On 7/6/26 8:09 PM, Volker Schlecht wrote:
Fixes
Use-after-free / double-free in c-ares query-completion handling, remotely
triggerable via ares_getaddrinfo() over TCP
https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
... and here's 1.34.8 fixing an unintentional API/ABI breakage:
Revert "Mark parameters in callbacks as const" which shipped in 1.34.7.
Changing the parameter types of the `ares_callback`, `ares_host_callback`,
and `ares_nameinfo_callback` function pointer typedefs was an unintended
API break: existing applications with the historical non-const callback
signatures no longer compiled, particularly in C++ where function pointer
types must match exactly. The read-only nature of the callback parameters
is now documented instead.
https://github.com/c-ares/c-ares/pull/1244
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/libcares/Makefile,v
retrieving revision 1.41
diff -u -p -r1.41 Makefile
--- Makefile 16 Jan 2026 16:06:46 -0000 1.41
+++ Makefile 7 Jul 2026 18:01:42 -0000
@@ -1,12 +1,12 @@
COMMENT= asynchronous resolver library
-V= 1.34.6
+V= 1.34.8
DISTNAME= c-ares-${V}
PKGNAME= libcares-${V}
CATEGORIES= net devel
SITES= https://github.com/c-ares/c-ares/releases/download/v${V}/
-SHARED_LIBS += cares 4.4 # 2.19.0
+SHARED_LIBS += cares 4.5 # 2.19.7
HOMEPAGE= https://c-ares.org/
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/libcares/distinfo,v
retrieving revision 1.25
diff -u -p -r1.25 distinfo
--- distinfo 16 Jan 2026 16:06:46 -0000 1.25
+++ distinfo 7 Jul 2026 18:01:42 -0000
@@ -1,2 +1,2 @@
-SHA256 (c-ares-1.34.6.tar.gz) = kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU=
-SIZE (c-ares-1.34.6.tar.gz) = 1017864
+SHA256 (c-ares-1.34.8.tar.gz) = wiK21oEJb5RE0sSGPSwRdAGeJ8rMoKSlwRTTbdfXv3g=
+SIZE (c-ares-1.34.8.tar.gz) = 1036098
