CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

ports-mgmt/pkg 2.8.4

Package manager

Port info

Maintainer
pkg@FreeBSD.org
Packages
latest: 2.8.4
Upstream
up to date
Last update
to 2.8.4 · 7e1abc7fc9
Quarterly
2026Q4: 2.8.4
Formerly
security/base-audit until 2022-07-17
WWW
https://github.com/freebsd/pkg
Links
cgit · VuXML

Install

Package
# pkg install pkg
installs 2.8.4 from latest; from quarterly (2026Q4) 2.8.4
Port
# cd /usr/ports/ports-mgmt/pkg && make install clean
# make -C /usr/ports/ports-mgmt/pkg config  # change options first
Size
13 MiB download · 52 MiB installed
Depends on
nothing
License
BSD2CLAUSE
Options
1 of 1 on in the package: DOCS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.8.42.8.4–
FreeBSD 152.8.42.8.4–
FreeBSD 142.8.42.8.42.8.4

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.8.42.8.4–
FreeBSD 142.8.42.8.42.8.4

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 2.8.4.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (34) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297757maintainer-feedback? ports-mgmt/pkg: pkg query for list variables produces output on empty listsNew2026-08-22
297065maintainer-feedback? ports-mgmt/pkg: pkg-2.8.1: pkg update -r FreeBSD-ports creates the db file with a size of 1.6 Giga(!)bytesNew2026-08-10
297219maintainer-feedback? ports-mgmt/pkg: 'pkg upgrade' lists all locked packages every time despite no updates being available for themNew2026-08-01
296272maintainer-feedback? ports-mgmt/pkg: does not autoremove automatic, non-vital, leaf packagesNew2026-06-25
296168ports-mgmt/pkg: pkg fetch -d fails to download pkgbase dependenciesNew2026-06-21
Show all 34
PRSummaryStatusChanged
295672ports-mgmt/pkg: "getgrnam_r(wheel): Result too large" with many users in wheelNew2026-05-30
280345maintainer-feedback? ports-mgmt/pkg: pkg segfault when OpenSSL legacy provider is enabledNew2026-05-28
295353maintainer-feedback? ports-mgmt/pkg: does not show a dependency for a package, but removing it wants to remove many others; autoremove trying to remove a manually installed packageIn Progress2026-05-18
295312maintainer-feedback? ports-mgmt/pkg: pkg upgrade: 'these portts to be upgraded; y/n and lists; NEED OPTION to list partially at firstNew2026-05-15
186497ports-mgmt/pkg: local overrides for pkg auditIn Progress2026-04-24
294685regression maintainer-feedback? ports-mgmt/pkg: regession, pkg 2.7 does not honour http_proxy from pkg.conf any moreNew2026-04-24
294639maintainer-feedback? ports-mgmt/pkg: Defaults to case sensitiveNew2026-04-20
294656maintainer-feedback? ports-mgmt/pkg pkg audit fails to validate certificateNew2026-04-20
287989maintainer-feedback? ports-mgmt/pkg: packages version recognizing errorIn Progress2026-04-11
291200maintainer-feedback? ports-mgmt/pkg periodic script weekly/400.status-pkg uses a wrong pkg -R optionNew2026-03-18
229393maintainer-feedback? ports-mgmt/pkg: Show which options changed if upgrade neededIn Progress2025-10-26
219036maintainer-feedback? ports-mgmt/pkg: pkg confused, installs older version over newerOpen2025-10-26
270547maintainer-feedback? ports-mgmt/pkg: missing information about security vulnerabilities in system componentsOpen2025-10-26
290322maintainer-feedback? ports-mgmt/pkg build failed: can't apply patchNew2025-10-17
267657needs-qa regression maintainer-feedback+ maintainer-feedback? merge-quarterly? ports-mgmt/pkg upgrade prompts to install if package is missingIn Progress2025-09-14
288973ports-mgmt/pkg pkg-delete - SYNOPSIS is missing -f optionNew2025-08-20
288702maintainer-feedback? ports-mgmt/pkg v2.2.2, pkg-fetch synopsis missing '-o' optionNew2025-08-07
285490maintainer-feedback? ports-mgmt/pkg: pkg upgrade unexpectedly installs uninstalled, non-dependency packageNew2025-08-04
284538maintainer-feedback? ports-mgmt/pkg: The option '-o' in command versionNew2025-07-01
287437maintainer-feedback? ports-mgmt/pkg: "pkg help query" says nothing about flavorsNew2025-06-11
286107maintainer-feedback? ports-mgmt/pkg: improvement request: only install files whose checksum have changedNew2025-05-16
283755maintainer-feedback? ports-mgmt/pkg: pkg-upgrade(8) - version comparison new kernel modules ("kmods") failureNew2025-05-15
285197maintainer-feedback? ports-mgmt/pkg - v.2.0.6 - pkg-upgrade and pkg-version fail using multiple repositoriesNew2025-03-06
245667feature ports-mgmt/pkg: Determine ports branch of active pkg repoNew2025-01-25
284263maintainer-feedback? ports-mgmt/pkg: [1.21.3] --raw-format is broken when multiple packages are suppliedNew2025-01-22
249374maintainer-feedback? ports-mgmt/pkg: 1.15.4 cannot unroll hard links to copiesNew2024-08-31
275053maintainer-feedback? ports-mgmt/pkg periodic jobs do not play well with readonly mounted filesystemsNew2023-11-13
194689easy feature needs-patch ports-mgmt/pkg: pkg needs a stand-alone equivalent to portupgrade's "pkg_sort".Open2021-10-14
218159ports-mgmt/pkg: pkg -r fails to run post install script.In Progress2020-05-11

Commits (349)

Baptiste Daroussin (bapt) · 1.0.3_1
Add a patch to bump the version output bump by pkg -v this was forgotten in the last release

Feature safe:	yes
93a80fc8aa
Baptiste Daroussin (bapt) · 1.0.3
- update to 1.0.3 - changes:   * Accept to query _https._tcp srv records   * Fix diskspace change calculation in pkg upgrade   * Fix pkg info -s -F apackage   * Better ABI determination   * Fix pkg upgrade badly returning 0 in case of failure   * Fix build with recent clang 3.2

Feature safe:	yes
6ad5396a43
Baptiste Daroussin (bapt) · 1.0.2
- update to 1.0.2 - changes:   * Add a completion for zsh   * 1 in pkg.conf is consider as true or yes for booleans   * Fix incremental pkg repo   * Provide a pkgconf pkg.pc file for third party software using libpkg   * Multiple grammar fixes   * Several fixes in pkg create   * Do not emit error if the deletion of a directory fails with EBUSY   * Use isdigit(3) rather than isnumber(3)   * Jail su

Feature safe:	yes
310cd31280
Baptiste Daroussin (bapt) · 1.0.1
Mark as not ccache safe

Reported by:	Piotr Kubaj <pkubaj@gmail.com>
a90808a87f
Baptiste Daroussin (bapt) · 1.0.1
- update to 1.0.1 - changes:   * Allow extra space for environment and command when piping to /bin/sh for scripts   * Improved DEVELOPER_MODE output   * Error when neither www or desc is defined in the manifest   * pkg help now have the same level of informations as usage()   * Lots of fixes in manpages   * Only try to get checksum on regular files   * pkg2ng: Preserve files under $PKG_DBDIR that
7f590f9ad9
Baptiste Daroussin (bapt) · 1.0
Mark as job safe

Submitted by:	Adam McDougall <mcdouga9@egr.msu.edu>
219c41c8e9
Baptiste Daroussin (bapt) · 1.0
- update to 1.0 - changes:   * SRV mirroring is on by default   * fix large scripts executions   * pkg check -d now installed packages tags as automatic   * performance improvements
72e4b80c71
Bryan Drewery (bdrewery) · 1.0.r6_1
- Fix crash when no PACKAGESITE is defined in pkg.conf

Approved by:	bapt (mentor, maintainer)
e73d68fc73
Pietro Cerutti (gahr) · 1.0.r6
- Fix prompt sign in pkg-message, pkg2ng must be run as root

Approved by:	bapt (portmgr)
34270a1982
Baptiste Daroussin (bapt) · 1.0.r6
- update to 1.0-rc6 - changes:   * pkg query now fails if no format strings has been provided   * pkg delete pkg is no more allowed expect if -f is specified   * large improvements on pkg backup/restore interface   * do not propose to downgrade dependencies expect if forced to   * every script execution now uses posix_spawn(3)   * this abi is now check on pkg update, if a remote repository does no
710d4251be
Baptiste Daroussin (bapt) · 1.0.r5_1
Fix a regression appending newline to commments

Reported by:	avilla
80a49985ce
Baptiste Daroussin (bapt) · 1.0.r5
- update to 1.0-rc5 - changes:   * speed improvements in pkg repo on multi core boxes   * fix pkg upgrade proposing to downgrade dependencies   * fix pkg2ng losing seom origin from dependencies   * fix losing new line informations in descriptions   * new -A option to track a new installation as automatically installed
8cf9526831
Baptiste Daroussin (bapt) · 1.0.r4_1
add a fix to pkg2ng preventing losing track of some dependency origins leading to a failure of the conversion.

Reported by:	Pierre Guinoiseau (via gitub issue #314)
Tested by:	Pierre Guinoiseau
db838cc82a
Baptiste Daroussin (bapt) · 1.0.r4
- update to 1.0-rc4 - changes:   * Fix reinstalling package due to options change losing automatic flag   * Fix pkg set -o   * do not use dlopen for figure out path of libraries to track shlibs   * more manpages cleanup
79769610e4
Baptiste Daroussin (bapt) · 1.0.r3
- update to 1.0-rc3 - changes:   * fix bug corrupting automatic and licenselogic flags   * some mdoc fixes   * fix a new dependencies pulled by upgrade showed as reinstalling instead of     installing   * some fixes in repo generations
26bc5ba5b1
Baptiste Daroussin (bapt) · 1.0.r2
- update to 1.0-rc2 - changes:   * fix an important bug on script handling resulting in scripts runned sometime     twice   * time can no more be negative while fetching   * fix a crash on pkg check   * fix an infinite retry loop when fetching a file that return 404   * emit a warning when search gives no results
d08b26f7dd
Baptiste Daroussin (bapt) · 1.0.r1
- update to 1.0 rc1 - changes:   * schema for remote repositories are versionned   * fix ordering of scripts   * ability to query SRV dns records for automatic mirror detection (ala     portsnap/frebsd-update) via the SRV_MIRROR options default to off   * new FETCH_RETRY options (default to 3)   * more style(9) compliance of the code   * lots of cleanup in exits codes   * lots of typos fixes in ma

No new feature to expect in next releases, only bug fixes
New feature will be for 1.1 (already planned :))
fd554fce86
Baptiste Daroussin (bapt) · 1.0.b17_1
Fix alignement error making pkg repo segfaul on i386

Reported by:	gjb, Ivan Klymenko <fidaj@ukr.net> (via ports@)
Tested by:	gjb
Obtained from:	pkgng git repository
0c571441dc
Baptiste Daroussin (bapt) · 1.0.b17
fix distinfo (sorry I commit the wrong one before)
6fe34aef3c
Baptiste Daroussin (bapt) · 1.0.b17
- update to 1.0 beta17 - changes:   * downgrading is always forbidden except if you explicitly force it   * yet another fix for incremental pkg repo   * pkg install/upgrade now detect ports which remote has different option set     and propose to reinstall them   * code refactoring, and improvement in pkgdb.c and pkg_repo.c   * new -f options for pkg update   * new -f and -q options for pkg repo
7db30eeb77
Baptiste Daroussin (bapt) · 1.0.b16
Really fix build on 8-stable and 9-stable No revision bump because no changes but allowing building when it failed

Obtained from:	pkgng git (Bryan Drewery)
9e3a60e39e
Baptiste Daroussin (bapt) · 1.0.b16
- update to 1.0-beta16 - changes:   * fix incremental pkg repo   * fix stage directory (copy mode) support   * improvements on documentation (man pages, error messages)   * new ARCH_INDEP options in developper mode to allow notifying a maintainer     that a port might be archiecture independant   * fix compilation on recent 8-stable and 9-stable   * improvemens is usage() output   * new option POR

Thanks to all contributors
4f79580b23
Baptiste Daroussin (bapt) · 1.0.b15_3
- Fix pkg2ng with new options framework
4ed25952f9
Baptiste Daroussin (bapt) · 1.0.b15_2
Backout reproducible packages.

pkgng tried since beta14 to create reproducible package: aka 1 package build
twice will get exactly the same checksums, this revealed some problem with
python that were workaround in beta15 but lots of build system seems to really
not approciate it, while the feature is good and might be reactivated in the
futur, the ports tree and upstream build systems, need a lot of work to be able~
to deal with 100% reproducible packages :(
a5d3bde5f9
Koop Mast (kwm) · 1.0.b15_1
Add pkg-remove.8 to MLINKS.

Approved by:	portmgr (bapt@)
c8e790e8a0
Baptiste Daroussin (bapt) · 1.0.b15
- update to 1.0-beta15 - changes:   - new -d to pkg fetch to download the dependencies along with the package   - fix automatic flag tracking over installs and upgrades   - fix hardlink detection (size calculation of git is now sane again :))   - pkg remove is now an alias to pkg delete   - fix a bug with shlibs track causing segfault   - pkg check -r now updates flatesiz and checksums   - all gen
66ade9c22c
Baptiste Daroussin (bapt) · 1.0.b14_1
- Fix pkg update adding repo.txz twice

PR:		ports/168235
Submitted by:	Andriy Syrovenko <andriys@gmail.com>
27150984d0
Baptiste Daroussin (bapt) · 1.0.b14
- update to 1.0-beta14 - changes:   * new DEVELOPER_MODE option: it will fail instead of just printing warnings   * package creation is now reproductible, the same package built twice will have the same checksum   * pkg install, upgrade and fetch now automatically performs the update of the remote metadata if necessary   * portmaster patch: use_pkgng is not nessecary anymore   * portmaster patch: 

Thanks to all contributors
a1ffe962fd
Baptiste Daroussin (bapt) · 1.0.b13
- update to 1.0-beta13 - changes:   * -a (all) is now befault behaviour of check, query, rquery   * speed up remote repository query   * fix excessive CPU usage on fetching   * improve man pages documentation   * only display filenames on fetching not full url   * fix an important bug on jobs ordering calculation   * lots of bugs fixes
0665269baf
Baptiste Daroussin (bapt) · 1.0.b12
pkg.conf.sample is not a PORTEXAMPLE
65e5ecf448
Baptiste Daroussin (bapt) · 1.0.b12
- update to 1.0-beta12 - changes:   * Fix to be downloaded calculation   * Respected rc.conf with handle_rc_scripts   * Improve man pages   * Fix pkg set -o   * new pkg rquery subcommand, do the same as pkg query but for remote     repositories   * Allow forcing installation of a package even on bad arches   * Add indexes to local database, speed up local queries   * Speed up file loading from dat
0a9194acae
Baptiste Daroussin (bapt) · 1.0.b11_1
Fix bug preventing self upgrade with beta11
3371d462a9
Baptiste Daroussin (bapt) · 1.0.b11
- update to 1.0 beta11 - changes:   * lot's of improvement in man pages documentations   * pkg info and pkg search are now aligned like pkg_info   * pkg search -x is now default   * new pkg shell subcommand, this fires up a sqlite3 shell use with caution   * pkg which gains 2 new options: -q (quiet) -o (origin)   * fix pkg repo incremental   * pkg version can now have -egXx <pattern> options   * w
0938297841
Baptiste Daroussin (bapt) · 1.0.b10
- update to 1.0-beta10 - changes:  * Fix memory corruption  * Fix handle_rc_script when upgrading services are now really restarted  * Report Already installed/Not found when installing packages if any  * when trying to pkg add something that doesn't exists, recommend the user to use pkg install  * Fix abi detection on recent current  * pkg -v report the version, -vv more informaton, -vvv even mor

Feature safe:	yes
16932b8e47
Baptiste Daroussin (bapt) · 1.0.b9_2
fix @ignore handling (fixes nullmailer)

Feature safe:	yes
55654d1b4f
Baptiste Daroussin (bapt) · 1.0.b9_1
Fix plist

Feature safe:	yes
ad624c8fdc
Baptiste Daroussin (bapt) · 1.0.b9_1
- Fix pkg check -ra

Reported by:	gelraen (irc://freenode/#pkgng)
Feature safe:	yes
8f79c9b4f5
Baptiste Daroussin (bapt) · 1.0.b9
- update to 1.0-beta9 - changes:   * query -f has been replaced by query -F when querying a package (file) for consistency with pkg info   * fix autoremove recursion   * pkg set -o oldorigin:neworigin allow the user to modify the origin of a packages (useful for MOVED)   * several fixes on powerpc   * pkg query evaluation expression now accept !=   * pkg2ng is now able to migrate a local database 

Concerning the new ABI, to be able to determine which package can be installed on which destination, pkgng couldn't rely on the simple:
os version/machine, because some arches have incompatible ABIs. Can compute on its own the ABI, the string is the followin:
OSNAME:OSMAJORVERSION:OSARCH:OSCLASS(:...)
... means the arch specific extensions.

which means on:
 * amd64: freebsd:9:x86:64
 * i386: freebsd:9:x86
 * arm: freebsd:9:arm:eb:oabi:softvp
etc

Be careful all the packages (.txz) files have to be rebuilt!!!
When binary upgradeing from pkg beta8, on amd64 do the following:
UNAME_m=freebsd:9:x86:64 pkg install -f pkg

on i386
UNAME_m=freebsd:9:x86:32 pkg install -f pkg

Bonus when run on a chroot/jail where ABI is different from the host, pkgng will dynamically determine the destination ABI.

Feature safe:	yes
0e618fdde0
Baptiste Daroussin (bapt) · 1.0.b8
- update to 1.0-beta8 - changes:  * pkg info -R now show a full yaml (script, options, users and groups were missing in previous versions)  * new pkg query -e <evalutaion> <query-format> to be able to query packages base on boolean expression matching content of the package  * pkg check now works like other subcommand: -a for all, -gxX for (glob, regex, eregex)  * pkg check is now able to check th
16f8237039
Baptiste Daroussin (bapt) · 1.0.b7
- update to 1.0-beta7 - changes:  * move commands man pages from section 1 to 8  * pkg check can now be run as a user (will print the missing dependencies if any)  * better handling of database creation error  * new option -f to install subcommand to force reinstallation of a package  * new option -f to upgrade subcommand to force reinstallation of the whole set of packages  * pkg audit can now ta
355300b9b8
Baptiste Daroussin (bapt) · 1.0.b6
Add forgotten pkg-updating(1) to plist

Submitted by:	George Liaskos <geo.liaskos@gmail.com>
eeeae46582
Baptiste Daroussin (bapt) · 1.0.b6
liblzma in base is needed so only version >= 800505 are supported

Submitted by:	thompsa
f10fbe8c96
Baptiste Daroussin (bapt) · 1.0.b6
- update to 1.0-beta6 - changes:  * pkg register: now run inside a transaction, this speeds up things a lot (thank you avg)  * pkg version: -v now print name-version to match behaviour of legacy pkg_version  * pkg register: fix flatsize calculation  * new pkg-updating(1) man page (thanks beat)
588dc92baa
Baptiste Daroussin (bapt) · 1.0.b5_1
pkg should never register itself as automatic

Tested by:	rene
d866f318b1
Baptiste Daroussin (bapt) · 1.0.b5
- update to beta5 - changes:  * move all the private headers into a private subdirectory to prevent the temptation of using them in the frontend  * fix a miss behaviour in pkg query printing things it shouldn't in case of mistakes
312733baa7
Baptiste Daroussin (bapt) · 1.0.b4
- update to beta4 - changes:  * do not assert in case of unfinished buffer but finish it instead  * more userfriendly error message for pkg audit  * print not found patterns for pkg info and pkg query
4dbdc36625
Baptiste Daroussin (bapt) · 1.0.b3
- update to beta3 - changes:   * fix pkg add (it is been broken during beta2 sorry about that)   * fix manifest emitter: now really emit the pkg-message in message no more description   * add %M to pkg query to show messages   * concat all pkg-messages and show it once at the end of operations   * print messages about missing dependency during pkg add
a4d4ba61b0
Baptiste Daroussin (bapt) · 1.0.b2
- update to 1.0-beta2 - add a message to warn user that they need to migrate using pkg2ng - add a mirror to download - changes:   * update bundled sqlite to 3.7.10   * add -n to pkg create to avoid packing already packed packages   * Fix rc script handling   * safer sbuf usage (this fix ia64 support)   * report a list of failing packages if any with pkg add   * allow "<category>/<port>" pattern in
72250ad7f0
Baptiste Daroussin (bapt) · 1.0.b1
Please welcome pkgng beta1.

if you want to use it please define WITH_PKGNG=yes in your /etc/make.conf
For more information read the announcement on the mailing list

With hat:		portmgr
Non-Regression test:	linimon
df0aa973b9