// A new man:rc.conf[5] variable has been added, `linux_mounts_enable`, which controls if Linux(R)-specific filesystems are mounted in [.filename]#/compat/linux# if `linux_enable` is set to `YES`. {{< revision "364883" >}} (Sponsored by The FreeBSD Foundation)
+The `-i` flag is now added to man:rtsol[8] and man:rtsold[8] by default in `/etc/defaults/rc.conf`. gitref:a0fc5094bf4c[repository=src]
+(Sponsored by https://www.patreon.com/cperciva[https://www.patreon.com/cperciva])
+
[[userland-programs]]
=== Userland Application Changes
+The `-i` option has been added to man:rtsol[8] and man:rtsold[8] to disable the random delay between zero and one seconds, speeding up the boot process. gitref:8056b73ea163[repository=src]
+(Sponsored by https://www.patreon.com/cperciva[https://www.patreon.com/cperciva])
+
+For 64-bit architectures, the base system is now built with Position
+Independent Executable (PIE) support enabled by default.
+It may be disabled using the `WITHOUT_PIE` knob.
+ A clean build is required.
+gitref:396e9f259d96[repository=src]
+
Add a new `zfskeys` man:rc[8] service script, which allows for automatic decryption of ZFS datasets encrypted with ZFS native encryption during boot.
See the man:rc.conf[5] manual page for more information.
gitref:33ff39796ffe[repository=src], gitref:8719e8a951b7[repository=src] (Sponsored by Modirum and Klara Inc.)
The NVMe emulation in man:bhyve[8] has been upgraded to version 1.4 of the NVMe specification. gitref:b7a2cf0d9102[repository=src] - gitref:eae02d959363[repository=src]
+NVMe iovec construction for large IOs in man:bhyve[8] has been fixed.
+The problem was exposed by the UEFI driver included with Rocky Linux 8.4.
+gitref:a7761d19dacd[repository=src]
+
+Extra Alt Gr mappings for Brazillian Portuguese ABNT2 keyboards were added.
+gitref:310623908c20[repository=src]
+
+The `chroot` facility now supports unprivileged operation, and
+the man:chroot[8] program now has a `-n` option to enable its use.
+gitref:460b4b550dc9[repository=src] (Sponsored by EPSRC)
+
+The CAM library has been modified to use man:realpath[3] on device names
+before parsing them, which allows tools such as man:camcontrol[8] and
+man:smartctl[8] to be friendlier when symlinks are in use.
+gitref:e32acf95ea25[repository=src]
+
+man:md5sum[1] and similar message-digest programs compatible with those
+on Linux were added by having the corresponding BSD programs run with the `-r`
+option if the program name ends in `sum`.
+gitref:c0d5665be0dc[repository=src]
+(Sponsored by Netflix)
+
+man:svnlite[1] is disabled in the build by default. gitref:a4f99b3c2384[repository=src]
+
+man:mpsutil[8] has been extended to show adapter information and to control NCQ.
+gitref:395bc3598b47[repository=src]
+
+Problems after downloading firmware to a device using man:camcontrol[8]
+were fixed by forcing a rescan of the LUN after the firmware download.
+gitref:327da43602cc[repository=src]
+(Sponsored by Netflix)
+
+A new mode has been added to the scripted partition editor for variant disk
+names in man:bsdinstall[8].
+If the disk parameter `DEFAULT` is set in place of an actual device name,
+or no disk is specified for the `PARTITIONS` parameter, the installer will
+follow the logic used in the automatic-partitioning mode, in which it
+will either provide a selection dialog for one of several disks if
+several are present or automatically select it if there is only one.
+This simplifies the creation of fully-automatic installation media for
+hardware or VMs with varying disk names. gitref:5ec4eb443e81[repository=src]
+
+
[[userland-contrib]]
=== Contributed Software
@@ -117,11 +172,40 @@
interpreted as hex numbers, while all other awks (now including One
True Awk) interpret them as `0`, in line with awk's historic behavior.
+`zlib` has been upgraded to version 1.2.12.
+
+`libarchive` has been upgraded to verion 3.6.0 with additional bug and
+security fixes from the upcoming patchlevel release.
+The `ssh` package has been updated to OpenSSH v8.8p1, including a security
+update and bug fixes. Other updates include these changes:
+
+* man:ssh[1]: When prompting whether to record a new host key, accept that key's fingerprint as a synonym for "yes."
+* man:ssh-keygen[1]: When acting as a CA and signing certificates with an RSA key, default to using the `rsa-sha2-512` signature algorithm.
+* man:ssh[1]: `UpdateHostkeys` is enabled by default, subject to some conservative preconditions.
+* man:scp[1]: The behavior of remote to remote copies (e.g. `scp host-a:/path host-b:`) has been changed to transfer through the local host by default.
+* man:scp[1] has experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used.
+
+The use of FIDO/U2F hardware authenticators has been enabled in `ssh`,
+using the new public key types `ecdsa-sk` and `ed25519-sk`, along with