diff --git a/security/heimdal-devel/Makefile b/security/heimdal-devel/Makefile
index 2601bbe44002..dacf23ed6f98 100644
--- a/security/heimdal-devel/Makefile
+++ b/security/heimdal-devel/Makefile
@@ -1,132 +1,129 @@
 PORTNAME=	heimdal
 PORTVERSION=	${HEIMDAL_COMMIT_DATE}
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	security
 PKGNAMESUFFIX=	-devel
 HASH=		8f9c2d115
 HEIMDAL_COMMIT_DATE=	2022.11.18
 
 MAINTAINER=	cy@FreeBSD.org
 COMMENT=	Popular BSD-licensed implementation of Kerberos 5
 WWW=		https://www.h5l.org/
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USE_GITHUB=	yes
 GH_TAGNAME=	${HASH}
 
 CONFLICTS=	krb5 krb5-*
 
 USES=		autoreconf:build cpe gettext-runtime gssapi:bootstrap,heimdal \
 		libtool pathfix pkgconfig python:build readline makeinfo ssl
 CPE_VENDOR=	${PORTNAME}_project
 USE_LDCONFIG=	${GSSAPILIBDIR}
 
-# Needs clang-format which is only provided by the port.
-# Else asm1_fails resulting in a command not found error.
-BUILD_DEPENDS=	clang${LLVM_DEFAULT}:devel/llvm${LLVM_DEFAULT} \
-		p5-JSON>0:converters/p5-JSON
+BUILD_DEPENDS=	p5-JSON>0:converters/p5-JSON
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ENV=	ac_cv_header_fnmatch_h=yes \
 		ac_cv_header_db_h=no \
 		ac_cv_header_db3_db_h=no \
 		ac_cv_header_db4_db_h=no \
 		ac_cv_header_db5_db_h=no \
 		ac_cv_header_db6_db_h=no \
 		ac_cv_prog_COMPILE_ET=${WRKSRC}/lib/com_err/compile_et
 CONFIGURE_ARGS=	--with-berkeley-db \
 		--with-libintl \
 		--with-libintl-include="${LOCALBASE}/include" \
 		--with-libintl-lib="${LOCALBASE}/lib" \
 		--libdir="${GSSAPILIBDIR}" \
 		--includedir="${GSSAPIINCDIR}" \
 		--with-kcm \
 		--with-openssl \
 		--with-openssl-include="${OPENSSLINC}" \
 		--with-openssl-lib="${OPENSSLLIB}" \
 		--enable-otp \
 		--enable-pthread-support \
 		--with-readline="${LOCALBASE}" \
 		--with-hdbdir="/var/${PORTNAME}" \
 		--sysconfdir="${PREFIX}/etc" \
 		CLANG_FORMAT="${LOCALBASE}/bin/clang-format${LLVM_DEFAULT}" \
 		--enable-kx509 \
 		--without-microhttpd
 # XXX --with-readline picks up libreadline even if found in /usr/lib.
 MAKE_ENV=	INSTALL_CATPAGES=no
 INSTALL_TARGET=	install-strip
 .if !exists(/etc/rc.d/ipropd_master)
 USE_RC_SUBR=	ipropd_master ipropd_slave
 .endif
 INFO=		heimdal hx509
 
 MAKE_JOBS_UNSAFE=	yes
 
 OPTIONS_DEFINE=	IPV6 BDB LMDB SQLITE LDAP PKINIT DIGEST KX509 CRACKLIB
 OPTIONS_DEFAULT=IPV6 BDB                  PKINIT DIGEST KX509
 OPTIONS_SUB=	yes
 
 IPV6_CONFIGURE_WITH=	ipv6
 
 BDB_DESC=		Enable BerkeleyDB KDC backend support
 BDB_USES=		bdb:5 localbase
 BDB_CONFIGURE_ENV=	ac_cv_header_db${BDB_VER}_db_h=yes \
 			ac_cv_func_db_create=yes \
 			ac_cv_funclib_db_create="-l${BDB_LIB_NAME}"
 BDB_CONFIGURE_ON=	--disable-ndbm-db
 BDB_CONFIGURE_ENV_OFF=	ac_cv_header_db_h=yes \
 			ac_cv_func_db_create=no \
 			ac_cv_funclib_db_create=no
 BDB_CONFIGURE_OFF=	--enable-ndbm-db
 
 LMDB_DESC=		Enable LMDB KDC backend support
 LMDB_CONFIGURE_ENABLE=	mdb_db
 LMDB_LIB_DEPENDS=	liblmdb.so:databases/lmdb
 
 SQLITE_DESC=		Enable SQLite KDC backend support
 SQLITE_USES=		sqlite
 SQLITE_CONFIGURE_ON=	--with-sqlite3-include="${LOCALBASE}/include" \
 			--with-sqlite3-lib="${LOCALBASE}/lib"
 SQLITE_CONFIGURE_WITH=	sqlite3
 
 LDAP_DESC=		Enable OpenLDAP KDC backend support
 LDAP_USE=		OPENLDAP=yes
 LDAP_CONFIGURE_ON=	--with-openldap-include="${LOCALBASE}/include" \
 			--with-openldap-lib="${LOCALBASE}/lib"
 LDAP_CONFIGURE_WITH=	openldap
 
 PKINIT_DESC=		Enable PK-INIT support
 PKINIT_CONFIGURE_ENABLE=pk-init
 
 DIGEST_DESC=		Enable DIGEST support
 DIGEST_CONFIGURE_ENABLE=digest
 
 KX509_DESC=		Enable kx509 support
 KX509_CONFIGURE_ENABLE=	kx509
 
 CRACKLIB_DESC=		Use CrackLib for password quality checking
 CRACKLIB_LIB_DEPENDS=	libcrack.so:security/cracklib
 
 .include <bsd.port.options.mk>
 
 post-extract:
 	@${MKDIR} ${WRKSRC}/kpasswdd-cracklib
 	${INSTALL_DATA} ${FILESDIR}/kpasswdd-cracklib.c \
 	    ${WRKSRC}/kpasswdd-cracklib
 	${INSTALL_DATA} ${FILESDIR}/kpasswdd-Makefile \
 	    ${WRKSRC}/kpasswdd-cracklib/Makefile
 
 pre-configure:
 	cd ${WRKSRC} && ./autogen.sh
 
 post-build-CRACKLIB-on:
 	cd ${WRKSRC}/kpasswdd-cracklib && \
 	    ${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_ARGS} ${BUILD_TARGET}
 
 post-install-CRACKLIB-on:
 	cd ${WRKSRC}/kpasswdd-cracklib && \
 	    ${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_ARGS} ${INSTALL_TARGET}
 
 .include <bsd.port.mk>
diff --git a/security/heimdal-devel/files/patch-configure.ac b/security/heimdal-devel/files/patch-configure.ac
index 048b6c83b622..b616d032b93a 100644
--- a/security/heimdal-devel/files/patch-configure.ac
+++ b/security/heimdal-devel/files/patch-configure.ac
@@ -1,10 +1,19 @@
---- configure.ac.orig	2019-06-07 06:21:39 UTC
-+++ configure.ac
-@@ -153,6 +153,7 @@ AC_ARG_ENABLE(kx509, 
+--- configure.ac.orig	2022-11-17 16:55:32.000000000 -0800
++++ configure.ac	2022-11-24 07:19:25.053801000 -0800
+@@ -19,7 +19,7 @@
+ AM_PROG_CC_C_O
+ AC_PROG_CPP
+ AM_PATH_PYTHON
+-AC_CHECK_PROG(CLANG_FORMAT, clang-format, [clang-format], [no])
++AC_CHECK_PROG(CLANG_FORMAT, clang-format, [clang-format], [])
+ test "$CLANG_FORMAT" = no && CLANG_FORMAT=true
+ 
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+@@ -177,6 +177,7 @@
  if test "$enable_kx509" != no ;then
  	AC_DEFINE([KX509], 1, [Define to enable kx509.])
  fi
 +AM_CONDITIONAL(KX509, test "$enable_kx509" != no)
  
  dnl Need to test if pkg-config exists
  PKG_PROG_PKG_CONFIG
diff --git a/security/heimdal/Makefile b/security/heimdal/Makefile
index 45301c01b888..6508bf471ee0 100644
--- a/security/heimdal/Makefile
+++ b/security/heimdal/Makefile
@@ -1,122 +1,118 @@
 PORTNAME=	heimdal
 PORTVERSION=	7.8.0
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	security
 MASTER_SITES=	https://github.com/heimdal/heimdal/releases/download/${DISTNAME}/
 
 MAINTAINER=	hrs@FreeBSD.org
 COMMENT=	Popular BSD-licensed implementation of Kerberos 5
 WWW=		https://www.h5l.org/
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 CONFLICTS=	krb5 krb5-*
 
 USES=		cpe gettext-runtime gssapi:bootstrap,heimdal libtool pathfix \
 		pkgconfig readline makeinfo ssl
 CPE_VENDOR=	${PORTNAME}_project
 USE_LDCONFIG=	${GSSAPILIBDIR}
 
-# Needs clang-format which is only provided by the port.
-# Else asm1_fails resulting in a command not found error.
-BUILD_DEPENDS=	clang${LLVM_DEFAULT}:devel/llvm${LLVM_DEFAULT}
-
 GNU_CONFIGURE=	yes
 CONFIGURE_ENV=	ac_cv_header_fnmatch_h=yes \
 		ac_cv_header_db_h=no \
 		ac_cv_header_db3_db_h=no \
 		ac_cv_header_db4_db_h=no \
 		ac_cv_header_db5_db_h=no \
 		ac_cv_header_db6_db_h=no \
 		ac_cv_prog_COMPILE_ET=${WRKSRC}/lib/com_err/compile_et \
 		PYTHON="${TRUE}"
 CONFIGURE_ARGS=	--with-berkeley-db \
 		--with-libintl \
 		--with-libintl-include="${LOCALBASE}/include" \
 		--with-libintl-lib="${LOCALBASE}/lib" \
 		--libdir="${GSSAPILIBDIR}" \
 		--includedir="${GSSAPIINCDIR}" \
 		--with-kcm \
 		--with-openssl \
 		--with-openssl-include="${OPENSSLINC}" \
 		--with-openssl-lib="${OPENSSLLIB}" \
 		--enable-otp \
 		--enable-pthread-support \
 		--with-readline="${LOCALBASE}" \
 		--with-hdbdir="/var/${PORTNAME}" \
 		--sysconfdir="${PREFIX}/etc" \
 		CLANG_FORMAT="${LOCALBASE}/bin/clang-format${LLVM_DEFAULT}"
 # XXX --with-readline picks up libreadline even if found in /usr/lib.
 MAKE_ENV=	INSTALL_CATPAGES=no
 INSTALL_TARGET=	install-strip
 .if !exists(/etc/rc.d/ipropd_master)
 USE_RC_SUBR=	ipropd_master ipropd_slave
 .endif
 INFO=		heimdal hx509
 
 MAKE_JOBS_UNSAFE=	yes
 
 OPTIONS_DEFINE=	IPV6 BDB LMDB SQLITE LDAP PKINIT DIGEST KX509 CRACKLIB
 OPTIONS_DEFAULT=IPV6 BDB                  PKINIT DIGEST KX509
 OPTIONS_SUB=	yes
 
 IPV6_CONFIGURE_WITH=	ipv6
 
 BDB_DESC=		Enable BerkeleyDB KDC backend support
 BDB_USES=		bdb:5 localbase
 BDB_CONFIGURE_ENV=	ac_cv_header_db${BDB_VER}_db_h=yes \
 			ac_cv_func_db_create=yes \
 			ac_cv_funclib_db_create="-l${BDB_LIB_NAME}"
 BDB_CONFIGURE_ON=	--disable-ndbm-db
 BDB_CONFIGURE_ENV_OFF=	ac_cv_header_db_h=yes \
 			ac_cv_func_db_create=no \
 			ac_cv_funclib_db_create=no
 BDB_CONFIGURE_OFF=	--enable-ndbm-db
 
 LMDB_DESC=		Enable LMDB KDC backend support
 LMDB_CONFIGURE_ENABLE=	mdb_db
 LMDB_LIB_DEPENDS=	liblmdb.so:databases/lmdb
 
 SQLITE_DESC=		Enable SQLite KDC backend support
 SQLITE_USES=		sqlite
 SQLITE_CONFIGURE_ON=	--with-sqlite3-include="${LOCALBASE}/include" \
 			--with-sqlite3-lib="${LOCALBASE}/lib"
 SQLITE_CONFIGURE_WITH=	sqlite3
 
 LDAP_DESC=		Enable OpenLDAP KDC backend support
 LDAP_USE=		OPENLDAP=yes
 LDAP_CONFIGURE_ON=	--with-openldap-include="${LOCALBASE}/include" \
 			--with-openldap-lib="${LOCALBASE}/lib"
 LDAP_CONFIGURE_WITH=	openldap
 
 PKINIT_DESC=		Enable PK-INIT support
 PKINIT_CONFIGURE_ENABLE=pk-init
 
 DIGEST_DESC=		Enable DIGEST support
 DIGEST_CONFIGURE_ENABLE=digest
 
 KX509_DESC=		Enable kx509 support
 KX509_CONFIGURE_ENABLE=	kx509
 
 CRACKLIB_DESC=		Use CrackLib for password quality checking
 CRACKLIB_LIB_DEPENDS=	libcrack.so:security/cracklib
 
 .include <bsd.port.options.mk>
 
 post-extract:
 	@${MKDIR} ${WRKSRC}/kpasswdd-cracklib
 	${INSTALL_DATA} ${FILESDIR}/kpasswdd-cracklib.c \
 	    ${WRKSRC}/kpasswdd-cracklib
 	${INSTALL_DATA} ${FILESDIR}/kpasswdd-Makefile \
 	    ${WRKSRC}/kpasswdd-cracklib/Makefile
 
 post-build-CRACKLIB-on:
 	cd ${WRKSRC}/kpasswdd-cracklib && \
 	    ${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_ARGS} ${BUILD_TARGET}
 
 post-install-CRACKLIB-on:
 	cd ${WRKSRC}/kpasswdd-cracklib && \
 	    ${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_ARGS} ${INSTALL_TARGET}
 
 .include <bsd.port.mk>
diff --git a/security/heimdal/files/patch-configure b/security/heimdal/files/patch-configure
index 4ac5681271fb..090c916d35c9 100644
--- a/security/heimdal/files/patch-configure
+++ b/security/heimdal/files/patch-configure
@@ -1,76 +1,85 @@
---- configure.orig	2019-06-07 06:23:13 UTC
-+++ configure
-@@ -792,6 +792,8 @@ CAPNG_CFLAGS
+--- configure.orig	2022-11-15 10:58:55.000000000 -0800
++++ configure	2022-11-24 07:15:39.173234000 -0800
+@@ -819,6 +819,8 @@
  PKG_CONFIG
  PKINIT_FALSE
  PKINIT_TRUE
 +KX509_FALSE
 +KX509_TRUE
  OPENLDAP_MODULE_FALSE
  OPENLDAP_MODULE_TRUE
  LIB_openldap
-@@ -15041,9 +15043,15 @@ if test "$enable_kx509" != no ;then
- $as_echo "#define KX509 1" >>confdefs.h
+@@ -14915,7 +14917,7 @@
+   done
+ IFS=$as_save_IFS
+ 
+-  test -z "$ac_cv_prog_CLANG_FORMAT" && ac_cv_prog_CLANG_FORMAT="no"
++  test -z "$ac_cv_prog_CLANG_FORMAT" && ac_cv_prog_CLANG_FORMAT=""
+ fi
+ fi
+ CLANG_FORMAT=$ac_cv_prog_CLANG_FORMAT
+@@ -16561,9 +16563,15 @@
+ printf "%s\n" "#define KX509 1" >>confdefs.h
  
  fi
 + if test "$enable_kx509" != no; then
 +  KX509_TRUE=
 +  KX509_FALSE='#'
 +else
 +  KX509_TRUE='#'
 +  KX509_FALSE=
 +fi
  
  
 -
  if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
  	if test -n "$ac_tool_prefix"; then
    # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args.
-@@ -16103,7 +16111,7 @@ case "$host" in
+@@ -17649,7 +17657,7 @@
      ;;
  *-*-freebsd*)
  	native_pthread_support=yes
 -	PTHREAD_LIBADD="-pthread"
 +	PTHREAD_LIBADD="-lpthread"
  	;;
  *-*-openbsd*)
  	native_pthread_support=yes
-@@ -16339,7 +16347,7 @@ if ${ac_cv_funclib_db_create+:} false; then :
-   $as_echo_n "(cached) " >&6
- else
+@@ -17907,7 +17915,7 @@
+   printf %s "(cached) " >&6
+ else $as_nop
  
 -if eval "test \"\$ac_cv_func_db_create\" != yes" ; then
 +if eval "test \"\$ac_cv_func_db_create\" = yes" ; then
  	ac_save_LIBS="$LIBS"
- 	for ac_lib in "" $dbheader db-5 db5 db4 db3 db; do
+ 	for ac_lib in "" $dbheader db-6 db-5 db4 db3 db; do
  		case "$ac_lib" in
-@@ -16912,6 +16920,9 @@ esac
+@@ -18448,6 +18456,9 @@
  
- $as_echo "#define HAVE_NDBM 1" >>confdefs.h
+ printf "%s\n" "#define HAVE_NDBM 1" >>confdefs.h
        have_ndbm=yes
 +      if test "$db_type" = "unknown"; then
 +      db_type=ndbm
 +      fi
      else
  
        $as_unset ac_cv_func_dbm_firstkey
-@@ -28663,7 +28674,7 @@ fi
+@@ -30678,7 +30689,7 @@
  
  krb_cv_compile_et="no"
  krb_cv_com_err_need_r=""
 -krb_cv_compile_et_cross=no
 +krb_cv_compile_et_cross=yes
  if test "${COMPILE_ET}" != "no"; then
  
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether compile_et has the features we need" >&5
-@@ -29176,6 +29187,10 @@ Usually this means the macro was only invoked conditio
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether compile_et has the features we need" >&5
+@@ -31185,6 +31196,10 @@
  fi
  if test -z "${PKINIT_TRUE}" && test -z "${PKINIT_FALSE}"; then
    as_fn_error $? "conditional \"PKINIT\" was never defined.
 +Usually this means the macro was only invoked conditionally." "$LINENO" 5
 +fi
 +if test -z "${KX509_TRUE}" && test -z "${KX509_FALSE}"; then
 +  as_fn_error $? "conditional \"KX509\" was never defined.
  Usually this means the macro was only invoked conditionally." "$LINENO" 5
  fi
  if test -z "${HAVE_CAPNG_TRUE}" && test -z "${HAVE_CAPNG_FALSE}"; then
diff --git a/security/heimdal/files/patch-configure.ac b/security/heimdal/files/patch-configure.ac
index 048b6c83b622..82506f13f45d 100644
--- a/security/heimdal/files/patch-configure.ac
+++ b/security/heimdal/files/patch-configure.ac
@@ -1,10 +1,19 @@
---- configure.ac.orig	2019-06-07 06:21:39 UTC
-+++ configure.ac
-@@ -153,6 +153,7 @@ AC_ARG_ENABLE(kx509, 
+--- configure.ac.orig	2022-11-15 10:56:25.000000000 -0800
++++ configure.ac	2022-11-24 07:17:10.904587000 -0800
+@@ -19,7 +19,7 @@
+ AM_PROG_CC_C_O
+ AC_PROG_CPP
+ AM_PATH_PYTHON
+-AC_CHECK_PROG(CLANG_FORMAT, clang-format, [clang-format], [no])
++AC_CHECK_PROG(CLANG_FORMAT, clang-format, [clang-format], [])
+ 
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+ 
+@@ -155,6 +155,7 @@
  if test "$enable_kx509" != no ;then
  	AC_DEFINE([KX509], 1, [Define to enable kx509.])
  fi
 +AM_CONDITIONAL(KX509, test "$enable_kx509" != no)
  
  dnl Need to test if pkg-config exists
  PKG_PROG_PKG_CONFIG