CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

shells/zsh 5.9.2

The Z shell

Port info

Maintainer
bapt@FreeBSD.org
Packages
latest: 5.9.2
Upstream
up to date
Last update
to 5.9.2 · 587b444789
Quarterly
2026Q4: 5.9.2
Formerly
shells/zsh+euc_hack until 2006-09-01
WWW
https://www.zsh.org/
Links
cgit · VuXML

Install

Package
# pkg install zsh
installs 5.9.2 from latest; from quarterly (2026Q4) 5.9.2
Port
# cd /usr/ports/shells/zsh && make install clean
# make -C /usr/ports/shells/zsh config  # change options first
Size
5.0 MiB download · 20 MiB installed
Depends on
nothing
License
ZSH
Options
2 of 7 on in the package: DOCS EXAMPLES
Show the 5 options that are off
DEBUG ETCDIR GDBM PCRE STATIC
pkg-message
Shown after installing
==========================================================

By default, zsh looks for system-wide defaults in
/usr/local/etc.

If you previously set up /etc/zprofile, /etc/zshenv, etc.,
either move them to /usr/local/etc or rebuild zsh with the
ETCDIR option enabled.

==========================================================

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 165.9.25.9.2–
FreeBSD 155.9.25.9.2–
FreeBSD 145.9.25.9.25.9.2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 155.9.25.9.2–
FreeBSD 145.9.25.9.25.9.2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 5.9.2.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (4) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
287149maintainer-feedback? shells/zsh: does not clean temporary files anymoreNew2025-05-29
278380maintainer-feedback? shells/zsh: Consider making PCRE=on the defaultNew2024-10-10
278817maintainer-feedback? shells/zsh: HTML documentation is mostly missingNew2024-05-06
269292maintainer-feedback? shells/zsh fails to reset tty state on TMOUTNew2023-02-02

Commits (277)

Baptiste Daroussin (bapt) · 5.9.2
shells/zsh: update to 5.9.2
587b444789
Baptiste Daroussin (bapt) · 5.9.1
shells/zsh: update to 5.9.1

While here switch from pcre to pcre2
Add a patch to support new RLIMITS_PIPEBUF[1] and RLIMITS_VMS
Remove patch which has been upstreamed

PR:		282487 [1]
Submitted by:	Martin Birgmeier <d8zNeCFG@aon.at> [1]
b38e6345c3
Lexi Winter (ivy) · 5.9_5
shells/zsh: Add Functions/VCS_Info to SHEBANG_FILES

Otherwise, the build fails when LOCALBASE is set to a non-default value.

PR:	288748
Approved by:	maintainer (timeout, > 30 days), arrowd (ports)
Reviewed by:	arrowd
Differential Revision:	https://reviews.freebsd.org/D52640
726649e043
Baptiste Daroussin (bapt) · 5.9_5
shells/zsh: add completion for mdo(1)
ef64775074
Muhammad Moinur Rahman (bofh) · 5.9_4
shells/zsh: Impelled to share/man

Approved by:    portmgr (blanket)
719515af28
Brad Davis (brd) · 5.9_3
shells/zsh: Fix build with DOCS option off and base system WITHOUT_DOCS

PR:		274713
Reviewed by:	garga
Approved by:	maintainer timeout
Sponsored by:	Rubicon Communications, LLC ("Netgate")
dcf26c53ab
Baptiste Daroussin (bapt) · 5.9_2
shells/zsh: cache the utx.active location

On fresh jails or chroot the /var/run/utx.active might not exist (like
in poudriere for example) but configure script is looking for its
existance to determine its existance and activate the build of the
utmx logging feature internally.

Caching it makes the configure script always build the logging features.

While here, make ZSH_VER use the distversion, which fixes the usecase of
building snapshots of zsh via the port.

PR:	268714
Reported by:	okiddle@yahoo.co.uk
ea5eba5c4d
Stefan Eßer (se) · 5.9_1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 5.9_1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Baptiste Daroussin (bapt) · 5.9_1
shells/zsh: remove the MEM option

Remove the option allowing to use zsh memory allocator, it is only
useful for zsh developers who won't use the port anyway.

PR:	259997
d278243809
Baptiste Daroussin (bapt) · 5.9
shells/zsh: remove the modification of the configure script

We used to modify the configure script to avoid zsh to link against
librt because clock_gettime on FreeBSD is in libc not librt.

It's been a while that we are configuring zsh with the --as-needed
linker flag which means now even if -lrt is passed we will not end
up linked to it librt anymore.

besides, modifying the configure script at the patch phase makes it
newer than stamp.h.in which results in the build system triggering a
regeneration of itself (hence the USES= autoreconf we had), not
touching anymore that script can remove the need for USES=autoreconf
and the load if build dependencies it drags in

Removing the USES=autoreconf highlights also the lack of build
dependency on perl which is needed to be able to the help files for
 run-help to work on builtins. this is fixed now
ede4dd7610
Tobias C. Berner (tcberner) · 5.9
shells: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Andreas Kohn <andreas@syndrom23.de>
  *  Carlos Jacobo Puga Medina <cpm@FreeBSD.org>
  *  Cyrille.Lefevre@laposte.net
  *  Danijel Tasov <danielt@pilgerer.org>
  *  David O'Brien <obrien@NUXI.com>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Hajimu UMEMOTO <ume@FreeBSD.org>
  *  Igor Pokrovsky <ip@unixway.org>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Kai Wang <kaiw27@gmail.com>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Nobuhiro Yasutomi <nobu@psrc.isac.co.jp>
  *  Oliver Eikemeier
  *  Patrick Gardella <patrick@FreeBSD.org>
  *  Pawel Pekala <pawel@FreeBSD.org>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Richard Rose <freebsd-security@rikrose.net>
  *  Sean Chittenden <seanc@FreeBSD.org>
  *  Sergey Matveychuk <sem@FreeBSD.org>
  *  Serhii (Sergey) Kozlov <skozlov@FreeBSD.org>
  *  Shinsuke Matsui <smatsui@karashi.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  UMENO Takashi <umeno@rr.iij4u.or.jp>
  *  Vaida Bogdan
  *  Will Andrews <andrews@technologist.com>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  conrads@cox.net
  *  erich@rrnet.com
  *  gebhart@secnetix.de
  *  kirk@strauser.com
  *  mcglk@artlogix.com
  *  torstenb

With hat:	portmgr
c3cc2da090
Baptiste Daroussin (bapt) · 5.9
shell/zsh: remove unnneeded patch

files/extra-patch-Src_Modules_curses__keys.awk is no longer needed
and broke patch phase if ports ncurses is installed.

The patch is already incorporated upstream, so doesn't apply.
fd6622942c
Baptiste Daroussin (bapt) · 5.9
shell/zsh: update to 5.9

Stop supporting case with both utmp.h and utmpx.h the changed happened
more than 10 years ago
e58369caf5
Baptiste Daroussin (bapt) · 5.8.1
shells/zsh: update to 5.8.1

MFH:            2022Q1
Security:       CVE-2021-45444
128eec0da7
Yasuhiro Kimura (yasu) · 5.8
shells/zsh: Revert "shells/zsh: Add BASE_ZSH option"

This reverts commit ae1787aab23e44e369dbb0cc814e8318c6f86e0d.

Requested by:	maintainer
defd64ec3c
Yasuhiro Kimura (yasu) · 5.8
shells/zsh: Add BASE_ZSH option

Add new option BASE_ZSH that makes zsh and rzsh also available as
/bin/zsh and /bin/rzsh.

Under ports flamework everything is installed under /usr/local unless
custom prefix is used. And according to it zsh is installed as
/usr/local/bin/zsh. But on most Linux based OSes zsh is installed as
/bin/zsh. And it causes problem if user's account information is
shared between FreeBSD and Linux by using such tools as LDAP or NIS as
account information also includes absolute path of user's login shell.
To work around it I have created /bin/zsh as symbolic link referencing
/usr/local/bin/zsh and also edited /etc/shells to add /bin/zsh to it
every time I set up new FreeBSD system. But it's quite bothersome and
that is why I add new BASE_ZSH option.

While I'm here,

* Pet portclippy
* Re-format Makefile with portfmt

PR:		259109
Proposed by:	Chris Hutchinson (more intuitive option name)
Approved by:	maintainer timeout (> 2 weeks)
ae1787aab2
Bernhard Froehlich (decke) · 5.8
shells/zsh: Add CPE information

Approved by:	portmgr (blanket)
de4d421d74
Mathieu Arnold (mat) · 5.8
Remove # $FreeBSD$ from Makefiles.
305f148f48
Mateusz Piotrowski (0mp) · 5.8
Switch to USES=localbase:ldflags

Approved by:	portmgr blanket
87fe7293c3
Fukang Chen (loader) · 5.8
shells/zsh: Fix build with devel/ncurses 6.2

When devel/ncurses is installed in the system, the Zsh configure script
detects and uses ${LOCALBASE}/include/ncurses/ncurses.h instead.

The patch is obtained from this commit:
https://sourceforge.net/p/zsh/code/ci/c6a85163619ed1cee89ab047a0d98108ed46828d/

cc -c -I. -I../../Src -I../../Src -I../../Src/Zle -I. -I/usr/local/include -DBOOL_DEFINED -DLIBICONV_PLUG -DHAVE_CONFIG_H -DMODULE -O2 -pipe  -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -fPIC -o curses..o curses.c
In file included from curses.c:210:
./curses_keys.h:93:15: error: use of undeclared identifier 'KEY_EVENT'
    {"EVENT", KEY_EVENT},
              ^
1 error generated.
*** Error code 1

Reviewed by:	koobs
Approved by:	koobs (ports, mentor)
Differential Revision:	https://reviews.freebsd.org/D26355
MFH:		2020Q3 (build fix)
ba1c6ab949
Baptiste Daroussin (bapt) · 5.8
Update to 5.8

Fix sites-functions not respecting PREFIX != LOCALBASE
Don't document the security issue CVE-2019-20044 as it does not
impact FreeBSD
6a601648bc
Tobias Kortkamp (tobik) · 5.7.1_1
shells/zsh: Spell PORTREVISION correctly
49b3d39d73
Baptiste Daroussin (bapt) · 5.7.1
Only show the pkg-message on installation, never do it on upgrades
a82adb747b
Baptiste Daroussin (bapt) · 5.7.1
Update to 5.7.1
4377815d68
Sunpoet Po-Chuan Hsieh (sunpoet) · 5.7_1
Update MASTER_SITES and WWW

Approved by:	portmgr (blanket)
7e6ea4bcad
Baptiste Daroussin (bapt) · 5.7_1
Add a patch to fix an infinite recursion when using VCS_info

Reported by:	ume
3f35201af5
Baptiste Daroussin (bapt) · 5.7
Commit forgotten patch:

Mandoc was not able to find zshbuiltin.1 in the path
2bf3dda12b
Baptiste Daroussin (bapt) · 5.7
Update to 5.7
2c706b0257
Alexey Dokuchaev (danfe) · 5.6.2_1
Update `databases/gdbm' to version 1.18.1, an important bugfix release which restores compatibility with old databases (version 1.8) and some later versions which were built without mmap(2) support.  Due to shlib version change, bump port revisions of the consumer ports.

PR:		233059
Exp-run by:	antoine
Approved by:	maintainer (johans, numerous timeouts)
936a36e30d
Baptiste Daroussin (bapt) · 5.6.2
Update to 5.6.2
4502331122
Baptiste Daroussin (bapt) · 5.6.1
update to 5.6.1
915eeb1c3a
Baptiste Daroussin (bapt) · 5.6
Update to 5.6

Security:	CVE-2018-0502, CVE-2018-13259
fb9b05a4f3
Baptiste Daroussin (bapt) · 5.5.1
Update to 5.5.1
46aa5e2216
Baptiste Daroussin (bapt) · 5.5
Update to zsh 5.5

Patch broken linux completion so that zcompile can actually compile it
Remove now useless patch for libarchive
ef403b13f3
Baptiste Daroussin (bapt) · 5.4.2_1
Fix diff -u completion

PR:		222420
Submitted by:	cy
0231318963
Baptiste Daroussin (bapt) · 5.4.2
Update to 5.4.2
b48b7be696
Baptiste Daroussin (bapt) · 5.4.1
Due to some timestamp issue zsh may need autoheader at build time Let's renegerate the autotools part to be safe

Reported by:	jrm
687975d2f0
Baptiste Daroussin (bapt) · 5.4.1
Update to 5.4.1
c377bbb4c7
Dag-Erling Smørgrav (des) · 5.3.1_1
Fix bug in kldload completion (also reported upstream).

Approved by:	bapt@
3d7c7f2ece
Baptiste Daroussin (bapt) · 5.3.1
Update to 5.3.1
f93e01db48
Baptiste Daroussin (bapt) · 5.3_1
Fix typo in chflags completion

Reported by:	adamw
d464887e15
Baptiste Daroussin (bapt) · 5.3
Update ZSH to 5.3

Among the usual bugs fixes and completion updates, FreeBSD users will now
benefit new completion functions for:
- cu
- gstat
- jot
- rcctl
- sysrc
b050d07493
Baptiste Daroussin (bapt) · 5.2_4
Fix make and gmake completion

Submitted by:	Daniel Shahaf (on zsh mailing list)
Reported by:	Guilherme Salazar (on zsh mailing list)
f121cb0019
Baptiste Daroussin (bapt) · 5.2_3
Grab back maintainership on zsh

Approved by:	adamw
87a41e614d
Adam Weinberger (adamw) · 5.2_3
Sort a few OPTIONS helpers
e45ae6d6db
Adam Weinberger (adamw) · 5.2_3
Reorganize, simplify, and improve the Makefile.

A couple options changes:
The MAILDIR and SECURE_FREE knobs were both removed and switched to
always-on. Having maildir support does not preclude mbox support, so
there's no reason not to include it for everybody. The secure-free
run-time free() safety check is good practice and is a mandatory default
on a number of other OS's, so now it's enabled for all zsh here as well.

PORTREVISION bump for the above changes.

The rest of the changes are simplifications, and reorganizing things to
be more legible. An EXTRA_PATCHES that was being applied unconditionally
was converted to a normal files/patch-, and I added in some comments
on things I got confused by.

While here, I also rewrote the descr to better describe what Zsh is
in relation to other shells. I also removed

	"See also zshcompsys(1) manpage. :)"

Not even a smiley face can undo the pain of trying to read zshcompsys(1).
5dd5b56d7e
Adam Weinberger (adamw) · 5.2_2
Change the ETCDIR description to say "${PREFIX}" instead of showing the actual prefix. Otherwise poudriere says it will read from /nonexistent/etc.
0a92ab1e3e
Adam Weinberger (adamw) · 5.2_2
Switch zsh back to looking for system-wide files under ${PREFIX}/etc, rather than /etc. Add an option, ETCDIR, to switch it back to /etc. Also includes a couple whitespace cleanups. PORTREVISION bump, and a note in UPDATING.

PR:		201866
e260b1b6ee
Dmitry Marakasov (amdmi3) · 5.2_1
- No need to specify master site subdirectory when it's the same as default

Approved by:	portmgr blanket
70e2eaabae