Update to 3.20140916. From the changelog:

* Don't double-decode CGI submissions with Encode.pm >= 2.53,
  fixing "Error: Cannot decode string with wide characters".
  Thanks, Antoine Beaupré
* Avoid making trails depend on everything in the wiki by giving them
  a better way to sort the pages
* Don't let users post comments that won't be displayed
* Fix encoding of Unicode strings in Python plugins.
  Thanks, chrysn
* Improve performance and correctness of the [[!if]] directive
* Let [[!inline rootpage=foo postform=no]] disable the posting form
* Switch default [[!man]] shortcut to manpages.debian.org. Closes: #700322
* Add UUID and TIME variables to edittemplate. Closes: #752827
  Thanks, Jonathon Anderson
* Display pages in linkmaps as their pagetitle (no underscore escapes).
  Thanks, chrysn
* Fix aspect ratio when scaling small images, and add support for
  converting SVG and PDF graphics to PNG.
  Thanks, chrysn
  - suggest ghostscript (required for PDF-to-PNG thumbnailing)
    and libmagickcore-extra (required for SVG-to-PNG thumbnailing)
  - build-depend on ghostscript so the test for scalable images can be run
* In the CGI wrapper, incorporate $config{ENV} into the environment
  before executing Perl code, so that PERL5LIB can point to a
  non-system-wide installation of IkiWiki.
  Thanks, Lafayette Chamber Singers Webmaster
* filecheck: accept MIME types not containing ';'
* autoindex: index files in underlays if the resulting pages aren't
  going to be committed. Closes: #611068
* Add [[!templatebody]] directive so template pages don't have to be
  simultaneously a valid template and valid HTML
* Add myself to Uploaders and release to Debian

 -- Simon McVittie <smcv@debian.org>  Fri, 12 Sep 2014 21:23:58 +0100

pkgsrc changes:

* Add 'cgi' option, enabled by default
* Add 'git' option, disabled by default

Updating during the freeze because it's a leaf with many fixes,
including our local patches.
Updated www/ikiwiki to 3.20140916
Updated security/ssdeep to version 2.11

Quoted from http://jessekornblum.livejournal.com/295883.html:

  This is an important update, which corrects a bug in the signature
  generation code. Any ssdeep hashes created with version 2.10 should be
  recomputed. The signatures are not wrong per se though, they are just not
  as good as they should be"
Updated security/ssdeep to 2.11
Updated devel/deforaos-libsystem to version 0.2.0

This release includes:
- a command-line tool, configctl(1), to interact with configuration files
- a new generic Mutator class
- further improvements to the String and Variable classes
Updated devel/deforaos-libsystem to 0.2.0
Update to 1.8.8, many security fixes.

D-Bus 1.8.8 (2014-09-16)
==

The "smashy smashy egg man" release.

Security fixes:

* Do not accept an extra fd in the padding of a cmsg message, which
  could lead to a 4-byte heap buffer overrun.
  (CVE-2014-3635, fd.o #83622; Simon McVittie)

* Reduce default for maximum Unix file descriptors passed per message
  from 1024 to 16, preventing a uid with the default maximum number of
  connections from exhausting the system bus' file descriptors under
  Linux's default rlimit. Distributors or system administrators with a
  more restrictive fd limit may wish to reduce these limits further.

  Additionally, on Linux this prevents a second denial of service
  in which the dbus-daemon can be made to exceed the maximum number
  of fds per sendmsg() and disconnect the process that would have
  received them.
  (CVE-2014-3636, fd.o #82820; Alban Crequy)

* Disconnect connections that still have a fd pending unmarshalling after
  a new configurable limit, pending_fd_timeout (defaulting to 150 seconds),
  removing the possibility of creating an abusive connection that cannot be
  disconnected by setting up a circular reference to a connection's
  file descriptor.
  (CVE-2014-3637, fd.o #80559; Alban Crequy)

* Reduce default for maximum pending replies per connection from 8192 to 128,
  mitigating an algorithmic complexity denial-of-service attack
  (CVE-2014-3638, fd.o #81053; Alban Crequy)

* Reduce default for authentication timeout on the system bus from
  30 seconds to 5 seconds, avoiding denial of service by using up
  all unauthenticated connection slots; and when all unauthenticated
  connection slots are used up, make new connection attempts block
  instead of disconnecting them.
  (CVE-2014-3639, fd.o #80919; Alban Crequy)

Other fixes:

* Check for libsystemd from systemd >= 209, falling back to
  the older separate libraries if not found (Umut Tezduyar Lindskog,
  Simon McVittie)

* On Linux, use prctl() to disable core dumps from a test executable
  that deliberately raises SIGSEGV to test dbus-daemon's handling
  of that condition (fd.o #83772, Simon McVittie)

* Fix compilation with --enable-stats (fd.o #81043, Gentoo #507232;
  Alban Crequy)

* Improve documentation for running tests on Windows (fd.o #41252,
  Ralf Habacker)
Updated sysutils/dbus to 1.8.8
Improve audio pause/playback patch; from Nat Sloss <nat@> again.
Bump PKGREVISION.
Updated multimedia/mpv to 0.5.1nb2
Add patch from GIT repository to fix build under Mac OS X.