rescue: Satisfy libifconfig's libnv dependency in crunched links
libifconfig now calls nv(9) routines for the SR-IOV VF status query, so
crunched builds that link the static library must also provide libnv.
The per-program CRUNCH_LIBS_ifconfig hook cannot do this: crunchgen
partially links per-program libraries into the program object and
crunchide then localizes every symbol except the stub entry, so members
absorbed there cannot satisfy references from another archive on the
final link's library list.
List libnv globally next to libifconfig.a in rescue(8) and bsdbox. This
also makes the existing per-program libnv links redundant; remove them
to avoid embedding private localized copies in the crunched binary.
Fixes: 2d6114f6d26b ("libifconfig: Add an SR-IOV VF status query")
[GlobalISel] Add G_ROTL/G_ROTR to computeNumSignBits (#213364)
Port SelectionDAG's `ROTL`/`ROTR` handling to
`GISelValueTracking::computeNumSignBits`.
Addresses one of the subtasks of #150515.
---
Assisted by Claude (Anthropic).
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Move the bundled fdintino nginx-upload-module to release 2.3.0 and work
around its PCRE2 incompatibility.
Since the removal of the PCRE1 option nginx is built against PCRE2 only.
The module's regex filter for upload_pass_form_field still tests the
ngx_regex_exec() return code for "rc == 0", which is only true under
PCRE1; PCRE2 returns the number of captures (>= 0) on a match, so
matching
form fields were silently dropped and upload_pass_form_field was
unusable
on any dynamic (DSO) build. Relax the test to "rc >= 0" (workaround
from
upstream pull request 152).
freenginx: additionally adapt the module to the removal of r->start_sec
in freenginx >= 1.29 (nginx_version >= 1029000), which is otherwise a
build failure.
[3 lines not shown]
py-pdf: update to 6.15.0.
## Version 6.15.0, 2026-08-06
### Security (SEC)
- Improve performance of read_until_whitespace (#3947)
- Limit CID width range and width count when loading fonts (#3946)
- Limit token length for ToUnicode entries (#3944)
### Deprecations (DEP)
- Deprecate previously missed inline_images setter as well (#3897)
### New Features (ENH)
- Add ActualText tag when we produce RTL appearance stream (#3901)
- Allow keeping original PDF header in non-incremental clone mode (#3918)
- AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831)
- Add actions base class (#3552)
### Bug Fixes (BUG)
[9 lines not shown]
[CIR][AMDGPU] Add support for AMDGCN permlane builtins (#197526)
Adds codegen for the following AMDGCN permlane builtins:
- __builtin_amdgcn_permlane16
- __builtin_amdgcn_permlane64
- __builtin_amdgcn_permlanex16
These are lowered to the corresponding `llvm.amdgcn.permlane16`,
`llvm.amdgcn.permlanex16`, and `llvm.amdgcn.permlane64` intrinsics.
DAG: Gracefully diagnose missing soft-float and strict-FP libcalls
Several soft-float legalization paths legalizer, called into a libcall
without checking whether the target provides one, fatally erroring for
fp128 operations on targets with no soft-float support.
Co-authored-by: Claude (Claude-Opus-4.8) <noreply at anthropic.com>
py-strich: updated to 0.19
0.19
All encoders: harden against untrusted input by constraining input and output
sizes — over-long payloads and over-large raster renders are now rejected
before any allocation rather than exhausting memory or CPU.
EAN-13 and ITF-14: new require_valid_check_digit option rejects a supplied
check digit that is missing or incorrect instead of silently recomputing it.
New exception subclasses
:class:~pystrich.exceptions.PyStrichInvalidPayloadLength and
:class:~pystrich.exceptions.PyStrichInvalidCheckDigit (both
:class:~pystrich.exceptions.PyStrichInvalidInput) give over-capacity input
and check-digit failures a distinct type.
ixgbe: Report SR-IOV VF status
Expose cached VF configuration, policy, and runtime state through the
iflib VF status method. Include access or trunk VLAN mode, the queue
count selected by the current virtualization mode, negotiated mailbox
API, whether traffic is enabled, and the MDD-blocked and quarantine
state.
The query runs under the iflib context lock and does not issue mailbox
requests or read hardware registers.
igb: Report SR-IOV VF status
Expose the cached per-VF configuration through the iflib VF status
method. Report mailbox handshake state, MAC address, access or trunk
VLAN mode, hardware queue count, administrator policy, and MDD blocking
state without issuing mailbox requests or reading hardware registers.
rtnetlink: Report SR-IOV VF status
Honor RTEXT_FILTER_VF on RTM_GETLINK requests and expose the versioned
SR-IOV VF status through typed nested FreeBSD attributes. Report
IFLA_NUM_VF with a successful requested query and preserve per-provider
errors in the status container.
Map the common nvlist schema to native integer, boolean, string, and
binary attributes. Carry namespaced driver extensions as packed
versioned nvlists so adding a driver-specific field does not expand the
common netlink ABI.
Add SNL parsers, parser verification, a constructed nested-status test,
and an RTM_GETLINK test for an interface without SR-IOV support.
Document the query contract and every attribute.
ifconfig: Use nvlist to report SR-IOV VF status
Replace the records with a versioned nvlist transported through struct
ifreq, following SIOCGIFCAPNV. The network stack now packs and copies
results, supports bounded retry for larger results, and handles native
and 32-bit callers centrally. Drivers only populate a kernel nvlist
while their state is locked.
Define optional common fields for identity, configuration and handshake
state, VLAN policy, queue resources, runtime blocks, PF link state, and
namespaced driver extensions. Document the extension and versioning
contract and require providers to omit values they cannot observe.
Improve the ixl provider to track its mailbox handshake and report the
expanded common policy. Render the expanded status as grouped output
under ifconfig -v.
iovctl: Report SR-IOV status
Add -L to query the generic packed-nvlist IOV_GET_STATUS interface.
Report PF enable state and configured and total VF counts. For each VF,
print its PCI address, newbus attachment, bound driver, and ppt state.
Retry size negotiation if the topology changes between ioctls and reject
malformed or incompatible status records.
Keep NIC-specific operational state in ifconfig -v; iovctl owns the
device-neutral PCI topology and applies to any SR-IOV device class.
Relnotes: yes
pci: Add SR-IOV status reporting
Add a generic packed-nvlist status query to each /dev/iov/<PF>
control device. Report the live VF Enable state, configured and total
VF counts, and one record for each configured VF.
Each VF record contains its PF-local index, computed PCI location,
newbus attachment state, attached driver, and ppt binding. Construct
records for hardware VFs whose newbus child is absent so attachment
failures remain visible.
Version the extensible schema in sys/iov.h. Use fixed-width request
fields so the ioctl command and layout are identical for 32-bit callers.
Serialize the topology snapshot with Giant, then pack and copy it after
releasing Giant.
libifconfig: Add an SR-IOV VF status query
Provide a public helper which retrieves, unpacks, and validates the
versioned VF status nvlist. Validate the required VF indices and the
shape and version of driver-specific extension namespaces while allowing
unknown optional fields.
The ioctl argument is not copied back when the command returns EFBIG.
Start with a practical buffer and grow it geometrically rather than
relying on the required length being observable.
Use the helper in ifconfig so other consumers share the same transport
and validation behavior.
ifconfig: Add SR-IOV VF status output
- Adds SR-IOV VF status to the existing ifconfig "-v" output
- Adds ioctl command for reporting VF status info from drivers
- Adds support to iflib for drivers to handle this new ioctl
- Add support for ioctl in ixl(4)
Signed-off-by: Eric Joyner <erj at freebsd.org>
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D19647
py-hypothesis: updated to 6.165.2
6.165.2 - 2026-08-05
This release extends a recent shrinking improvement to many more strategies. In unions like wide_strategy | specific_strategy, values produced by the specific branch can now be re-encoded and shrunk as if generated by the wider branch when the strategies involved include sampled_from(), lists(), tuples(), dictionaries() and fixed_dictionaries(), builds() of a dataclass, permutations(), the dates() family of strategies, and filtered, deferred, or recursive combinations of them.
6.165.1 - 2026-08-04
This release improves shrinking for strategies like st.text() | some_more_complicated_strategy: values produced by the more specific strategy can now be shrunk as if they had been generated by the wider strategy. (Values from just() are the exception, as generating them makes no choices which could be re-encoded.)
6.165.0 - 2026-08-02
characters() now issues the new NonRoundTrippableCharactersWarning if the codec argument allows generating characters which encode successfully but do not decode back to the same character - for example the yen sign becomes a backslash under shift_jis - since strings containing them do not round-trip. Pass each such character in include_characters to generate it without the warning, or in exclude_characters to generate only characters which round-trip.
[flang] Reject module-scope fir.alloca (#214157)
`fir.alloca` represents a stack allocation, but its verifier currently
accepts operations placed directly in a `builtin.module`. During
FIR-to-LLVM conversion, `AllocaOpConversion::matchAndRewrite` calls
`getBlockForAllocaInsert`, which performs a `dyn_cast` to
`OutlineableOpenMPOpInterface` on the alloca's parent op.
For a module-level alloca the expected parent function/block does not
exist and the cast/assert fails.
This patch rejectsdirect module-scope `fir.alloca` operations during FIR
verification.
Assisted-by: codex
---------
Signed-off-by: Keshav Vinayak Jha <keshavvinayakjha at gmail.com>
py-test-run-parallel: updated to 0.10.0
0.10.0
Use = as separator for the test run report
Respect verbosity/quietness settings when deciding to print the parallel report summary
Configure per-test report to be displayed at higher verbosity modes
Create a separate tmpdir/tmp_path subdirectory for each iteration, so these fixtures can work with --iterations
py-unidiff: updated to 1.0.0
1.0.0 - 2026-07-25
* Dropped Python 2 support; the minimum supported version is now Python 3.9.
* Converted to real PEP 484 type annotations and generic containers, and
shipped a py.typed marker
* Migrated packaging to pyproject.toml; the sdist now includes the tests
* Replaced Travis CI with GitHub Actions (tests + mypy).
* Exposed git file modes via PatchedFile.source_mode / target_mode and an
is_symlink property
* Added support for git mnemonic source/target prefixes (i/ w/ c/ o/ and
1/ 2/), which also fixes `git diff --cached` paths
* Exposed PatchedFile.diff_line_no to locate hunkless (e.g. binary) file
entries in the diff
* PatchSet and PatchSet.from_string now accept bytes input directly,
decoding with the given encoding (default UTF-8)
* PatchSet.from_filename and PatchSet.from_string now accept the
metadata_only argument.
[6 lines not shown]
chromium: update to 151.0.7922.108
* 151.0.7922.108
This update includes 41 security fixes. Please see the Chrome Security Page for more information.
[TBD][499602793] Critical CVE-2026-19137: Use after free in WebGL. Reported by anonymous on 2026-04-05
[N/A][524824288] Critical CVE-2026-19149: Use after free in Aura. Reported by Google on 2026-06-17
[N/A][532941869] Critical CVE-2026-19154: Use after free in Skia. Reported by Google on 2026-07-09
[N/A][534903095] Critical CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google on 2026-07-14
[TBD][537729021] Critical CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. on 2026-07-22
[N/A][537838324] Critical CVE-2026-19172: Use after free in Views. Reported by Google on 2026-07-22
[$5000][537390933] High CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@svn-dys) on 2026-07-21
[$500][536945254] High CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg on 2026-07-20
[N/A][500097298] High CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google on 2026-04-06
[N/A][511731805] High CVE-2026-19139: Race in CredentialProvider. Reported by Google on 2026-05-10
[N/A][513044017] High CVE-2026-19140: Use after free in GPU. Reported by Google on 2026-05-14
[N/A][513602949] High CVE-2026-19141: Use after free in Resources. Reported by Google on 2026-05-15
[N/A][515428251] High CVE-2026-19142: Use after free in Views. Reported by Google on 2026-05-21
[33 lines not shown]
py-test-forked: updated to 1.7.5
1.7.5
* Drop support for EOL Python versions: 3.7, 3.8, 3.9.
* Print proper child process exit status.
* Removed dependency to `py <https://pypi.org/project/py>`__.
* Fix tests marked with `@pytest.mark.forked` in pytest 7+.
* pytest >= 7 is now required.
py-test-check: updated to 2.9.1
2.9.1
Fixed
- Fix [An issue with pytest-reportlog thanks to a suggestion from MV Seotlo
- also the resulting code is a bit cleaner of a solution for the pseudo-traceback code.
2.9.0
Highlights
- Added `--check-max-tb-line=<int>` to control one-line traceback output for additional failures.
- Traceback output now supports two tiers:
- full pseudo-tracebacks for early failures (`--check-max-tb`)
- one-line traceback output for later failures (`--check-max-tb-line`)
- Improved one-line traceback output for context-manager checks:
- points to the failing line inside `with check:` blocks
- includes exception type and message when available
