Add the CHANGES file for the new pkgsrc-2007Q1 branch
Pullup ticket 2062 - requested by joerg
build fix for scilab

- pkgsrc/math/scilab/distinfo				1.25
- pkgsrc/math/scilab/patches/patch-aa			1.13
- pkgsrc/math/scilab/patches/patch-ab			1.14
- pkgsrc/math/scilab/patches/patch-aj			1.9

   Module Name:	pkgsrc
   Committed By:	joerg
   Date:		Tue Apr 10 15:53:17 UTC 2007

   Modified Files:
	   pkgsrc/math/scilab: distinfo
	   pkgsrc/math/scilab/patches: patch-aa patch-ab patch-aj

   Log Message:
   Handle DragonFly as FreeBSD for now. Fix build on both.
#2062
Pullup ticket 2065 - requested by tron
security update for fetchmail

- pkgsrc/mail/fetchmail/Makefile			1.162
- pkgsrc/mail/fetchmail/distinfo			1.37
- pkgsrc/mail/fetchmailconf/Makefile			1.72

   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Sat Apr 14 22:14:29 UTC 2007

   Modified Files:
	   pkgsrc/mail/fetchmail: Makefile distinfo
	   pkgsrc/mail/fetchmailconf: Makefile

   Log Message:
   Update "fetchmail" and "fetchmailconf" packages to version 6.3.8.
   Changes since version 6.3.6:
   - Make the APOP challenge parser more distrustful and have it reject
     challenges that do not conform to RFC-822 msg-id format, in the hope
     to make mounting man-in-the-middle attacks (MITM) against APOP a bit
     more difficult. (CVE-2007-1558)
   - Fix pluralization of oversized-message warning mails.
   - Fix manual page: --sslcheck -> --sslcertck, and do not set trailing
     "recommended:" in bold.
   - Repoll immediately if a protocol error happens during the authentication
     attempt after a failed opportunistic TLS upgrade.
   - Fix rendering of the "24 - 26, 28, 29" paragraph in the exit codes
     section.
   - If SOCKS support was compiled in, add 'socks' to the feature_options
     Python list emitted in --configdump.
   - Do not crash with a null pointer dereference when opening the BSMTP file
     fails. Improve error checking and reporting.
   - Make BSMTP output actually work, it would persistently fail with SOCKET
     error after writing the first header.
   - Fix KPOP.
   - Fix repoll when server disconnects after opportunistic TLS failed for
     POP3.
#2065
Pullup ticket 2070 - requested by joerg
security update for lighttpd

- pkgsrc/www/lighttpd/Makefile				1.14
- pkgsrc/www/lighttpd/PLIST				1.6
- pkgsrc/www/lighttpd/distinfo				1.9
- pkgsrc/www/lighttpd/patches/patch-aa			removed
- pkgsrc/www/lighttpd/patches/patch-ab			removed
- pkgsrc/www/lighttpd/patches/patch-ac			removed
- pkgsrc/www/lighttpd/patches/patch-ad			removed
- pkgsrc/www/lighttpd/patches/patch-ae			removed
- pkgsrc/www/lighttpd/patches/patch-af			removed
- pkgsrc/www/lighttpd/patches/patch-ag			removed
- pkgsrc/www/lighttpd/patches/patch-ah			removed

   Module Name:	pkgsrc
   Committed By:	joerg
   Date:		Thu Apr 19 16:16:19 UTC 2007

   Modified Files:
	   pkgsrc/www/lighttpd: Makefile PLIST distinfo
   Removed Files:
	   pkgsrc/www/lighttpd/patches: patch-aa patch-ab patch-ac patch-ad
	       patch-ae patch-af patch-ag patch-ah

   Log Message:
   Update to lighttpd 1.4.15:

   Most important changes are:
   - fix a crash for files with an mtime of 0
   - fix cpu hog in certain requests
   - added mod_extforward module
   - reduced default PATH_MAX to 255
#2070
Pullup ticket 2074 - requested by xtraeme
security update for opera

- pkgsrc/www/opera/Makefile				1.65
- pkgsrc/www/opera/distinfo				1.20

   Module Name:	pkgsrc
   Committed By:	xtraeme
   Date:		Mon Apr 16 23:21:41 UTC 2007

   Modified Files:
	   pkgsrc/www/opera: Makefile distinfo

   Log Message:
   Update to 9.20 (latest stable version), tested with NetBSD/amd64.

   See http://www.opera.com/docs/changelogs/linux/920/
   to see changes for this release.
#2074
Pullup ticket 2072 - requested by ghen
dovecot update

Revisions pulled up:
- pkgsrc/mail/dovecot/Makefile			1.93, 1.94, 1.95
- pkgsrc/mail/dovecot/distinfo			1.65, 1.66

   Module Name:		pkgsrc
   Committed By:	ghen
   Date:		Sun Apr  8 10:48:08 UTC 2007

   Modified Files:
   	pkgsrc/mail/dovecot: Makefile distinfo

   Log Message:
   Update to dovecot-1.0rc31.  From the release announcement mail:

   mbox + NFS combination shouldn't break anymore. v1.0 still planned to
   be released next friday.

   	- mbox: Give "mbox file was modified while we were syncing" error only
   	  if we detect some problems in the mbox file. The check can't be
   	  trusted with NFS.
   	- Convert plugin: If directory for destination storage doesn't exist,
   	  create it.
   	- Convert plugin: Mailbox names weren't converted in subscription
   	  list.
---
   Module Name:		pkgsrc
   Committed By:	ghen
   Date:		Fri Apr 13 12:24:05 UTC 2007

   Modified Files:
   	pkgsrc/mail/dovecot: Makefile distinfo

   Log Message:
   Update to dovecot-1.0.0.  This release is identical to 1.0rc32 (which has not
   been in pkgsrc) except for the version number, so here is the announcement of
   1.0rc32:

   Pretty late for changes if v1.0 is supposed to come out tomorrow, but I
   can't really leave these LDAP bugs unfixed. They shouldn't anyway break
   anything, so here's one more day for you people to find out about any
   bugs.

   One thing that I'm a bit concerned about is the addition of #define
   LDAP_DEPRECATED. I know it fixes crashes with OpenLDAP 2.3 + 64bit
   systems, but I hope it doesn't break compiling with some old versions or
   non-OpenLDAP libraries..

   	- LDAP, auth_bind=3Dno: Don't crash if doing non-plaintext ldap passdb
   	  lookup for unknown user. This also broke deliver when userdb static
   	  was used.
   	- LDAP, auth_bind=3Dyes and userdb ldap: We didn't wait until bind was
   	  finished before sending the userdb request, which could have caused
   	  problems.
   	- LDAP: Don't break when compiling with OpenLDAP v2.3 library
   	- Convert plugin: Don't create "maildirfolder" file to Maildir root.
---
   Module Name:		pkgsrc
   Committed By:	ghen
   Date:		Fri Apr 13 12:29:22 UTC 2007

   Modified Files:
   	pkgsrc/mail/dovecot: Makefile

   Log Message:
   Forgot to delete a commented line.
#2072
Pullup ticket 2078 - requested by tron
security fix for php-gd

- pkgsrc/graphics/php-gd/Makefile			1.16
- pkgsrc/lang/php5/distinfo				1.39
- pkgsrc/lang/php5/patches/patch-ac			1.4
- pkgsrc/www/php4/distinfo				1.64
- pkgsrc/www/php4/patches/patch-ae			1.7

   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Sun May  6 13:08:34 UTC 2007

   Modified Files:
	   pkgsrc/graphics/php-gd: Makefile
	   pkgsrc/lang/php5: distinfo
	   pkgsrc/www/php4: distinfo
   Added Files:
	   pkgsrc/lang/php5/patches: patch-ac
	   pkgsrc/www/php4/patches: patch-ae

   Log Message:
   Add security fix for CVE-2007-1001 to "php4-gd" and "php5-gd" packages.
   Bump package revision.
Pullup ticket 2079 - requested by martti
security update for squirrelmail

- pkgsrc/mail/squirrelmail/Makefile			1.83
- pkgsrc/mail/squirrelmail/PLIST			1.21
- pkgsrc/mail/squirrelmail/distinfo			1.36
- pkgsrc/mail/squirrelmail/patches/patch-aa		1.13

   Module Name:	pkgsrc
   Committed By:	martti
   Date:		Thu May 10 06:48:28 UTC 2007

   Modified Files:
	   pkgsrc/mail/squirrelmail: Makefile PLIST distinfo
	   pkgsrc/mail/squirrelmail/patches: patch-aa

   Log Message:
   Updated mail/squirrelmail to 1.4.10

   This version, 1.4.10 is a maintenance release, addressing
   the following problems since 1.4.9a:
   - Some security fixes (see below)
   - Small enhancements
   - A collection of bugfixes and stability enhancements
   (see ChangeLog for a full list)

   Security issues
   ===============

   This release addresses security issues found since the release of 1.4.9a:

   There's an ongoing battle to further secure the HTML filter against malicious
   HTML mail and the browsers that accept almost any malformed piece of HTML.

   This release contains fixes for the following:
   - HTML attachments containing "data:" URLs;
   - Internet Explorer in various versions accepts many permutations of HTML
      and JavaScript in many charsets. We now properly canonicalize the incoming
      HTML to us-ascii before applying further filters. IE only.
   - Request forgery through images. It was possible to include "images" in
      HTML mails which were in fact GET requests for the compose.php page sending
      mail. These images are now properly detected, and the compose form will only
      send mail through a POST request.

   Thanks to Mikhail Markin, Tomas Kuliavas and Michael Jordon for reporting
   (parts of) these issues and working with us to get them resolved.

   These are known as CVE-2007-1262. Further details on SquirrelMail
   vulnerabilities can be found at the following address:

      http://www.squirrelmail.org/security/
#2079
Pullup ticket 2081 - requested by martti
bugfix update for squirrelmail

- pkgsrc/mail/squirrelmail/Makefile			1.84
- pkgsrc/mail/squirrelmail/PLIST			1.22
- pkgsrc/mail/squirrelmail/distinfo			1.37

   Module Name:	pkgsrc
   Committed By:	martti
   Date:		Thu May 10 09:24:44 UTC 2007

   Modified Files:
	   pkgsrc/mail/squirrelmail: Makefile PLIST distinfo

   Log Message:
   Updated mail/squirrelmail to 1.4.10a

   Shortly after the release of SquirrelMail 1.4.10, a regression in the compose
   form was discovered. Unfortunately the limited disclosure of security patches
   does not allow for public testing, so this regression went unnoticed. We're
   sorry for the inconvenience.
#2081
Pullup ticket 2080 - requested by ghen
security update for postgresql

Revisions pulled up:
- pkgsrc/databases/postgresql80/Makefile.common		1.28, 1.29
- pkgsrc/databases/postgresql80/distinfo		1.18
- pkgsrc/databases/postgresql80-client/PLIST		1.16
- pkgsrc/databases/postgresql80-server/Makefile		1.24
- pkgsrc/databases/postgresql80-server/PLIST		1.9
- pkgsrc/databases/postgresql81/Makefile.common		1.11, 1.12, 1.13
- pkgsrc/databases/postgresql81/distinfo		1.9
- pkgsrc/databases/postgresql81-client/PLIST		1.7
- pkgsrc/databases/postgresql81-server/PLIST		1.3
- pkgsrc/databases/postgresql82/Makefile.common		1.5, 1.6
- pkgsrc/databases/postgresql82/distinfo		1.7
- pkgsrc/databases/postgresql82-client/PLIST		1.5
- pkgsrc/databases/postgresql82-server/PLIST		1.3

   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Mon Apr 30 13:37:01 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql82: Makefile.common distinfo
   	pkgsrc/databases/postgresql82-client: PLIST
   	pkgsrc/databases/postgresql82-server: PLIST

   Log Message:
   Changes 8.2.4:
   * Support explicit placement of the temporary-table schema within
     search_path, and disable searching it for functions and operators
   * Fix shared_preload_libraries for Windows by forcing reload in each
     backend
   * Fix to_char() so it properly upper/lower cases localized day or
     month names
   * "/contrib/tsearch2" crash fixes
   * Require "COMMIT PREPARED" to be executed in the same database as
     the transaction was prepared in
   * Allow "pg_dump" to do binary backups larger than two gigabytes on
     Windows
   * New traditional (Taiwan) Chinese FAQ
   * Prevent the statistics collector from writing to disk too
     frequently
   * Fix potential-data-corruption bug in how "VACUUM FULL" handles
     "UPDATE" chains
   * Fix bug in domains that use array types
   * Fix "pg_dump" so it can dump a serial column's sequence using "-t"
     when not also dumping the owning table
   * Planner fixes, including improving outer join and bitmap scan
     selection logic
   * Fix possible wrong answers or crash when a PL/pgSQL function tries
     to RETURN from within an EXCEPTION block
   * Fix PANIC during enlargement of a hash index
   * Fix POSIX-style timezone specs to follow new USA DST rules
---
   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Mon Apr 30 13:37:23 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql81: Makefile.common distinfo
   	pkgsrc/databases/postgresql81-client: PLIST
   	pkgsrc/databases/postgresql81-server: PLIST

   Log Message:
   Changes 8.1.9:
   * Support explicit placement of the temporary-table schema within
     search_path, and disable searching it for functions and operators
   * "/contrib/tsearch2" crash fixes
   * Require "COMMIT PREPARED" to be executed in the same database as
     the transaction was prepared in
   * Fix potential-data-corruption bug in how "VACUUM FULL" handles
     "UPDATE" chains
   * Planner fixes, including improving outer join and bitmap scan
     selection logic
   * Fix PANIC during enlargement of a hash index (bug introduced in
     8.1.6)
   * Fix POSIX-style timezone specs to follow new USA DST rules
---
   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Mon Apr 30 13:37:36 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql80: Makefile.common distinfo

   Log Message:
   Changes 8.0.13:
   * Support explicit placement of the temporary-table schema within
     search_path, and disable searching it for functions and operators
   * "/contrib/tsearch2" crash fixes
   * Fix potential-data-corruption bug in how "VACUUM FULL" handles
     "UPDATE" chains
   * Fix PANIC during enlargement of a hash index (bug introduced in
     8.0.10)
   * Fix POSIX-style timezone specs to follow new USA DST rules
---
   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Fri May  4 19:44:52 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql81: Makefile.common

   Log Message:
   CONFLICTS fix
---
   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Fri May  4 19:45:52 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql82: Makefile.common

   Log Message:
   CONFLICTS fix
---
   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Fri May  4 20:04:06 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql80: Makefile.common
   	pkgsrc/databases/postgresql80-client: PLIST

   Log Message:
   CONFLICTS and PLIST fix
---
   Module Name:		pkgsrc
   Committed By:	adam
   Date:		Fri May  4 20:04:52 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql81: Makefile.common

   Log Message:
   CONFLICTS fix
---
   Module Name:		pkgsrc
   Committed By:	joerg
   Date:		Tue May  8 15:58:39 UTC 2007

   Modified Files:
   	pkgsrc/databases/postgresql80-server: Makefile PLIST

   Log Message:
   Fix PLIST after last update.
#2080
Pullup ticket 2063 - requested by joerg
vga restore fix for xf86-video-ati

Revisions pulled up:
- pkgsrc/x11/xf86-video-ati/Makefile			1.4
- pkgsrc/x11/xf86-video-ati/distinfo			1.2
- pkgsrc/x11/xf86-video-ati/patches/patch-aa		1.1

   Module Name:		pkgsrc
   Committed By:	joerg
   Date:		Tue Apr 10 19:10:55 UTC 2007

   Modified Files:
   	pkgsrc/x11/xf86-video-ati: Makefile distinfo
   Added Files:
   	pkgsrc/x11/xf86-video-ati/patches: patch-aa

   Log Message:
   Include the mode restore bugfix from monolithic Xorg, that is derived
   from the version in xsrc which in turn was provided by Matthieu Herb
   over 3 years ago on the XFree86 lists. Suggested by various developers,
   hold-back due to the working state in xorg-server 1.1.1. Tracing down
   the exact change showed that the changed default color depth made this
   issue a lot more prominent again. Discussed with Eric Anholt.
   Bump revision.
#2063