• devel/libwasmtime: Update 49.0.2 => 50.0.1
• security/vuxml: Document libwasmtime vulnerabilities

@yuri I would cherry-pick e11bc8b0b0ee to 2026Q4? f3 10.0 fails to build on i386 there too. testport passes on 144i386 and 144amd64 against quarterly packages.

use minimum version of dependencies according to the CRAN DESCRIPTION, drop WWW

In D60940#1397408, @jrm wrote:

Could you make the VuXML entry a separate commit? It looks like lots of other ports that bundle wasmtime are vulnerable (please confirm).

git -C /usr/ports grep -E 'wasmtime-[0-9]+\.[0-9]+\.[0-9]+' '*/*/Makefile*'
cad/surfer/Makefile.crates:     wasmtime-41.0.4 \
cad/veryl/Makefile.crates:      wasmtime-49.0.1 \
databases/mongodb90/Makefile.crates:        wasmtime-44.0.1 \
databases/surrealdb/Makefile:       wasmtime-48.0.5 \
devel/codemark/Makefile.crates:     wasmtime-29.0.1 \
devel/moon/Makefile.crates:     wasmtime-43.0.2 \
devel/tree-sitter-cli/Makefile.crates:      wasmtime-36.0.14 \
devel/wizer/Makefile:       wasmtime-42.0.1 \
editors/gram/Makefile.crates:       wasmtime-36.0.14 \
editors/lapce/Makefile.crates:      wasmtime-14.0.2 \
editors/vscode/Makefile.crates:     wasmtime-36.0.10 \
editors/zed/Makefile.crates:        wasmtime-48.0.1 \
games/veloren-weekly/Makefile.crates:       wasmtime-49.0.2 \
misc/zeroclaw/Makefile:     wasmtime-41.0.4 \
x11/waveterm/Makefile.crates:       wasmtime-38.0.4 \

Since there are 20 GHSA, rather than referencing them all in the devel/libwasmtime commit log, perhaps just point to the VuXML entry with Security: 57e6e702-cd69-11f1-b0e3-74563cf85f9d.

Add VuXML entry

Add VuXML entry

In D60853#1395620, @jrm wrote:

Looks good.

• Since there is a release page, it's better to reference it in the commit log. https://github.com/ankitects/anki/releases/tag/26.09.3
• Normally we should wait for maintainer approval, but since the release page says, "Please upgrade to 26.09+ as soon as possible as it includes important security fixes." you can push sooner.
• VuXML entry?

Update WWW to the new CRAN URL format

It seems a reasonable change

Drop PASTE and add a comment section for TEST_DEPENDS

UPDATING: add pkg set -n step for the package rename

remove NO_ARCH= yes

In D60719#1392565, @yuri wrote:

In D60719#1392563, @longros wrote:

Thanks for the feedback Yuri. The change is upstream in the main but there is no new release with it yet.

Then you should say in the comment that this is a back-ported change/fix from the upstream.

Bump Makefile, add comment of backported fix and GitHub URL

In D60718#1392564, @yuri wrote:

distilator shows that the WWW URL redirects. The redirect target should be in the WWW field.
You should always run distilator for new ports and port updates to check whether important URLs like WWW and MASTER_SITES redirect.

make sure that the URL redirects with distilator

In D60719#1392557, @yuri wrote:

Hi Christos,

Several problems:

1. When you add a patch you should always add a comment in the first lines of the patch explaining why is it needed. This is especially important for a patch like this one when it isn't obvious why does it solve a problem stated in the subject.
2. Bump in the Makefile is needed because this is a code change that might affect binaries on all architectures, at least from the first look.
3. Such change should be upstreamed if possible. Please mention in the patch comment whether you upstreamed it. In case of a GitHub hosted project like this one a pull request URL would be appropriate. I use the GitHub's gh CLI to create such PRs completely from the command line. gh makes it very easy.