i've just finished to cvs update my tree with the pkgsrc-2004Q1 flag and it seems there are pkg with known vulneralibities : apache-1.3.29nb1 mplayer-1.0rc3nb1 pkgsrc/multimedia/mplayer/README.html says this is mplayer-1.0rc3nb5 but PKGREVISION is set to 1