deadsimple BSD Security Advisories and Announcements

Announcing the pkgsrc-2023Q4 branch

The pkgsrc developers are proud to announce the 81st quarterly release
of pkgsrc, the cross-platform packaging system.  pkgsrc contains over
27,000 packages, with varying support across 23 distinct operating
systems.  More information on pkgsrc itself is available at

Since the pkgsrc-2023Q3 release, 221 packages were added, 171 removed,
and 2574 updates (to 1732 distinct packages) were processed.  These
included 44 Go, 211 Haskell, 109 Perl, 863 Python, and 111 Ruby
package updates.

For the 2023Q4 release we welcome the following notable package

 - p5-Net-OAuth2 0.67
 - flang 16.0.6
 - many Haskell packages
 - tailspin 2.2.0
 - chezscheme 9.9.9alpha2023.11.03
 - argyllcms 3.0.2
 - duckdb 0.9.2
 - terrapin-scanner 1.0.3

We welcome the following notable updates:

 - boost 1.83.0
 - CMake 3.28.1
 - Django 4.2.6
 - Firefox 120.0.1
 - Firefox ESR 115
 - GHC 9.6.3
 - Ghostscript 10.02.2
 - kdevelop 23.04.3
 - llvm/clang 16.0.6
 - LXQt 1.4.0
 - matrix-synapse 1.98.0
 - NodeJS 21.4.0
 - openjdk
 - PHP 8.3.0
 - Python 3.12 (but not all python packages work with it yet)
 - Rust 1.73.0
 - SQLite 3.44.2
 - Squid 6.6
 - xen{kernel,tools} 4.18

As always, many packages have been brought up to date relative to
upstream micro releases.  Examples include:

 - Go 1.20.12, 1.21.5
 - MATE (some core components updated)
 - Nextcloud 27.1.4
 - NodeJS 18.18.2, 20.9.0
 - PostgreSQL 11.21, 12.16, 13.12, 14.9, 15.4
 - Python 3.8.17, 3.9.17, 3.10.12, 3.11.4
 - qgis 3.28.13
 - Qt6 6.6.1
 - Thunderbird 115.5.1
 - Xfce4 (some core and plugin components updated)

This branch we say notable goodbyes to:

 - various Gnome 2 packages (including packagekit and policykit)
 - NodeJS 14xentk
 - promscale
 - xen{kernel,tools} 4.13

Changes to the pkgsrc infrastructure and notes:

 - Several packages have been folded into base packages.  While the
   result is simpler, those updating may need to force-remove the
   secondary packages, depending on the update method.  When doing
   make replace, one has to pkg_delete -f the secondary packages.
   pkgin handles at least the python packages correctly, removing the
   split package when updating python.  Specific packages and the
   former packages now included:

     * cairo: cairo-gobject
     * python: py-cElementTree py-curses py-cursespanel py-expat
       py-readline py-sqlite3

 - Some packages have had files moved between them, also necessitating
   pkg_delete -f:

     * pyNN-cairo and py-cairo-shared

 - rust no longer works on NetBSD 8, due to increased compiler
   requirements.  While this could in theory be worked around, no one
   has done that.

 - This will be the last quarterly branch to have binary packages for
   NetBSD 8.  NetBSD 8 is almost EOL, and is so old (5.5 years since
   release) that an increasing amount of software does not build on
   it.  NetBSD 8 support in pkgsrc will end immediately on the release
   of NetBSD 10.  This is entirely on plan with respect to "pkgsrc
   supports the current and previous formal releases of NetBSD", but
   users are cautioned not to expect "we'll make one final quarterly
   release supporting it after NetBSD 10".  This is the final
   quarterly release with NetBSD 8 binary packages, regardless of when
   NetBSD 10 is actually released.

 - There are on the order of 1000 fewer buildable packages for i386 vs
   x86_64, at least on NetBSD.  Those using i386 on hardware that
   supports x86_64 may wish to upgrade to NetBSD/x86_64.

Instructions on using the binary package manager can be found at, and pkgsrc itself can be retrieved via CVS, tar file,
and other mirrors.  See
for instructions.  The branch name for the 2023Q4 branch is