Hello,

I'm having trouble with update pkgsrc netbsd repository, I'm using cvs:

Little info of my system: 
$uname -a 
>NetBSD netbsd 4.0_RC3 NetBSD 4.0_RC3 (GENERIC)...
And I using bash2 for the shell.

I've to download from ftp netbsd the pkgsrc-2007Q3.tar.bz2 and untar
in /usr now ask for the pkgsrc branch

	$cd /usr/pkgsrc
        $cvs log Makefile | grep pkgsrc-2007Q.: 
        
	>pkgsrc-2007Q3: 1.83.0.4
        >pkgsrc-2007Q2: 1.83.0.2
        >pkgsrc-2007Q1: 1.81.0.2

Previously I have to set up in the /etc/profile two vars:
	
	CVS_RSH=ssh
	CVSROOT=:ext:anoncvs@anoncvs.NetBSD.org:/cvsroot
	PKGSRCDIR=/usr/pkgsrc

	export CVS_RSH
	export CVSROOT
	export PKGSRCDIR


I've to select the first one, "pkgsrc-2007Q3" for to do the checkout:
	
	$ cd /usr
	$ cvs checkout -r pkgsrc-2007Q3 -P pkgsrc

To update pkgsrc just I do:

	$ cd /usr/pkgsrc
	$ cvs update -Pd

Well after this, but why I have a php5 as a vulnerable package

=> Bootstrap dependency digest>=20010302: digest-20070803 found
===> Checking for vulnerabilities in php-5.2.4nb3
ERROR: denial-of-service vulnerability in php-5.2.4nb3 - see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4887 for more information
php>=5<5.2.5
ERROR: Define ALLOW_VULNERABLE_PACKAGES if this package is absolutely essential

I Know the php5 has version 5.2.5 in netbsd.se pkgsrc web page but why don't update for me?. 
Is a problem for repositories?. Perhaps I need to change of server, select another mirror?

Now I'm investigate the fetching list for the package because don't see in the directory distfiles.

Thanks and regards