>>> On NetBSD 1.6, what is the correct way to go about upgrading a
>>> package (building from source) that other packages depend on?
>>>
>>> For example, I'm getting warnings about vulnerabilities in
>>> openssl-0.9.6l, so I want to upgrade it to openssl-0.9.6m (or
>>> whatever is the latest version).
>>>
>>> 'make install' correctly tells me I need to do a 'pkg_delete' and a
>>> 'make reinstall' to upgrade. However pkg-delete then tells me that
>>> bind9 depends on openssl, so it can't be safely deleted. Obviously
>>> I don't want to hose my bind setup...
>>>
>>> What is the correct (and hopefully least painful) way to solve
>>> problems like this? I've looked through the online docs and I can't
>>> seem to find a good answer for this...
>
> The easiest way I've found to do a package update, (more) cleanly: use
> pkg_comp to set up your chrooted anvironment, rebuild *all* your
> packages from source with the latest fixes in them, and then re-install
> everything outside the chrooted environment from binary packages
> created from within the pkg_comp chroot.
>
> Very good little set of scripts and helpers.

Thanks to everyone who sent responses. It was very helpful and 
imformative.

I've got two boxes with the same set of problems (a backup/sandbox 
server and the production server). I decided to bite the bullet and 
just pkg_delete and rebuild the affected packages on the sandbox 
machine which was quite a learning experience about how to not do this. 
That went something like this:

make openssl. pkg_delete bind9. pkg_delete openssl. make install 
openssl. make install bind9. bind9 build fails because it wants to 
download the latest patches and for some reason name resolution is 
suddenly not working... followed by lots of pounding of my head on the 
desk for not seeing that one coming... Doh!

I'm now convinced I need to learn how to do these wondrous chrooted 
builds I keep hearing about.

Dave