Link [ pkgsrc | NetBSD | pkgsrc git mirror | PR fulltext-search | netbsd commit viewer ]


   
        usage: [branch:branch] [user:user] [path[@revision]] keyword [... [-excludekeyword [...]]] (e.g. branch:MAIN pkgtools/pkg)




switch to index mode

recent branches: MAIN (6h)  pkgsrc-2024Q1 (9d)  pkgsrc-2023Q4 (56d)  pkgsrc-2023Q2 (88d)  pkgsrc-2023Q3 (168d) 

2024-05-27 03:09:20 UTC Now

2017-11-21 10:32:02 UTC MAIN commitmail json YAML

nmh: Update mail/nmh to 1.7

pkgsrc changes:
- Update MASTER_SITES (use https:// and avoid redirects)

- Delete (a bit outdated) comment about locking mechanisms

  Since 02 Feb 2014 (post-1.6) the default locking mechanisms are
  (directly from m4/locking.m4):

    - aix*|cygwin*|linux*: fcntl
    - freebsd*|*netbsd*|openbsd*|darwin*: flock
    - everything else: dot

  The original comment was probably about just NetBSD and maybe Solaris
  (it's dated 1999). Solaris still uses the `dot' mechanisms by default
  but we no longer have any local patches about locking.

- Delete (no more needed) `-O1' hack to CFLAGS

  mh_strcasecmp() was completely replaced by strcasecmp() on 24 Mar 2013, and
  hence present in 1.6. Forcing `-O1' for gcc is no longer needed.

- Adjust --sysconfdir CONFIGURE_ARGS per-upstream change, now the nmh
  directory is created by nmh's configure so pass PKG_SYSCONFBASE instead of
  PKG_SYSCONFDIR.

- Add support for the `test' phase

  Add support for nmh tests. Modify patches/patch-ca accordingly in order to
  adjust TEST_ENVIRONMENT to use the configuration files in $egdir instead of the
  ones in $nmhetcdir.
  Actually all tests are passed except an mhparam test that sposts the
  $egdir/$nmetcdir kludge.

- Do not include bsd.prefs.mk two times (NFC)

- Add `oauth' PKG_OPTIONS (disabled by default) to enable OAuth2 support in
  SMTP and POP auth via curl

Changes:
Release notes for nmh 1.7
=========================
Welcome to nmh, the new version of the classic MH mail handling system.
It's been over three years since the last release of nmh, and there have
been a number of significant changes since the last release.  Long-time
MH and nmh uses should read careful the NOTEABLE CHANGES section, as there
are some significant changes to nmh behavior.  Otherwise, please see the
README and INSTALL files for help on getting started with nmh.

For news of future releases, subscribe to the low-volume
    https://lists.nongnu.org/mailman/listinfo/nmh-announce

---------------
NOTABLE CHANGES
---------------

The largest notable changes in the 1.7 release are:

- Complete unification of network security support.  All network protocols
  (currently, POP and SMTP) have been refactored to use a common set of
  security routines.  This means all protocols support all SASL mechanisms
  (via the Cyrus-SASL library) and TLS.  TLS support has been strengthened
  to perform certificate name validation and to require TLS 1.1 as a
  minimum protocol.  Also, all protocols can make use of the OAuth2/XOAUTH
  SASL mechanism, which is supported by Gmail.
- send(1) now supports adding switches to post(8) based on the address or
  domain of the email address in the From: header; this more easily allows
  users to support multiple identities.
- A generic facility for passing arguments to filter programs in repl(1)
  by use of the -convertargs switch.
- Native support for the manipulation of iCalendar requests; see mhical(1)
  for more details.

------------
NEW FEATURES
------------

The following are new features for the 1.7 release of nmh:

- When building from source, configure will derive ${prefix} from an existing
  nmh installation if it finds one in your $PATH.
- Added welcome message when nmh detects that its version changed.
- The default locations for configuration files and support binaries
  have been changed.  Configuration files now install into ${sysconfdir}/nmh,
  and support binaries are placed in ${libexecdir}/nmh.  If you are upgrading
  an existing installation you should look for old configuration files in
  ${sysconfdir} and merge any local customizations into the new files in
  ${sysconfdir}/nmh, then remove the old files.  ${libdir} will also contain
  obsolete support programs that should be removed.
- All TLS connections now perform certificate validation (including hostname
  matching) by default; can be disabled on a per-application basis.
- post now defaults to port 587 on 'smtp' message submission.
- A value of 0 for the width switch of scan(1), inc(1), ap(1), dp(1),
  fmttest(1), and mhl(1) now means as many characters as the format
  engine can produce [Bug #15274].  That amount is limited by internal
  buffers.
- If a component has trailing whitespace, e.g., body:component="> ",
  mhl now trims that whitespace off when filtering blank text lines.
- An "rtrim" flag has been added to mhl to remove any trailing
  whitespace from filtered text lines.  A corresponding "nortrim" flag
  has also been added.
- Added getmymbox and getmyaddr mh-format(5) function escapes.
- New -[no]changecur, -fixtype, -decodetypes, and -[no]crlflinebreaks switches
  have been added to mhfixmsg(1).
- mhfixmsg now removes an extraneous trailing semicolon from header
  parameter lists.
- Added -convertargs switch to repl(1), to pass arguments to programs
  specified in the user's profile or mhn.defaults to convert message
  content.
- Added mhical(1), to display, reply to, and cancel iCalendar (RFC 5545)
  event requests.
- Added multiply mh-format(5) function.
- "mhparam bindir" prints the path to the directory containing the public
  executables (${bindir}).
- New "-prefer" switch for mhshow (and mhlist and mhshow), to allow specifying
  the preferred content types to show, if present in a multipart alternative.
- mh-format now has %(kilo) and %(kibi) functions, to allow printing
  numbers with SI or IEC quantities, e.g. "10K", "2.3Mi".
- Support for the -sendmail flag to send/post to change the sendmail
  binary when using the sendmail/pipe MTS.
- Added support to send(1) to specify switches to post(1) based on address or
  domain name in From: header line in message draft.
- post(8) -snoop now attempts to decode base64-encoded SMTP traffic.
- folder(1) -nocreate now prints a warning message for a non-existent folder.
- mhfixmsg(1) now allows -decodetext binary, though 8bit is still the default.
- inc(1) and msgchk(1) now support TLS encryption natively.
- All network protocols support the XOAUTH authentication mechanism.
- Support for SMTPUTF8 (RFC 6531) has been added.  mhshow(1) already supported
  RFC 6532, assuming all 8-bit message header field bodies are UTF-8 and use
  of a UTF-8 locale.
- mhfixmsg now replaces RFC 2047 encoding with RFC 2231 encoding of name and
  filename parameters in Content-Type and Content-Disposition headers,
  respectively.
- If a message body contains 8-bit bytes, post(8) uses SMTP 8BITMIME if the
  server supports it.  If not, post fails with a message to the user to
  encode the message for 7-bit transport.
- Fewer lseek(2)s will be used when reading headers in the common case.
- ./configure's --enable-debug has been removed;  it did nothing.
- configure now defaults to enabling each of TLS and Cyrus SASL if the
  necessary headers and libraries are found.
- Moved build_nmh to top-level directory.
- Better error reporting for connections to network services.

---------
BUG FIXES
---------

- The format scanner no longer subtracts 1 from the width.  This has the
  effect of no longer counting the trailing newline in the output of
  scan(1), inc(1), and the other programs that rely on the format scanner.
- The first character of some very short (less than 4 characters) message
  bodies is no longer dropped.
- Single-character headers can be reliably formatted, etc., instead of
  apparently being missing.
- mhfixmsg now adds a Content-Transfer-Encoding header at the message level,
  if needed after decoding text parts.
- mhbuild now checks whether all text parts need a Content-Transfer-Encoding
  header, not just those with a character set not specified.
- mhbuild no longer parses lines that start with # as directives with
  -nodirectives.
- repl now makes sure that any Fcc header in a replied-to message is not
  copied into the outgoing draft by default, and that the -fcc switch
  actually works in the absence of a Fcc header in the replied-to message.
- A Content-ID is generated for message/external-body entities as required
  by RFC 2045, even if -nocontentid is supplied to mhbuild.
- post will now expand aliases on a "From" line when doing a BCC [Bug #51098].
- scan can now handle empty files without violating an assert [Bug #51693].
- An error when writing an error message, e.g. EPIPE, no longer causes
  recursion until the stack is exhausted.

-------------------
DEPRECATED FEATURES
-------------------

- Support for the MHPDEBUG environment variable is deprecated and will be
  removed from a future nmh release.  Instead, use the -debug switch to pick.
- With the move of support binaries from ${libdir} to ${libexecdir}/nmh, the
  mostly undocumented 'libdir' mhparam(1) component has been replaced by a
  new 'libexecdir' component.  'libdir' will be removed in a future release.

-----------------
OBSOLETE FEATURES
-----------------

- The undocumented -queue switch to post was deprecated in nmh 1.6, and was
  removed in this release.
- conflict(8) was deprecated in nmh 1.6, and was removed in this release.
- mhtest(8) was deprecated in nmh 1.6, and was removed in this release.
- msh(1) was deprecated in nmh 1.6, and was removed in this release.
- Support in alias files for the the "*" address-group (everyone) was
  deprecated in nmh 1.6, and was removed in this release.
- Support for multiple hostnames in the "servers" entry of mts.conf has
  been removed.
- Support in alias files for expanding aliases based on group membership
  (=) and primary group (+) has been removed.

As always, feedback is welcome.

(leot)

2017-11-20 23:04:05 UTC MAIN commitmail json YAML

libgit2: remove python from bl3.mk

cmake says it's only needed for tests

(wiz)

2017-11-20 17:17:50 UTC MAIN commitmail json YAML

Escape whitespace in PKG_JAVA_HOME when setting JAVA_HOME

(minskim)

2017-11-20 17:11:12 UTC MAIN commitmail json YAML

doc: Updated devel/py-ipython to 6.2.1nb2

(minskim)

2017-11-20 17:10:43 UTC MAIN commitmail json YAML

Correct the PYPKGPREFIX value

It should be "py34" rather than "34".

Bump PKGREVISION.

(minskim)

2017-11-20 16:06:20 UTC MAIN commitmail json YAML

doc: Updated databases/mongo-c-driver to 1.8.2

(fhajny)

2017-11-20 16:06:11 UTC MAIN commitmail json YAML

Update databases/mongo-c-driver to 1.8.2.

- Remove option to bundle the Snappy compression library, it caused issues
  for programs linking to libmongoc
- Fix pkg-config and CMake config file flags for programs that statically
  link to libmongoc when libmongoc is statically linked to zLib
- The configure flag "--with-zlib=no" was ignored
- Fix crash in authentication when username is NULL

(fhajny)

2017-11-20 16:05:14 UTC MAIN commitmail json YAML

doc: Updated devel/libbson to 1.8.2

(fhajny)

2017-11-20 16:05:04 UTC MAIN commitmail json YAML

Update devel/libbson to 1.8.2.

No change since 1.8.1; released to keep pace with libmongoc's version.

(fhajny)

2017-11-20 16:02:59 UTC MAIN commitmail json YAML

Fails with Python > 2.7 - add PYTHON_VERSIONS_ACCEPTED=27

(abs)

2017-11-20 15:57:37 UTC MAIN commitmail json YAML

doc: Updated devel/py-argcomplete to 1.9.3

(fhajny)

2017-11-20 15:57:27 UTC MAIN commitmail json YAML

Update devel/py-argcomplete to 1.9.3.

- Fix handling of COMP_POINT
- Fix crash when writing unicode to debug_stream in Python 2

(fhajny)

2017-11-20 15:55:25 UTC MAIN commitmail json YAML

doc: Updated sysutils/beats to 6.0.0

(fhajny)

2017-11-20 15:55:16 UTC MAIN commitmail json YAML

Update sysutils/beats to 6.0.0.

=== Beats version 6.0.0

==== Breaking changes

Affecting all Beats

- The log directory (`path.log`) for Windows services is now set to
  `C:\ProgramData\[beatname]\logs`.
- The _all field is disabled in Elasticsearch 6.0.
- Fail if removed setting output.X.flush_interval is explicitly
  configured.
- Rename the `/usr/bin/beatname.sh` script (e.g. `metricbeat.sh`) to
  `/usr/bin/beatname`.
- Beat does not start if elasticsearch index pattern was modified but
  not the template name and pattern.
- Fail if removed setting output.X.flush_interval is explicitly
  configured.
- Rename `kubernetes` processor to `add_kubernetes_metadata`.
- Rename `.full.yml` config files to `*.reference.yml`.
- The `scripts/import_dashboards` is removed from packages. Use the
  `setup` command instead.
- Change format of the saved kibana dashboards to have a single JSON
  file for each dashboard
- Rename `configtest` command to `test config`.
- Remove setting `queue_size` and `bulk_queue_size`.
- Remove setting `dashboard.snapshot` and `dashboard.snapshot_url`.
- Beats can no longer be launched from Windows Explorer (GUI), command
  line is required.

Filebeat

- Rename `input_type` field to `prospector.type`
- The `@metadata.type` field, added by the Logstash output, is now
  hardcoded to `doc` and will be removed in future versions.

Metricbeat

- Change all `system.cpu..pct` metrics to be scaled by the number of
  CPU cores.
- Remove filters setting from metricbeat modules.
- Added `type` field to filesystem metrics.

Heartbeat

- Renamed the heartbeat RPM/DEB name to `heartbeat-elastic`.

Packetbeat

- Remove not-working `runoptions.uid` and `runoptions.gid` options in
  Packetbeat.
- Remove the already unsupported `pf_ring` sniffer option.

Auditbeat

- Changed file metricset config to make `file.paths` a list instead of
  a dictionary.

==== Bugfixes

Affecting all Beats

- Fix data race accessing watched containers.
- Do not require template if index change and template disabled
- Fix missing ACK in redis output.
- Fix the `/usr/bin/beatname` script to accept `-d ""` as a parameter.
- Combine `fields.yml` properties when they are defined in different
  sources.
- Keep Docker & Kubernetes pod metadata after container dies while
  they are needed by processors.
- Fix `fields.yml` lookup when using `export template` with a custom
  `path.config` param.
- Remove runner creation from every reload check
- Fix add_kubernetes_metadata matcher registry lookup.
- Register kubernetes `field_format` matcher and remove logger in
  `Encode` API
- Fix go plugins not loaded when beat starts
- Add support for `initContainers` in `add_kubernetes_metadata`
  processor.
- Eliminate deprecated _default_ mapping in 6.x
- Fix pod name indexer to use both namespace, pod name to frame index
  key
- Don't stop with error loading the ES template if the ES output is
  not enabled.
- Fix race condition in internal logging rotator.
- Normalize all times to UTC to ensure proper index naming.
- Fix issue with loading dashboards to ES 6.0 when .kibana index did
  not already exist.
- Fix importing the dashboards when the limit for max open files is
  too low.
- Fix configuration documentation for kubernetes processor
- Fix misspelling in `add_locale` configuration option for
  abbreviation.

Filebeat

- Fix machine learning jobs setup for dynamic modules.
- Fix default paths for redis 4.0.1 logs on macOS
- Fix Filebeat not starting if command line and modules configs are
  used together.
- Fix double `@timestamp` field when JSON decoding was used.
- Fix issue where the `fileset.module` could have the wrong value.
- Fix race condition on harvester stopping with reloading enabled.
- Fix recursive glob config parsing and resolution across restarts.
- Allow string characters in user agent patch version (NGINX and
  Apache)
- Fix grok pattern in filebeat module system/auth without hostname.

Winlogbeat

- Removed validation of top-level config keys.

Metricbeat

- Use `beat.name` instead of `beat.hostname` in the Host Overview
  dashboard.
- Fix the loading of 5.x dashboards.
- Fix a memory allocation issue where more memory was allocated than
  needed in the windows-perfmon metricset.
- Don't start metricbeat if external modules config is wrong and
  reload is disabled
- The MongoDB module now connects on each fetch, to avoid stopping the
  whole Metricbeat instance if MongoDB is not up when starting.
- Fix kubernetes events module to be able to index time fields
  properly.
- Fixed `cmd_set` and `cmd_get` being mixed in the Memcache module.
- Added missing mongodb configuration file to the `modules.d` folder.
- Fix wrong MySQL CRUD queries timelion visualization
- Add new metrics to CPU metricsset
- Fix issue affecting Windows services timing out at startup.
- Fix incorrect docker.diskio.total metric calculation.
- Vsphere module: used memory field corrected.
- Set correct format for percent fields in memory module.
- Fix a debug statement that said a module wrapper had stopped when it
  hadn't.
- Use MemAvailable value from /proc/meminfo on Linux 3.14.
- Fix panic when events were dropped by filters.
- Add filtering to system filesystem metricset to remove relative
  mountpoints like those from Linux network namespaces.
- Remove unnecessary print statement in schema apis.
- Fix type of field `haproxy.stat.check.health.last`.

Heartbeat

- Fix monitor.name being empty by default.
- Fix wrong event timestamps.

Packetbeat

- Fix missing length check in the PostgreSQL module.
- Fix panic in ACK handler if event is dropped on blocked queue
- Update flow timestamp on each packet being received.
- Enabled /proc/net/tcp6 scanning and fixed ip v6 parsing.
- Enable memcache filtering only if a port is specified in the config
  file.

Auditbeat

- Fix `file.max_file_size` config option for the audit file metricset.

==== Added

Affecting all Beats

- Enable flush timeout by default.
- Add @metadata.version to events send to Logstash.
- Add setting to enable/disable the slow start in logstash output.
- Update init scripts to use the `test config` subcommand instead of
  the deprecated `-configtest` flag.
- Get by default the credentials for connecting to Kibana from the
  Elasticsearch output configuration.
- Added `cloud.id` and `cloud.auth` settings, for simplifying using
  Beats with the Elastic Cloud.
- Add lz4 compression support to kafka output.
- Add newer kafka versions to kafka output.
- Configure the index name when loading the dashboards and the index
  pattern.
- New cli subcommands interface.
- Allow source path matching in `add_docker_metadata` processor.
- Add support for analyzers and multifields in fields.yml.
- Add support for JSON logging.
- Add `test output` command, to test Elasticsearch and Logstash output
  settings.
- Introduce configurable event queue settings: queue.mem.events,
  queue.mem.flush.min_events and queue.mem.flush.timeout.
- Enable pipelining in Logstash output by default.
- Added 'result' field to Elasticsearch QueryResult struct for
  compatibility with 6.x Index and Delete API responses.
- The sample dashboards are now included in the Beats packages.
- Add `pattern` option to be used in the fields.yml to specify the
  pattern for a number field.
- Upgraded to Golang 1.8.3.
- Added the possibility to set Elasticsearch mapping template settings
  from the Beat configuration file.
- Add a variable to the SysV init scripts to make it easier to change
  the user.
- Add the option to write the generated Elasticsearch mapping template
  into a file.
- Add `instance_name` in GCE add_cloud_metadata processor.
- Add `add_docker_metadata` processor.
- Add `logging.files` `permissions` option.

Filebeat

- Add Kubernetes manifests to deploy Filebeat.
- Changed the number of shards in the default configuration to 3.
- Don't start filebeat if external modules/prospectors config is wrong
  and reload is disabled
- Add `filebeat.registry_flush` setting, to delay the registry
  updates.
- Add experimental Redis module.
- Nginx module: use the first not-private IP address as the remote_ip.
- Load Ingest Node pipelines when the Elasticsearch connection is
  established, instead of only once at startup.
- Add support for loading Xpack Machine Learning configurations from
  the modules, and added sample configurations for the Nginx module.
- Add udp prospector type.
- Enabled Cgo which means libc is dynamically compiled.
- Add Beta module config reloading mechanism
- Remove spooler and publisher components and settings.
- Added ability to sort harvested files.
- Add experimental Redis slow log prospector type.

Winlogbeat

- Changed the number of shards in the default configuration to 3.
- Add the ability to use LevelRaw if Level isn't populated in the
  event XML.

Metricbeat

- Add Kubernetes manifests to deploy Metricbeat.
- Auto-select a hostname (based on the host on which the Beat is
  running) in the Host Overview dashboard.
- Add `filesystem.ignore_types` to system module for ignoring
  filesystem types.
- Add support to exclude labels from kubernetes pod metadata.
- Add random startup delay to each metricset to avoid the thundering
  herd problem.
- Add the ability to configure audit rules to the kernel module.
- Add the ability to configure kernel's audit failure mode.
- Add experimental Aerospike module.
- Vsphere module: collect custom fields from virtual machines.
- Add `test modules` command, to test modules expected output.
- Add `processors` setting to metricbeat modules.
- Support `npipe` protocol (Windows) in Docker module.
- Add macOS implementation of the system diskio metricset.
- Add process_summary metricset that records high level metrics about
  processes.
- Add `kube-state-metrics` based metrics to `kubernetes` module
- Add debug logging to Jolokia JMX metricset.
- Add events metricset for kubernetes metricbeat module
- Change Metricbeat default configuration file to be better optimized
  for most users.
- Add experimental RabbitMQ module.
- Add Kibana dashboard for the Kubernetes modules.

Heartbeat

- Changed the number of shards in the default configuration to 1.
- Enabled Cgo which means libc is dynamically compiled.

Packetbeat

- Changed the number of shards in the default configuration to 3.

Auditbeat

- Changed the number of shards in the default configuration to 3.
- Add support for receiving audit events using a multicast socket.
- Added `file.hash_types` config option for controlling the hash
  types.
- Added the ability to specify byte unit suffixes to
  `file.max_file_size`.
- Add file integrity metricset to the audit module.

==== Deprecated

Affecting all Beats

- The `@metadata.type` field, added by the Logstash output, is
  deprecated, hardcoded to `doc` and will be removed in future
versions.

Filebeat

- The `filebeat.config_dir` option is deprecated. Use
  `filebeat.config.prospector` options instead.
- Deprecate `input_type` prospector config. Use `type` config option
  instead.

=== Beats version 5.6.4

- Fix race condition in internal logging rotator.
- Add support for enabling TLS renegotiation.
- Add setting to enable/disable the slow start in logstash output.
- Packetbeat: Fix missing length check in the PostgreSQL module.

(fhajny)

2017-11-20 15:40:15 UTC MAIN commitmail json YAML

doc: Updated databases/py-elasticsearch to 6.0.0

(fhajny)

2017-11-20 15:40:05 UTC MAIN commitmail json YAML

Update databases/py-elasticsearch to 6.0.0.

6.0.0 (2017-11-14)
- compatibility with Elasticsearch 6.0.0

5.5.0 (2017-11-10)
- streaming_bulk helper now supports retries with incremental backoff
- scan helper properly checks for successful shards instead of just
  checking failed
- compatible release with elasticsearch 5.6.4
- fix handling of UTF-8 surrogates

(fhajny)

2017-11-20 15:36:57 UTC MAIN commitmail json YAML

doc: Updated databases/elasticsearch to 6.0.0

(fhajny)

2017-11-20 15:36:47 UTC MAIN commitmail json YAML

Update databases/elasticsearch to 6.0.0.

=== Breaking changes

Aggregations::
- Change parsing of numeric `to` and `from` parameters in `date_range`
  aggregation

Aliases::
- Wrong behavior deleting alias

Allocation::
- Remove `cluster.routing.allocation.snapshot.relocation_enabled`
  setting

Analysis::
- Do not allow custom analyzers to have the same names as built-in
  analyzers
- Removing query-string parameters in `_analyze` API

CAT API::
- Write -1 on unbounded queue in cat thread pool

CRUD::
- Disallow `VersionType.FORCE` for GetRequest
- Disallow `VersionType.FORCE` versioning for 6.x indices
- If the index does not exist, delete document will not auto create it

Cluster::
- Disallow : in cluster and index/alias names
- No longer allow cluster name in data path

Core::
- Simplify file store
- Make boolean conversion strict
- Remove the `default` store type.
- Remove store throttling.

Geo::
- Remove deprecated geo search features
- Reduce GeoDistance Insanity

Highlighting::
- Remove the postings highlighter and make unified the default
  highlighter choice

Index APIs::
- Remove (deprecated) support for '+' in index expressions
- Delete index API to work only against concrete indices
- Open/Close index api to allow_no_indices by default
- Remove support for controversial `ignore_unavailable` and
  `allow_no_indices` from indices exists api

Index Templates::
- Allows multiple patterns to be specified for index templates

Indexed Scripts/Templates::
- Scripting: Remove search template actions

Ingest::
- update ingest-user-agent regexes.yml
- remove ingest.new_date_format

Inner Hits::
- Return the _source of inner hit nested as is without wrapping it
  into its full path context

Java API::
- Enforce Content-Type requirement on the rest layer and remove
  deprecated methods

Java REST Client::
- Remove deprecated created and found from index, delete and bulk

Mapping::
- Reject out of range numbers for float, double and half_float
- Enforce at most one type.
- Disallow `include_in_all` for 6.0+ indices
- Disable _all by default, disallow configuring _all on 6.0+ indices
- Throw an exception on unrecognized "match_mapping_type"

Network::
- Remove unused Netty-related settings
- Remove blocking TCP clients and servers
- Remove `modules/transport_netty_3` in favor of `netty_4`
- Remove LocalTransport in favor of MockTcpTransport

Packaging::
- Configure heap dump path out of the box
- Remove support for ES_INCLUDE
- Setup: Change default heap to 1G
- Use config directory to find jvm.options
- Remove implicit 32-bit support
- Remove default path settings
- Remove path.conf setting
- Honor masking of systemd-sysctl.service
- Rename CONF_DIR to ES_PATH_CONF
- Remove customization of ES_USER and ES_GROUP

Percolator::
- Remove deprecated percolate and mpercolate apis

Plugin Analysis ICU::
- Upgrade icu4j for the ICU analysis plugin to 59.1
- Upgrade icu4j to latest version

Plugin Delete By Query::
- Require explicit query in _delete_by_query API

Plugin Discovery Azure Classic::
- Remove `discovery.type` BWC layer from the EC2/Azure/GCE plugins

Plugin Discovery EC2::
- Ec2 Discovery: Cleanup deprecated settings
- Discovery EC2: Remove region setting
- AWS Plugins: Remove signer type setting

Plugin Lang JS::
- Remove lang-python and lang-javascript

Plugin Mapper Attachment::
- Remove mapper attachments plugin

Plugin Repository Azure::
- Remove global `repositories.azure` settings
- Remove auto creation of container for azure repository

Plugin Repository GCS::
- GCS Repository: Remove specifying credential file on disk

Plugin Repository S3::
- S3 Repository: Cleanup deprecated settings
- S3 Repository: Remove region setting
- S3 Repository: Remove bucket auto create
- S3 Repository: Remove env var and sysprop credentials support
- Remove deprecated S3 settings

Plugins::
- Make plugin loading stricter

Query DSL::
- Remove deprecated `type` and `slop` field in `match` query
- Remove several parse field deprecations in query builders
- Remove deprecated parameters from `ids_query`
- Refactor QueryStringQuery for 6.0
- Change `split_on_whitespace` default to false
- Remove deprecated template query
- Throw exception in scroll requests using `from`
- Remove deprecated `minimum_number_should_match` in BoolQueryBuilder
- Remove support for empty queries
- Remove deprecated query names: in, geo_bbox, mlt, fuzzy_match and
  match_fuzzy
- The `terms` query should always map to a Lucene `TermsQuery`.
- Be strict when parsing values searching for booleans
- Remove collect payloads parameter

REST::
- IndexClosedException to return 400 rather than 403
- Remove comma-separated feature parsing for GetIndicesAction
- Improve REST error handling when endpoint does not support HTTP
  verb, add OPTIONS support
- Remove ldjson support and document ndjson for bulk/msearch
- Enable strict duplicate checks for all XContent types
- Enable strict duplicate checks for JSON content
- Remove lenient stats parsing
- Remove allow unquoted JSON
- Remove FORCE version_type

Scripting::
- remove lang url parameter from stored script requests
- Disallow lang to be used with Stored Scripts
- Remove Deprecated Script Settings
- Scripting: Remove native scripts
- Scripting: Remove file scripts
- Make dates be ReadableDateTimes in scripts
- Remove groovy scripting language
- Remove script access to term statistics

Search::
- Make `index` in TermsLookup mandatory
- Removes FieldStats API
- Remove deprecated fielddata_fields from search request
- Removes deprecated fielddata_fields
- ProfileResult and CollectorResult should print machine readable
  timing information
- Remove indices query
- Remove ignored type parameter in search_shards api

Sequence IDs::
- Change certain replica failures not to fail the replica shard

Settings::
- Settings: Remove shared setting property
- Settings: Remove support for yaml and json config files

Shadow Replicas::
- Remove shadow replicas

Similarities::
- Similarity should accept dynamic settings when possible

=== Breaking Java changes

Aggregations::
- Remove the unused SignificantTerms.compareTerm() method
- Make SignificantTerms.Bucket an interface rather than an abstract
  class
- Fix NPE when `values` is omitted on percentile_ranks agg
- Make Terms.Bucket an interface rather than an abstract class
- Compound order for histogram aggregations

Internal::
- Collapses package structure for some bucket aggs

Java API::
- Remove deprecated IdsQueryBuilder ctor
- Removing unneeded getTookInMillis method
- Java api: ActionRequestBuilder#execute to return a PlainActionFuture

Java High Level REST Client::
- Unify the result interfaces from get and search in Java client
- Allow RestHighLevelClient to use plugins

Java REST Client::
- Rename client artifacts

Network::
- Simplify TransportAddress

Plugin Delete By Query::
- Move DeleteByQuery and Reindex requests into core

Plugins::
- Drop name from TokenizerFactory

Query DSL::
- Remove QueryParseContext
- Remove QueryParseContext from parsing QueryBuilders

REST::
- Return index name and empty map for `/{index}/_alias` with no
  aliases

=== Deprecations

Index APIs::
- Deprecated use of + in index expressions

Index Templates::
- Restore deprecation warning for invalid match_mapping_type values

Indexed Scripts/Templates::
- Scripting: Deprecate stored search template apis

Internal::
- Deprecate XContentType auto detection methods in XContentFactory

Percolator::
- Deprecate percolate query's document_type parameter.

Plugins::
- Plugins: Add backcompat for sha1 checksums

Scripting::
- Scripting: Change keys for inline/stored scripts to source/id
- Scripting: Deprecate native scripts
- Scripting: Deprecate index lookup
- Deprecate Fine Grain Settings for Scripts
- Scripting: Deprecate file script settings
- Scripting: Deprecate file scripts

Settings::
- Settings: Update settings deprecation from yml to yaml
- Deprecate settings in .yml and .json

Tribe Node::
- Deprecate tribe service

=== New features

Aggregations::
- SignificantText aggregation - like significant_terms, but for text

Analysis::
- Expose simplepattern and simplepatternsplit tokenizers
- Parse synonyms with the same analysis chain

Core::
- Enable index-time sorting

Internal::
- Automatically adjust search threadpool queue_size

Mapping::
- Add new ip_range field type

Parent/Child::
- Move parent_id query to the parent-join module
- Introduce ParentJoinFieldMapper, a field mapper that creates
  parent/child relation within documents of the same index

Plugin Analysis ICU::
- Add ICUCollationFieldMapper

Search::
- Automatically early terminate search query based on index sorting

Sequence IDs::
- Add a scheduled translog retention check
- Initialize sequence numbers on a shrunken index
- Initialize primary term for shrunk indices
- Introduce translog size and age based retention policies

Stats::
- Adds nodes usage API to monitor usages of actions

Task Manager::
- Task Management

Upgrade API::
- TemplateUpgraders should be called during rolling restart

=== Enhancements

Aggregations::
- Add strict parsing of aggregation ranges
- Adds rewrite phase to aggregations
- Tweak AggregatorBase.addRequestCircuitBreakerBytes
- Add superset size to Significant Term REST response
- Add document count to Matrix Stats aggregation response
- Adds an implementation of LogLogBeta for the cardinality aggregation
- Support distance units in GeoHashGrid aggregation precision
- Reject multiple methods in `percentiles` aggregation
- Use `global_ordinals_hash` execution mode when sorting by sub
  aggregations.
- Add a specialized deferring collector for terms aggregator
- Agg builder accessibility fixes
- Remove support for the include/pattern syntax.
- Promote longs to doubles when a terms agg mixes decimal and
  non-decimal numbers

Allocation::
- Adjust status on bad allocation explain requests
- Promote replica on the highest version node

Analysis::
- [Analysis] Support normalizer in request param
- Enforce validation for PathHierarchy tokenizer
- [analysis-icu] Allow setting unicodeSetFilter
- Match- and MultiMatchQueryBuilder should only allow setting analyzer
  on string values

Bulk::
- Simplify bulk request execution

CAT API::
- expand `/_cat/nodes` to return information about hard drive

CRUD::
- Added validation for upsert request

Circuit Breakers::
- ScriptService: Replace max compilation per minute setting with max
  compilation rate

Cluster::
- Validate a joining node's version with version of existing cluster
  nodes
- Switch indices read-only if a node runs out of disk space
- Add a cluster block that allows to delete indices that are read-only
- Separate publishing from applying cluster states
- Adds cluster state size to /_cluster/state response

Core::
- Allow `InputStreamStreamInput` array size validation where
  applicable
- Refactor bootstrap check results and error messages
- Add BootstrapContext to expose settings and recovered state to
  bootstrap checks
- Unit testable index creation task on MetaDataCreateIndexService
- Ignore .DS_Store files on macOS
- Add max file size bootstrap check
- Add compatibility versions to main action response
- Index ids in binary form.
- Explicitly reject duplicate data paths
- Use SPI in High Level Rest Client to load XContent parsers
- Upgrade to lucene-7.0.0-snapshot-a0aef2f
- Speed up PK lookups at index time.
- Use Java 9 FilePermission model
- Add friendlier message on bad keystore permissions
- Epoch millis and second formats accept float implicitly
- Remove connect SocketPermissions from core
- Add repository-url module and move URLRepository
- Remove accept SocketPermissions from core
- Move IfConfig.logIfNecessary call into bootstrap
- Remove artificial default processors limit
- Simplify write failure handling
- Improve bootstrap checks error messages

Discovery::
- Allow plugins to validate cluster-state on join

Engine::
- Add refresh stats tracking for realtime get
- Introducing a translog deletion policy
- Fill missing sequence IDs up to max sequence ID when recovering from
  store
- Use sequence numbers to identify out of order delivery in replicas &
  recovery
- Add replica ops with version conflict to translog
- Clarify global checkpoint recovery
- Move the IndexDeletionPolicy to be engine internal

Exceptions::
- IllegalStateException: Only duplicated jar instead of classpath

Highlighting::
- Picks offset source for the unified highlighter directly from the es
  mapping

Index APIs::
- Let primary own its replication group
- Create index request should return the index name

Index Templates::
- Fix error message for a put index template request without
  index_patterns

Ingest::
- Add Ingest-Processor specific Rest Endpoints & Add Grok endpoint
- Port support for commercial GeoIP2 databases from Logstash.
- add `exclude_keys` option to KeyValueProcessor
- Allow removing multiple fields in ingest processor
- Add target_field parameter to ingest processors

Inner Hits::
- Reuse inner hit query weight

Internal::
- TemplateUpgradeService should only run on the master
- Cleanup IndexFieldData visibility
- Bump the min compat version to 5.6.0
- "shard started" should show index and shard ID
- Break out clear scroll logic from TransportClearScrollAction
- Add helper methods to TransportActionProxy to identify proxy actions
  and requests
- Add remote cluster infrastructure to fetch discovery nodes.
- Add the ability to set eager_global_ordinals in the new parent-join
  field
- Disallow multiple parent-join fields per mapping
- Remove the need for _UNRELEASED suffix in versions
- Optimize the order of bytes in uuids for better compression.
- Prevent cluster internal `ClusterState.Custom` impls to leak to a
  client
- Use holder pattern for lazy deprecation loggers
- Allow `ClusterState.Custom` to be created on initial cluster states
- Try to convince the JVM not to lose stacktraces
- Make document write requests immutable
- Add assertions enabled helper

Java API::
- Always Accumulate Transport Exceptions

Java High Level REST Client::
- [DOCS] restructure java clients docs pages
- Use SPI in High Level Rest Client to load XContent parsers
- Add support for clear scroll to high level REST client
- Add search scroll method to high level REST client
- Add search method to high level REST client
- Make RestHighLevelClient Closeable and simplify its creation
- Add info method to High Level Rest client
- Add support for named xcontent parsers to high level REST client
- Add BulkRequest support to High Level Rest client
- Add UpdateRequest support to High Level Rest client
- Add delete API to the High Level Rest Client
- Add Index API to High Level Rest Client
- Add get/exists method to RestHighLevelClient
- Add fromxcontent methods to delete response
- Add REST high level client gradle submodule and first simple method
- Add doc_count to ParsedMatrixStats
- Add fromXContent method to ClearScrollResponse
- ClearScrollRequest to implement ToXContentObject
- SearchScrollRequest to implement ToXContentObject
- Add aggs parsers for high level REST Client

Java REST Client::
- Shade external dependencies in the rest client jar
- RestClient uses system properties and system default SSLContext
- Wrap rest httpclient with doPrivileged blocks

Logging::
- Prevent excessive disk consumption by log files
- Use LRU set to reduce repeat deprecation messages

Mapping::
- More efficient encoding of range fields.
- Don't detect source's XContentType in DocumentParser.parseDocument()
- Better validation of `copy_to`.
- Optimize `terms` queries on `ip` addresses to use a
  `PointInSetQuery` whenever possible.
- Loosen the restrictions on disabling _all in 6.x
- Date detection should not rely on a hardcoded set of characters.
- Identify documents by their `_id`.

Network::
- Add additional low-level logging handler
- Unwrap causes when maybe dying
- Move TransportStats accounting into TcpTransport
- Simplify connection closing and cleanups in TcpTransport
- Disable the Netty recycler in the client
- Remove Netty logging hack
- Isolate SocketPermissions to Netty
- Wrap netty accept/connect ops with doPrivileged
- Replace Socket, ServerSocket, and HttpServer usages in tests with
  mocksocket versions

Packaging::
- Remove memlock suggestion from systemd service
- Set address space limit in systemd service file
- Version option should display if snapshot
- Ignore JVM options before checking Java version
- Also skip JAVA_TOOL_OPTIONS on Windows
- Introduce elasticsearch-env for Windows
- Introduce elasticsearch-env
- Stop exporting HOSTNAME from scripts
- Set number of processes in systemd unit file

Parent/Child::
- Remove ParentJoinFieldSubFetchPhase
- Support parent id being specified as number in the _source

Percolator::
- Store the QueryBuilder's Writable representation instead of its
  XContent representation
- Add support for selecting percolator query candidate matches
  containing wildcard / prefix queries

Plugin Discovery EC2::
- Read ec2 discovery address from aws instance tags

Plugin Lang Painless::
- Allow Custom Whitelists in Painless
- Update Painless to Allow Augmentation from Any Class
- Add Needs Methods to Painless Script Context Factories
- Support Script Context Stateful Factory in Painless
- Generate Painless Factory for Creating Script Instances
- Update Painless to Use New Script Contexts
- Optimize instance creation in LambdaBootstrap
- Make Painless Compiler Use an Instance Per Context
- Make PainlessScript An Interface

Plugin Repository GCS::
- GCS Repository: Add secure storage of credentials

Plugin Repository HDFS::
- Add permission checks before reading from HDFS stream
- Add doPrivilege blocks for socket connect ops in repository-hdfs
- Add Kerberos support for Repo HDFS plugin

Plugin Repository S3::
- S3 Repository: Add back repository level credentials

Plugins::
- Adjust SHA-512 supported format on plugin install
- Move tribe to a module
- Plugins can register pre-configured char filters
- Add purge option to remove plugin CLI
- Allow plugins to register pre-configured tokenizers
- Move ReindexAction class to core
- Make PreConfiguredTokenFilter harder to misuse
- Plugins: Remove leniency for missing plugins dir
- Add doPrivilege blocks for socket connect operations in plugins

Query DSL::
- Make slop optional when parsing `span_near` query
- Require a field when a `seed` is provided to the `random_score`
  function.
- Add support for auto_generate_synonyms_phrase_query in match_query,
  multi_match_query, query_string and simple_query_string

REST::
- Cat shards bytes
- Refactor PathTrie and RestController to use a single trie for all
  methods
- Make ObjectParser support string to boolean conversion

Recovery::
- Introduce a History UUID as a requirement for ops based recovery
- Goodbye, Translog Views
- Disallow multiple concurrent recovery attempts for same target shard
- Live primary-replica resync (no rollback)
- Peer Recovery: remove maxUnsafeAutoIdTimestamp hand off
- Introduce sequence-number-based recovery

Scripting::
- Scripting: Rename SearchScript.needsScores to needs_score
- Scripting: Add optional context parameter to put stored script
  requests
- Add New Security Script Settings
- Add StatefulFactoryType as optional intermediate factory in script
  contexts
- Make contexts available to ScriptEngine construction
- Make ScriptEngine.compile generic on the script context
- Add instance and compiled classes to script contexts

Search::
- Add soft limit on allowed number of script fields in request
- Add a soft limit for the number of requested doc-value fields
- Rewrite search requests on the coordinating nodes
- Ensure query resources are fetched asynchronously during rewrite
- Introduce a new Rewriteable interface to streamline rewriting
- Reduce the scope of `QueryRewriteContext`
- Reduce the overhead of timeouts and low-level search cancellation.
- Reduce profiling overhead.
- Prevent `can_match` requests from sending to incompatible nodes
- Add a shard filter search phase to pre-filter shards based on query
  rewriting
- Ensure we rewrite common queries to `match_none` if possible
- Limit the number of concurrent shard requests per search request
- Add cluster name validation to RemoteClusterConnection
- Speed up sorted scroll when the index sort matches the search sort
- Leverage scorerSupplier when applicable.
- Add Cross Cluster Search support for scroll searches
- Track EWMA[1] of task execution time in search threadpool executor
- Query range fields by doc values when they are expected to be more
  efficient than points
- Search: Fairer balancing when routing searches by session ID
-  Add parsing from xContent to Suggest
- Add parsing from xContent to ShardSearchFailure
- Eliminate array access in tight loops when profiling is enabled.
- Support Multiple Inner Hits on a Field Collapse Request
- Expand cross cluster search indices for search requests to the
  concrete index or to it's aliases

Search Templates::
- Add max concurrent searches to multi template search

Sequence IDs::
- Roll translog generation on primary promotion
- Restoring from snapshot should force generation of a new history
  uuid
- Add global checkpoint tracking on the primary
- Introduce global checkpoint background sync
- Move `UNASSIGNED_SEQ_NO` and `NO_OPS_PERFORMED` to SequenceNumbers`
- Move primary term from ReplicationRequest to ConcreteShardRequest
- Add reason to global checkpoint updates on replica
- Introduce primary/replica mode for GlobalCheckPointTracker
- Throw back replica local checkpoint on new primary
- Update global checkpoint when increasing primary term on replica
- Enable a long translog retention policy by default
- Introduce primary context
- Block older operations on primary term transition
- Block global checkpoint advances when recovering
- Add primary term to doc write response
- Preserve multiple translog generations
- Introduce translog generation rolling
- Replicate write failures
- Introduce sequence-number-aware translog
- Introduce translog no-op
- Tighten sequence numbers recovery
- Add BWC layer to seq no infra and enable BWC tests
- Add internal _primary_term doc values field, fix _seq_no indexing
- Add global checkpoint to translog checkpoints
- Sequence numbers commit data for Lucene uses Iterable interface
- Simplify GlobalCheckpointService and properly hook it for cluster
  state updates
- Fill gaps on primary promotion
- Introduce clean transition on primary promotion
- Guarantee that translog generations are seqNo conflict free
- Inline global checkpoints

Settings::
- Add disk threshold settings validation
- Enable cross-setting validation
- Validate `transport.profiles.*` settings
- Cleanup network / transport related settings
- Emit settings deprecation logging at most once
- IndexMetaData: Introduce internal format index setting
- Persist created keystore on startup unless keystore is present
- Settings: Add keystore.seed auto generated secure setting
- Settings: Add keystore creation to add commands

Snapshot/Restore::
- Fixed references to Multi Index Syntax
- Improves snapshot logging and snapshot deletion error handling
- Enhances get snapshots API to allow retrieving repository index only

Stats::
- Update `IndexShard#refreshMetric` via a
  `ReferenceManager.RefreshListener`
- Expose disk usage estimates in nodes stats

Store::
- Remote support for lucene versions without checksums

Suggesters::
- Remove deprecated _suggest endpoint

Task Manager::
- Add descriptions to bulk tasks

Translog::
- Translog file recovery should not rely on lucene commits

=== Bug fixes

Aggregations::
- Do not delegate a null scorer to LeafBucketCollectors
- Create weights lazily in filter and filters aggregation
- Fix IndexOutOfBoundsException in histograms for NaN doubles (#26787)
- Scripted_metric _agg parameter disappears if params are provided
- Fixes array out of bounds for value count agg
- Aggregations bug: Significant_text fails on arrays of text.
- Check bucket metric ages point to a multi bucket agg
- Terms aggregation should remap global ordinal buckets when a
  sub-aggregator is used to sort the terms
- Correctly set doc_count when MovAvg "predicts" values on existing
  buckets
- DateHistogram: Fix `extended_bounds` with `offset`
- Fix ArrayIndexOutOfBoundsException when no ranges are specified in
  the query

Aliases::
- mget with an alias shouldn't ignore alias routing
- GET aliases should 404 if aliases are missing

Allocation::
- Fix DiskThresholdMonitor flood warning
- Allow wildcards for shard IP filtering

Analysis::
- Pre-configured shingle filter should disable graph analysis
- PatternAnalyzer should lowercase wildcard queries when `lowercase`
  is true.

CAT API::
- Fix NPE for /_cat/indices when no primary shard

CRUD::
- Serialize and expose timeout of acknowledged requests in REST layer
- Fix silent loss of last command to _bulk and _msearch due to missing
  newline

Cache::
- Reduce the default number of cached queries.
- fix bug of weight computation

Circuit Breakers::
- Checks the circuit breaker before allocating bytes for a new big
  array

Cluster::
- Register setting `cluster.indices.tombstones.size`

Core::
- Correctly encode warning headers
- Fix cache compute if absent for expired entries
- Timed runnable should delegate to abstract runnable
- Stop invoking non-existent syscall
- MetaData Builder doesn't properly prevent an alias with the same
  name as an index
- Release operation permit on thread-pool rejection
- Node should start up despite of a lingering `.es_temp_file`
- Fix cache expire after access

Dates::
- Fix typo in date format

Discovery::
- MasterNodeChangePredicate should use the node instance to detect
  master change

Engine::
- Die with dignity while merging
- Engine - do not index operations with seq# lower than the local
  checkpoint into lucene

Geo::
- Fix typo in GeoUtils#isValidLongitude

Highlighting::
- Fix percolator highlight sub fetch phase to not highlight query
  twice
- FastVectorHighlighter should not cache the field query globally
- Higlighters: Fix MultiPhrasePrefixQuery rewriting
- Fix nested query highlighting

Index APIs::
- Shrink API should ignore templates
- Rollover max docs should only count primaries
- Validates updated settings on closed indices

Ingest::
- date processor should not fail if timestamp is specified as json
  number
- date_index_name processor should not fail if timestamp is specified
  as json number
- Sort Processor does not have proper behavior with targetField
- fix grok's pattern parsing to validate pattern names in expression
- Remove support for Visio and potm files
- Fix floating-point error when DateProcessor parses UNIX
- add option for _ingest.timestamp to use new ZonedDateTime (5.x
  backport)

Inner Hits::
- Do not allow inner hits that fetch _source and have a non nested
  object field as parent
- When fetching nested inner hits only access stored fields when
  needed
- If size / offset are out of bounds just do a plain count
- Fix Source filtering in new field collapsing feature

Internal::
- Bump version to 6.0.1
- `IndexShard.routingEntry` should only be updated once all internal
  state is ready
- Catch exceptions and inform handler in
  RemoteClusterConnection#collectNodes
- Internal: Add versionless alias for rest client codebase in policy
  files
- Upgrade Lucene to version 7.0.1
- Fix BytesReferenceStreamInput#skip with offset
- Fix race condition in RemoteClusterConnection node supplier
- Initialise empty lists in BaseTaskResponse constructor
- Extract a common base class for scroll executions
- Obey lock order if working with store to get metadata snapshots
- Fix Version based BWC and set correct minCompatVersion
- Fix `_field_caps` serialization in order to support cross cluster
  search
- Avoid race when shutting down controller processes
- Fix handling of document failure exception in InternalEngine
- Ensure remote cluster is connected before fetching `_field_caps`

Java API::
- BulkProcessor flush runnable preserves the thread context from
  creation time

Java High Level REST Client::
- Make RestHighLevelClient's Request class public
- Forbid direct usage of ContentType.create() methods
- Make ShardSearchTarget optional when parsing ShardSearchFailure

Java REST Client::
- Better message text for ResponseException
- rest-client-sniffer: configurable threadfactory

Logging::
- Allow not configure logging without config

Mapping::
- Allow copying from a field to another field that belongs to the same
  nested object.
- Fixed bug that mapper_parsing_exception is thrown for numeric field
  with ignore_malformed=true when inserting "NaN"
- Coerce decimal strings for whole number types by truncating the
  decimal part
- Fix parsing of ip range queries.
- Disable date field mapping changing
- Correctly enable _all for older 5.x indices
- token_count datatype should handle null value
- keep _parent field while updating child type mapping
- ICUCollationKeywordFieldMapper use SortedSetDocValuesField
- Fix serialization of the `_all` field.

More Like This::
- Pass over _routing value with more_like_this items to be retrieved

NOT CLASSIFIED::
- DocumentMissingException during Logstash scripted upsert
- An assertion trips when master opens an index from before 5.x

Nested Docs::
- In case of a single type the _id field should be added to the nested
  document instead of _uid field
- Inner hits source filtering not working

Network::
- Fixed ByteBuf leaking in
  org.elasticsearch.http.netty4.Netty4HttpRequestHandler
- Check for closed connection while opening
- Ensure pending transport handlers are invoked for all channel
  failures
- Notify onConnectionClosed rather than onNodeDisconnect to prune
  transport handlers
- Release pipelined http responses on close
- Fix error message if an incompatible node connects

Packaging::
- Fix handling of Windows paths containing parentheses
- Exit Windows scripts promptly on failure
- Pass config path as a system property
- ES_HOME needs to be made absolute before attempt at traversal
- Fix elasticsearch-keystore handling of path.conf
- Stop disabling explicit GC
- Avoid failing install if system-sysctl is masked
- Get short path name for native controllers
- When stopping via systemd only kill the JVM, not its control group
- remove remaining references to scripts directory
- Handle parentheses in batch file path
- Detect modified keystore on package removal
- Create keystore on RPM and Debian package install
- Add safer empty variable checking for Windows
- Export HOSTNAME environment variable
- Fix daemonization command status test
- Set RuntimeDirectory in systemd service

Parent/Child::
- The default _parent field should not try to load global ordinals

Percolator::
- Also support query extraction for queries wrapped inside a
  ESToParentBlockJoinQuery
- Fix range queries with date range based on current time in
  percolator queries.

Plugin Analysis Kuromoji::
- Fix kuromoji default stoptags

Plugin Analysis Phonetic::
- Fix beidermorse phonetic token filter for unspecified `languageset`

Plugin Discovery File::
- Fix discovery-file plugin to use custom config path

Plugin Ingest Attachment::
- Add missing mime4j library

Plugin Lang Painless::
- Painless: allow doubles to be casted to longs.

Plugin Repository Azure::
- Azure snapshots can not be restored anymore
- Snapshot : azure module - accelerate the listing of files (used in
  delete snapshot)
- Use Azure upload method instead of our own implementation
- Make calls to CloudBlobContainer#exists privileged

Plugin Repository GCS::
- Ensure that gcs client creation is privileged

Plugin Repository HDFS::
- Add Log4j to SLF4J binding for repository-hdfs
- Upgrading HDFS Repository Plugin to use HDFS 2.8.1 Client

Plugin Repository S3::
- Avoid SecurityException in repository-S3 on
  DefaultS3OutputStream.flush()
- Wrap getCredentials() in a doPrivileged() block

Plugins::
- X-Pack plugin download fails on Windows desktop
- Fix plugin installation permissions

Query DSL::
- Fixed incomplete JSON body on count request making
  org.elasticsearch.rest.action.RestActions#parseTopLevelQueryBuilder
go into endless loop
- SpanNearQueryBuilder should return the inner clause when a single
  clause is provided
- Refactor field expansion for match, multi_match and query_string
  query
- WrapperQueryBuilder should also rewrite the parsed query

REST::
- Rest test fixes
- Fix inconsistencies in the rest api specs for cat.snapshots
- Fix inconsistencies in the rest api specs for *_script
- exists template needs a template name
- Fix handling of invalid error trace parameter
- Fix handling of exceptions thrown on HEAD requests
- Fixed NPEs caused by requests without content.
- Fix get mappings HEAD requests

Recovery::
- Close translog view after primary-replica resync

Reindex API::
- Fix update_by_query's default size parameter
- Reindex: don't duplicate _source parameter
- Add qa module that tests reindex-from-remote against pre-5.0
  versions of Elasticsearch

Scroll::
- Fix single shard scroll within a cluster with nodes in version `>=
  5.3` and `<= 5.3`

Search::
- Fail query when a sort is provided in conjunction with rescorers
- Let search phases override max concurrent requests
- Avoid stack overflow on search phases
- Fix search_after with geo distance sorting
- Fix serialization errors when cross cluster search goes to a single
  shard
- Early termination with index sorting should not set terminated_early
  in the response
- Format doc values fields.
- Fix term(s) query for range field
- Caching a MinDocQuery can lead to wrong results.
- Fix random score generation when no seed is provided.
- Merge FunctionScoreQuery and FiltersFunctionScoreQuery
- Respect cluster alias in `_index` aggs and queries
- First increment shard stats before notifying and potentially sending
  response
- Remove assertion about deviation when casting to a float.
- Prevent skipping shards if a suggest builder is present
- Ensure remote cluster alias is preserved in inner hits aggs
- Do not search locally if remote index pattern resolves to no indices
- Adds check for negative search request size
- Make sure range queries are correctly profiled.
- Fix RangeFieldMapper rangeQuery to properly handle relations
- Fix ExpandSearchPhase when response contains no hits
- Refactor simple_query_string to handle text part like multi_match
  and query_string
- Fix `_exists_` in query_string on empty indices.
- Fix script field sort returning Double.MAX_VALUE for all documents
- Compute the took time of the query after the expand phase of field
  collapsing

Sequence IDs::
- Fire global checkpoint sync under system context
- Fix pre-6.0 response to unknown replication actions
- Track local checkpoint on primary immediately
- Initialize max unsafe auto ID timestamp on shrink
- Use correct primary term for replicating NOOPs
- Handle already closed while filling gaps
- TranslogWriter.assertNoSeqNumberConflict failure
- Avoid losing ops in file-based recovery
- Handle primary failure handling replica response

Settings::
- Emit settings deprecation logging on empty update
- Fix filtering for ListSetting
- Fix settings serialization to not serialize secure settings or not
  take the total size into account
- Keystore CLI should use the AddFileKeyStoreCommand for files
- Allow resetting settings that use an IP validator
- Updating an unrecognized setting should error out with that reason
- Settings: Fix setting groups to include secure settings

Similarities::
- Add boolean similarity to built in similarity types

Snapshot/Restore::
- Snapshot/Restore: better handle incorrect chunk_size settings in FS
  repo
- Snapshot/Restore: Ensure that shard failure reasons are correctly
  stored in CS
- Output all empty snapshot info fields if in verbose mode
- Remove redundant and broken MD5 checksum from repository-s3
- Consolidates the logic for cleaning up snapshots on master election
- Removes completed snapshot from cluster state on master change
- Keep snapshot restore state and routing table in sync
- Master failover during snapshotting could leave the snapshot
  incomplete
- Fix inefficient (worst case exponential) loading of snapshot
  repository

Stats::
- Fix RestGetAction name typo
- Keep cumulative elapsed scroll time in microseconds
- _nodes/stats should not fail due to concurrent
  AlreadyClosedException
- Avoid double decrement on current query counter
- Adjust available and free bytes to be non-negative on huge FSes

Suggesters::
- Fix division by zero in phrase suggester that causes assertion to
  fail
- Context suggester should filter doc values field
- Fix context suggester to read values from keyword type field

Templates::
- Tests: Fix FullClusterRestartIT.testSnapshotRestore test failing in
  6.x

Translog::
- Fix Translog.Delete serialization for sequence numbers

Upgrade API::
- Upgrade API: fix excessive logging and unnecessary template updates

=== Regressions

Bulk::
- Only re-parse operation if a mapping update was needed

Highlighting::
- Fix Fast Vector Highlighter NPE on match phrase prefix

Search::
- Always use DisjunctionMaxQuery to build cross fields disjunction

Sequence IDs::
- Indexing performance degradation in 6.0.0-beta1

=== Upgrades

Core::
- Upgrade to Lucene 7.0.0

Logging::
- Upgrade to Log4j 2.9.1

Network::
- Upgrade to Netty 4.1.13.Final

Plugin Ingest Attachment::
- Update to Tika 1.14

Upgrade API::
- Improve stability and logging of TemplateUpgradeServiceIT tests

(fhajny)

2017-11-20 10:50:20 UTC MAIN commitmail json YAML

doc: Updated archivers/libzip to 1.3.2

(wiz)

2017-11-20 10:50:09 UTC MAIN commitmail json YAML

libzip: update to 1.3.2.

1.3.2 [2017-11-20]
==================
* Fix bug introduced in last: zip_t was erroneously freed if zip_close() failed.

(wiz)

2017-11-20 09:22:45 UTC MAIN commitmail json YAML

doc/TODO: make myself responsible for nmh 1.7 update

(Everything is in pkgsrc-wip and probably ready to be imported as-is
but a commit message with pkgsrc and nmh changes need to be filled)

(leot)

2017-11-20 08:34:17 UTC MAIN commitmail json YAML

xentools48: use pkgsrc iasl, build is broken with iasl 20171110

From Chavdar Ivanov in PR pkg/52732

(maya)

2017-11-20 08:29:42 UTC MAIN commitmail json YAML

bash: comment broken option, remove dead master sites,
remove conflict with non-existent package.

PR pkg/51519

(maya)

2017-11-20 08:09:46 UTC MAIN commitmail json YAML

I'm sorry, should call res_ndestroy() instead of res_nclose() to
avoid an fd leak.
Bump PKGREVISION.

(he)

2017-11-20 04:54:18 UTC MAIN commitmail json YAML

doc: Updated www/contao44 to 4.4.8nb1

(taca)

2017-11-20 04:53:56 UTC MAIN commitmail json YAML

www/contao44: Update due to repacakge.

Add DIST_SUBDIR due to repacakging.

Bump PKGREVISION.

(taca)

2017-11-20 03:43:39 UTC MAIN commitmail json YAML

Updated sysutils/pciutils to 3.5.6.
Updated sysutils/intel-microcode-netbsd to 20171117.

(msaitoh)

2017-11-20 03:41:09 UTC MAIN commitmail json YAML

Update intel-microcode-netbsd to 20171117.

Added:
Family 6, Model 0x55, Stepping 0x4
(Xeon Scalable (Skylake))
00050654-5

Family 6, Model 0x5c, Stepping 0x9
(Atom (Goldmont))
000506c9-0
000506c9-1

Family 6, Model 0x7a, Stepping 0x1
(Atom (Goldmont Plus))
000706a1-0

Family 6, Model 0x9e, Stepping 0x[ab]
(7th gen Core (Kaby Lake))
000906ea-1
000906ea-5
000906eb-1

Updated:
Family 6, Model 0x55, Stepping 0x4
(Xeon Scalable (Skylake))
00050654-0
00050654-1
00050654-2
00050654-4
00050654-7

Family 6, Model 0x8e, Stepping 0xa
(7th gen Core (Kaby Lake))
000806ea-6
000806ea-7

(msaitoh)

2017-11-20 03:14:42 UTC MAIN commitmail json YAML

Update pciutils to 3.5.6.

2017-11-17  Martin Mares <mj@ucw.cz>

* Released as 3.5.6.

* Improvements of the FreeBSD back-end: read-only access for non-root,
  support DragonFly BSD, support extended config space.

* MN VPD keyword is decoded correctly.

* As usually, updated pci.ids to the current snapshot of the database.

(msaitoh)

2017-11-20 00:03:54 UTC MAIN commitmail json YAML

doc/TODO: add nmh-1.7.

(wiz)

2017-11-19 16:51:14 UTC MAIN commitmail json YAML

Updated sysutils/u-boot-pinebook to 2017.09

(jmcneill)

2017-11-19 16:50:35 UTC MAIN commitmail json YAML

2017-11-19 16:31:58 UTC MAIN commitmail json YAML

Note update of graphics/tiff to 4.0.9.

(he)

2017-11-19 16:31:04 UTC MAIN commitmail json YAML

Update tiff to version 4.0.9.

Pkgsrc changes:
* Adapt PLIST, remove patches for now-integrated bugfixes.

Upstream changes:
* Many changes related to security & stability.
  See the source's ChangeLog for the details.

(he)

2017-11-19 15:44:41 UTC MAIN commitmail json YAML

doc: Updated archivers/libzip to 1.3.1

(wiz)

2017-11-19 15:44:31 UTC MAIN commitmail json YAML

libzip: update to 1.3.1.

1.3.1 [2017-11-19]
==================

* Install zipconf.h into ${PREFIX}/include
* Add zip_libzip_version()
* Fix AES tests on Linux

(wiz)

2017-11-19 15:19:44 UTC MAIN commitmail json YAML

doc/TODO: add some

+ audacity-2.2.0, binutils-2.29.1, dbus-1.12.2, gtk3-3.22.26,
  gtkmm-3.22.2, haproxy-1.8, harfbuzz-1.7.1, libgsf-1.14.42,
  nickle-2.81, pango-1.40.14, plasma-5.11, poppler-0.61.1,
  py-setuptools-36.7.2, tiff-4.0.9, vala-0.38.3, vim-8.0.1316,
  vim-share-8.0.1316, x264-devel-20171118.

(wiz)

2017-11-19 15:08:38 UTC MAIN commitmail json YAML

doc: Updated devel/mk-configure to 0.29.2

(cheusov)

2017-11-19 15:08:25 UTC MAIN commitmail json YAML

Update mk-configure to 0.29.2

  Fix MKC_FEATURES "fgenln"
  mkc_check_common.sh is installed to libexec directory

(cheusov)

2017-11-19 12:58:02 UTC MAIN commitmail json YAML

doc: Updated editors/nano to 2.9.0

(wiedi)

2017-11-19 12:57:36 UTC MAIN commitmail json YAML

doc: Updated net/mikutter to 3.5.15

(tsutsui)

2017-11-19 12:57:24 UTC MAIN commitmail json YAML

nano: updated to 2.9.0

2017.11.18 - GNU nano 2.9.0 "Eta" introduces the ability to record and
replay keystrokes (M-: to start and stop recording, M-;
to play the macro back), makes ^Q and ^S do something
useful by default (^Q starts a backward search, and ^S
saves the current file), changes ^W to start always a
forward search, shows the number of open buffers (when
more than one) in the title bar, no longer asks to press
Enter when there are errors in an rc file, retires the
options '--quiet' and 'set quiet' and 'set backwards',
makes indenting and unindenting undoable, will look in
$XDG_CONFIG_HOME for a nanorc file and in $XDG_DATA_HOME
for the history files, adds a history stack for executed
commands (^R^X), does not overwrite the position-history
file of another nano, and fixes a score of tiny bugs.

(wiedi)

2017-11-19 12:57:11 UTC MAIN commitmail json YAML

mikutter: update to 3.5.15.

Upstream change:

- use Ruby-GNOME2 3.2.0

(tsutsui)

2017-11-19 10:47:05 UTC MAIN commitmail json YAML

doc: Updated ruby-gnome2 packages to 3.2.0

(tsutsui)

2017-11-19 10:38:40 UTC MAIN commitmail json YAML

ruby-gnome2: update to 3.2.0.

Upstream changes (from NEWS):

== Ruby-GNOME2 3.2.0: 2017-11-07

This is a bug fix release for Ruby/Poppler.

=== Changes

==== Ruby/GLib

  * Improvements

    * (({GLib::IOChannel#create_watch})): Supported.
      [GitHub#1106][Reported by kspt-johs]

    * (({GLib::IOChannel#create_watch})): Supported.

==== Ruby/GTK3

  * Improvements

    * Added a sample.
      [GitHub#1109][Patch by cedlemo]

==== Ruby/Poppler

  * Improvements

    * (({Poppler#Document#size})): Added again.

    * (({Poppler#Document#pages})): Added again.

  * Fixes

    * Updated dependencies.
      [GitHub#1107][Reported by OBATA Akio]

    * (({Poppler#Document#initialize(:data => data)})): Added
      workaround. It should be fixed in upstream.

=== Thanks

  * kspt-johs

  * OBATA Akio

  * cedlemo

(tsutsui)

2017-11-19 08:38:52 UTC MAIN commitmail json YAML

Updated www/mediawiki to 1.29.2

(wen)

2017-11-19 08:36:57 UTC MAIN commitmail json YAML

Update to 1.29.2

Upstream changes:
MediaWiki 1.29.2

This is a security and maintenance release of the MediaWiki 1.29 branch.
Changes since 1.29.1

    (T166757) Avoid scoped lock errors in Category::refreshCounts() due to nesting.
    (T175439) Unbreak Postgres Updater when setting defaults for a column.
    (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
    Fixed login button label to accept RawMessage.
    Fixed case of SpecialRecentChanges class usage.
    (T174255) Declare uploadCount property in importDump.php.
    (T163646) Pass a string not an int to mysql_real_escape_string().
    (T180143) Bump justinrainbow/json-schema development dependency to ~5.2.
    Updated dev dependancy phpunit/phpunit from v4.8.35 to v4.8.36.
    (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.
    (T165846) SECURITY: BotPassword login attempts weren't throttled.
    (T128209) SECURITY: Reflected File Download from api.php.
    (T134100) SECURITY: Do not reveal if user exists during login failure.
    (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
    (T125163) SECURITY: Make anchor for headlines escape > and <.
    (T180237) SECURITY: Protect vendor folder with .htaccess.
    (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in update.php.
    (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
    (T119158) SECURITY: Handle -{}- syntax in attributes safely.
    (T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly fixed in all branches in the previous security release.

(wen)

2017-11-18 18:39:56 UTC MAIN commitmail json YAML

Renamed sysutils/u-boot-sinovoip-bpi-m3 to sysutils/u-boot-bananapi-m3

(jmcneill)

2017-11-18 18:38:48 UTC MAIN commitmail json YAML

2017-11-17 23:21:30 UTC MAIN commitmail json YAML

doc: Updated multimedia/gst-plugins1-libav to 1.12.3nb1

(prlw1)

2017-11-17 23:21:06 UTC MAIN commitmail json YAML

gst-plugins1-libav: fix mp4 playback

From Jana Saout in https://bugzilla.gnome.org/show_bug.cgi?id=789193

Not meant as "fix" but as temporary workaround for people bothered
by this issue:

This quick & dirty hack replaces the deprecated call to
avcodec_decode_video2 by calls to avcodec_send_packet and
avcodec_receive_frame.

Note that this is hack is really ugly, because the API really isn't
meant to be used this way (the assumption is that each call to
avcodec_send_packet will produce at most one new frame) and also
the error handling and probably other cases are not handled correctly.

However, MP4 videos seem to play fine for me.

(prlw1)

2017-11-17 22:10:04 UTC MAIN commitmail json YAML

Note update of {py-,}protobuf to version 3.5.0.

(he)

2017-11-17 22:09:11 UTC MAIN commitmail json YAML

Upgrade protobuf to version 3.5.0.

Pkgsrc changes:
* Adapt PLIST.
* After exchange, set MAINTAINER to pkgsrc-users@

Upstream changes:

2017-11-13 version 3.5.0 (C++/Java/Python/PHP/Objective-C/C#/Ruby/JavaScript)
  Planned Future Changes
  * Make C++ implementation C++11 only: we plan to require C++11 to build
    protobuf code starting from 3.6.0 release. Please join this github issue:
    https://github.com/google/protobuf/issues/2780 to provide your feedback.

  General
  * Unknown fields are now preserved in proto3 for most of the language
    implementations for proto3 by default. See the per-language section for
    details.
  * reserve keyword are now supported in enums

  C++
  * Proto3 messages are now preserving unknown fields by default. If you rely on
    unknowns fields being dropped. Please use DiscardUnknownFields() explicitly.
  * Deprecated the unsafe_arena_release_* and unsafe_arena_add_allocated_*
    methods for string fields.
  * Added move constructor and move assignment to RepeatedField,
    RepeatedPtrField and google::protobuf::Any.
  * Added perfect forwarding in Arena::CreateMessage
  * In-progress experimental support for implicit weak fields with lite protos.
    This feature allows the linker to strip out more unused messages and reduce
    binary size.
  * Various performance optimizations.

  Java
  * Proto3 messages are now preserving unknown fields by default. If you'd like
    to drop unknown fields, please use the DiscardUnknownFieldsParser API. For
    example:
      Parser<Foo> parser = DiscardUnknownFieldsParser.wrap(Foo.parser());
      Foo foo = parser.parseFrom(input);
  * Added a new CodedInputStream decoder for Iterable<ByteBuffer> with direct
    ByteBuffers.
  * TextFormat now prints unknown length-delimited fields as messages if
    possible.
  * FieldMaskUtil.merge() no longer creates unnecessary empty messages when a
    message field is unset in both source message and destination message.
  * Various performance optimizations.

  Python
  * Proto3 messages are now preserving unknown fields by default. Use
    message.DiscardUnknownFields() to drop unknown fields.
  * Add FieldDescriptor.file in generated code.
  * Add descriptor pool FindOneofByName in pure python.
  * Change unknown enum values into unknown field set .
  * Add more Python dict/list compatibility for Struct/ListValue.
  * Add utf-8 support for text_format.Merge()/Parse().
  * Support numeric unknown enum values for proto3 JSON format.
  * Add warning for Unexpected end-group tag in cpp extension.

  PHP
  * Proto3 messages are now preserving unknown fields.
  * Provide well known type messages in runtime.
  * Add prefix "PB" to generated class of reserved names.
  * Fixed all conformance tests for encode/decode json in php runtime. C
    extension needs more work.

  Objective-C
  * Fixed some issues around copying of messages with unknown fields and then
    mutating the unknown fields in the copy.

  C#
  * Added unknown field support in JsonParser.
  * Fixed oneof message field merge.
  * Simplify parsing messages from array slices.

  Ruby
  * Unknown fields are now preserved by default.
  * Fixed several bugs for segment fault.

  Javascript
  * Decoder can handle both paced and unpacked data no matter how the proto is
    defined.
  * Decoder now accept long varint for 32 bit integers.

(he)

2017-11-17 15:09:34 UTC MAIN commitmail json YAML

Default build without xft - there are problems with switching fonts,
and we end up with a proportional font, which defeats the primary use
of this editor.

(hauke)

2017-11-17 14:17:17 UTC MAIN commitmail json YAML

Return to using the same system root as editors/xemacs{,-packages}.

(hauke)

2017-11-17 13:06:03 UTC MAIN commitmail json YAML

2017-11-17 11:37:30 UTC MAIN commitmail json YAML

Updated www/libsass, www/sassc

(adam)

2017-11-17 11:36:30 UTC MAIN commitmail json YAML

libsass/sassc: updated to 3.4.7

3.4.7:
Features
* Implement exponents for numbers
* Implement long file path support for Windows

Fixes
* Error on quoted string in simple selector parsing
* Do not compress colors in selectors
* Fix issue when passing restargs to call
* Fix issue with attribute selector unification
* Improve wrapped pseudo selector handling
* Improve extend of wrapped pseudo selectors
* Fix propagation of named rest arguments
* Do not output invisible support blocks
* Various build makefile and CI related fixes

(adam)

2017-11-17 11:19:13 UTC MAIN commitmail json YAML

Updated security/libassuan2, time/py-pendulum

(adam)

2017-11-17 11:18:50 UTC MAIN commitmail json YAML

py-pendulum: updated to 1.3.2

1.3.2
Fixed instance() behaviour with pytz offsets.
Fixed deepcopy / pickle compatibility for TimezoneInfo.

(adam)

2017-11-17 11:15:18 UTC MAIN commitmail json YAML

libassuan2: updated to 2.4.4

Changes in version 2.4.4:
* New configure option --disable-doc.
* Fix the use of nanosleep.
* Portability fixes for OpenBSD and macOS.
* Portability fix for systems not defining INADDR_LOOPBACK.
* Improve descriptor passing test to fix a Cygwin build problem.

(adam)

2017-11-17 11:08:09 UTC MAIN commitmail json YAML

doc: Updated www/php-glpi to 9.2.1

(hauke)

2017-11-17 11:07:39 UTC MAIN commitmail json YAML

Update www/php-glpi to v9.2.1

Upstream says:

You'll find below the changes of this bugfixes version:

- Rework mail attachments for notifications (inline images are now handled, ...),
- Fix ticket reopening,
- Fix operating system update on sub-entities,
- Fix issues on knowledge base items removal and display,
- Unset autoclose delay on fresh install,
- Improve private saved searches (with entities),
- Fix carriage return issues on tickets,
- Fix massive actions on operating systems,
- Fix migration issues from 9.1 and 9.2,
- Add support for other cache methods than APCu,
- Fix linear amortize calculation,
- Fix mail collector attachments owner,
- And many more!

Full ChangeLog:
<https://github.com/glpi-project/glpi/milestone/21?closed=1>

(hauke)

2017-11-17 09:52:25 UTC MAIN commitmail json YAML

2017-11-17 09:51:48 UTC MAIN commitmail json YAML

lighttpd: updated to 1.4.48

This release fixes a few regressions from lighttpd 1.4.46 and adds
a new module mod_authn_sasl when lighttpd is built --with-sasl

(adam)

2017-11-17 09:07:39 UTC MAIN commitmail json YAML

Downgraded www/py-selenium; Updated security/py-asyncssh

(adam)

2017-11-17 09:07:02 UTC MAIN commitmail json YAML

py-asyncssh: updated to 1.11.1

Release 1.11.1:
Switched to using PBKDF2 implementation provided by PyCA, replacing a much slower pure-Python implementation used in earlier releases.
Improved support for file-like objects in process I/O redirection, properly handling objects which don窶冲 support fileno() and allowing both text and binary file objects based on whether they have an 窶脇ncoding窶� member.
Changed PEM parser to be forgiving of trailing blank lines.
Updated documentation to note lack of support in OpenSSH for send_signal(), terminate(), and kill() channel requests.
Updated unit tests to work better with OpenSSH 7.6.
Updated Travis CI config to test with more recent Python versions.

(adam)

2017-11-17 08:15:43 UTC MAIN commitmail json YAML

py-selenium: downgraded to 3.7.0

The package was actually 3.7.0, but marked as 3.7.1.
Now, it does not depend on Java, and pulls the (pre-built) distfile from PyPI.

(adam)

2017-11-17 03:16:42 UTC MAIN commitmail json YAML

Updated www/moodle to 3.3.3

(wen)

2017-11-17 03:15:41 UTC MAIN commitmail json YAML

Update to 3.3.3

Upstream changes:
Highlights

    MDL-59798 - Assignment: Show Due Date in calendar for teachers and managers
    MDL-36580 - External Tool: backup/restore consumer key and secret (on the same site only)
    MDL-57560 - Show file upload progress bar in Boost theme
    MDL-37810 - List custom roles in the filter on Participants page

Security issues

A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
Fixes and improvements

    MDL-52131 - Respect comment format in questions manual comments when Plain text area editor is used
    MDL-55849 - Assignment: Reopening a group assignment should not create additional attempts for each group member
    MDL-59909 - Fixed error in ad-hoc refresh_mod_calendar_events_task that caused exceptions and very long cron run time
    MDL-59780 - Restore MathJax filter settings that were lost in previous upgrades
    MDL-54540 - External tool: Allow to switch to full screen mode
    MDL-51892 - Better explaination of the reason for failed logins in the logs report
    MDL-57055 - Label resource: allow to access "Label administration" without Administration block on the "Edit label" page
    MDL-53244 - Show error message when incorrect CAPTCHA is entered on sign-up page
    MDL-57477 - Fixed configuration of PHP 7 sessions using memcached (3.x.x)
    MDL-59854 - Forum: Avoid creating duplicate subscriptions due to race conditions
    MDL-60366 - Feedback: fixed upgrade script (introduced in 3.1.6 and 3.2.3) that deleted valid multiple anonymous attempts. If your site was affected, please follow MDL-60592 for the script that restores accidentally deleted data.

(wen)

2017-11-17 02:32:11 UTC MAIN commitmail json YAML

Updated textproc/p5-Filter to 0.58

(wen)

2017-11-17 02:31:21 UTC MAIN commitmail json YAML

Update to 1.58

Upstream changes:
1.58 2017-11-15 rurban
----
  * Drop 5.005 support
  * Switch from DynaLoader to XSLoader [atoomic #5]
  * Replace use vars by our. [atoomic #5]
  * Lazy load Carp only when required. [atoomic #5]
  * Minor test improvements
  * Fix v5.8 cast warnings

(wen)

2017-11-17 02:23:46 UTC MAIN commitmail json YAML

Updated textproc/p5-YAML-LibYAML to 0.67

(wen)

2017-11-17 02:22:51 UTC MAIN commitmail json YAML

Update to 0.67

Upstream changes:
0.67 Wed Nov 15 18:59:33 CET 2017
- Support standard tags !!str, !!map and !!seq instead of dying. PR#67
  (TINITA++)
- Support JSON::PP::Boolean and boolean.pm via $YAML::XS::Boolean. PR#66
  (TINITA++) Thanks also to Bj譫嗷n H譫喇rmann for SvPV_nolen()

(wen)

2017-11-17 02:16:20 UTC MAIN commitmail json YAML

Updated devel/p5-Moo to 2.003003

(wen)

2017-11-17 02:15:20 UTC MAIN commitmail json YAML

Update to 2.003003

Upstream changes:
2.003003 - 2017-11-16
  - test tweaks
  - fix handling of code refs stored directly in the stash (for perl 5.28)
  - consider inline packages with constants in them as being loaded
  - stubs will be treated as methods that exist when inflating to Moose
  - avoid loading overload.pm unless required

(wen)

2017-11-17 00:53:53 UTC MAIN commitmail json YAML

Update to 52.5.0

* Sync with www/firefox52-52.5.0

(ryoon)

2017-11-17 00:53:05 UTC MAIN commitmail json YAML

Updated mail/thunderbird-l10n to 52.4.0

(ryoon)

2017-11-17 00:52:40 UTC MAIN commitmail json YAML

Update to 52.4.0

* Sync with mail/thunderbird-52.4.0

(ryoon)

2017-11-17 00:49:50 UTC MAIN commitmail json YAML

Updated mail/thunderbird to 52.4.0

(ryoon)

2017-11-17 00:49:20 UTC MAIN commitmail json YAML

Update to 52.4.0

Chagelog:
New
In Thunderbird 52 a new behavior was introduced for replies to mailing
list posts: "When replying to a mailing list, reply will be sent to
address in From header ignoring Reply-to header". A new preference
mail.override_list_reply_to allows to restore the previous behavior.

Fixed
Under certain circumstances (image attachment and non-image attachment),
attached images were shown truncated in messages stored in IMAP
folders not synchronised for offline use.

Fixed
IMAP UIDs > 0x7FFFFFFF not handled properly

Security fixes:
#CVE-2017-7793: Use-after-free with Fetch API

Reporter
    Abhishek Arya
Impact
    high

Description

A use-after-free vulnerability can occur in the Fetch API when the
worker or the associated window are freed when still in use,
resulting in a potentially exploitable crash.

References
    Bug 1371889

#CVE-2017-7818: Use-after-free during ARIA array manipulation

Reporter
    Nils
Impact
    high

Description

A use-after-free vulnerability can occur when manipulating arrays of
Accessible Rich Internet Applications (ARIA) elements within containers
through the DOM. This results in a potentially exploitable crash.

References
    Bug 1363723

#CVE-2017-7819: Use-after-free while resizing images in design mode

Reporter
    Nils
Impact
    high

Description

A use-after-free vulnerability can occur in design mode when image
objects are resized if objects referenced during the resizing have
been freed from memory. This results in a potentially exploitable crash.

References
    Bug 1380292

#CVE-2017-7824: Buffer overflow when drawing and validating elements
with ANGLE

Reporter
    Omair, Andre Weissflog
Impact
    high

Description

A buffer overflow occurs when drawing and validating elements with
the ANGLE graphics library, used for WebGL content. This is due to
an incorrect value being passed within the library during checks and
results in a potentially exploitable crash.

References
    Bug 1398381

#CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes

Reporter
    Martin Thomson
Impact
    high

Description

During TLS 1.2 exchanges, handshake hashes are generated which point
to a message buffer. This saved data is used for later messages but
in some cases, the handshake transcript can exceed the space available
in the current buffer, causing the allocation of a new buffer. This
leaves a pointer pointing to the old, freed buffer, resulting in
a use-after-free when handshake hashes are then calculated afterwards.
This can result in a potentially exploitable crash.

References
    Bug 1377618

#CVE-2017-7814: Blob and data URLs bypass phishing and malware
protection warnings

Reporter
    Fran巽ois Marier
Impact
    moderate

Description

File downloads encoded with blob: and data: URL elements bypassed
normal file download checks though the Phishing and Malware Protection
feature and its block lists of suspicious sites and files. This
would allow malicious sites to lure users into downloading executables
that would otherwise be detected as suspicious.

References
    Bug 1376036

#CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode
characters as spaces

Reporter
    Khalil Zhani
Impact
    moderate

Description

Several fonts on OS X display some Tibetan and Arabic characters
as whitespace. When used in the addressbar as part of an IDN
this can be used for domain name spoofing attacks.
Note: This attack only affects OS X operating systems. Other
operating systems are unaffected.

References
    Bug 1393624
    Bug 1390980

#CVE-2017-7823: CSP sandbox directive did not create a unique origin

Reporter
    Jun Kokatsu
Impact
    moderate

Description

The content security policy (CSP) sandbox directive did not
create a unique origin for the document, causing it to behave as
if the allow-same-origin keyword were always specified. This could
allow a Cross-Site Scripting (XSS) attack to be launched from
unsafe content.

References
    Bug 1396320

#CVE-2017-7810: Memory safety bugs fixed in Firefox 56, Firefox ESR 52.4,
and Thunderbird 52.4

Reporter
    Mozilla developers and community
Impact
    critical

Description

Mozilla developers and community members Christoph Diehl, Jan de Mooij,
Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, and Sebastian
Hengst reported memory safety bugs present in Firefox 55, Firefox
ESR 52.3, and Thunderbird 52.3. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort that some
of these could be exploited to run arbitrary code.

References
    Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

(ryoon)

2017-11-17 00:22:47 UTC MAIN commitmail json YAML

Updated www/firefox52-l10n to 52.5.0

(ryoon)

2017-11-17 00:19:54 UTC MAIN commitmail json YAML

Updated www/firefox52 to 52.5.0

(ryoon)

2017-11-17 00:19:01 UTC MAIN commitmail json YAML

Update to 52.5.0

Changelog:
Security fixes:
#CVE-2017-7828: Use-after-free of PressShell while restyling layout

Reporter
    Nils
Impact
    critical

Description

A use-after-free vulnerability can occur when flushing and resizing
layout because the PressShell object has been freed while still
in use. This results in a potentially exploitable crash during
these operations.

References

    Bug 1406750
    Bug 1412252

#CVE-2017-7830: Cross-origin URL information leak through Resource Timing API

Reporter
    Jun Kokatsu
Impact
    high

Description

The Resource Timing API incorrectly revealed navigations in cross-origin
iframes. This is a same-origin policy violation and could allow for
data theft of URLs loaded by users.

References

    Memory safety bugs fixed in Firefox 57

#CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

Reporter
    Mozilla developers and community
Impact
    critical

Description

Mozilla developers and community members Christian Holler, David
Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer,
Philipp, Nicholas Nethercote, Oriol Brufau, Andr辿 Bargull, Bob Clary,
Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, and Ryan VanderMeulen
reported memory safety bugs present in Firefox 56 and Firefox ESR 52.4.
Some of these bugs showed evidence of memory corruption and we presume
that with enough effort that some of these could be exploited to
run arbitrary code.

References

    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

(ryoon)

2017-11-16 22:36:34 UTC MAIN commitmail json YAML

doc: Updated devel/py-h5py to 2.7.1

(minskim)

2017-11-16 22:36:04 UTC MAIN commitmail json YAML

devel/py-h5py: Update to 2.7.1

Notable changes since 2.5.0:
- Support for HDF5 Virtual Dataset API
- Add MPI Collective I/O Support

(minskim)

2017-11-16 21:10:56 UTC MAIN commitmail json YAML

Add support for LDFLAGS

This notably fixes building with RELRO enabled (without cwrappers).

(khorben)

2017-11-16 19:48:24 UTC MAIN commitmail json YAML

rust: Restore SunOS support.  Switch back to configure script.

No changes intended on other platforms, the configure script arguments
should be identical to those previously found in config.toml.  Doing it
this way makes it a lot easier to have per-OS configuration.

(jperkin)

2017-11-16 18:51:32 UTC MAIN commitmail json YAML

doc: Updated devel/py-ipython to 6.2.1nb1

(minskim)

2017-11-16 18:50:53 UTC MAIN commitmail json YAML

devel/py-ipython: Needs py-typing when used with python34

Bump PKGREVISION.

(minskim)

2017-11-16 16:49:40 UTC MAIN commitmail json YAML

Update gst-plugins1-libav to 1.12.3

Bugs fixed in this release
- 784735 : gst-libav: Memory leak and possible crash in avio_alloc_context.

XXX Unfortunately https://trac.ffmpeg.org/ticket/6775 stands.
(ffmpeg 3.4 regression)

(prlw1)

2017-11-16 15:14:54 UTC MAIN commitmail json YAML

Remove useless patch

This modification to the Makefile is no longer necessary since the
custom CFLAGS and LDFLAGS are now passed explicitly, instead of through
the environment (which did not work for me).

NFC.

(khorben)

2017-11-16 15:11:10 UTC MAIN commitmail json YAML

doc: Updated multimedia/adobe-flash-player to 27.0.0.187

(tsutsui)

2017-11-16 15:10:44 UTC MAIN commitmail json YAML

adobe-flash-player: update to 27.0.0.187.

Upstream announcement:

https://helpx.adobe.com/security/products/flash-player/apsb17-33.html

Adobe Security Bulletin
Security updates available for Flash Player | APSB17-33

(tsutsui)

2017-11-16 15:07:05 UTC MAIN commitmail json YAML

2017-11-16 15:05:31 UTC MAIN commitmail json YAML

More generic fix for CFLAGS and LDFLAGS for audio/ladspa

In the C plug-ins, mark the constructor and destructor functions as
such. While there, comment out a new target to run the tests; they are
broken, but not because of this modification. This allows us to use
cc(1) to link the plug-ins, thus working around a bug in the cwrappers
for ld(1).

Bump PKGREVISION, since this generates a different binary now that SSP
and FORTIFY are enabled.

(khorben)

2017-11-16 14:52:30 UTC MAIN commitmail json YAML

doc: Updated devel/gradle to 4.3.1

(fhajny)

2017-11-16 14:52:21 UTC MAIN commitmail json YAML

Update devel/gradle to 4.3.1.

This bug-fix release addresses several regressions in Gradle 4.3.

- Gradle 4.3 introduced an improvement where an error in resolving a
  module from one repository would prevent Gradle from searching for
  that same module in subsequent repositories. However, the change to
  abort searching repositories on all unrecognized errors proved to be
  too aggressive. With 4.3.1, only repository timeout errors will
  prevent Gradle from searching for a module in a subsequent repository.
- Moreover, the connection and socket timeouts for HTTP/HTTPS requests
  have been increased to 30 seconds.
- This version of Gradle also removes an overload of
  TaskInputs.property which caused statically compiled plugin code to
  use the wrong method when calling TaskInputs.property(..., null).
- Finally, when using --scan the build scan plugin is applied before
  other plugins to avoid rendering a warning message.

(fhajny)

2017-11-16 14:49:22 UTC MAIN commitmail json YAML

doc: Updated databases/py-cassandra-driver to 3.12.0

(fhajny)

2017-11-16 14:49:12 UTC MAIN commitmail json YAML

Update databases/py-cassandra-driver to 3.12.0.

Features
- Send keyspace in QUERY, PREPARE, and BATCH messages
- Add IPv4Address/IPv6Address support for inet types
- WriteType.CDC and VIEW missing
- Warn on Cluster init if contact points are specified but LBP isn't
- Include hash of result set metadata in prepared stmt id
- Add NO_COMPACT startup option
- Add new exception type for CDC

Bug Fixes
- Both _set_final_exception/result called for the same ResponseFuture
- Use of DCAwareRoundRobinPolicy raises NoHostAvailable exception
- Not create two sessions by default in CQLEngine
- Bug when subclassing AyncoreConnection
- Error at cleanup when closing the asyncore connections
- Fix sites where sessions can change during iteration
- cqlengine: allow min_length=0 for Ascii and Text column types
- Rare exception when "sys.exit(0)" after query timeouts
- Dont set the session keyspace when preparing statements
- Use of DCAwareRoundRobinPolicy raises NoHostAvailable exception

Other
- Remove DeprecationWarning when using WhiteListRoundRobinPolicy
- Bump Cython dependency version to 0.27

(fhajny)

2017-11-16 13:57:19 UTC MAIN commitmail json YAML

2017-11-16 12:51:18 UTC MAIN commitmail json YAML

Note update of sysutils/zabbix{,-frontend} to version 3.2.10.

(he)

2017-11-16 12:50:34 UTC MAIN commitmail json YAML

Update to zabbix version 3.2.10.

Pkgsrc changes:
* for zabbix-frontend, adjust PLIST

Upstream changes:
Changes for 3.2.10

3.2.10rc1 was released as 3.2.10 without any changes

Changes for 3.2.10rc1

New features:
..F....... [ZBXNEXT-1421] added service sorting by name if multiple services
          has same 'sortorder' value (miks)
..F....... [ZBXNEXT-4081] improved error message for case when none of
  supported database modules exists (gcalenko)

Bug fixes:
..F....... [DEV-593] fixed multiple security issues (miks)
........S. [ZBX-11658] fixed error message in case no items were found
  for aggre gated check (gleb)
.......PS. [ZBX-12854] fixed crash of VMware collector with DebugLevel=4 (gleb)
...G...... [ZBX-11902] fixed CPU count for LPAR partitions in IBM AIX (abs)
...G...... [ZBX-12260] fixed windows agent to support UTF-16LE, UCS-2,
  UCS-2LE encodings (vso)
..F....... [ZBX-6669] fixed use of current host as filter when selecting
  items for graph forms and trigger forms (gcalenko)
..F....... [ZBX-12722] fixed scrollbar causing a JS error in "500 latest
  values" page due to unnecessarily initialization (Ivo)
..F....... [ZBX-12710] fixed OS type detection logic (vjaceslavs)
..F....... [ZBX-12543] fixed problems with session management (vjaceslavs)
........S. [ZBX-12259] added an informative warning about lack of data for
  macros used in LLD rule filter (viktors)

--------------------------------------------------------------------------------
Changes for 3.2.9

3.2.9rc1 was released as 3.2.9 without any changes

--------------------------------------------------------------------------------
Changes for 3.2.9rc1

New features:
...G...PS. [ZBXNEXT-1862] modified server, proxy and agent to follow
  changes in /etc/resolv.conf (Andris)

Bug fixes:
..F....... [ZBX-12788] fixed error when template is added to hosts via
  mass update form (gcalenko, vmurzins)
..F....... [ZBX-12666] fixed ETag comparison check in jsLoader for web
  server with enabled compression (gcalenko)
........S. [ZBX-10547] fixed IT services calculation in parallel
  transactions not seeing each other changes when calculating
  common parent service (vso)
........S. [ZBX-12441] fixed user permission check for macros containing
  user personal information in notification messages (viktors)
....I..... [ZBX-12779] fixed detection of PostgreSQL 10 (Andris)
.......P.. [ZBX-12281] fixed simultaneous sending of the same history
  data from passive proxy (gleb, vjaceslavs)
..F....... [ZBX-12770] fixed links in select popup for user groups;
  updated group selection field in Administration->Users (gcalenko)
A......... [ZBX-8277] improved performance of hostgeneral.unlink() method;
  fixed SQL statement (Sasha)
........S. [ZBX-11426] fixed the housekeeper for not deleting events in
  open problem state (abs)
A......... [ZBX-10754] fixed inheritance of template properties in
  web scenarios (miks)
A......... [ZBX-12681] fixed SQL errors in event.get() method (Sasha)
A......... [ZBX-12727] fixed response for script.get() method with
  "editable" flag (Sasha)
A......... [ZBX-12727] fixed dcheck.get(), dhost.get() and dservice.get()
  permission checks for admin users; related to ZBX-7238 (Sasha)

--------------------------------------------------------------------------------
Changes for 3.2.8

3.2.8rc1 was released as 3.2.8 without any changes

--------------------------------------------------------------------------------
Changes for 3.2.8rc1

New features:
A.F....... [ZBX-1357] enabled Turkish translation to be displayed
  by default (zalex_ua)
A.F....... [ZBX-1357] updated Czech, English (United States), French,
  Italian, Japanese, Korean, Russian, Turkish translations;
  thanks to Zabbix translators (zalex_ua)
........S. [ZBX-12258] added bulk selections to improve performance
  in processing of escalations (Sergejs)

Bug fixes:
..F....... [ZBX-12769] fixed XSS vulnerabilities in argument passing for
  popup forms and file import forms (gcalenko)
A.F....... [ZBX-12768] added schema validation for URL fields based on
  schemas whitelist in ZBX_URI_VALID_SCHEMES (gcalenko, Sasha)
.......PS. [ZBX-11675] fixed crash that could occur during connection
  failures to MySQL (Sergejs, vso)
..F....... [ZBX-12617] fixed sorting by host name for items on
  availability report page (gcalenko)
........S. [ZBX-12696] fixed trigger not being calculated for newly
  received item values if last one of those is unsupported value (vso)
..F....... [ZBX-12548] fixed notification sound not being played for
  message with timeout set to greater than minute (gcalenko)
...G...... [ZBX-12653] fixed heap corruption in Windows agent;
  thanks to Ronnie Kaech for the patch (abs)
A......... [ZBX-12660] fixed result of hostinterface.replacehostinterfaces
  method (Sasha)
..F....... [ZBX-12469] added new context for 'Second' string to be
  properly translated in maintenance period form (gcalenko)
.......PS. [ZBX-12493] fixed address and ports array size in
  zbx_init_ipmi_host() to match OpenIPMI internals (Andris, vso)
..F....... [ZBX-12623] fixed label macro resolving in maps (vjaceslavs)
..F.....S. [ZBX-11042] allowed libcurl to choose SMTP authentication
  mechanism other than PLAIN (gleb, vjaceslavs)
..F....... [ZBX-8997] fixed trigger expression validation test
  form (gcalenko, Sasha)
..F.I...S. [ZBX-12434] fixed housekeeping of problems and events for
  deleted items and triggers; added optional database patch
  to cleanup problems for deleted items and triggers (vso)
..F....... [ZBX-12646] fixed incorrect SQL query in availability reports (Sasha)
..F....... [ZBX-12545] fixed undefined index error on latest data
  page when host was deleted in another session (gcalenko)
..F....... [ZBX-12321] fixed removal of multiselect options using
  backspace button (miks)
..F....... [ZBX-12416] optimized data selection of user preferences
  stored in profiles (gcalenko)
..F....... [ZBX-11607] fixed a rounding of large unsigned numbers (miks)
..F....... [ZBX-12404] fixed visibility of item data first row for
  'latest data' page and 'audit log' page (gcalenko)
..F....... [ZBX-12463] fixed undefined index error in "Last 20 issues" (Sasha)
........S. [ZBX-12186] fixed parallel processing of multiple values
  for same lld rule (vjaceslavs)
..F....... [ZBX-11887] fixed improper DB::refreshIds() call when
  selected row is locked (miks)
..F....... [ZBX-12022] fixed trigger resolving in services configuration;
  fixed popup window size (miks)
..F....... [ZBX-12429] fixed template replacement in mass update form (gcalenko)
..F....... [ZBX-12396] fixed an error in screens if screen trigger
  overview element contains deleted host group (miks)
..F....... [ZBX-12439] fixed macro name field length in host configuration
  form (gcalenko)
...G...PS. [ZBX-10820] fixed potential loss of data when server/proxy
  processes zabbix_sender data (Andris)
........S. [ZBX-12446] fixed discovery and auto registration to accept
  empty DNS names (vso)
........S. [ZBX-12295] fixed possible accumulation of executed tasks in
  database (Sergejs)
........S. [ZBX-12318] fixed maintenance status not being updated in cache
  if host is disabled (vso)
.......PS. [ZBX-12224] fixed connection to Oracle database when database
  server gives out warnings (gleb)
...G...PS. [ZBX-12195] fixed contamination of script output with Zabbix'es
  own log messages when logging level is set to 4 or 5 and
  LogType=console (gleb)
...G...... [ZBX-12270] fixed processing of AIX item 'system.stat[ent]'
  in agent; thanks to Marc for patch (Andris)
..F....... [ZBX-12277] fixed trigger expression test form incorrectly
  replacing macros (Ivo)

(he)

2017-11-16 11:31:22 UTC MAIN commitmail json YAML

doc: Updated security/vault to 0.9.0

(fhajny)

2017-11-16 11:31:12 UTC MAIN commitmail json YAML

Update security/vault to 0.9.0.

DEPRECATIONS/CHANGES:

- API HTTP client behavior: When calling `NewClient` the API no longer
  modifies the provided client/transport.
- AWS EC2 client nonce behavior: The client nonce generated by the
  backend that gets returned along with the authentication response
  will be audited in plaintext.
- AWS Auth role options: The API will now error when trying to create
  or update a role with the mutually-exclusive options
  `disallow_reauthentication` and `allow_instance_migration`.
- SSH CA role read changes: When reading back a role from the `ssh`
  backend, the TTL/max TTL values will now be an integer number of
  seconds rather than a string. This better matches the API elsewhere
  in Vault.
- SSH role list changes: When listing roles from the `ssh` backend via
  the API, the response data will additionally return a `key_info` map
  that will contain a map of each key with a corresponding object
  containing the `key_type`.
- More granularity in audit logs: Audit request and response entires
  are still in RFC3339 format but now have a granularity of
  nanoseconds.
- High availability related values have been moved out of the
  `storage` and `ha_storage` stanzas, and into the top-level
  configuration. `redirect_addr` has been renamed to `api_addr`.
- A new `seal` stanza has been added to the configuration file, which
  is optional and enables configuration of the seal type to use for
  additional data protection, such as using HSM or Cloud KMS solutions
  to encrypt and decrypt data.

FEATURES:

- RSA Support for Transit Backend: Transit backend can now generate
  RSA keys which can be used for encryption and signing.
- Identity System: Now in open source and with significant
  enhancements, Identity is an integrated system for understanding
  users across tokens and enabling easier management of users directly
  and via groups.
- External Groups in Identity: Vault can now automatically assign
  users and systems to groups in Identity based on their membership in
  external groups.
- Seal Wrap / FIPS 140-2 Compatibility (Enterprise): Vault can now
  take advantage of FIPS 140-2-certified HSMs to ensure that Critical
  Security Parameters are protected in a compliant fashion.
- Control Groups (Enterprise): Require multiple members of an Identity
  group to authorize a requested action before it is allowed to run.
- Cloud Auto-Unseal (Enterprise): Automatically unseal Vault using AWS
  KMS and GCP CKMS.
- Sentinel Integration (Enterprise): Take advantage of HashiCorp
  Sentinel to create extremely flexible access control policies - even
  on unauthenticated endpoints.
- Barrier Rekey Support for Auto-Unseal (Enterprise): When using
  auto-unsealing functionality, the `rekey` operation is now
  supported; it uses recovery keys to authorize the master key rekey.
- Operation Token for Disaster Recovery Actions (Enterprise): When
  using Disaster Recovery replication, a token can be created that can
  be used to authorize actions such as promotion and updating primary
  information, rather than using recovery keys.
- Trigger Auto-Unseal with Recovery Keys (Enterprise): When using
  auto-unsealing, a request to unseal Vault can be triggered by a
  threshold of recovery keys, rather than requiring the Vault process to
  be restarted.
- UI Redesign (Enterprise): All new experience for the Vault
  Enterprise UI. The look and feel has been completely redesigned to
  give users a better experience and make managing secrets fast and
  easy.
- UI: SSH Secret Backend (Enterprise): Configure an SSH secret
  backend, create and browse roles. And use them to sign keys or
  generate one time passwords.
- UI: AWS Secret Backend (Enterprise): You can now configure the AWS
  backend via the Vault Enterprise UI. In addition you can create
  roles, browse the roles and Generate IAM Credentials from them
  in the UI.

IMPROVEMENTS:

- api: Add ability to set custom headers on each call
- command/server: Add config option to disable requesting client
  certificates
- core: Disallow mounting underneath an existing path, not just over
- physical/file: Use `700` as permissions when creating directories.
  The files themselves were `600` and are all encrypted, but this
  doesn't hurt.
- secret/aws: Add ability to use custom IAM/STS endpoints
- secret/cassandra: Work around Cassandra ignoring consistency levels
  for a user listing query
- secret/pki: Private keys can now be marshalled as PKCS#8
- secret/pki: Allow entering URLs for `pki` as both comma-separated
  strings and JSON arrays
- secret/ssh: Role TTL/max TTL can now be specified as either a string
  or an integer
- secret/transit: Sign and verify operations now support a `none` hash
  algorithm to allow signing/verifying pre-hashed data
- secret/database: Add the ability to glob allowed roles in the
  Database Backend
- ui (enterprise): Support for RSA keys in the transit backend
- ui (enterprise): Support for DR Operation Token generation,
  promoting, and updating primary on DR Secondary clusters

BUG FIXES:

- api: Fix panic when setting a custom HTTP client but with a nil
  transport
- api: Fix authing to the `cert` backend when the CA for the client
  cert is not known to the server's listener
- auth/approle: Create role ID index during read if a role is missing
  one
- auth/aws: Don't allow mutually exclusive options
- auth/radius: Fix logging in in some situations
- core: Fix memleak when a connection would connect to the cluster
  port and then go away
- core: Fix panic if a single-use token is used to step-down or seal
- core: Set rather than add headers to prevent some duplicated headers
  in responses when requests were forwarded to the active node
- physical/etcd3: Fix some listing issues due to how etcd3 does prefix
  matching
- physical/etcd3: Fix case where standbys can lose their etcd client
  lease
- physical/file: Fix listing when underscores are the first component
  of a path
- plugins: Allow response errors to be returned from backend plugins
- secret/transit: Fix panic if the length of the input ciphertext was
  less than the expected nonce length
- ui (enterprise): Reinstate support for generic secret backends -
  this was erroneously removed in a previous release

(fhajny)

2017-11-16 11:01:47 UTC MAIN commitmail json YAML

Note update of sysutils/zabbix to 3.2.7nb3.

(he)

2017-11-16 11:01:12 UTC MAIN commitmail json YAML

Zabbix_agentd is a threaded program, and it tries to muck with the
global `_res' variable.  That's not supported on NetBSD, and IME
causes the zabbix agent daemon to exit shortly after having been started.
Convert to instead using res_ninit(), res_nsend(), and res_nclose().
Bump PKGREVISION.

(he)

2017-11-16 10:32:36 UTC MAIN commitmail json YAML

p5-Function-Parameters: remove comment about failing test

The reason was a pkgsrc patch for perl5; the patch
has been removed.

(wiz)

2017-11-16 10:28:38 UTC MAIN commitmail json YAML

doc: Updated lang/perl5 to 5.26.1nb1

(wiz)

2017-11-16 10:28:26 UTC MAIN commitmail json YAML

perl: Remove patch-dist_Carp_lib_Carp.pm

This patch is a workaround for a perl core problem.
The patch has not been accepted upstream, and in its current form
introduces other bugs, see https://rt.perl.org/Ticket/Display.html?id=132448

Bump PKGREVISION.

(wiz)

2017-11-16 09:59:02 UTC MAIN commitmail json YAML

Note update of textproc/icu to 59.1nb3.

(he)

2017-11-16 09:58:26 UTC MAIN commitmail json YAML

2017-11-16 08:00:35 UTC MAIN commitmail json YAML

Updated devel/py-attrs, devel/py-hypothesis

(adam)

2017-11-16 07:59:55 UTC MAIN commitmail json YAML

py-hypothesis: updated to 3.37.0

3.37.0:
This is a deprecation release for some health check related features.

The following are now deprecated:

* Passing exception_in_generation to suppress_health_check. This no longer does anything even when passed - All errors that occur during data generation will now be immediately reraised rather than going through the health check mechanism.

* Passing random_module to suppress_health_check. This hasn窶冲 done anything for a long time, but was never explicitly deprecated. Hypothesis always seeds the random module when running @given tests, so this is no longer an error and suppressing it doesn窶冲 do anything.

* Passing non-HealthCheck values in suppress_health_check. This was previously allowed but never did anything useful.

In addition, passing a non-iterable value as suppress_health_check will now raise an error immediately (it would never have worked correctly, but it would previously have failed later). Some validation error messages have also been updated.

(adam)

2017-11-16 07:57:53 UTC MAIN commitmail json YAML

py-attrs: updated to 17.3.0

17.3.0:

Backward-incompatible Changes
- Attributes are not defined on the class body anymore.
  This means that if you define a class C with an attribute x, the class will *not* have an attribute x for introspe
ction anymore.
  Instead of C.x, use attr.fields(C).x or look at C.__attrs_attrs__.
  The old behavior has been deprecated since version 16.1.

Changes
- super() and __class__ now work on Python 3 when slots=True.
- Added type argument to attr.ib() and corresponding type attribute to attr.Attribute.

  This change paves the way for automatic type checking and serialization (though as of this release attrs does not make use of it).
  In Python 3.6 or higher, the value of attr.Attribute.type can alternately be set using variable type annotations
- The combination of str=True and slots=True now works on Python 2.
- attr.Factory is hashable again.
- Subclasses now can overwrite attribute definitions of their superclass.

  That means that you can -- for example -- change the default value for an attribute by redefining it.
- Added new option auto_attribs to @attr.s that allows to collect annotated fields without setting them to attr.ib().

  Setting a field to an attr.ib() is still possible to supply options like validators.
  Setting it to any other value is treated like it was passed as attr.ib(default=value) -- passing an instance of attr.Factory also works as expected.

(adam)

2017-11-16 07:46:12 UTC MAIN commitmail json YAML

py-sphinx: remove py-typing dependency for py35

python-3.5 includes this module.

(wiz)

2017-11-16 02:43:51 UTC MAIN commitmail json YAML

Really use the parent sink for ld(1)

(khorben)

2017-11-16 02:16:56 UTC MAIN commitmail json YAML

Introduce a command sink for ld(1) with MKPIE

When not using cwrappers, so far PKGSRC_MKPIE was only automatically
applied when linking using gcc(1) (when enabled). This is now also the
case for packages using ld(1) to link executables.

(khorben)

2017-11-16 01:28:13 UTC MAIN commitmail json YAML

Add support for CFLAGS and LDFLAGS

This notably fixes building with MKPIE or RELRO enabled.

Bump PKGREVISION, since this generates a different binary now that SSP and
FORTIFY are enabled.

(khorben)

2017-11-16 01:18:12 UTC MAIN commitmail json YAML

Updated devel/nss to 3.34

(ryoon)

2017-11-16 01:17:00 UTC MAIN commitmail json YAML

Updated www/firefox-l10n to 57.0

(ryoon)

2017-11-16 01:15:57 UTC MAIN commitmail json YAML

Update to 3.34

The following CA certificates were Added:

CN = GDCA TrustAUTH R5 ROOT
SHA-256 Fingerprint: BF:FF:8F:D0:44:33:48:7D:6A:8A:A6:0C:1A:29:76:7A:9F:C2:BB:B0:5E:42:0F:71:3A:13:B9:92:89:1D:38:93
Trust Flags: Websites

CN = SSL.com Root Certification Authority RSA
SHA-256 Fingerprint: 85:66:6A:56:2E:E0:BE:5C:E9:25:C1:D8:89:0A:6F:76:A8:7E:C1:6D:4D:7D:5F:29:EA:74:19:CF:20:12:3B:69
Trust Flags: Websites, Email

CN = SSL.com Root Certification Authority ECC
SHA-256 Fingerprint: 34:17:BB:06:CC:60:07:DA:1B:96:1C:92:0B:8A:B4:CE:3F:AD:82:0E:4A:A3:0B:9A:CB:C4:A7:4E:BD:CE:BC:65
Trust Flags: Websites, Email

CN = SSL.com EV Root Certification Authority RSA R2
SHA-256 Fingerprint: 2E:7B:F1:6C:C2:24:85:A7:BB:E2:AA:86:96:75:07:61:B0:AE:39:BE:3B:2F:E9:D0:CC:6D:4E:F7:34:91:42:5C
Trust Flags: Websites

CN = SSL.com EV Root Certification Authority ECC
SHA-256 Fingerprint: 22:A2:C1:F7:BD:ED:70:4C:C1:E7:01:B5:F4:08:C3:10:88:0F:E9:56:B5:DE:2A:4A:44:F9:9C:87:3A:25:A7:C8
Trust Flags: Websites

CN = TrustCor RootCert CA-1
SHA-256 Fingerprint: D4:0E:9C:86:CD:8F:E4:68:C1:77:69:59:F4:9E:A7:74:FA:54:86:84:B6:C4:06:F3:90:92:61:F4:DC:E2:57:5C
Trust Flags: Websites, Email

CN = TrustCor RootCert CA-2
SHA-256 Fingerprint: 07:53:E9:40:37:8C:1B:D5:E3:83:6E:39:5D:AE:A5:CB:83:9E:50:46:F1:BD:0E:AE:19:51:CF:10:FE:C7:C9:65
Trust Flags: Websites, Email

CN = TrustCor ECA-1
SHA-256 Fingerprint: 5A:88:5D:B1:9C:01:D9:12:C5:75:93:88:93:8C:AF:BB:DF:03:1A:B2:D4:8E:91:EE:15:58:9B:42:97:1D:03:9C
Trust Flags: Websites, Email

The following CA certificates were Removed:

CN = Certum CA, O=Unizeto Sp. z o.o.
SHA-256 Fingerprint: D8:E0:FE:BC:1D:B2:E3:8D:00:94:0F:37:D2:7D:41:34:4D:99:3E:73:4B:99:D5:65:6D:97:78:D4:D8:14:36:24

CN = StartCom Certification Authority
SHA-256 Fingerprint: C7:66:A9:BE:F2:D4:07:1C:86:3A:31:AA:49:20:E8:13:B2:D1:98:60:8C:B7:B7:CF:E2:11:43:B8:36:DF:09:EA

CN = StartCom Certification Authority
SHA-256 Fingerprint: E1:78:90:EE:09:A3:FB:F4:F4:8B:9C:41:4A:17:D6:37:B7:A5:06:47:E9:BC:75:23:22:72:7F:CC:17:42:A9:11

CN = StartCom Certification Authority G2
SHA-256 Fingerprint: C7:BA:65:67:DE:93:A7:98:AE:1F:AA:79:1E:71:2D:37:8F:AE:1F:93:C4:39:7F:EA:44:1B:B7:CB:E6:FD:59:95

CN = TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3
SHA-256 Fingerprint: E4:C7:34:30:D7:A5:B5:09:25:DF:43:37:0A:0D:21:6E:9A:79:B9:D6:DB:83:73:A0:C6:9E:B1:CC:31:C7:C5:2A

CN = ACEDICOM Root
SHA-256 Fingerprint: 03:95:0F:B4:9A:53:1F:3E:19:91:94:23:98:DF:A9:E0:EA:32:D7:BA:1C:DD:9B:C8:5D:B5:7E:D9:40:0B:43:4A

CN = Certinomis - Autorité Racine
SHA-256 Fingerprint: FC:BF:E2:88:62:06:F7:2B:27:59:3C:8B:07:02:97:E1:2D:76:9E:D1:0E:D7:93:07:05:A8:09:8E:FF:C1:4D:17

CN = TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı
SHA-256 Fingerprint: 97:8C:D9:66:F2:FA:A0:7B:A7:AA:95:00:D9:C0:2E:9D:77:F2:CD:AD:A6:AD:6B:A7:4A:F4:B9:1C:66:59:3C:50

CN = PSCProcert
SHA-256 Fingerprint: 3C:FC:3C:14:D1:F6:84:FF:17:E3:8C:43:CA:44:0C:00:B9:67:EC:93:3E:8B:FE:06:4C:A1:D7:2C:90:F2:AD:B0

CN = CA 沃通根证书, O=WoSign CA Limited
SHA-256 Fingerprint: D6:F0:34:BD:94:AA:23:3F:02:97:EC:A4:24:5B:28:39:73:E4:47:AA:59:0F:31:0C:77:F4:8F:DF:83:11:22:54

CN = Certification Authority of WoSign
SHA-256 Fingerprint: 4B:22:D5:A6:AE:C9:9F:3C:DB:79:AA:5E:C0:68:38:47:9C:D5:EC:BA:71:64:F7:F2:2D:C1:D6:5F:63:D8:57:08

CN = Certification Authority of WoSign G2
SHA-256 Fingerprint: D4:87:A5:6F:83:B0:74:82:E8:5E:96:33:94:C1:EC:C2:C9:E5:1D:09:03:EE:94:6B:02:C3:01:58:1E:D9:9E:16

CN = CA WoSign ECC Root
SHA-256 Fingerprint: 8B:45:DA:1C:06:F7:91:EB:0C:AB:F2:6B:E5:88:F5:FB:23:16:5C:2E:61:4B:F8:85:56:2D:0D:CE:50:B2:9B:02

libfreebl no longer requires SSE2 instructions.

New in NSS 3.34

New Functionality
When listing an NSS database using certutil -L, but the database
hasn't yet been initialized with any non-empty or empty password,
the text "Database needs user init" will be included in the listing.

When using certutil to set an inacceptable password in FIPS mode,
a correct explanation of acceptable passwords will be printed.

SSLKEYLOGFILE is now supported with TLS 1.3, see Bug 1287711 for details.

SSLChannelInfo has two new fields (Bug 1396525)

  SSLNamedGroup originalKeaGroup holds the key exchange group of the
  original handshake when the session was resumed.

  PRBool resumed is PR_TRUE when the session is resumed and PR_FALSE
  otherwise.

RSA-PSS signatures are now supported on certificates.  Certificates
with RSA-PSS or RSA-PKCS#1v1.5 keys can be used to create an RSA-PSS
signature on a certificate using the --pss-sign argument to certutil.

New Functions
Compatibility

NSS 3.34 shared libraries are backward compatible with all older NSS 3.x
shared libraries. A program linked with older NSS 3.x shared libraries
will work with NSS 3.34 shared libraries without recompiling or relinking.
Furthermore, applications that restrict their use of NSS APIs to the
functions listed in NSS Public Functions will remain compatible with
future versions of the NSS shared libraries.

(ryoon)

2017-11-16 01:06:47 UTC MAIN commitmail json YAML

2017-11-16 01:05:41 UTC MAIN commitmail json YAML

Updated www/firefox to 57.0

(ryoon)

2017-11-16 01:04:38 UTC MAIN commitmail json YAML

Update to 57.0

Changelog:  New
    A completely new browsing engine, designed to take full advantage
    of the processing power in modern devices

    A redesigned interface with a clean, modern appearance, consistent
    visual elements, and optimizations for touch screens

    A unified address and search bar. New installs will see this
    unified bar. Learn how to add the stand-alone search bar to
    the toolbar

    A revamped new tab page that includes top visited sites, recently
    visited pages, and recommendations from Pocket (in the US,
    Canada, and Germany)

    An updated product tour to orient new and returning Firefox
    users

    AMD VP9 hardware video decoder support for improved video
    playback with lower power consumption

    An expanded section in preferences to manage all website
    permissions

Fixed
    Various security fixes

Changed
    Firefox now exclusively supports extensions built using the
    WebExtension API, and unsupported legacy extensions will no
    longer work. Learn more about our efforts to improve the
    performance and security of extensions

    The browser's autoscroll feature, as well as scrolling by
    keyboard input and touch-dragging of scrollbars, now use
    asynchronous scrolling. These scrolling methods are now similar
    to other input methods like mousewheel, and provide a smoother
    scrolling experience

    The content process now has a stricter security sandbox that
    blocks filesystem reading and writing on Linux, similar to the
    protections for Windows and macOS that shipped in Firefox 56

    Middle mouse paste in the content area no longer navigates to
    URLs by default on Unix systems

    Removed the toolbar Share button. If you relied on this feature,
    you can install the Share Backported extension instead.

    Some older versions of the ATOK IME, including ATOK 2006, 2008,
    2009 and 2010, can cause crashes and are therefore disabled on
    the Windows 64-bit version of Firefox Quantum. To fix those
    incompatibility issues, please use a newer version of ATOK or
    one of other IMEs.

    The default font for Japanese text is now Meiryo

Security fixes:

CVE-2017-7828: Use-after-free of PressShell while restyling layout

Reporter
    Nils
Impact
    critical

Description

A use-after-free vulnerability can occur when flushing and resizing
layout because the PressShell object has been freed while still in
use. This results in a potentially exploitable crash during these
operations.

References
    Bug 1406750 Bug 1412252

#CVE-2017-7830: Cross-origin URL information leak through Resource
Timing API

Reporter
    Jun Kokatsu
Impact
    high

Description

The Resource Timing API incorrectly revealed navigations in
cross-origin iframes. This is a same-origin policy violation and
could allow for data theft of URLs loaded by users.

References
    Bug 1408990

#CVE-2017-7831: Information disclosure of exposed properties on
JavaScript proxy objects

Reporter
    Oriol Brufau
Impact
    moderate

Description

A vulnerability where the security wrapper does not deny access to
some exposed properties using the deprecated exposedProps mechanism
on proxy objects. These properties should be explicitly unavailable
to proxy objects.

References
    Bug 1392026

#CVE-2017-7832: Domain spoofing through use of dotless 'i' character
followed by accent markers

Reporter
    Jonathan Kew
Impact
    moderate

Description

The combined, single character, version of the letter 'i' with any
of the potential accents in unicode, such as acute or grave, can
be spoofed in the addressbar by the dotless version of 'i' followed
by the same accent as a second character with most font sets. This
allows for domain spoofing attacks because these combined domain
names do not display as punycode.

References
    Bug 1408782

#CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker
characters

Reporter
    Rayyan Bijoora
Impact
    moderate

Description

Some Arabic and Indic vowel marker characters can be combined with
Latin characters in a domain name to eclipse the non-Latin character
with some font sets on the addressbar. The non-Latin character will
not be visible to most viewers. This allows for domain spoofing
attacks because these combined domain names do not display as
punycode.

References
    Bug 1370497

#CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections

Reporter
    Jordi Chancel
Impact
    moderate

Description

A data: URL loaded in a new tab did not inherit the Content Security
Policy (CSP) of the original page, allowing for bypasses of the
policy including the execution of JavaScript. In prior versions
when data: documents also inherited the context of the original
page this would allow for potential cross-site scripting (XSS)
attacks.

References
    Bug 1358009

#CVE-2017-7835: Mixed content blocking incorrectly applies with
redirects

Reporter
    Ben Kelly
Impact
    moderate

Description

Mixed content blocking of insecure (HTTP) sub-resources in a secure
(HTTPS) document was not correctly applied for resources that
redirect from HTTPS to HTTP, allowing content that should be blocked,
such as scripts, to be loaded on a page.

References
    Bug 1402363

#CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and
OS X

Reporter
    Ezra Caltum
Impact
    moderate

Description

The "pingsender" executable used by the Firefox Health Report
dynamically loads a system copy of libcurl, which an attacker could
replace. This allows for privilege escalation as the replaced
libcurl code will run with Firefox's privileges.  Note: This attack
requires an attacker have local system access and only affects OS
X and Linux. Windows systems are not affected.

References
    Bug 1401339

#CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies

Reporter
    Jun Kokatsu
Impact
    moderate

Description

SVG loaded through <img> tags can use <meta> tags within the SVG
data to set cookies for that page.

References
    Bug 1325923

#CVE-2017-7838: Failure of individual decoding of labels in
international domain names triggers punycode display of entire IDN

Reporter
    Corey Bonnell
Impact
    low

Description

Punycode format text will be displayed for entire qualified
international domain names in some instances when a sub-domain
triggers the punycode display instead of the primary domain being
displayed in native script and the sub-domain only displaying as
punycode. This could be used for limited spoofing attacks due to
user confusion.

References
    Bug 1399540

#CVE-2017-7839: Control characters before javascript: URLs defeats
self-XSS prevention mechanism

Reporter
    Eric Lawrence
Impact
    low

Description

Control characters prepended before javascript: URLs pasted in the
addressbar can cause the leading characters to be ignored and the
pasted JavaScript to be executed instead of being blocked. This
could be used in social engineering and self-cross-site-scripting
(self-XSS) attacks where users are convinced to copy and paste text
into the addressbar.

References
    Bug 1402896

#CVE-2017-7840: Exported bookmarks do not strip script elements
from user-supplied tags

Reporter
    Hanno Bock
Impact
    low

Description

JavaScript can be injected into an exported bookmarks file by
placing JavaScript code into user-supplied tags in saved bookmarks.
If the resulting exported HTML file is later opened in a browser
this JavaScript will be executed. This could be used in social
engineering and self-cross-scripting (self-XSS) attacks if users
were convinced to add malicious tags to bookmarks, export them,
and then open the resulting file.

References
    Bug 1366420

#CVE-2017-7842: Referrer Policy is not always respected for <link>
elements

Reporter
    Jun Kokatsu
Impact
    low

Description

If a document's Referrer Policy attribute is set to "no-referrer"
sometimes two network requests are made for <link> elements
instead of one. One of these requests includes the referrer instead
of respecting the set policy to not include a referrer on requests.

References
    Bug 1397064

#CVE-2017-7827: Memory safety bugs fixed in Firefox 57

Reporter
    Mozilla developers and community
Impact
    critical

Description

Mozilla developers and community members Boris Zbarsky, Carsten Book,
Christian Holler, Byron Campen, Jan de Mooij, Jason Kratzer,
Jesse Schwartzentruber, Marcia Knous, Randell Jesup, Tyson Smith,
and Ting-Yu Chou reported memory safety bugs present in Firefox 56.
Some of these bugs showed evidence of memory corruption and we presume
that with enough effort that some of these could be exploited to run
arbitrary code.

References
    Memory safety bugs fixed in Firefox 57

#CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox
ESR 52.5

Reporter
    Mozilla developers and community
Impact
    critical

Description

Mozilla developers and community members Christian Holler, David
Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer,
Philipp, Nicholas Nethercote, Oriol Brufau, Andr辿 Bargull, Bob
Clary, Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, and
Ryan VanderMeulen reported memory safety bugs present in Firefox
56 and Firefox ESR 52.4. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort that some
of these could be exploited to run arbitrary code.

References
    Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

(ryoon)

2017-11-16 00:40:07 UTC MAIN commitmail json YAML

Recognize more situations where not linking executables

This is only relevant for PKGSRC_MKPIE. It partly reflects a fix that
was committed to the cwrappers for MKPIE, where the "-pie" flag was
automatically added in spite of the linker not actually creating an
executable.

(khorben)

2017-11-16 00:36:10 UTC MAIN commitmail json YAML

Obtain the MKPIE flags from the environment

This solves an issue with the command sink component of the MKPIE
wrapper for GCC, where the contents of the _MKPIE_CFLAGS.gcc and
_MKPIE_LDFLAGS.gcc variables was guessed. It is now communicated to
cmd-sink-mkpie-gcc through the environment instead.

(khorben)

2017-11-16 00:31:47 UTC MAIN commitmail json YAML

Let the MKPIE command sink for GCC re-use the generic command sink

The cmd-sink-mkpie-gcc component for PKGSRC_MKPIE support on GCC was
lagging behind the generic one. This makes sure it cannot happen again,
by invoking the generic sink right away.

(khorben)

2017-11-15 23:35:27 UTC MAIN commitmail json YAML

doc: update py-openexr

(markd)

2017-11-15 23:29:26 UTC MAIN commitmail json YAML

graphics/py-fits: add python2 only entries to PLIST

(markd)

2017-11-15 23:26:33 UTC MAIN commitmail json YAML

graphics/py-openexr: update to 1.3.0

supports python3

(markd)

2017-11-15 23:22:28 UTC MAIN commitmail json YAML

math/py-networkx: prefix doc directory with python version

so package doesn't conflict with other versions of itself.
Bump PKGREVISION

(markd)

2017-11-15 23:07:47 UTC MAIN commitmail json YAML

devel/py-typing: Make this incompatible with python35

The typing module was introduced in Python 3.5.

(minskim)

2017-11-15 22:20:43 UTC MAIN commitmail json YAML

tzosdclock: comment out dead sites.

(wiz)

2017-11-15 22:20:14 UTC MAIN commitmail json YAML

tile: comment out dead sites.

(wiz)

2017-11-15 22:19:44 UTC MAIN commitmail json YAML

since: comment out dead sites

(wiz)

2017-11-15 22:18:52 UTC MAIN commitmail json YAML

pkcs11-helper: fix HOMEPAGE

(wiz)

2017-11-15 22:18:17 UTC MAIN commitmail json YAML

p5-Tie-Simple: fix HOMEPAGE

(wiz)

2017-11-15 22:17:28 UTC MAIN commitmail json YAML

osmo-sdr: update HOMEPAGE

(wiz)

2017-11-15 22:16:47 UTC MAIN commitmail json YAML

opencv2: follow redirect

(wiz)

2017-11-15 22:16:17 UTC MAIN commitmail json YAML

openct: update HOMEPAGE

(wiz)

2017-11-15 22:15:16 UTC MAIN commitmail json YAML

netris: Comment out dead sites.

(wiz)

2017-11-15 22:14:31 UTC MAIN commitmail json YAML

mxterm: comment out dead sites

(wiz)

2017-11-15 22:13:38 UTC MAIN commitmail json YAML

libsvm: follow redirects

(wiz)

2017-11-15 22:13:24 UTC MAIN commitmail json YAML

libshorttext: follow redirects

(wiz)

2017-11-15 22:13:17 UTC MAIN commitmail json YAML

Updated sysutils/u-boot-a10-olinuxino-lime to 2017.11
Updated sysutils/u-boot-bananapi to 2017.11
Updated sysutils/u-boot-beagleboard to 2017.11
Updated sysutils/u-boot-beagleboneblack to 2017.11
Updated sysutils/u-boot-beaglebonewhite to 2017.11
Updated sysutils/u-boot-chip to 2017.11
Updated sysutils/u-boot-chip-pro to 2017.11
Updated sysutils/u-boot-cubieboard2 to 2017.11
Updated sysutils/u-boot-cubieboard4 to 2017.11
Updated sysutils/u-boot-cubietruck to 2017.11
Updated sysutils/u-boot-hummingbird-a31 to 2017.11
Updated sysutils/u-boot-jetson-tx1 to 2017.11
Updated sysutils/u-boot-nanopi-neo to 2017.11
Updated sysutils/u-boot-nanopi-neo2 to 2017.11
Updated sysutils/u-boot-orangepi-2 to 2017.11
Updated sysutils/u-boot-orangepi-one to 2017.11
Updated sysutils/u-boot-orangepi-plus2e to 2017.11
Updated sysutils/u-boot-pine64 to 2017.11
Updated sysutils/u-boot-pocketchip to 2017.11
Updated sysutils/u-boot-sinovoip-bpi-m3 to 2017.11

(jmcneill)

2017-11-15 22:12:56 UTC MAIN commitmail json YAML

liblinear: follow redirects

(wiz)

2017-11-15 22:12:17 UTC MAIN commitmail json YAML

go-ini: fix HOMEPAGE

(wiz)

2017-11-15 22:10:53 UTC MAIN commitmail json YAML

go-goptlib: Improve HOMEPAGE.

(wiz)

2017-11-15 22:09:11 UTC MAIN commitmail json YAML

aspell-sc: Comment out dead HOMEPAGE

(wiz)

2017-11-15 22:08:27 UTC MAIN commitmail json YAML

2017-11-15 22:01:22 UTC MAIN commitmail json YAML

security/php-pecl-mcrypt: enable php72

It should support php72.  (Not tested yet.)

(taca)

2017-11-15 21:37:54 UTC MAIN commitmail json YAML

doc: Updated lang/nodejs to 9.2.0

(fhajny)

2017-11-15 21:37:44 UTC MAIN commitmail json YAML

Update lang/nodejs to 9.2.0.

crypto:
- Support building with both 1.1.0 and 1.0.2
fs:
- fs.realpathSync.native and fs.realpath.native are now exposed
process:
- expose process.ppid

(fhajny)

2017-11-15 20:48:40 UTC MAIN commitmail json YAML

doc: Updated editors/xemacs-current to 21.5.34

(hauke)

2017-11-15 20:30:19 UTC MAIN commitmail json YAML

doc: Updated devel/hdf5{,-c++} to 1.10.1

(minskim)

2017-11-15 20:28:27 UTC MAIN commitmail json YAML

devel/hdf5{,-c++}: Update to 1.10.1

New features since 1.8.x:
- SWMR (a concurrent read/write file access pattern)
- Fine-tuning the Metadata Cache
- Collective Metadata I/O
- File Space Management
- Virtual Datasets (VDS)
- Partial Edge Chunk Options
- Metadata Cache Image
- Metadata Cache Evict on Close
- Paged Aggregation
- Page Buffering

(minskim)

2017-11-15 19:04:24 UTC MAIN commitmail json YAML

Revert "Always add "-fPIC" when linking with PKGSRC_MKPIE"

It seems to break emulators/qemu.

(khorben)

2017-11-15 18:23:20 UTC MAIN commitmail json YAML

Note update of security/{py-,}yara to version 3.7.0.

(he)

2017-11-15 18:22:22 UTC MAIN commitmail json YAML

Update {py-,}yara to version 3.7.0.

Pkgsrc changes:
* adapt PLIST
* remove patch which no longer applies
* apply patches for proper value domain for isxxxx() functions/macros

Upstream changes:
* time module (Wesley Shields)
* yara command-line tool now accept multiple rule files
* Allow a configurable limit for the number of strings per rule
  (option --max-strings-per-rule)
* Implement integrity check for compiled rules
* Implement API for customizingimport statement (@edhoedt)
* Scan process memory in FreeBSD and OpenBDS (Hilko Bengen)
* BUGFIX: Negated character classes not working with case-insensitive
  regexps (#765)
* BUGFIX: Multiple bugs while parsing ELF files (Nate Rosenblum)
* BUGFIX: Out-of-bounds access while parsing PE files.
* BUGFIX: Memory leaks while parsing invalid rules.

(he)

2017-11-15 15:08:23 UTC MAIN commitmail json YAML

doc: Updated editors/xemacs-current-nox11 to 21.5.34

(hauke)

2017-11-15 15:08:07 UTC MAIN commitmail json YAML

doc: Updated editors/xemacs-current to 21.5.34

(hauke)

2017-11-15 15:07:17 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Most of the functionality moved to
../../editors/xemacs-current/{Makefile.common,options.mk}

(hauke)

2017-11-15 15:04:25 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Don't try to define max_align_t in C11 or C++11 mode.

Regen patch.

(hauke)

2017-11-15 15:02:19 UTC MAIN commitmail json YAML

2017-11-15 15:01:36 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Deal with bulk build namespace intrusion.

Was patch-an

(hauke)

2017-11-15 15:00:38 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Obsolete, fixed upstream

(hauke)

2017-11-15 14:59:55 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Deal with a difference between bmake and gmake in using $< in a
makefile target

Was patch-al

(hauke)

2017-11-15 14:58:54 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Prefer NAME_MAX over MAXNAMLEN, if available

Was patch-ak

(hauke)

2017-11-15 14:57:58 UTC MAIN commitmail json YAML

2017-11-15 14:57:09 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Obsolete, change is in upstream

(hauke)

2017-11-15 14:56:25 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Obsolete, CANNA v1 was de-supported in 2007

(hauke)

2017-11-15 14:55:35 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Obsolete, the file is #included, and the including file
should import the required headers

(hauke)

2017-11-15 14:54:56 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Obsolete, gtk support does not build, and is
subject to re-work upstream

(hauke)

2017-11-15 14:54:09 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Obsolete, src/unexfreebsd.c is gone

(hauke)

2017-11-15 14:53:27 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Enhance ELF macros to deal with 32/64 bit arches
Special-case alpha

Was patch-ad

(hauke)

2017-11-15 14:52:02 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Install internal build scripts as scripts
Prefix {c,e}tags to avoid conflicts

Was patch-ac

(hauke)

2017-11-15 14:50:50 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Add POSIX syntax for passing ld(1) options through the
compiler front end

NetBSD machine settings are gone
Other patches are in upstream

Was patch-ab

(hauke)

2017-11-15 14:49:32 UTC MAIN commitmail json YAML

Upgrade to XEmacs 21.5.34

Prefix {c,e}tags to avoid conflicts.

Was patch-aa

(hauke)

2017-11-15 14:46:31 UTC MAIN commitmail json YAML

Upgrade xemacs-current to 21.5.34

Since the non-{X11,lucid} toolkits have bitrotted, remove those
options, and rework options.mk like the editors/xemacs one.

Switching to the portable dumper and using system malloc obsoletes the
hacks.

Like XEmacs 21.4 and the emacsen, we need to build with -DTERMINFO for
proper console display.

Since Makefile content is minimal for xemacs-current{,-nox11}, keep
the pkgsrc nb revision centrally in Makefile.common.

Take maintainership.

(hauke)

2017-11-15 14:19:43 UTC MAIN commitmail json YAML

For Python 2.7: depend on py-backports.functools_lru_cache instead of py-functools32

(adam)

2017-11-15 14:18:46 UTC MAIN commitmail json YAML

2017-11-15 14:15:24 UTC MAIN commitmail json YAML

Updated textproc/py-natsort, devel/py-test

(adam)

2017-11-15 14:14:49 UTC MAIN commitmail json YAML

py-test: updated to 3.2.5

Pytest 3.2.5:

Bug Fixes
Remove py<1.5 restriction from pytest as this can cause version conflicts in some installations.

(adam)

2017-11-15 14:13:58 UTC MAIN commitmail json YAML

py-natsort: updated to 5.1.1

5.1.1:
* Added additional unicode number support for Python 3.7.
* Added information on how to install and test.

(adam)

2017-11-15 14:09:39 UTC MAIN commitmail json YAML

doc: Updated www/contao44 to 4.4.8

(taca)

2017-11-15 14:09:16 UTC MAIN commitmail json YAML

www/contao44: update to 4.4.8

# Contao core bundle change log

### 4.4.8 (2017-11-15)

* Prevent SQL injections in the back end search panel (see CVE-2017-16558).
* Support class named services in System::import() and System::importStatic()
  (see #1176).
* Only show pretty error screens on Contao routes (see #1149).

# Contao listing bundle change log

### 4.4.8 (2017-11-15)

* Prevent SQL injections in the listing module (see CVE-2017-16558).

(taca)

2017-11-15 14:08:18 UTC MAIN commitmail json YAML

doc: Updated www/contao35 to 3.5.31

(taca)

2017-11-15 14:07:53 UTC MAIN commitmail json YAML

Update contaoet to 3.5.31.

Version 3.5.31 (2017-11-15)
---------------------------

### Fixed
Prevent SQL injections in the back end search panel (see CVE-2017-16558).

(taca)

2017-11-15 12:52:16 UTC MAIN commitmail json YAML

ocaml: Recognize NetBSD armv6 correctly in configure

While MACHINE_ARCH can be earmv6hf on NetBSD, configure has to match
what config.guess outputs, which is armv6.  For now, leave the old
earmv6/7 tokens, because this code inexplicably succeeded on earmv7hf.

With this, ocaml builds and builds a working unison, on earmv6hf
(RPI3).

(gdt)

2017-11-15 11:58:28 UTC MAIN commitmail json YAML

doc: Updated graphics/feh to 2.22.2

(szptvlfn)

2017-11-15 11:58:03 UTC MAIN commitmail json YAML

feh: Update to 2.22.2

https://git.finalrewind.org/feh/plain/ChangeLog
Tue, 07 Nov 2017 17:36:26 +0100  Daniel Friesel <derf+feh@finalrewind.org>

* Release v2.22.2
    * Fix HTTPS certificate errors on some systems (broken in 2.22)

Tue, 07 Nov 2017 07:51:48 +0100  Daniel Friesel <derf+feh@finalrewind.org>

* Release v2.22.1
    * Allow ~/.fehbg to be sourced (instead of executed) from other shell
      scripts again (broken in 2.22)

Sat, 04 Nov 2017 14:55:38 +0100  Daniel Friesel <derf+feh@finalrewind.org>

* Release v2.22
    * Add support for CURL_CA_BUNDLE environment variable when loading images
      via HTTPS
    * Fix ~/.fehbg not being updated when setting a wallpaper via menu
      (broken in 2.21)

(szptvlfn)

2017-11-15 11:41:33 UTC MAIN commitmail json YAML

doc: Updated net/p5-Net to 3.11

(wiz)

2017-11-15 11:41:24 UTC MAIN commitmail json YAML

p5-Net: update to 3.11.

Add comment to patch.

3.11 2017-11-14

    - Treat FTP MLSD commands case-insensitively.  [Brian M. Carlson, PR#32]

(wiz)

2017-11-15 11:01:32 UTC MAIN commitmail json YAML

2017-11-15 11:01:17 UTC MAIN commitmail json YAML

add a comment to fix the MASTER_SITES once this is out of RC

(jdolecek)

2017-11-15 10:49:09 UTC MAIN commitmail json YAML

doc: Updated devel/p5-experimental to 0.017

(wiz)

2017-11-15 10:49:00 UTC MAIN commitmail json YAML

p5-experimental: update to 0.017.

0.017    2017-11-14 16:23:53+01:00 Europe/Amsterdam
          Remove auto_deref for 5.24+

(wiz)

2017-11-15 10:48:18 UTC MAIN commitmail json YAML

doc: Updated devel/p5-Search-Elasticsearch to 6.00

(wiz)

2017-11-15 10:48:03 UTC MAIN commitmail json YAML

p5-Search-Elasticsearch: update to 6.00.

6.00    2017-11-14
        Released 6.00 with default API for 6_0.
        Legacy 5_0 API now released separately
        Trace logging now includes content-type headers where appropriate
        Deprecation warnings are now parsed to extract the message only
        Improved boolean value handling in query string params - now accepts
          true, false, \1, \0, or a JSON::PP::Boolean object
        Handle removal of '.' from @INC in perl 5.26

(wiz)