CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

www/webkit2-gtk2.46.6_8

Opensource browser engine using the GTK 3 toolkit

Maintainer
gnome@FreeBSD.org
Packages
webkit2-gtk_40 2.46.6_8, webkit2-gtk_41 2.46.6_8, webkit2-gtk_60 2.46.6_8
Upstream
Higher version available: 2.54.2
CPE
webkitgtk:webkitgtk from the port
WWW
https://webkitgtk.org/
Links
cgit · VuXML

Unaddressed (4) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2025-433429.8published 2025-09-15

A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-433439.8published 2025-09-15

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-312778.8published 2025-07-30

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

CVE-2025-65588.8published 2025-07-15

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (17)

Gleb Popov (arrowd) · 2.46.6_8
www/webkit2-gtk: Pull a patch from upstream fixing build with CMake 4

Approved by:	portmgr (fixit blanket)
be7aa1a61f
Jan Beich (jbeich) · 2.46.6_8
graphics/libjxl: update to 0.12

Changes:	https://github.com/libjxl/libjxl/releases/tag/v0.12.0
Reported by:	GitHub (watch releases)
fc57321249
Don Lewis (truckman) · 2.46.6_7
*/*: bump PORTREVISION for gtk40 upgrade

The gtk40 port and friends had a binary incompatible upgrade.  Bump
PORTREVISION of their consumers to for rebuild and reinstallation.

PR:		292076
c9e2fae172
Po-Chuan Hsieh (sunpoet) · 2.46.6_6
graphics/lcms2: Bump PORTREVISION of dependent ports for shlib change

PR:		292881
Reported by:	Petr Lampa <lampa@fit.vutbr.cz>
2adc4bef7d
Charlie Li (vishwin) · 2.46.6_5
www/webkit2-gtk: note libsoup 2 support sunsetting and scheduled removal
caa3bd039c
Dimitry Andric (dim) · 2.46.6_4
www/webkit2-gtk: fix build with clang >= 20

With clang 20 or higher webkit2-gtk fails to build, with errors similar
to:

    /wrkdirs/usr/ports/www/webkit2-gtk/work-40/.build/WTF/Headers/wtf/EnumTraits.h:246:20: error: no matching function for call to 'enumName'
      246 |         names[i] = enumName<static_cast<E>(static_cast<unsigned>(i))>();
          |                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    /wrkdirs/usr/ports/www/webkit2-gtk/work-40/.build/WTF/Headers/wtf/EnumTraits.h:233:9: note: in instantiation of function template specialization 'WTF::enumNames()::(anonymous class)::operator()<std::integral_constant<unsigned long, 64>>' requested here
      233 |         func(std::integral_constant<size_t, i>());
          |         ^
    /wrkdirs/usr/ports/www/webkit2-gtk/work-40/.build/WTF/Headers/wtf/EnumTraits.h:234:9: note: in instantiation of function template specialization 'WTF::detail::forConstexpr<64UL, 256UL, (lambda at /wrkdirs/usr/ports/www/webkit2-gtk/work-40/.build/WTF/Headers/wtf/EnumTraits.h:245:36)>' requested here
      234 |         forConstexpr<i + 1, end>(func);
          |         ^
    ...

This is fixed by https://commits.webkit.org/292321@main for
https://bugs.webkit.org/show_bug.cgi?id=289669, so import that patch,
plus https://commits.webkit.org/290345@main, which is a prerequisite.

PR:		292165
Approved by:	vishwin (maintainer)
MFH:		2025Q4
c71c571a6d
Rene Ladan (rene) · 2.46.6_4
all: bump PORTREVISION after updating graphics/libyuv

Using the Tools/scripts/bump_revision.pl script
b304d8ab18
Baptiste Daroussin (bapt) · 2.46.6_1
libxml2: chase libxml soversion bump
3068854dd0
Charlie Li (vishwin) · 2.46.6
www/webkit2-gtk: properly expose roundeven{,f} on 32-bit platforms

The preprocessor guard only accounts for Linux without glibc, but
we don't have these C23 functions yet either.

Reported and tested by: fuz, makc, dinoex
Differential Revision: https://reviews.freebsd.org/D50138
c467c7498d
Charlie Li (vishwin) · 2.46.6
www/webkit2-gtk: fix configure with ruby 3.4

Add getoptlong unconditionally to BUILD_DEPENDS

/usr/local/lib/ruby/3.4/did_you_mean/core_ext/name_error.rb:11: warning: getoptlong is not part of the default gems starting from Ruby 3.4.0. Install getoptlong from RubyGems.
<internal:/usr/local/lib/ruby/3.4/rubygems/core_ext/kernel_require.rb>:136:in 'Kernel#require': cannot load such file -- getoptlong (LoadError)
	from <internal:/usr/local/lib/ruby/3.4/rubygems/core_ext/kernel_require.rb>:136:in 'Kernel#require'
	from /wrkdirs/usr/ports/www/webkit2-gtk/work-60/.build/WTF/Scripts/generate-unified-source-bundles.rb:27:in '<main>'
CMake Error at Source/cmake/WebKitMacros.cmake:30 (message):
  generate-unified-source-bundles.rb exited with non-zero status, exiting
4c9f1b2bb8
Charlie Li (vishwin) · 2.46.6
gnome.mk: rename gdkpixbuf2 to gdkpixbuf to prepare for port move

The GTK 1-based gdk-pixbuf has not existed for some time.

No functional or package changes.
e87d8134a3
Charlie Li (vishwin) · 2.46.6
www/webkit2-gtk: update to 2.46.6

Release notes: https://webkitgtk.org/2025/02/07/webkitgtk2.46.6-released.html
a728ba8a00
Robert Clausecker (fuz) · 2.46.5_3
www/webkit2-gtk: fix build on aarch64

Add some missing arch-specific bits.

Approved by:	portmgr (build fix blanket)
fce678edc3
Daniel Engberg (diizzy) · 2.46.5_3
*/*: Bump consumers of devel/icu

...to avoid library mismatches
ff33dd4700
Charlie Li (vishwin) · 2.46.5_2
www/webkit2-gtk: remove byteRangeSample from PlatformSample

The presence of this union member causes the build to fail with our
libc++ because version 1 ABI's std::pair does not have a trivial
copy constructor (see D35327). However this code is only used for
a deprecated plugin only for macOS, and it along with supporting
code like this have been removed in the main branch upstream, so
this should hold in the upcoming 2.48 series. For now, only remove
byteRangeSample as the complete upstream commit does not apply.

This allows the port to return to using the base system toolchain,
including libc++, fixing crashes from mangling libc++-built
dependencies with libstdc++ webkitgtk. While here, remove some
unused USE_X11 depends to save another PORTREVISION bump.

Reference: https://github.com/WebKit/WebKit/commit/d0527fca8fc20cdda907dfdc293323d7283bd262
PR: 284378
Reported by: huanghwh[at]gmail[dot]com
Tested by: eduardo, shamaz.mazum[at]gmail[dot]com (previous iterations)
1eeaaa8e06
Charlie Li (vishwin) · 2.46.5_1
www/webkit2-gtk: remove no longer needed WPE dependencies since 2.44

Reported by: shamaz.mazum[at]gmail[dot]com
PR: 275914
3c6dc755c4
Charlie Li (vishwin) · 2.46.5
www/webkit2-gtk: update to 2.46.5

Changelog: https://github.com/WebKit/WebKit/blob/webkitgtk-2.46.5/Source/WebKit/gtk/NEWS

Now consolidated into one port with flavours since the codebase is
the same, just linked with different libraries resulting in different
SONAMEs and APIs. SONAMEs/flavours:

* GTK3 + libsoup = libwebkit2gtk-4.0 (40)
* GTK3 + libsoup3 = libwebkit2gtk-4.1 (41)
* GTK4 + libsoup3 = libwebkitgtk-6.0 (60)

Despite upstream's recommendation to use clang for better skia
optimisation, this port now USE_GCC due to extensive std::pair copy
constructor use that is not trivial to continue patching to stay
working with our libc++ version 1 ABI. See review D35327 for some
details.

Reported by: eduardo
PR: 275914
Differential Revision: https://reviews.freebsd.org/D45878
9431001288