From: Volker Schlecht Subject: Re: [Update] net/libcares 1.34.8 was: 1.34.7 To: ports , Brad Date: Tue, 7 Jul 2026 20:04:56 +0200 On 7/6/26 8:09 PM, Volker Schlecht wrote: > Fixes > > Use-after-free / double-free in c-ares query-completion handling, remotely > triggerable via ares_getaddrinfo() over TCP > https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542 ... and here's 1.34.8 fixing an unintentional API/ABI breakage: Revert "Mark parameters in callbacks as const" which shipped in 1.34.7. Changing the parameter types of the `ares_callback`, `ares_host_callback`, and `ares_nameinfo_callback` function pointer typedefs was an unintended API break: existing applications with the historical non-const callback signatures no longer compiled, particularly in C++ where function pointer types must match exactly. The read-only nature of the callback parameters is now documented instead. https://github.com/c-ares/c-ares/pull/1244 Index: Makefile =================================================================== RCS file: /cvs/ports/net/libcares/Makefile,v retrieving revision 1.41 diff -u -p -r1.41 Makefile --- Makefile 16 Jan 2026 16:06:46 -0000 1.41 +++ Makefile 7 Jul 2026 18:01:42 -0000 @@ -1,12 +1,12 @@ COMMENT= asynchronous resolver library -V= 1.34.6 +V= 1.34.8 DISTNAME= c-ares-${V} PKGNAME= libcares-${V} CATEGORIES= net devel SITES= https://github.com/c-ares/c-ares/releases/download/v${V}/ -SHARED_LIBS += cares 4.4 # 2.19.0 +SHARED_LIBS += cares 4.5 # 2.19.7 HOMEPAGE= https://c-ares.org/ Index: distinfo =================================================================== RCS file: /cvs/ports/net/libcares/distinfo,v retrieving revision 1.25 diff -u -p -r1.25 distinfo --- distinfo 16 Jan 2026 16:06:46 -0000 1.25 +++ distinfo 7 Jul 2026 18:01:42 -0000 @@ -1,2 +1,2 @@ -SHA256 (c-ares-1.34.6.tar.gz) = kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU= -SIZE (c-ares-1.34.6.tar.gz) = 1017864 +SHA256 (c-ares-1.34.8.tar.gz) = wiK21oEJb5RE0sSGPSwRdAGeJ8rMoKSlwRTTbdfXv3g= +SIZE (c-ares-1.34.8.tar.gz) = 1036098