I have no clue how xorg-server works, however it has been vulnerable for 17 days with high severity vulnerabilities. Xorg runs with setuid so vulnerabilities within it are concerning, so I had a crack at it myself, and a simple version bump seemed to be all it needed, I am using 21.1.20 to submit this patch now, everything seems to work fine.
Fixes CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 (https://www.vuxml.org/freebsd/e99a32c8-b8e2-11f0-8510-b42e991fc52e.html)