From: Josh Grosse <josh@jggimi.net>
Subject: Re: [security update] multimedia/shotcut 26.8.1 -> 26.9.27
To: ports@openbsd.org
Date: Wed, 7 Oct 2026 18:52:05 -0400

On Mon, Sep 28, 2026 at 08:49:06AM -0400, Josh Grosse wrote:
> For *possible* inclusion with 8.0, CVE is pending.  Tested on amd64.

Pinging, now that the tree is unlocked. Diff re-attached for convenience.

> 
> ---
> 
> Security Notice
> 
> All users are encouraged to upgrade. This release fixes flaws in Shotcut's network downloads:
> 
>     A failed HTTPS fetch was retried over cleartext HTTP.
>     Shotcut offered to ignore certificate errors.
>     An upgrade URL was accepted from a host other than shotcut.org.
>     A Whisper model was kept even when its SHA-256 did not match the digest shipped with Shotcut.
>     Refresh Models loaded a downloaded descriptor as QML.
> 
> ---
> 
> Changelog: https://github.com/mltframework/shotcut/releases/tag/v26.9.27
> Announcement: https://www.shotcut.org/blog/new-release-26.9.27/

diff --git multimedia/shotcut/Makefile multimedia/shotcut/Makefile
index d30faa2e5cd..3f7625cac08 100644
--- multimedia/shotcut/Makefile
+++ multimedia/shotcut/Makefile
@@ -2,7 +2,7 @@ USE_WXNEEDED =	Yes
 
 COMMENT =	video editor
 
-V =		26.8.1
+V =		26.9.27
 
 DIST_TUPLE =	github mltframework shotcut v${V} .
 PKGNAME =	shotcut-${V}
diff --git multimedia/shotcut/distinfo multimedia/shotcut/distinfo
index 39ee8978ce6..4c6874aa1a9 100644
--- multimedia/shotcut/distinfo
+++ multimedia/shotcut/distinfo
@@ -1,2 +1,2 @@
-SHA256 (mltframework-shotcut-v26.8.1.tar.gz) = ytBjPy2IkkmXlA3cwel+bMlobHQTA8a3uniOumnH+aE=
-SIZE (mltframework-shotcut-v26.8.1.tar.gz) = 38362612
+SHA256 (mltframework-shotcut-v26.9.27.tar.gz) = 3cdcnnmjVologfJnFtezfaQu5qLpcnlWyctHLuR2Xcc=
+SIZE (mltframework-shotcut-v26.9.27.tar.gz) = 40868657
diff --git multimedia/shotcut/patches/patch-CMakeLists_txt multimedia/shotcut/patches/patch-CMakeLists_txt
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git multimedia/shotcut/patches/patch-src_CMakeLists_txt multimedia/shotcut/patches/patch-src_CMakeLists_txt
index 1b9b7c5c332..d20f3f39fab 100644
--- multimedia/shotcut/patches/patch-src_CMakeLists_txt
+++ multimedia/shotcut/patches/patch-src_CMakeLists_txt
@@ -1,7 +1,7 @@
 Index: src/CMakeLists.txt
 --- src/CMakeLists.txt.orig
 +++ src/CMakeLists.txt
-@@ -427,5 +427,5 @@ if(UNIX AND NOT APPLE)
+@@ -431,5 +431,5 @@ if(UNIX AND NOT APPLE)
    install(FILES ${CMAKE_SOURCE_DIR}/packaging/linux/icons/128x128/org.shotcut.Shotcut.png
      DESTINATION ${CMAKE_INSTALL_DATADIR}/icons/hicolor/128x128/apps/)
    install(FILES ${CMAKE_SOURCE_DIR}/packaging/linux/shotcut.1
diff --git multimedia/shotcut/patches/patch-src_mainwindow_cpp multimedia/shotcut/patches/patch-src_mainwindow_cpp
index c4200577251..481e700151e 100644
--- multimedia/shotcut/patches/patch-src_mainwindow_cpp
+++ multimedia/shotcut/patches/patch-src_mainwindow_cpp
@@ -1,7 +1,7 @@
 Index: src/mainwindow.cpp
 --- src/mainwindow.cpp.orig
 +++ src/mainwindow.cpp
-@@ -158,7 +158,7 @@ MainWindow::MainWindow()
+@@ -168,7 +168,7 @@ MainWindow::MainWindow()
      , m_keyframesDock(0)
  {
  #if defined(Q_OS_UNIX) && !defined(Q_OS_MAC)
diff --git multimedia/shotcut/patches/patch-src_util_cpp multimedia/shotcut/patches/patch-src_util_cpp
index 556fee56b71..ada132cc78d 100644
--- multimedia/shotcut/patches/patch-src_util_cpp
+++ multimedia/shotcut/patches/patch-src_util_cpp
@@ -1,7 +1,7 @@
 Index: src/util.cpp
 --- src/util.cpp.orig
 +++ src/util.cpp
-@@ -555,6 +555,8 @@ bool Util::isMemoryLow()
+@@ -566,6 +566,8 @@ bool Util::isMemoryLow()
      meminfo.close();
      LOG_INFO() << "available RAM = " << availableKB << "KB";
      return availableKB < kLowMemoryThresholdKB;