CVE and update status of the FreeBSD ports tree3,310 unaddressed CVEs in 678 portsAll times are CET
Port details

ports-mgmt/pkg 2.8.4

Package manager

Port info

Maintainer
pkg@FreeBSD.org
Packages
latest: 2.8.4
Upstream
up to date
Last update
to 2.8.4 · 7e1abc7fc9
Quarterly
2026Q4: 2.8.4
Formerly
security/base-audit until 2022-07-17
WWW
https://github.com/freebsd/pkg
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install pkg
installs 2.8.4 from latest; from quarterly (2026Q4) 2.8.4
Port
# cd /usr/ports/ports-mgmt/pkg && make install clean
# make -C /usr/ports/ports-mgmt/pkg config  # change options first
Size
13 MiB download · 52 MiB installed
Depends on
nothing
License
BSD2CLAUSE
Options
1 of 1 on in the package: DOCS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.8.42.8.4–
FreeBSD 152.8.42.8.4–
FreeBSD 142.8.42.8.42.8.4

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.8.42.8.4–
FreeBSD 142.8.42.8.42.8.4

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 2.8.4.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (34) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297757maintainer-feedback? ports-mgmt/pkg: pkg query for list variables produces output on empty listsNew2026-08-22
297065maintainer-feedback? ports-mgmt/pkg: pkg-2.8.1: pkg update -r FreeBSD-ports creates the db file with a size of 1.6 Giga(!)bytesNew2026-08-10
297219maintainer-feedback? ports-mgmt/pkg: 'pkg upgrade' lists all locked packages every time despite no updates being available for themNew2026-08-01
296272maintainer-feedback? ports-mgmt/pkg: does not autoremove automatic, non-vital, leaf packagesNew2026-06-25
296168ports-mgmt/pkg: pkg fetch -d fails to download pkgbase dependenciesNew2026-06-21
Show all 34
PRSummaryStatusChanged
295672ports-mgmt/pkg: "getgrnam_r(wheel): Result too large" with many users in wheelNew2026-05-30
280345maintainer-feedback? ports-mgmt/pkg: pkg segfault when OpenSSL legacy provider is enabledNew2026-05-28
295353maintainer-feedback? ports-mgmt/pkg: does not show a dependency for a package, but removing it wants to remove many others; autoremove trying to remove a manually installed packageIn Progress2026-05-18
295312maintainer-feedback? ports-mgmt/pkg: pkg upgrade: 'these portts to be upgraded; y/n and lists; NEED OPTION to list partially at firstNew2026-05-15
186497ports-mgmt/pkg: local overrides for pkg auditIn Progress2026-04-24
294685regression maintainer-feedback? ports-mgmt/pkg: regession, pkg 2.7 does not honour http_proxy from pkg.conf any moreNew2026-04-24
294639maintainer-feedback? ports-mgmt/pkg: Defaults to case sensitiveNew2026-04-20
294656maintainer-feedback? ports-mgmt/pkg pkg audit fails to validate certificateNew2026-04-20
287989maintainer-feedback? ports-mgmt/pkg: packages version recognizing errorIn Progress2026-04-11
291200maintainer-feedback? ports-mgmt/pkg periodic script weekly/400.status-pkg uses a wrong pkg -R optionNew2026-03-18
229393maintainer-feedback? ports-mgmt/pkg: Show which options changed if upgrade neededIn Progress2025-10-26
219036maintainer-feedback? ports-mgmt/pkg: pkg confused, installs older version over newerOpen2025-10-26
270547maintainer-feedback? ports-mgmt/pkg: missing information about security vulnerabilities in system componentsOpen2025-10-26
290322maintainer-feedback? ports-mgmt/pkg build failed: can't apply patchNew2025-10-17
267657needs-qa regression maintainer-feedback+ maintainer-feedback? merge-quarterly? ports-mgmt/pkg upgrade prompts to install if package is missingIn Progress2025-09-14
288973ports-mgmt/pkg pkg-delete - SYNOPSIS is missing -f optionNew2025-08-20
288702maintainer-feedback? ports-mgmt/pkg v2.2.2, pkg-fetch synopsis missing '-o' optionNew2025-08-07
285490maintainer-feedback? ports-mgmt/pkg: pkg upgrade unexpectedly installs uninstalled, non-dependency packageNew2025-08-04
284538maintainer-feedback? ports-mgmt/pkg: The option '-o' in command versionNew2025-07-01
287437maintainer-feedback? ports-mgmt/pkg: "pkg help query" says nothing about flavorsNew2025-06-11
286107maintainer-feedback? ports-mgmt/pkg: improvement request: only install files whose checksum have changedNew2025-05-16
283755maintainer-feedback? ports-mgmt/pkg: pkg-upgrade(8) - version comparison new kernel modules ("kmods") failureNew2025-05-15
285197maintainer-feedback? ports-mgmt/pkg - v.2.0.6 - pkg-upgrade and pkg-version fail using multiple repositoriesNew2025-03-06
245667feature ports-mgmt/pkg: Determine ports branch of active pkg repoNew2025-01-25
284263maintainer-feedback? ports-mgmt/pkg: [1.21.3] --raw-format is broken when multiple packages are suppliedNew2025-01-22
249374maintainer-feedback? ports-mgmt/pkg: 1.15.4 cannot unroll hard links to copiesNew2024-08-31
275053maintainer-feedback? ports-mgmt/pkg periodic jobs do not play well with readonly mounted filesystemsNew2023-11-13
194689easy feature needs-patch ports-mgmt/pkg: pkg needs a stand-alone equivalent to portupgrade's "pkg_sort".Open2021-10-14
218159ports-mgmt/pkg: pkg -r fails to run post install script.In Progress2020-05-11

Commits (349)

Ryan Steinmetz (zi) · 1.9.4_1
- Instruct portscout to ignore these
b76b458340
Baptiste Daroussin (bapt) · 1.9.4_1
Fix file descriptor leak that might lead to errors on packages with lots of files

PR:		215544
Submitted by:	pasokondokoro@gmail.com
0693ccefbe
Baptiste Daroussin (bapt) · 1.9.4
Update to 1.9.4 - Stop dropping privileges for fetching, it causes more issues than it solves - Fix segfault when ABI is defined by empty - Fix reporting of deprecated packages - Provide instructions on how to unset vital flages - Fix libfetch for NetBSD - Fix @config potential double free - Always warn about the deprecated @dirrm/@dirrmtry - Always warn about the deprecated @exec - Rework pkg reg

PR:		214381 [1], 215029 [2]
Reported by:	lampa@fit.vutbr.cz [1]
Exp-run:	antoine [2]
0c586c93ba
Baptiste Daroussin (bapt) · 1.9.3
Update to 1.9.3 - Fix file descriptor leak during rc script execution - Fix setting attributes on directories - Fix locking on NFS - Allow pkg annodate -S to run as a non priviledge user - Extend the audit periodic script to report about expiration/deprecation
e39c5c4efc
Baptiste Daroussin (bapt) · 1.9.2
Update to 1.9.2 - Fix NetBSD ABI - Add a fallback for when utimensat returns EOPNOTSUPP like on some NFS servers - Install the NEWS file
1bc4c308f8
Baptiste Daroussin (bapt) · 1.9.1
Release 1.9.1

- fix a fd leak on freebsd <11

Reported by:	mat
Tested by:	mat
df21debbe1
Baptiste Daroussin (bapt) · 1.9.0
Update to 1.9.0

- Drop privileges in many commands
- Drop privileges when fetching a file
- Add resource limitation in sandboxes
- Add support for METALOG
- pkg delete new prints a warning for pattens that matches nothing?
dd098475c5
Bryan Drewery (bdrewery) · 1.8.7_3
Force a rebuild to bring in libarchive fixes from head r305819.

MFH:		2016Q3
f771ab66f2
Baptiste Daroussin (bapt) · 1.8.7_2
Add javavmwrapper 2.5_1 to the list of buggy scripts
e7badd6689
Baptiste Daroussin (bapt) · 1.8.7_1
Add a hack in pkg to skip running predeinstall for javavmwrapper-2.5

During upgrades/reinstall javavmwrapper 2.5 pre deinstall script deletes the pkg
temporary files preventing to finish the upgrade.

A fixed version of javavmwrapper will be made soon, this hack will remain in the
ports tree and not in pkg(8) itself. This hack is made to not bother users is
only affecting upgrade/reinstall phase not proper deinstall

PR:		210313
a203d9f11c
Baptiste Daroussin (bapt) · 1.8.7
Update to 1.8.7 - update internal expat to 2.2.0 - fix external solver - fix build on freebsd pre 9.2 - fix warnings on armv6 - fix solver issue resulting in missing conflicts or reinstalling unneeded   packages - add a mini summary at the end of the output
b6c1d8ce53
Baptiste Daroussin (bapt) · 1.8.6
Release 1.8.6 - Important fixes in the solver - When conflicts are found, they are explicitly printed - Reduce namecache contention a bit - Temporary files created during extraction are now hidden - Accept symlinks to directories when pkg is expecting a directory
80871d0e41
Baptiste Daroussin (bapt) · 1.8.5_1
Fix pkg upgrade -f
d7f63035c7
Baptiste Daroussin (bapt) · 1.8.5
Release 1.8.5 Changes: - Fix mirror_type: http with https servers - Fix regression in the solver that tries to reinstall reverse deps sometime
f8a8451d63
Baptiste Daroussin (bapt) · 1.8.4_1
Add a patch to fix grabbing mirror lists over https

Note that people are using mirror_type: http when they should not
most probably due to bad documentation on our side so we will improve that later

mirror_type: http is only useful if you actually host multiple mirror of your
repos see pkg-repository(5).
2c20fde739
Baptiste Daroussin (bapt) · 1.8.4
Update to 1.8.4 Changes: - Fix: setting date on system not POSIX 2008 compliant (like FreeBSD 8) - Fix: running pkg in env where the 0 file descriptor is closd - Fix: make http mirror type respect the specified port - Fix: chown/chmod on linux - Fix: pkg ssh - Improved upgrade chain in multi repo environment - Update libucl to latest version
508189966c
Baptiste Daroussin (bapt) · 1.8.3
Update to 1.8.3 Changes: - upgrading/reinstall packages also need to not check the result of the predeinstall script :(
e50957faea
Baptiste Daroussin (bapt) · 1.8.2
Do not check deinstall script results at all except if DEVELOPER_MODE is set

Due to too many bad quality ports, for now we are back in not checking pre/post
deinstall scripts at all except if DEVELOPER_MODE=yes is set, we hope to readd
those checks once the ports have been fixed
60d910a9c9
Baptiste Daroussin (bapt) · 1.8.1
Update to 1.8.1 Changes: - Fix double free in pkg updating - Drop failures on POST-DEINSTALL (still too many failures in ports there :()
db527ddf9d
Baptiste Daroussin (bapt) · 1.8.0
Release pkg 1.8.0

New features:
- new vital flag that prevent from removing a package with pkg delete when not specifying -f
- upgrade process now has atomicity per packages meaning now we can safely check the return of the pre* scripts
- handle ctrl-c during upgrade/install/update
- solver improvements
- pkg clean now runs in a capsicum sandbox on supported plateforms

Changes:
- pkg delete now fails if one tries to delete it (the pkg package) without -f. Before it was just warning and skipping it
- pkg install --from-root has been renamed pkg install --recursive to avoir confusion

Fixes:
- correctly handle hardlinked setuid files
- better handling of setuid
- fix elf analysis when some bad libraries have SONAME specified by empty
- fix elf analysis when a binary provides elf_notes but not the expected ones and are still valid freebsd binaries
  (this fixes the case when libgdk_pixbuf was not found as a provided lib on i386)
- NAMESERVER option is now working again and inputs are better checked
- lots of bug fixes: potential leaks mostly
e55afefa90
Baptiste Daroussin (bapt) · 1.7.2
Update to 1.7.2

Changes:
- Update libucl to latest version which fixes an issue with empty pkg.conf (regression test added)
- pkg install on an already installed package returns 0 again this regression was introduced when fixing pkg lock (regression test added)
ec0aae92aa
Baptiste Daroussin (bapt) · 1.7.1
Update to 1.7.1

This release fixes regressions:
- detection of new version of pkg could fail
- if the all process operation would have an inpact of less than 1MB on the FS
  then the action is proceed with out asking the user to acknowledge it
95792e97da
Baptiste Daroussin (bapt) · 1.7.0
Update to pkg 1.7.0 Changes: - Support new "vital" notion: prevent from implicit deletion - Improved support for OpenBSD/bitrig (still lacks some functions in libc) - Improved ZSH completion - Updated libucl - Lots of fixes in error messages - Fixed "pkg lock" handling - Allow to specify "inline" respositories in pkg.conf - ipv6 fixes - Allow to restrict the accepted url schemes - More commands su
5f4b8f7e80
Bryan Drewery (bdrewery) · 1.6.4_1
Add missing patch for r409562
da7ab928ba
Baptiste Daroussin (bapt) · 1.6.4_1
Add a patch to fix hardlink installation pkg 1.6.5 is on its way but requires more testing
255a33dd69
Baptiste Daroussin (bapt) · 1.6.4
Update to 1.6.4 Changes: - Fix hardlinks extraction with --rootdir - Relax url scheme acceptance to allow file:/ and file:// - Accept pkg+ for url scheme where it was never intended to be used, because users used it anyway - Remove pkg-message
bd61a67da2
Baptiste Daroussin (bapt) · 1.6.3
Update to 1.6.3 Changes: - Allow to limit the valid url scheme in pkg.conf - Add support for SOURCE_DATE_EPOCH: https://reproducible-builds.org/specs/source-date-epoch/ - Fix pkg check -d - Fix testsuite with kyua 0.12 - Fix completion on pkg info -l - Reduce te probability to get an infinite loop on pkg version check - Fix pkg version -q - Update libfetch to the latest version from head - Debug m

Note that this release will be merged to quarterly branch in 10 days
e13581d0d9
Baptiste Daroussin (bapt) · 1.6.2
Update to 1.6.2 Changes: - Fix cross building - Improved zsh completion - Improved error messages - Improved documentation - Bug fixes in the solver - Allow to specify repositories directly via pkg.conf - Allow multiple version of the same package in a repository - Fix ipv6 testing in configuration
7878a5ea8e
Baptiste Daroussin (bapt) · 1.6.1_2
Seems like there is no place for humour :(

Requested by:	many
a89f3b5d08
Ryan Steinmetz (zi) · 1.6.1_1
- Add bapt-get symlink - Bump PORTREVISION

Approved by:	portmgr (bapt)
edc9841089
Baptiste Daroussin (bapt) · 1.6.1
Release pkg 1.6.1 Changes: - Fix a regression in performance when listing files [1] - Remove references to EOLed FreeBSD version in manpages
f3b3f6076a
Baptiste Daroussin (bapt) · 1.6.0
Release pkg-1.6.0 Changes since pkg-1.5 series - Lots of improvements in the solver (in particular fixes the case like the   recent jpeg upgrade) - Lots of fixes in the 3 way merge code - pkg add can now work without a version specified in the dependency line - pkg check -d now also check the required libraries - Improved support for partial upgrades - Improved zsh completion support - Improved li
0a0888440f
Mathieu Arnold (mat) · 1.5.6
Remove UNIQUENAME and LATEST_LINK.

UNIQUENAME was never unique, it was only used by USE_LDCONFIG and now,
we won't have conflicts there.

Use PKGBASE instead of LATEST_LINK in PKGLATESTFILE, the *only* consumer
is pkg-devel, and it works just fine without LATEST_LINK as pkg-devel
has the correct PKGNAME anyway.

Now that UNIQUENAME is gone, OPTIONSFILE is too. (it's been called
OPTIONS_FILE now.)

Reviewed by:	antoine, bapt
Exp-run by:	antoine
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D3336
21a283f3be
Baptiste Daroussin (bapt) · 1.5.6
Update to pkg 1.5.6 Changes: - Incorporate in sources the patch for expat CVE-2015-1283   Note that pkg is not vulnerable because it does not use the patched function - improvements in pkg check manpage - fix format specifier in libpkg's pkg_vets
5408cac7ef
Baptiste Daroussin (bapt) · 1.5.5
Release pkg 1.5.5 Changes: - Manpages updates - Add a random delay to pkg-audit when invoked without a TTY - Update zsh completion - Add a new AUTOCLEAN option to automatically clean the cache directory - Don't attempt to set file ownership when INSTALL_AS_USER is set - Add a new configuration item to define custom HTTP User-Agent - Fix an integer overflow when displaying package size for packages
61ccdb94ea
Baptiste Daroussin (bapt) · 1.5.4
Update to 1.5.4

Changes:
- Fix partial upgrades
- pkg create -v now ticks (print does on a regular basis) if not on a tty
- Fix vuxml url in sample configuration
- zsh completion improvements
febc0cf608
Baptiste Daroussin (bapt) · 1.5.3
Update to 1.5.3 Changes: - Updates in manpages - Improved support for --quiet everywhere - Keep 7 (by default) days (rotation) of backups of the database - Prune old style backups entirely - Do not pushed in shlibs required any library we can find in the list of files   owned by the package
c0a105285e
Baptiste Daroussin (bapt) · 1.5.2
Update to 1.5.2 Changes: - Documentation updates - Make pkg alias -l respect quiet - Reinstall packages if shlib provided has changed - Do not expose shlibs without SONAME as provided libs - Fix pkg audit -r formatting - Stop elf analysis sooner if not operating on an elf file - Fix checking signatures on arm
aa69fca2a3
Baptiste Daroussin (bapt) · 1.5.1
Update to 1.5.1 Changes: - Fix pkg ssh:// - Fix a missing '\n' in pkg audit - Fix compat at functions to not mess up with cwd
e78a6af418
John Marino (marino) · 1.5.0
ports-mgmt/pkg: Regenerate EXTRA_PATCHES (unbreaks DragonFly)

The patch target will fail if EXTRA_PATCHES is defined, but it is
only defined on DragonFly (change is no-op for FreeBSD)

Approved by:	Just fix it
aadfeb0da6
Bryan Drewery (bdrewery) · 1.5.0
Let WITH_CCACHE_BUILD work on the pkg port that is not PKG_ORIGIN.

For example, if ports-mgmt/pkg is PKG_ORIGIN then it is safe to use
ccache for ports-mgmt/pkg-devel.
ea5adfb8f1
Baptiste Daroussin (bapt) · 1.5.0
Update to 1.5.0 Changes since pkg 1.4.0: - Initial provides/requires support - Lots of new regression tests have been added - Initial support for OS X - Initial support for NetBSD/EdgeBSD - Update most of the bundled third party software has been updated to their   latest version - Improve the messages reported by pkg - Properly support file flags - Implement argument support for custom keywords -

Thanks to all testers and contributors,
27b1e9e432
Baptiste Daroussin (bapt) · 1.4.12
Pass maintainership to pkg@
e21fae5c5d
Baptiste Daroussin (bapt) · 1.4.12
Release pkg 1.4.12: - Fix a bug that can generate an unlinkat issue on dragonfly
3c3b3a32c6
Baptiste Daroussin (bapt) · 1.4.11
Release 1.4.11 Changes: - show repository priority in pkg -vv - document pkg_repo_priority() in pkg_repos(3) - fix a bug handling chflags on systems without chflagsat reported on dfly but   might also affect FreeBSD 8 and 9 even if no bugs were reported yet [1]

[1] Special thanks goes to Dillon for removing the dirt our of my eyes and
spotting the bug, Antonio Huete Jimenez (tuxillo) for testing and tracking the
bug since it has been spotted on dragonfly
d8b3fe2296
Baptiste Daroussin (bapt) · 1.4.10
Update to 1.4.10 and 1.4.99.10 - Fix a regression causing bus error

Reported by:	marino
e6d0c7f821
Baptiste Daroussin (bapt) · 1.4.9
Update pkg to 1.4.9 Update pkg-devel to 1.4.99.9 Changes: - Fix regression introduced in 1.4.8 [1] - Document pkg set -n - add pkg alias

Reported by:	mandree [1]
4617df4fba
Baptiste Daroussin (bapt) · 1.4.8
Update to 1.4.8 Changes: - Tons of resources leak plugged (thanks coverity) - Fix size calculation output - Fix 'pkg add -M -' - Update libucl to latest version - Improve documentation
4b43394ffe
Baptiste Daroussin (bapt) · 1.4.7
Release 1.4.7: Changes: - pkg updating now support case insensitive matching - pkg_printf(3) support %x (so print the size of the package tarball) - Use SI symbols (MiB instead of MB) - When using procctl on an older kernel that does not implement the reaper functionnality, be explicit about the failing syscall. - Lofs of fixes on the chflags handling
de9b9ec948
Baptiste Daroussin (bapt) · 1.4.6
Release 1.4.6 Fix a last minute regression
2f45dcbc07