BSDSec

deadsimple BSD Security Advisories and Announcements

Announcing the pkgsrc-2025Q1 branch

The pkgsrc developers are proud to announce the 86th quarterly release
of pkgsrc, the cross-platform packaging system.  pkgsrc contains over
29,000 packages. More information on pkgsrc itself is available at
https://www.pkgsrc.org/

Since the last release (2024Q4), 199 packages were added, 2811 packages
were updated, and 67 packages were removed.

New in this branch is that multiple versions of PHP can coexist, which
may require re-applying changes to PHP config files. More details below.

Notable package additions were:
- Chromium 131.0.6778.204
- Elm 0.19.1
- pytorch 2.5
- uv 0.6.4
- libjxl 0.11.1
- wezterm 20250307.120843

Notable package updates were:
- XFCE 4.20 
- The default Go version is now 1.24.1
- Ruby 3.4.2
- GHC 9.10.1
- PHP 8.4.5 (note: pkgsrc can install multiple versions of PHP)

Notable package removals were:
- GHC 7, 8.0, 8.4, 8.8, 8.10, 9.0. Newer GHC versions are available.
- oracle-jre8, oracle-jdk8
- sun-jdk7, sun-jre7

2025Q1 will be the last branch to support several platforms listed below,
due to bitrot and lack of use. If you'd like to speak up, please use the
following threads:

MirBSD       https://mail-index.netbsd.org/tech-pkg/2025/03/12/msg030607.html
GNU/kFreeBSD https://mail-index.netbsd.org/tech-pkg/2025/03/11/msg030600.html
Interix      https://mail-index.netbsd.org/tech-pkg/2025/03/08/msg030572.html
BSD/OS       https://mail-index.netbsd.org/tech-pkg/2025/03/17/msg030646.html

PHP upgrade concerns:

If you have local changes, e.g. to your PREFIX/etc/php.ini file, you
will need to manually re-apply these changes to the version-specific
php.ini file.
If you are using PHP 8.4, it now lives in PREFIX/etc/php/8.4/php.ini.

pkgsrc will not delete a locally modified config file during upgrades or
removal of packages, so by extension: if you don't have your old php.ini
file after an upgrade, you didn't have any local changes, and you're not
impacted by this upgrade issue.

php-fpm:
1. The rc.d script now includes the version suffix, so rc.conf will need
to be adjusted to say php_fpm84=yes, instead of php_fpm=yes
2. Similar to the php.ini change, local changes to php-fpm config files
will need to be migrated to the versioned PREFIX/etc/php/8.4/
3. The package has also changed its defaults, and now defaults to unix
sockets instead of 127.0.0.1:9000