legacy provider is enabledNew2026-05-28
295353maintainer-feedback? ports-mgmt/pkg: does not show a dependency for a package, but removing it wants to remove many others; autoremove trying to remove a manually installed packageIn Progress2026-05-18
295312maintainer-feedback? ports-mgmt/pkg: pkg upgrade: 'these portts to be upgraded; y/n and lists; NEED OPTION to list partially at firstNew2026-05-15
186497ports-mgmt/pkg: local overrides for pkg auditIn Progress2026-04-24
294685regression maintainer-feedback? ports-mgmt/pkg: regession, pkg 2.7 does not honour http_proxy from pkg.conf any moreNew2026-04-24
294639maintainer-feedback? ports-mgmt/pkg: Defaults to case sensitiveNew2026-04-20
294656maintainer-feedback? ports-mgmt/pkg pkg audit fails to validate certificateNew2026-04-20
287989maintainer-feedback? ports-mgmt/pkg: packages version recognizing errorIn Progress2026-04-11
291200maintainer-feedback? ports-mgmt/pkg periodic script weekly/400.status-pkg uses a wrong pkg -R optionNew2026-03-18
229393maintainer-feedback? ports-mgmt/pkg: Show which options changed if upgrade neededIn Progress2025-10-26
219036maintainer-feedback? ports-mgmt/pkg: pkg confused, installs older version over newerOpen2025-10-26
270547maintainer-feedback? ports-mgmt/pkg: missing information about security vulnerabilities in system componentsOpen2025-10-26
290322maintainer-feedback? ports-mgmt/pkg build failed: can't apply patchNew2025-10-17
267657needs-qa regression maintainer-feedback+ maintainer-feedback? merge-quarterly? ports-mgmt/pkg upgrade prompts to install if package is missingIn Progress2025-09-14
288973ports-mgmt/pkg pkg-delete - SYNOPSIS is missing -f optionNew2025-08-20
288702maintainer-feedback? ports-mgmt/pkg v2.2.2, pkg-fetch synopsis missing '-o' optionNew2025-08-07
285490maintainer-feedback? ports-mgmt/pkg: pkg upgrade unexpectedly installs uninstalled, non-dependency packageNew2025-08-04
284538maintainer-feedback? ports-mgmt/pkg: The option '-o' in command versionNew2025-07-01
287437maintainer-feedback? ports-mgmt/pkg: "pkg help query" says nothing about flavorsNew2025-06-11
286107maintainer-feedback? ports-mgmt/pkg: improvement request: only install files whose checksum have changedNew2025-05-16
283755maintainer-feedback? ports-mgmt/pkg: pkg-upgrade(8) - version comparison new kernel modules ("kmods") failureNew2025-05-15
285197maintainer-feedback? ports-mgmt/pkg - v.2.0.6 - pkg-upgrade and pkg-version fail using multiple repositoriesNew2025-03-06
245667feature ports-mgmt/pkg: Determine ports branch of active pkg repoNew2025-01-25
284263maintainer-feedback? ports-mgmt/pkg: [1.21.3] --raw-format is broken when multiple packages are suppliedNew2025-01-22
249374maintainer-feedback? ports-mgmt/pkg: 1.15.4 cannot unroll hard links to copiesNew2024-08-31
275053maintainer-feedback? ports-mgmt/pkg periodic jobs do not play well with readonly mounted filesystemsNew2023-11-13
194689easy feature needs-patch ports-mgmt/pkg: pkg needs a stand-alone equivalent to portupgrade's "pkg_sort".Open2021-10-14
218159ports-mgmt/pkg: pkg -r fails to run post install script.In Progress2020-05-11

Commits (349)

Baptiste Daroussin (bapt) · 1.15.3
Update to 1.15.3 - Fix fetching files not belonging to a repo (fixes pkg audit -F)

PR:		249185
Reported by:	Peter Larsen
65dde89c8b
Baptiste Daroussin (bapt) · 1.15.2
Release 1.15.2

- Fixes a crash in the fetch methods
e59ff60f67
Baptiste Daroussin (bapt) · 1.15.1
Commit forgotten distinfo
b0b6a38fb3
Baptiste Daroussin (bapt) · 1.15.1
Fix a crash when fetching audit file
3ecd5e8213
Emmanuel Vadot (manu) · 1.15.0
ports-mgmt/pkg: Update to 1.15

Changes from 1.14.99.6 to 1.14.99.7
- Default the OSVERSION check to false
- Fix some errors related to getpwname_r/getgrnam_r
- Add RISC-V ABI aliases
- Add '%X' to pkg-query, this print the internal package checksum

Changes from 1.14.99.5 to 1.14.99.6
- Run lua scripts before shell scripts
- unbreak build with -fno-common

Changes from 1.14.99.4 to 1.14.99.5
- Fix lua script during pkg_delete
- Return file type for lua_stat

Changes from 1.14.99.3 to 1.14.99.4
- Add function to lua scripts:
  * Simple stat()
  * filecopy to copy a file preserving its attributes
  * filecmp to compare files
  * update sqlite to latest version
  * Add a new 'hash' mode to pkg repo to make repositories CDN friendly
  * Isolate transport protocol to be able to easily change implementations
    in the futur
  * Fix invalid json in even_pipe
  * lots of portability fixes

Changes from 1.14.99.2 to 1.14.99.3
- Fix linking on FreeBSD

Changes from 1.14.99.1 to 1.14.99.2
- Fix hanging if a script spawn a process and
  it still run after the scripts finish
- Prevent potential hang with lua scripts
- For http mirror first try to get the list from the
  full path and then fallback on the root one if we
  didn't find anything.
- Add a debug message if obtaining the lock fails

hanges from 1.13.99.7 to 1.14.99.1
- parallelize the run of the tests
- Fix VERSION_MINOR expansion
- Fix chflags tests
- Bring back pkg create -n but in a consistent way
- Improve build of sqlite
- Use mmap in sqlite
- Update sqlite to latest version
- Document pkg_create(3)
- Prepare the land for futur proof remote dependency handling
- Update usage of pkg set -A and pkg set -v
- Add pkg create -l (compression level)

PR:		249035 (exp-run)
Approved by:	bapt
1dc396abb3
Emmanuel Vadot (manu) · 1.14.7
ports-mgmt/pkg: Update to 1.4.17

- Fix build with -fno-common
c7029ad98e
Emmanuel Vadot (manu) · 1.14.6
Update to 1.14.6

Changes from 1.14.5 to 1.14.6:
- Fix linking on FreeBSD

Approved by:	bapt (implicit)
e7a53bc45a
Emmanuel Vadot (manu) · 1.14.5
Update to 1.14.5

Changes from 1.14.4 to 1.14.5:
- Prevent potential hang with lua scripts
- Add a debug message if obtaining the lock fails

Approved by:	bapt
b4b063f21c
Xin LI (delphij) · 1.14.4_1
ports-mgmt/pkg: Respect liblzma.pc if available.

Note that this is meant to be a temporary hack and will be reverted once the
freebsd/pkg have solved this in the build infrastructure.

PR:			200142
MFH:			2020Q2
Approved by:		portmgr (bapt over IRC)
Differential Revision:  https://reviews.freebsd.org/D24972
5321f236b3
Baptiste Daroussin (bapt) · 1.14.4
Update to 1.14.4 - fix a hang in pkg scripts

PR:		245462
Submitted by:	sobomax
Reported by:	sobomax, jkim
e6431df8d5
Baptiste Daroussin (bapt) · 1.14.3
Update to 1.14.3:

- Add pkg create -l to set compression level
- Parallelize the run of kyua
- Fix VERSION_MINOR UCL expansion
- Bring back pkg create -n
- Document pkg_create(3)
- Improve documentations in pkg-set(8)
469e950f79
Baptiste Daroussin (bapt) · 1.14.2
Update to 1.14.2 - Disable keep-alive for now, it is not stable enough
7c47e31675
Baptiste Daroussin (bapt) · 1.14.1
Update to 1.14.1 - fix a regression in the autosetup system which resulted in bad path   for periodic script
d439f6d42a
Baptiste Daroussin (bapt) · 1.14.0
forgot to commit the plist part

Reported by:	ohauer
0c9aeef553
Baptiste Daroussin (bapt) · 1.14.0
Update to 1.14

Major changes since 1.13:
- HTTP keep-alive in libfetch (imported from xbps)
- allow to backup shared libraries during upgrades
  (a compat-libraries packages is created to keep track of it)
- better reproducible build support
- More variable exposed to configuration

exp-run by:	antoine
eb7f018869
Baptiste Daroussin (bapt) · 1.13.2
Update to 1.13.2

- fix pkg fetch -o
- accept again colon before path in ssh url scheme in repositories
3602ee63c4
Baptiste Daroussin (bapt) · 1.13.1
Update to 1.3.1 - Fix inverted logic that lead to pkg always restarting rc scripts

Reported by:	flo
252d58ddcd
Baptiste Daroussin (bapt) · 1.13.0
Release pkg 1.13  - when installing over a non tracked file (not owned by any package)    pkg now saves a copy of that file as .pkgsave  - Fix a chicken/egg problem with the meta being compressed and defining    the compression format. Now pkg repo will create a meta.conf file    uncompressed (it is small enough) and fallback on the old meta.txz.    Note that meta.txz is still created for backward

PR:		243564
exp-run by:	antoine
dfcf194888
Baptiste Daroussin (bapt) · 1.12.0_1
Import the libfetch patch to the bundled libfetch
d6f58b5351
Baptiste Daroussin (bapt) · 0.4 · as security/base-audit
Fix dependency on pkg, the initial syntax will always find pkg (in base)
dab6cdb616
Baptiste Daroussin (bapt) · 1.12.0
Attempt to fix pkg on mips.

Since recently, libarchive is linked to libzstd, which itself uses threads
somehow, this make the build of pkg in mips unhappy.

Given libpkg is not threadsafe anyway just drop the __thread

PR:		240822
Reported by:	tech-lists@zyxst.net and mandree
Discussed with:	jhb
44b8c0a038
Baptiste Daroussin (bapt) · 1.12.0
Release pkg 1.12.0

- updating: allow to use regular expession in AFFECTS: value
- updating: improve the exact matching for AFFECTS: values
- recommand using pkg bootstrap -f instead of pkg-static install -f to reinstall
  pkg itself
- Add support for lua in package scripts (not documented yet)
- Add support for lua in keywords definition (not documented yet)
- Properly detect when base libarchive is linked to zstd and handle it. (needed
  an upcoming change in base)
- Add a function tu lua script to append message at the run of the pkg process
  along with other messages
- Add the missing warning about @unexec being deprecated for a while now in
  pkg-plist
- Fix build with gmake
- Ensure pkg_shutdown properly reinitialize all the closed fd to -1.
- Do not crash when being passed an unsupported ABI
ce9cb11db9
Kurt Jaeger (pi) · 0.4 · as security/base-audit
security/base-audit: upgrade 0.3 -> 0.4

- Since all supported FreeBSD versions have anticongestion function
  in /etc/default/periodic.conf, always use it to insert random sleep
  with non-interactive mode.
- pet portlint

PR:		236751
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>
Approved by:	Miroslav Lachman <000.fbsd@quip.cz> (maintainer)
16115b35bb
Baptiste Daroussin (bapt) · 1.11.1
Respect CC

Submitted by:	tijl
887504ba6b
Dirk Meyer (dinoex) · 1.11.1
- fix build with custom PREFIX PR:		238296
08110940c7
Baptiste Daroussin (bapt) · 1.11.1
Update to 1.11.1 - Fix abi string for dragonfly - Fix libfetch built without ipv6 support [1]

PR:		238264
Reported by:	ume
75b69fed68
Baptiste Daroussin (bapt) · 1.11.0
Update to 1.11

Improvements:
  * better ABI name on linux
  * lots of changes in internal API to use fd when possible
  * 410.pkg-audit now uses anticongestion on freebsd 12+
  * completion improvements
  * add an extra line when printing pkg-messages to improve readability
  * add %q to pkg_printf(3) and pkg-query(8) to print altabi
  * make pkg version -r imply -R
  * New build system based on autosetup
  * pkg is now a semi static binary
  * Add 3 new aliases:
    - rall-depends: showing depenencies of a non installed package
    - rcomment: showing only the comment of a non installed package
    - rdesc: showing only the description of a non installed package
  * close stdin when running scripts
  * Tons of bug fixes
Removal:
  * removed option: pkg repo -L
  * removed script: pkg2ng
b49bc9fc24
Baptiste Daroussin (bapt) · 1.10.5_5
Add a patch to fix pkg-static with linked against openssl 1.1.1

This is needed to be able to sign repository with pkg-static

Reported by:	many (based on a patch by gjb)
MFH:		2018Q4
721fca0324
Ryan Steinmetz (zi) · 1.10.5_4
- Bump PORTREVISION to chase openssl update in CURRENT
274759c90c
Brad Davis (brd) · 1.10.5_3
Apply a patch from git that fixes make packages with hardlinks and config files.
27f9bf5942
Mathieu Arnold (mat) · 1.10.5_2
Add DOCS options to ports that should have one.

Also various fixes related to said option.

PR:		230864
Submitted by:	mat
exp-runs by:	antoine
e1bfdfbe56
Kurt Jaeger (pi) · 0.3 · as security/base-audit
security/base-audit: update 0.2 -> 0.3

- Use anticongestion function if available

PR:		230393
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>
Approved by:	Miroslav Lachman <000.fbsd@quip.cz> (maintainer)
1722513b5c
Brad Davis (brd) · 1.10.5_2
Add a small patch to pkg to fix NULL check in pkg_is_config_file().

This helps pkgbase users with recent updates.

Approved by:	bapt
8a3ef66b51
Dmitry Marakasov (amdmi3) · 1.10.5_1
- Update WWW

Approved by:	portmgr blanket
5e4a9887a7
Brad Davis (brd) · 1.10.5_1
Apply patch for a segfault on upgrade

https://github.com/freebsd/pkg/issues/1663

Approved by:	bapt
2a713fb09d
Brad Davis (brd) · 1.10.5
Update pkg to 1.10.5

PR:		225104
Reviewed by:	bdrewery
cd2c7260e4
Steve Wills (swills) · 1.10.4
Don't use pkg-static when cross building

PR:		224217
Submitted by:	nwhitehorn
Approved by:	bapt
cbee9380e1
Kurt Jaeger (pi) · 0.2 · as security/base-audit
security/base-audit: update 0.1 -> 0.2

- Introduce security_status_baseaudit_period variable to
  files/405.pkg-base-audit.in in order to make it possible to specify
  when this script is executed (i.e. daily, weekly or monthly).

PR:		224239
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>, Miroslav Lachman <000.fbsd@quip.cz> (maintainer)
67a866343f
Baptiste Daroussin (bapt) · 1.10.4
Update to 1.10.4 - Fix progression display - Parse FreeBSD OS version and forbid to install too new packages
39150e2743
Mark Felder (feld) · 0.1 · as security/base-audit
Audit base system against known vulnerabilities and generate reports including references to security advisories. It uses pkg audit and Vuxml database as is used for packages but this script checks base system.
606b958e0c
Baptiste Daroussin (bapt) · 1.10.3_1
Fix segfault in pkg version against the ports tree

PR:		224023
Reported by:	jrm, kib, Trond.Endrestol@ximalas.info
Tested by:	jrm (an early version of the patch)
bfd7582edd
Baptiste Daroussin (bapt) · 1.10.3
Update to 1.10.3 - Accept DT_SONAME anywhere in .dynamic when parsing elf binaries - Fix pkg version when it deals with the ports tree and INDEX after flavors - Sort fts traversal in repo creation (for reproducible builds) - Documentation improvements - make pkg version -r imply -R
d389ce1e3e
Baptiste Daroussin (bapt) · 1.10.2_1
Add patches from git to handle pkg version with newly flavoured ports tree
bec657efdd
Baptiste Daroussin (bapt) · 1.10.2
Update to 1.10.2 Changes from 1.10.1 to 1.10.2 - pkg clean is now happy if the cache dir non existing - 410.pkg-audit now uses anticongestion on freebsd 12 - fix pkg install -r foo if foo is a disabled repository - fix elf handling on non FreeBSD - fix support for platforms without AT_SYMLINK_NOFOLLOW - fix dropping privileges on Linux - fix build with recent libbsd - fix duplicate pkg registratio

PR:		221129
exp-run by:	antoine
3b5d6ed28f
Guido Falsi (madpilot) · 1.10.1
Retire WITHOUT_DEBUG flag.

The flag has partial support across the tree, and the same effect
can be obtained by using ".undef WITH_DEBUG".

Reviewed by:		mat, rene
Approved by:		portmgr (rene)
Differential Revision:	https://reviews.freebsd.org/D12548
b1fac01e5e
Baptiste Daroussin (bapt) · 1.10.1
Update to 1.10.1 - Cache pw result to avoid over reloading nssswitch.conf - Fix allow to set env per repo for everykind of repo - Fix signing_command something saving a truncated signature in the file   as a result pkg will reject any repository signed - Fix sqlite vfs overload with new sqlite - pkg which: add -m to show what files matched using globs - Revert the new UI which does not respect 80
6b22736a0e
Baptiste Daroussin (bapt) · 1.10.0_2
Fix signing_command something saving a truncated signature in the file as a result pkg will reject any repository signed
7c12f910f1
Baptiste Daroussin (bapt) · 1.10.0_1
Allow per repo environment variable to be set for every kind of repositories

Reported by:	kib
Tested by:	kib
f646936a1d
Baptiste Daroussin (bapt) · 1.10.0
Release pkg 1.10.0

* fix pkg which -g
* Do not use openssl for sha256
* Improve the default output when fetching data
* Update libfetch to the version of FreeBSD 11
* Fix NetBSD ABI
* Add a fallback for utimensat when reporting EOPNOTSUPP
* replace libsbuf with utstring for portability
* Overwrite some sqlite vfs functions to allow more capsicumisation of pkg
* move more pkg audit details into the library
* allow to run pkg query without any privileges
* extend the audit periodic script to report deprecated packages
* Fix fd leak to rcscripts
* stop dropping privieges during fetching it causes more issues than it solves
* speed walking though [reverse]dependencies
* Update blake2b to latest version
* Add blake2s to the list of supported checksums
* Internal digest now default on blake2b on 64 bits and blake2s on 32 bits.
* Fix segfault when ABI is defined but empty
* Do not use the shared library provides/requires on non FreeBSD/Linux
* Define _NETBSD_SOURCES on NetBSD to allow libfetch to use funopen
* Document vital flags
* Fix potential double free when dealing with @config keyword
* Add progress when fetching (number of files to fetch)
* Improved messages about locked packages
* Return 1 when a user rejects the proposed plan
* When dealing with configuration files '@config' never overwrites non tracked
  files
* Warn everyone about deprecation of @dirrm and @exec
* Deduplicate metadata loading code
* pkg register now understands context aware messages
* Fix pkg register issues with some version of libarchive:
      hardlinks not being made hardlinks sometime
      issues when PREFIX is a symlink to another directory
* Use portable mechanism to find the number of CPUs which allows pkg repo to be
  faster on linux
* New pkg upgrade --vulnerable
e69e8ebbc4