archivers/xz: security fix for CVE-2025-31115
The multithreaded .xz decoder in liblzma has a bug where invalid input
can at least result in a crash.
reported by jca@
archivers/libarchive: update to 3.7.9
Fixes confusion between the size of the extracted file and the size
of the contents in the tar archive when GNU sparse entrie are
involved.
archivers/xz: security fix for CVE-2025-31115
The multithreaded .xz decoder in liblzma has a bug where invalid input
can at least result in a crash.
reported by jca@
net/curl: update to 8.13.0
Changes:
* curl: add write-out variable 'tls_earlydata'
* curl: make --url support a file with URLs
* IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
* lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
* OpenSSL/quictls: add support for TLSv1.3 early data
* var: add a '64dec' function that can base64 decode a string
Committed now to minimize the difference for the inevitable security
updates during the lifetime of OpenBSD 7.7-stable.
update to anubis-1.15.1
only change is a fix for: "due to an incorrect logic change in a refactor.
This allows an attacker to mint a valid access token by passing any SHA-256
hash instead of one that matches the proof-of-work test"
drop obsolete build dependency on devel/xsd
in last update to 4.1.0 upstream switched to libxml and xmlsec,
back then I forgot to remove the line from our Makefile.
Update spiped to 1.6.4
Fixes a bug which can cause spiped to abort of a RST package arrives
from one side of a pipe at the same time as a FIN packet arrives from
the other end.
update py3-ansible-libssh to a git checkout baa2ab830d4 fixing issues
including:
- Copying >2048M file with scp.put results in the remote file becoming
0 bytes and pylibssh fails with an exception
- Intermittent SIGSEGV on consecutive ssh_channel.exec_command() invocations
- When sftp.get requires reading two chunks, the last chunk overwrites
earlier ones
from Mikolaj Kucharski
"I don't have comments" maintainer
cherrypick a bunch of bug fixes from upstream got.git into devel/got
The got.git repository contains several new features which are not ready
to be released. However, some bugs were fixed and pulling these fixes
into the devel/got port for the upcoming OpenBSD release seems desirable.
- make got clone/fetch work against Git servers which do not speak English
- got/gotwebd: fix use-after-free in match_packed_object()
- gotd: add a missing malloc failure check to repo_write process
- gotd: close file descriptors passed to gotd_imsg_compose_event() on failure
- gotd: stop processing more messages upon error in gotd repo_write process
