CVS commit: [pkgsrc-2026Q2] pkgsrc/mail/rspamd
"Maya Rashish" <[email protected]> Wed, 5 Aug 2026 15:39:50 +0000
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Wed Aug 5 15:39:50 UTC 2026
Modified Files:
pkgsrc/mail/rspamd [pkgsrc-2026Q2]: Makefile PLIST cfgfiles.mk distinfo
Removed Files:
pkgsrc/mail/rspamd/patches [pkgsrc-2026Q2]:
patch-src_plugins_lua_dmarc.lua
Log Message:
Pullup ticket #7221 - requested by taca
mail/rpsmad: Security fix
Revisions pulled up:
- mail/rspamd/Makefile 1.136-1.138
- mail/rspamd/PLIST 1.42-1.43
- mail/rspamd/cfgfiles.mk 1.21-1.23
- mail/rspamd/distinfo 1.75-1.77
- mail/rspamd/patches/patch-src_plugins_lua_dmarc.lua deleted
---
Module Name: pkgsrc
Committed By: wiz
Date: Mon Jul 6 09:22:18 UTC 2026
Modified Files:
pkgsrc/mail/rspamd: Makefile PLIST cfgfiles.mk distinfo
Removed Files:
pkgsrc/mail/rspamd/patches: patch-src_plugins_lua_dmarc.lua
Log Message:
rspamd: update to 4.1.1.
4.1.1: 19 Jun 2026
** Features **
* [Feature] checkv3: Negotiate representation and compression via Accept/Accept-Encoding
* [Feature] css: Detect more text-hiding tricks (off-screen positioning, clip, negative text-indent, tiny fonts)
* [Feature] lua_archive: Add opt-in extraction limits (size, count, ratio) to bound zip-bomb expansion
* [Feature] lua_text: Add byte-distribution statistics methods (entropy, byte mean/deviation, serial correlation, Monte-Carlo Pi)
* [Feature] lua: Add zlib/YARA-compatible crc32 for rspamd_text, rspamd_util, and cryptobox hash
* [Feature] multipattern: Add explicit SOM (start-of-match) flag and fix regex-fallback offsets
* [Feature] neural: Add pluggable feature-provider and ANN-architecture registries
* [Feature] neural: Add sequence output mode and SIF word selection to fasttext_embed
* [Feature] kann: Add multi-head attention pooling operator
* [Feature] lua_kann: Expose slice and concat graph transforms
** Bug fixes **
* [Fix] dns: Do not defer resolver nameservers (fixes SIGSEGV at worker startup, regression in 4.1.0)
* [Fix] lua: Add state/generation guards and refcounting to the coroutine thread pool to prevent use-after-free on async completion
* [Fix] lua_worker: Avoid deadlock when a spawned subprocess returns an invalid value
* [Fix] milter: Send QUARANTINE even with a caller-supplied reply (regression from 3.10.0)
* [Fix] neural: Stabilise training on dense embedding inputs (funnel architecture, input-typed learning rate, single-class quality gate)
* [Fix] neural: Don't strand trained ANNs behind stale high-version tombstones
* [Fix] mx_check: Classify loopback-only MX as MX_LOCAL_ONLY instead of MX_BOGON_ONLY
* [Fix] monitored: Use alphanumeric-only random DNS prefixes for random_monitored RBL checks
* [Fix] protocol: Use case-preserving boundary for v3 HTTP multipart parsing
* [Fix] controller: Register the /checkv3 endpoint
* [Fix] symcache: Fix timeout inflation in pre/postfilter priority grouping
* [Fix] url: Scan bare query-embedded URLs containing '=' as a whole
* [Fix] url: Do not multiply URLs with multiple '@' signs and backslashes
* [Fix] css: Detect text hidden via overflow clipping, opacity, and max-width/height
* [Fix] mime: Fix build with OpenSSL 4.0 opaque ASN1_STRING
* [Fix] mime_string: Make iterator const to fix doctest 2.5.0 build
* [Fix] Prioritise bundled simdutf headers over system ones
4.1.0: 05 Jun 2026
** Incompatible changes **
* [Rework] mx_check: three-layer Redis cache and finer outcome symbols (MX_NONE replaces MX_NXDOMAIN/MX_MISSING)
* [Conf] fuzzy_check: discover rspamd.com servers via SRV by default
** Major features **
* [Feature] protocol: Expose custom metadata for /checkv3 via metadata headers and task:get_metadata()
* [Feature] composites: Add hot-reloadable dynamic composites map
* [Feature] lua_task: Add bulk and regexp symbol lookups
* [Feature] lua_tcp: Add phase-specific timeouts (connect/read/write) and on_error callback
* [Feature] task: Report pending async events and stalled symbols at scan timeout
* [Feature] upstream: Load-aware selection with Power of Two Choices, latency EWMA, and slow start on revive
* [Feature] upstream: Expand each SRV target into its own upstream, honouring SRV weights and per-target error budgets
* [Feature] upstream: Defer DNS resolution for unreachable hosts so transient startup DNS failures no longer drop upstreams
* [Feature] mx_check: Add IP-class classification, bad_mxs/bad_ips trust maps, and per-source checks
* [Feature] external_services: Add per-service <RULE>_CHECK anchor symbol for dependency ordering
* [Feature] url_redirector: Add chain-aware cache with intermediate hop injection
* [Feature] url_redirector: Add coherent browser fingerprint profiles for stealth resolution
* [Feature] url_redirector: Switch redirector_hosts_map from set to glob
* [Feature] url_redirector: Allow GET for a user-defined list of URLs
* [Feature] http: Optional insertion-ordered header emission
* [Feature] elastic: Log Reply-To, received IPs, URL metadata, and forcing module
* [Feature] clickhouse: Add named extra_columns presets with an outbound preset
* [Feature] selectors: Add fuzzy_digest, fuzzy_shingles, authenticated, and received_count
* [Feature] html: Add HTML5 tag definitions (video/audio/picture/svg/...)
* [Feature] dmarc_report: Add --batch-wait option to throttle batches
* [Feature] autolearnstats: Add --sort-by and --group options
* [Feature] lualib: Add lua_feedback_parsers for DSN and ARF reports
* [Feature] lua_extras: Structured loader for custom selectors, maps, and regexps with cross-kind dependency ordering
* [Feature] lua_scanners: Add eXpurgate engine support
* [Feature] Add rspamadm control memstat for per-worker memory dumps (RSS, mempool callsites, Lua heap, jemalloc)
* [Feature] Make baseline pidfile and logging env-overridable for containers
* [Feature] Auto-load shipped fasttext model when present
* [Feature] fpconv: Add fixed-point (%.Nf) formatting with correct rounding
** Bug fixes **
* [CritFix] mime_parser: Avoid NULL deref on S/MIME with empty pkcs7-data
* [Fix] mime_parser: Bound S/MIME recursion depth to prevent stack exhaustion (DoS)
* [Fix] mime_parser: Defensive guards against NULL deref and resource leaks
* [Fix] multipattern: Bound URL query scan reentrancy to prevent crash on nested query URLs (DoS)
* [Fix] composites: Avoid over-eager second-pass deferral so filter-stage composites are visible from postfilters
* [Fix] ratelimit: Track all buckets in selector rules
* [Fix] archives: Harden RAR/ZIP/7-zip parsers against malformed input (bounds, varint, infinite loop, OOB reads)
* [Fix] images: Guard image linking against NULL decoded header
* [Fix] css: Fix out-of-bounds read in ident escape scanner
* [Fix] str_util: Fix lookahead over-read in find_eoh
* [Fix] spf: Fix over-read on a bare "spf2." sender-id record
* [Fix] rdns: Reject DNS labels that overrun the packet
* [Fix] html: Prevent buffer overflow in entity decoding
* [Fix] html: Preserve verbatim href as url->raw
* [Fix] url: Fix out-of-bounds read on empty/all-dots host
* [Fix] url: Canonicalise mailto: URIs and bare emails to a consistent slash-less form (RFC 6068)
* [Fix] url: Do not drop URLs with long userinfo (userinfo-obfuscation phishing)
* [Fix] url_suspect: Require TLD >= 3 chars for word_dot naked domain matches
* [Fix] mime_headers: Avoid uninitialised bytes in rfc2047 decode
* [Fix] mime_headers/encoding: Correct lengths after in-place rewrites
* [Fix] arc: Emit ARC headers in a deterministic order
* [Fix] Map DKIM permfail to dkim=permerror in Authentication-Results
* [Fix] Honor mime_utf8 option in INVALID_MSGID rule
* [Fix] fuzzy_storage: Harden network input paths
* [Fix] fuzzy_storage: Fix peer-pipe partial-write resume and shutdown drain
* [Fix] fuzzy_storage: Avoid per-refresh leak in dynamic ban inserts
* [Fix] fuzzy_storage: Fix per-frame memory leak on persistent TCP connections
* [Fix] fuzzy: Do not block allowed clients on TCP
* [Fix] neural: Preserve trained ANN across symbol-list drift and symcache-driven profile rotation
* [Fix] neural: Stabilise profile digest under disable_symbols_input and retarget training to the newest profile
* [Fix] protocol: Apply inline metadata.settings on /checkv3
* [Fix] protocol: Populate request headers in /checkv3
* [Fix] upstream: Refill token bucket over time so a flapping upstream recovers
* [Fix] upstream: Avoid infinite loop in get_random when the only candidate is excluded
* [Fix] lua_tcp: Avoid connection leak on read without write
* [Fix] lua_redis: Resolve Redis master for rspamadm tools under Sentinel
* [Fix] elastic: Use Queue:new() instead of non-existent lua_util.newdeque()
* [Fix] dmarc: Floor connect timestamp before os.date for PUC Lua compatibility
* [Fix] greylist: Separate greylisting period from Redis connection timeout
* [Fix] rspamadm vault: Write formatted output to stdout directly
* [Fix] regexp: Do not discard capture groups following an empty one
* [Fix] Skip ICU conversion for synthetic x-binaryenc charset
* [Fix] Warn on task_timeout less than symcache symbol timeout
* [Fix] Port security fixes from libucl upstream (msgpack, parser bounds, schema)
* [Fix] Use string_view::data() for pointer access to fix libc++ builds
---
Module Name: pkgsrc
Committed By: wiz
Date: Mon Jul 27 15:26:07 UTC 2026
Modified Files:
pkgsrc/mail/rspamd: Makefile PLIST cfgfiles.mk distinfo
Log Message:
rspamd: update to 4.1.3.
4.1.3: 25 Jul 2026
** Incompatible changes **
* [Rework] WebUI: Drop jQuery dependency (all modules migrated to native DOM and XMLHttpRequest)
* [Rework] WebUI: Drop the Font Awesome framework in favour of a local subset SVG sprite
* [Rework] dkim: Scope HAVE_ED25519 to OpenSSL key parsing, so ed25519 verification works on OpenSSL builds without it
** Features **
* [Feature] fuzzy_check: Structured match results, diagnostics API and task:get_fuzzy_results()
* [Feature] fuzzy_check: Anchor the probability weight curve at the match threshold (prob_bias, prob_power)
* [Feature] fuzzy: Persist shingle sets with digests in redis, fixing orphaned slots on DEL and decay on REFRESH
* [Feature] fuzzy: Per-hash introspection via rspamadm control fuzzyhash
* [Feature] fuzzy: Track unkeyed clients in fuzzystat
* [Feature] rspamadm: Add fuzzy_hash command
* [Feature] clickhouse: Export fuzzy match details (schema version 11)
* [Feature] milter_headers: Annotate the X-Rspamd-Fuzzy header with rule, flag, probability and timestamp
* [Feature] lua_http: Add forbid_local option to block requests to local networks, enabled by default in url_redirector
* [Feature] lua_feedback_parsers: Enrich sparse ARF reports from the original message headers
** Bug fixes **
* [CritFix] dkim: Bound bh= length before the body hash comparison (out-of-bounds read via ed25519 signatures)
* [CritFix] fuzzy: Release TCP session ownership exactly once (use-after-free on aborted connections)
* [CritFix] protocol: Validate shared memory segment bounds and reject non-regular segments
* [CritFix] http: Fix shared body storage lifecycle (double free, descriptor 0 leak and closing an unrelated socket)
* [Fix] dkim: Bound public key size and modulus width from DNS
* [Fix] dkim: Stop reading before the body slice in empty line skipping
* [Fix] dkim: Apply max_sigs before any work and count every signature header
* [Fix] dkim: Bound the number of h= header list items
* [Fix] spf: Return permerror when a DNS limit is hit
* [Fix] spf: Enforce the include/redirect nesting limit
* [Fix] spf: Bound address lookups spawned by mx/ptr expansion (max_dns_expansions)
* [Fix] spf: Use the enclosing element for exists
* [Fix] fuzzy: Check admission before parsing UDP commands, and rate limit PING and STAT
* [Fix] fuzzy: Fix stack overread in the sqlite backend id
* [Fix] fuzzy_check: Log the rule and the server for error replies
* [Fix] ragel: Bound nested comment depth in the header parsers
* [Fix] mime_parser: Bound parser resource usage
* [Fix] mime_headers: Bound parser resource usage
* [Fix] content_type: Bound parameters per header and fix RFC 2231 continuation ordering
* [Fix] message: Bound per-part newline metadata and make the budget task-global
* [Fix] message: Link plain text parts to their HTML alternative
* [Fix] message: Bound alt-part linking and fasttext langdet cost
* [Fix] html: Eliminate DOM recursion to survive deeply nested messages
* [Fix] html: Bound attributes per tag and per task
* [Fix] html: Cap synthetic tags and fix the balance loop
* [Fix] html: Correct image style dimension parsing
* [Fix] images: Avoid quadratic Content-ID linking
* [Fix] archives: Bound metadata resource usage
* [Fix] 7zip: Bound folder count and guarantee parser progress
* [Fix] url: Enforce max_urls at the central insertion boundary
* [Fix] url_suspect: Drop dead branch in the user field check and skip mailto URLs
* [Fix] task: Bound zstd decompression by max_message and plug an error-path leak
* [Fix] zstd: Share one bounded decompression helper across HTTP, proxy and maps
* [Fix] http: Bound request bodies on the controller, proxy and control sockets
* [Fix] http: Enforce the read deadline when data is pending at timer expiry
* [Fix] map: Bound remote HTTP map sizes, compressed and decompressed (max_map_size)
* [Fix] maps: Map the signature file as a file, not as shmem
* [Fix] maps: Redact credentials from map error logs
* [Fix] util: Harden the shared memory mapping helpers
* [Fix] lua_http: Bound HTTP responses by default (max_lua_http_response)
* [Fix] lua_http: Deliver errors to coroutine callers
* [Fix] lua_tcp: Make the connection ref release one-shot to avoid a double free
* [Fix] lua_content/pdf: Emit newlines for Td/TD line breaks
* [Fix] cfg: Warn when a module section is defined multiple times
* [Fix] WebUI: Route a malformed /stat response to the login dialog
* [Fix] WebUI: Restore smooth scroll on the Scan tab
* [Fix] WebUI: Stop the refresh spinner restarting mid fan-out
* [Fix] WebUI: Guard the optional fuzzy_hashes key and other jQuery-removal regressions
4.1.2: 21 Jul 2026
** Incompatible changes **
* [Rework] lua_task: Make the 'orig' address flavour return only the wire addresses when a rewrite preserved the originals
* [Rework] WebUI: Migrate all tables from FooTable to Tabulator (per-column filters, global history/scan search) and remove FooTable
** Features **
* [Feature] composites: Add per-symbol Lua conditions and explicit dependencies
* [Feature] configdump: Show symcache flags in --symbol-details
* [Feature] neural: Add static_embed provider (WordPiece subword tokenizer over a static embedding matrix, with per-token vector access)
* [Feature] neural: Add forced-learn minimal-scan fast path and train.frozen control to stop automatic training
* [Feature] rspamadm: Discover command modules from external directories (rspamadm.d and RSPAMADM_COMMAND_PATH)
* [Feature] rspamadm: Allow reading the password from the environment for automation
* [Feature] settings: Add apply policy option (implicit_allow) with additive symbols_enabled and strict explicit_enable gating
** Bug fixes **
* [CritFix] mime_parser: Bound message/rfc822 recursion depth (remote DoS via deeply nested messages)
* [Fix] aliases: Refuse to rewrite From address domains (SPF, DKIM and DMARC key on the sender identity)
* [Fix] aliases: Never rewrite the googlemail.com domain to gmail.com
* [Fix] dmarc: Evaluate the From and envelope domains as seen in the message, not after alias rewriting
* [Fix] spf: Check the original envelope sender even if it was rewritten
* [Fix] forged_recipients: Compare envelope and header addresses as they were transmitted
* [Fix] mime: Split address lists on semicolons as well as commas (Outlook-style recipient lists)
* [Fix] fuzzy: Skip injected (computed) parts on learn and check
* [Fix] phishing: Don't penalise the same label under another TLD (brand.co.uk displayed over brand.com)
* [Fix] maps: Anchor glob map patterns to match the whole subject; entries relying on substring matching need explicit wildcards
* [Fix] lua_selectors: Reject selectors that parse only as a prefix instead of silently evaluating the truncated part
* [Fix] lua_selectors: Don't crash the scan on a method call missing on the extracted value
* [Fix] lua_cryptobox: Pass the padded nonce to secretbox encrypt/decrypt (out-of-bounds read with short nonces)
* [Fix] lua_kann: Fix load({filename}) argument index and save() return value
* [Fix] gpt: Don't send a duplicate request when context_augment invokes its callback synchronously
* [Fix] icap: Fix insertion of HTTP header in get_http_headers
* [Fix] dmarc_report: Don't call blocking sleep from an async callback when throttling batches
* [Fix] Lua 5.5 compatibility: do not assign to for-loop variables (fixes startup error in Jinja templates via lupa)
---
Module Name: pkgsrc
Committed By: taca
Date: Thu Jul 30 15:40:28 UTC 2026
Modified Files:
pkgsrc/mail/rspamd: Makefile cfgfiles.mk distinfo
Log Message:
mail/rspamd: update to 4.1.4
pkgsrc change: remove a pkglint warning of cfgfiles.mk.
4.1.4 (2026-07-29)
Incompatible changes
* Build: rspamd now links a single shared jemalloc instance per process and
refuses a static-only jemalloc ― duplicated allocators caused segfaults
at startup
Features
* WebUI: read-only users can now access the Selectors tab and the Errors
history
Bug fixes
* Controller (critical): fail closed on a malformed password hash ―
previously any password was accepted
* Regexp engine: fix a PCRE2 match-data leak on invalid UTF input, bound the
heap a single match can use, stop re:matchn() looping forever on empty
matches, avoid reading past the end of a bounded pattern when generating
ids, and propagate the regexp data limit to named scopes
* Message processing: consult the Lua URL filter at most twice per user
field instead of once per byte, and bound the words retained per message
with a message-wide budget
* CSS: skip comments iteratively in the tokeniser, avoiding a stack overflow
on many sequential comments
* Startup: release actrie GLib allocations with g_free, fixing a startup
segfault with jemalloc
* rspamadm: resolve SRV-based upstreams and wait for storages in fuzzy_ping
and fuzzy_hash
To generate a diff of this commit:
cvs rdiff -u -r1.135 -r1.135.2.1 pkgsrc/mail/rspamd/Makefile
cvs rdiff -u -r1.41 -r1.41.2.1 pkgsrc/mail/rspamd/PLIST
cvs rdiff -u -r1.20 -r1.20.2.1 pkgsrc/mail/rspamd/cfgfiles.mk
cvs rdiff -u -r1.74 -r1.74.2.1 pkgsrc/mail/rspamd/distinfo
cvs rdiff -u -r1.3 -r0 \
pkgsrc/mail/rspamd/patches/patch-src_plugins_lua_dmarc.lua
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 13.5 KB)
Modified files:
Index: pkgsrc/mail/rspamd/Makefile
diff -u pkgsrc/mail/rspamd/Makefile:1.135 pkgsrc/mail/rspamd/Makefile:1.135.2.1
--- pkgsrc/mail/rspamd/Makefile:1.135 Wed Apr 15 20:48:56 2026
+++ pkgsrc/mail/rspamd/Makefile Wed Aug 5 15:39:49 2026
@@ -1,10 +1,8 @@
-# $NetBSD: Makefile,v 1.135 2026/04/15 20:48:56 wiz Exp $
+# $NetBSD: Makefile,v 1.135.2.1 2026/08/05 15:39:49 maya Exp $
#
# When updating this, run 'make cfgfiles'.
-# XXX: as of 4.0.1 this adds two extra entries (worker-hs_helper*)
-# XXX: removed manually
-DISTNAME= rspamd-4.0.1
+DISTNAME= rspamd-4.1.4
CATEGORIES= mail
MASTER_SITES= ${MASTER_SITE_GITHUB:=rspamd/}
@@ -100,7 +98,8 @@ cfgfiles:
${RUN} ${RECURSIVE_MAKE} extract
@${ECHO} "# \$$NetBSD\$$" > ${.CURDIR}/cfgfiles.mk
@${ECHO} "# Do not edit, regenerate using 'make cfgfiles'" >> ${.CURDIR}/cfgfiles.mk
- ${RUN} cd ${WRKSRC}/conf && ${FIND} * -type f | ${SORT} \
+# as of 4.0.1 two extra entries (worker-hs_helper*) need to be manually removed
+ ${RUN} cd ${WRKSRC}/conf && ${FIND} * -type f | ${GREP} -v worker-hs_helper | ${SORT} \
| ${TR} '\n' ' ' | ${SED} 's, $$,,' \
| ${AWK} '{print("CFGFILES=\t" $$0)}' >> ${.CURDIR}/cfgfiles.mk
@${ECHO} >> ${.CURDIR}/cfgfiles.mk
@@ -112,8 +111,8 @@ post-extract:
post-install:
${MV} ${DESTDIR}${PKG_SYSCONFDIR} ${DESTDIR}${PREFIX}/share/examples/rspamd
-# as of 4.0.1
-# 952 tests 946 passed 2244 assertions 2 failed 0 errors 4 unassertive 0 pending
+# as of 4.1.1
+# 1058 tests 1054 passed 2586 assertions 0 failed 0 errors 4 unassertive 0 pending
TEST_ENV+= LD_LIBRARY_PATH=${WRKSRC}/${CMAKE_BUILD_DIR}/src:${WRKSRC}/${CMAKE_BUILD_DIR}/contrib/replxx:${WRKSRC}/${CMAKE_BUILD_DIR}/contrib/aho-corasick:${WRKSRC}/${CMAKE_BUILD_DIR}/contrib/libev:${WRKSRC}/${CMAKE_BUILD_DIR}/contrib/kann
Index: pkgsrc/mail/rspamd/PLIST
diff -u pkgsrc/mail/rspamd/PLIST:1.41 pkgsrc/mail/rspamd/PLIST:1.41.2.1
--- pkgsrc/mail/rspamd/PLIST:1.41 Wed Apr 15 20:48:56 2026
+++ pkgsrc/mail/rspamd/PLIST Wed Aug 5 15:39:49 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.41 2026/04/15 20:48:56 wiz Exp $
+@comment $NetBSD: PLIST,v 1.41.2.1 2026/08/05 15:39:49 maya Exp $
bin/mapstats
bin/rspamadm
bin/rspamadm-${PKGVERSION}
@@ -23,7 +23,10 @@ share/examples/rspamd/lang_detection.inc
share/examples/rspamd/local.d/antivirus.conf.example
share/examples/rspamd/local.d/module.conf.example
share/examples/rspamd/logging.inc
+share/examples/rspamd/lua.local.d/maps/example.lua.example
share/examples/rspamd/lua.local.d/module.lua.example
+share/examples/rspamd/lua.local.d/regexps/example.lua.example
+share/examples/rspamd/lua.local.d/selectors/example.lua.example
share/examples/rspamd/maps.d/dmarc_whitelist.inc
share/examples/rspamd/maps.d/exe_clickbait.inc
share/examples/rspamd/maps.d/maillist.inc
@@ -185,6 +188,8 @@ share/rspamd/lualib/lua_content/pdf.lua
share/rspamd/lualib/lua_content/vcard.lua
share/rspamd/lualib/lua_cta.lua
share/rspamd/lualib/lua_dkim_tools.lua
+share/rspamd/lualib/lua_extras.lua
+share/rspamd/lualib/lua_feedback_parsers.lua
share/rspamd/lualib/lua_ffi/common.lua
share/rspamd/lualib/lua_ffi/dkim.lua
share/rspamd/lualib/lua_ffi/init.lua
@@ -213,6 +218,7 @@ share/rspamd/lualib/lua_scanners/clamav.
share/rspamd/lualib/lua_scanners/cloudmark.lua
share/rspamd/lualib/lua_scanners/common.lua
share/rspamd/lualib/lua_scanners/dcc.lua
+share/rspamd/lualib/lua_scanners/expurgate.lua
share/rspamd/lualib/lua_scanners/fprot.lua
share/rspamd/lualib/lua_scanners/icap.lua
share/rspamd/lualib/lua_scanners/init.lua
@@ -251,6 +257,7 @@ share/rspamd/lualib/plugins/dmarc.lua
share/rspamd/lualib/plugins/neural.lua
share/rspamd/lualib/plugins/neural/providers/fasttext_embed.lua
share/rspamd/lualib/plugins/neural/providers/llm.lua
+share/rspamd/lualib/plugins/neural/providers/static_embed.lua
share/rspamd/lualib/plugins/neural/providers/symbols.lua
share/rspamd/lualib/plugins/neural/providers/text_hash.lua
share/rspamd/lualib/plugins/ratelimit.lua
@@ -282,12 +289,14 @@ share/rspamd/lualib/rspamadm/dkim_keygen
share/rspamd/lualib/rspamadm/dmarc_report.lua
share/rspamd/lualib/rspamadm/dns_tool.lua
share/rspamd/lualib/rspamadm/fuzzy_convert.lua
+share/rspamd/lualib/rspamadm/fuzzy_hash.lua
share/rspamd/lualib/rspamadm/fuzzy_ping.lua
share/rspamd/lualib/rspamadm/fuzzy_stat.lua
share/rspamd/lualib/rspamadm/grep.lua
share/rspamd/lualib/rspamadm/keypair.lua
share/rspamd/lualib/rspamadm/logstats.lua
share/rspamd/lualib/rspamadm/mapstats.lua
+share/rspamd/lualib/rspamadm/memstat.lua
share/rspamd/lualib/rspamadm/mime.lua
share/rspamd/lualib/rspamadm/neural_export.lua
share/rspamd/lualib/rspamadm/neural_test.lua
@@ -379,35 +388,36 @@ share/rspamd/www/ARCHITECTURE.md
share/rspamd/www/README.md
share/rspamd/www/apple-touch-icon.png
share/rspamd/www/browserconfig.xml
-share/rspamd/www/css/FooTable.FontAwesome.css
share/rspamd/www/css/bootstrap.min.css
share/rspamd/www/css/codejar-linenumbers.css
share/rspamd/www/css/d3evolution.css
share/rspamd/www/css/d3pie.css
-share/rspamd/www/css/footable.standalone.min.css
+share/rspamd/www/css/icons.css
share/rspamd/www/css/nprogress.css
share/rspamd/www/css/prism.css
share/rspamd/www/css/rspamd.css
-share/rspamd/www/css/svg-with-js.min.css
+share/rspamd/www/css/tabulator_bs5.min.css
share/rspamd/www/favicon-16x16.png
share/rspamd/www/favicon-32x32.png
share/rspamd/www/favicon.ico
share/rspamd/www/img/asc.png
share/rspamd/www/img/desc.png
share/rspamd/www/img/drop-area.svg
+share/rspamd/www/img/icons.svg
share/rspamd/www/img/rspamd_logo_navbar.png
share/rspamd/www/img/rspamd_logo_navbar_dark.png
share/rspamd/www/index.html
share/rspamd/www/js/app/common.js
share/rspamd/www/js/app/config.js
-share/rspamd/www/js/app/footable-fontawesome.js
share/rspamd/www/js/app/graph.js
share/rspamd/www/js/app/history.js
+share/rspamd/www/js/app/icons.js
share/rspamd/www/js/app/libft.js
share/rspamd/www/js/app/rspamd.js
share/rspamd/www/js/app/selectors.js
share/rspamd/www/js/app/stats.js
share/rspamd/www/js/app/symbols.js
+share/rspamd/www/js/app/tab-utils.js
share/rspamd/www/js/app/upload.js
share/rspamd/www/js/lib/bootstrap.bundle.min.js
share/rspamd/www/js/lib/codejar-linenumbers.min.js
@@ -415,14 +425,10 @@ share/rspamd/www/js/lib/codejar.min.js
share/rspamd/www/js/lib/d3.min.js
share/rspamd/www/js/lib/d3evolution.min.js
share/rspamd/www/js/lib/d3pie.min.js
-share/rspamd/www/js/lib/fontawesome.min.js
-share/rspamd/www/js/lib/footable.min.js
-share/rspamd/www/js/lib/jquery-3.7.1.min.js
-share/rspamd/www/js/lib/jquery.stickytabs.min.js
share/rspamd/www/js/lib/nprogress.min.js
share/rspamd/www/js/lib/prism.js
share/rspamd/www/js/lib/require.min.js
-share/rspamd/www/js/lib/solid.min.js
+share/rspamd/www/js/lib/tabulator.min.js
share/rspamd/www/js/lib/visibility.min.js
share/rspamd/www/js/main.js
share/rspamd/www/mstile-150x150.png
Index: pkgsrc/mail/rspamd/cfgfiles.mk
diff -u pkgsrc/mail/rspamd/cfgfiles.mk:1.20 pkgsrc/mail/rspamd/cfgfiles.mk:1.20.2.1
--- pkgsrc/mail/rspamd/cfgfiles.mk:1.20 Wed Apr 15 20:48:56 2026
+++ pkgsrc/mail/rspamd/cfgfiles.mk Wed Aug 5 15:39:50 2026
@@ -1,4 +1,3 @@
-# $NetBSD: cfgfiles.mk,v 1.20 2026/04/15 20:48:56 wiz Exp $
+# $NetBSD: cfgfiles.mk,v 1.20.2.1 2026/08/05 15:39:50 maya Exp $
# Do not edit, regenerate using 'make cfgfiles'
-CFGFILES= actions.conf common.conf composites.conf groups.conf lang_detection.inc local.d/antivirus.conf.example local.d/module.conf.example logging.inc lua.local.d/module.lua.example maps.d/dmarc_whitelist.inc maps.d/exe_clickbait.inc maps.d/maillist.inc maps.d/mid.inc maps.d/mime_types.inc maps.d/redirectors.inc maps.d/spf_dkim_whitelist.inc maps.d/surbl-whitelist.inc maps.d/suspicious_tlds.inc metrics.conf modules.conf modules.d/aliases.conf modules.d/antivirus.conf modules.d/arc.conf modules.d/asn.conf modules.d/aws_s3.conf modules.d/bayes_expiry.conf modules.d/bimi.conf modules.d/chartable.conf modules.d/clickhouse.conf modules.d/contextal.conf modules.d/dcc.conf modules.d/dkim.conf modules.d/dkim_signing.conf modules.d/dmarc.conf modules.d/elastic.conf modules.d/emails.conf modules.
d/external_relay.conf modules.d/external_services.conf modules.d/force_actions.conf modules.d/forged_recipients.conf modules.d/fuzzy_check.conf modules.d/gpt.conf modules.d/greylist.conf modules.d/h
filter.conf modules.d/history_redis.conf modules.d/http_headers.conf modules.d/known_senders.conf modules.d/maillist.conf modules.d/metadata_exporter.conf modules.d/metric_exporter.conf modules.d/mid.conf modules.d/milter_headers.conf modules.d/mime_types.conf modules.d/multimap.conf modules.d/mx_check.conf modules.d/neural.conf modules.d/neural_autolearn.conf modules.d/once_received.conf modules.d/p0f.conf modules.d/phishing.conf modules.d/ratelimit.conf modules.d/rbl.conf modules.d/redis.conf modules.d/regexp.conf modules.d/replies.conf modules.d/reputation.conf modules.d/rspamd_update.conf modules.d/spamassassin.conf modules.d/spamtrap.conf modules.d/spf.conf modules.d/surbl.conf modules.d/trie.conf modules.d/url_redirector.conf modules.d/url_suspect.conf modules.d/whitelist.conf modul
es.local.d/module.conf.example options.inc override.d/module.conf.example rspamd.conf scores.d/content_group.conf scores.d/fuzzy_group.conf scores.d/headers_group.conf scores.d/hfilter_group.conf sc
ores.d/mime_types_group.conf scores.d/mua_group.conf scores.d/phishing_group.conf scores.d/policies_group.conf scores.d/rbl_group.conf scores.d/statistics_group.conf scores.d/subject_group.conf scores.d/surbl_group.conf scores.d/url_suspect_group.conf scores.d/whitelist_group.conf settings.conf statistic.conf worker-controller.inc worker-fuzzy.inc worker-normal.inc worker-proxy.inc
-
+CFGFILES= actions.conf common.conf composites.conf groups.conf lang_detection.inc local.d/antivirus.conf.example local.d/module.conf.example logging.inc lua.local.d/maps/example.lua.example lua.local.d/module.lua.example lua.local.d/regexps/example.lua.example lua.local.d/selectors/example.lua.example maps.d/dmarc_whitelist.inc maps.d/exe_clickbait.inc maps.d/maillist.inc maps.d/mid.inc maps.d/mime_types.inc maps.d/redirectors.inc maps.d/spf_dkim_whitelist.inc maps.d/surbl-whitelist.inc maps.d/suspicious_tlds.inc metrics.conf modules.conf modules.d/aliases.conf modules.d/antivirus.conf modules.d/arc.conf modules.d/asn.conf modules.d/aws_s3.conf modules.d/bayes_expiry.conf modules.d/bimi.conf modules.d/chartable.conf modules.d/clickhouse.conf modules.d/contextal.conf modules.d/dcc.conf mod
ules.d/dkim.conf modules.d/dkim_signing.conf modules.d/dmarc.conf modules.d/elastic.conf modules.d/emails.conf modules.d/external_relay.conf modules.d/external_services.conf modules.d/force_actions.
conf modules.d/forged_recipients.conf modules.d/fuzzy_check.conf modules.d/gpt.conf modules.d/greylist.conf modules.d/hfilter.conf modules.d/history_redis.conf modules.d/http_headers.conf modules.d/known_senders.conf modules.d/maillist.conf modules.d/metadata_exporter.conf modules.d/metric_exporter.conf modules.d/mid.conf modules.d/milter_headers.conf modules.d/mime_types.conf modules.d/multimap.conf modules.d/mx_check.conf modules.d/neural.conf modules.d/neural_autolearn.conf modules.d/once_received.conf modules.d/p0f.conf modules.d/phishing.conf modules.d/ratelimit.conf modules.d/rbl.conf modules.d/redis.conf modules.d/regexp.conf modules.d/replies.conf modules.d/reputation.conf modules.d/rspamd_update.conf modules.d/spamassassin.conf modules.d/spamtrap.conf modules.d/spf.conf modules.d
/surbl.conf modules.d/trie.conf modules.d/url_redirector.conf modules.d/url_suspect.conf modules.d/whitelist.conf modules.local.d/module.conf.example options.inc override.d/module.conf.example rspam
d.conf scores.d/content_group.conf scores.d/fuzzy_group.conf scores.d/headers_group.conf scores.d/hfilter_group.conf scores.d/mime_types_group.conf scores.d/mua_group.conf scores.d/phishing_group.conf scores.d/policies_group.conf scores.d/rbl_group.conf scores.d/statistics_group.conf scores.d/subject_group.conf scores.d/surbl_group.conf scores.d/url_suspect_group.conf scores.d/whitelist_group.conf settings.conf statistic.conf worker-controller.inc worker-fuzzy.inc worker-normal.inc worker-proxy.inc
Index: pkgsrc/mail/rspamd/distinfo
diff -u pkgsrc/mail/rspamd/distinfo:1.74 pkgsrc/mail/rspamd/distinfo:1.74.2.1
--- pkgsrc/mail/rspamd/distinfo:1.74 Wed Apr 15 20:48:56 2026
+++ pkgsrc/mail/rspamd/distinfo Wed Aug 5 15:39:50 2026
@@ -1,13 +1,12 @@
-$NetBSD: distinfo,v 1.74 2026/04/15 20:48:56 wiz Exp $
+$NetBSD: distinfo,v 1.74.2.1 2026/08/05 15:39:50 maya Exp $
-BLAKE2s (rspamd-4.0.1.tar.gz) = 8f8d454ea0efee03f29b48afb9c1ebba852bd9453dc5be7a353f86cb8dedfd20
-SHA512 (rspamd-4.0.1.tar.gz) = 4fafba3af4d7456376bc7f0c6b56bd0bed0bcd4d5420b36c1a359639db9941d3069ddfcb7ae91f5384f69b3e4a68586d0347f249137a829366ff5e5bfb19b815
-Size (rspamd-4.0.1.tar.gz) = 6998348 bytes
+BLAKE2s (rspamd-4.1.4.tar.gz) = f40adf3b5a174909ffa434c943c7aab7e6af1f013a7f6b271b744f14deac7728
+SHA512 (rspamd-4.1.4.tar.gz) = 5ebc039fc224f5f401d1a57b1db82c7f3ee7e362ef85f31620b36bd5549744c0678dfd8683acffae2d5d240494a79dd83190d19d02e2f9819a9d64037206d1b9
+Size (rspamd-4.1.4.tar.gz) = 7086679 bytes
SHA1 (patch-CMakeLists.txt) = 25a1264b573d5a1f7ff9a1ac7b8453c5d9cb0a06
SHA1 (patch-cmake_Toolset.cmake) = fbc4027fedb4261ce913701ebbb32d8395bc7783
SHA1 (patch-contrib_fpconv_fpconv.c) = b1ec2b07570674458e69020ccbf25f0374d894f6
SHA1 (patch-lualib_rspamadm_dmarc__report.lua) = 93ccb04512dd84ea83de44c394571ef2bebe6bd2
SHA1 (patch-src_libserver_symcache_symcache__impl.cxx) = 8a5c69ab343409427619a9cbc0dc080d548b9c53
SHA1 (patch-src_libstat_backends_redis__backend.cxx) = 4c60287a574066a841c76081cd88512a57f0b27f
-SHA1 (patch-src_plugins_lua_dmarc.lua) = a10b16e53438ee2cde79bc45f35608571be1a581
SHA1 (patch-src_rspamd.c) = 1903994d5970af57de9c5d522df3dd12576c8418