CVS commit: pkgsrc/security/keepassxc

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Oct 27 07:59:32 UTC 2026

Modified Files:
        pkgsrc/security/keepassxc: Makefile PLIST distinfo options.mk

Log Message:
keepassxc: update to 2.8.0.

New Features

    Add remote database synchronization and import using external tools [#7222, #10896, #11271]
    Allow configuring keyboard shortcuts [#9643]
    SSH Agent: Add support for generating RSA, ECDSA, and Ed25519 keys [#7215]
    Linux: Add Wayland Auto-Type support using XDG Desktop Portals [#13359, #13449, #13579, #13770, #13810]
    Linux: Add Quick Unlock using Polkit (adds a UUID to public metadata, marking database as modified on first launch) [#8983]
    Linux Add AArch64 AppImage [#13816]
    macOS: Allow Quick Unlock using the device password when Touch ID is unavailable [#11410]
    Windows: Allow administrators to enforce certain user settings via global Group Policy overrides [#11223]
    Windows: Add native Arm64 builds [#13678, #13727]

Major Changes

    Migrate to Qt 6 [#11651, #7783, #13456, #13473, #13684, #13784]
    Linux: Store application state in XDG_STATE_HOME instead of XDG_CACHE_HOME [#9755]
    Build: Bundle build features under a single KPXC_MINIMAL CMake option [#11003]

Security Fixes

    Fix use-after-free when importing crafted KDB files (CVE-2026-69150; Credits: A. Ramos (@aramosf)) [#13500]
    Browser: Prevent entry reference injection when creating or updating entries via browser extension (CVE-PENDING; Credits: Davonte (@BadPingHere)) [#13580, #13670, #13688]
    Browser: Fix out-of-bounds writes when encrypting and decrypting native messaging messages (CVE-PENDING; Credits: @sigure21) [#13679]
    Windows: Randomize shared memory mapping names when sending SSH keys to Pageant (CVE-PENDING; Credits: NATO Cyber Security Centre (NCSC), Viktor Markopoulos NCIA/NCSC) [#13680]
    Fix integer overflow and out-of-bounds read in legacy KDB importer (CVE-PENDING; Credits: NATO Cyber Security Centre (NCSC), Viktor Markopoulos NCIA/NCSC) [#13682]
    Secret Service: Exclude protected attributes from attribute listings (Credits: Koda Reef (@kodareef5)) [#13674]
    Windows: Fix clipboard exclusion format name (Credits: @ByeWhiteLists) [#13352]
    Improve clearing of decrypted database fragments from memory used by zlib [#13677]

Changes

    Change Clone Entry shortcut to Ctrl+D [#10903]
    Show suggestions when adding or renaming additional attributes [#13633]
    Add passkey and TOTP entry counts to database statistics in GUI and CLI [#13632]
    Remove legacy KeePassHTTP attribute conversion [#8007]
    Browser: Support get-database-entries request to list entry titles, URLs, and UUIDs [#7292]
    CLI: Reduce GUI library dependencies and simplify line reader code [#9701, #13330]
    Proton Pass Importer: Support Wi-Fi, SSH keys, and unknown entry types [#13148]
    Update translations and clean up code [#9702, #12611, #13258, #8008, #7999, #7998]

Fixes

    Fix application lockups on systems with one or two CPU cores [#13296]
    Preserve entry custom data in newly created history items [#13573]
    Fix password strength evaluation for referenced passwords [#13479]
    Respect password generator settings when auto-generating passwords for new entries [#13277]
    Fix case-sensitive search with the + prefix modifier [#13493]
    Fix directory creation error handling [#13508]
    Fix favicon download redirect limit being ignored [#13663]
    Fix showing challenge-response credentials without a password [#13615]
    Fix key file selection link not being clickable when translated incorrectly [#13396]
    Prevent database unlock controls from shrinking vertically [#13428]
    Prevent mouse wheel scrolling from changing the unfocused alternative save method setting [#13358]
    Fix password font size not following application font size [#13658]
    Fix typos and documentation links [#10124, #10893, #9993]
    Fix null pointer dereference in Secret Service integration [#13655]
    Fix ellipsis password reuse tooltip in database reports [#13091]
    Fix database lock after autosave due to external changes [#13733]
    Auto-Type: Support {PGDN} placeholder [#13463]
    Auto-Type: Refactor Auto-Type plugins to integrate them into the main binary [#13469]
    Browser: Fix showing and closing the password generator [#9984, #9743]
    Browser: Respect selected database when storing a new passkey [#13798]
    CSV Import: Fix automatic column mapping for English headers with non-English UI languages [#13531]
    Secret Service: Fix crash when a database locks while the item access dialog is open [#13598, #13602]
    SSH Agent: Prevent recursive updates when changing entry settings and attachments [#13068]
    Linux: Improve AppImage desktop integration [#13470, #13476]
    Linux: Include keyutils in Snap builds [#10687]
    Linux: Fix race condition in dark mode detection at startup [#13366]
    Linux: Do not query X root window without a display with QT_QPA_PLATFORM=offscreen [#13761]
    Linux: Improve TLS handling im AppImages [#13805]
    macOS: Improve window tray hide and restore behaviour [#13645]
    macOS: Use the native temporary directory for the browser integration socket [#13484]
    macOS: Prevent deleting entries and groups while a modal dialog is open [#13383]
    macOS: Prevent hiding the menu bar [#13147]
    macOS: Fix application icon installation for IDE builds [#12679]
    Windows: Fix SSH Agent builds with MSYS2 [#8708]
    Build: Fix build-system-related issues [#13278, #13275]


To generate a diff of this commit:
cvs rdiff -u -r1.97 -r1.98 pkgsrc/security/keepassxc/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/security/keepassxc/PLIST
cvs rdiff -u -r1.28 -r1.29 pkgsrc/security/keepassxc/distinfo
cvs rdiff -u -r1.3 -r1.4 pkgsrc/security/keepassxc/options.mk

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/keepassxc/Makefile
diff -u pkgsrc/security/keepassxc/Makefile:1.97 pkgsrc/security/keepassxc/Makefile:1.98
--- pkgsrc/security/keepassxc/Makefile:1.97     Tue Sep 29 06:07:21 2026
+++ pkgsrc/security/keepassxc/Makefile  Tue Oct 27 07:59:32 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.97 2026/09/29 06:07:21 wiz Exp $
+# $NetBSD: Makefile,v 1.98 2026/10/27 07:59:32 wiz Exp $
 
-DISTNAME=      keepassxc-2.7.12-src
+DISTNAME=      keepassxc-2.8.0-src
 PKGNAME=       ${DISTNAME:S/-src//}
-PKGREVISION=   6
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=keepassxreboot/}
 GITHUB_RELEASE=        ${PKGVERSION_NOREV}
@@ -13,6 +12,8 @@ HOMEPAGE=     https://keepassxc.org/
 COMMENT=       Password generator and manager
 LICENSE=       gnu-gpl-v2 AND gnu-lgpl-v2 AND gnu-lgpl-v2 AND gnu-lgpl-v3 AND mit AND cc0-1.0-universal
 
+TOOL_DEPENDS+= ${RUBY_PKGPREFIX}-asciidoctor-[0-9]*:../../textproc/ruby-asciidoctor
+
 SUPERSEDES+=   keepassx-[0-9]*
 SUPERSEDES+=   keepassx0-[0-9]*
 
@@ -22,35 +23,29 @@ GCC_REQD+=  11
 WRKSRC=                ${WRKDIR}/${DISTNAME:S/-src//}
 
 USE_LANGUAGES=         c c++
-CMAKE_CONFIGURE_ARGS+= -DKEEPASSXC_BUILD_TYPE=Release
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_DOCS=OFF
-
-NOT_PAX_MPROTECT_SAFE+=        bin/keepassxc
+USE_TOOLS+=            pkg-config
 
-.PHONY: qmake-bin-add
-pre-configure: qmake-bin-add
-
-qmake-bin-add:
-       ${LN} -sf ${QTDIR}/bin/qmake ${BUILDLINK_DIR}/bin/
+CMAKE_CONFIGURE_ARGS+= -DKEEPASSXC_BUILD_TYPE=Release
+CMAKE_CONFIGURE_ARGS+= -DASCIIDOCTOR_EXE=${PREFIX}/bin/asciidoctor${RUBY_SUFFIX}
 
 .include "options.mk"
 
 .include "../../archivers/minizip/buildlink3.mk"
-.include "../../devel/cmake/build.mk"
 .include "../../converters/qrencode/buildlink3.mk"
+.include "../../devel/cmake/build.mk"
+.include "../../devel/libusb1/buildlink3.mk"
+.include "../../devel/qt6-qttools/buildlink3.mk"
+# does not support editline
+.include "../../devel/readline/buildlink3.mk"
 .include "../../devel/zlib/buildlink3.mk"
 .include "../../graphics/hicolor-icon-theme/buildlink3.mk"
+.include "../../graphics/qt6-qtsvg/buildlink3.mk"
+.include "../../lang/ruby/rubyversion.mk"
 .include "../../security/argon2/buildlink3.mk"
 .include "../../security/botan3/buildlink3.mk"
+.include "../../security/pcsc-lite/buildlink3.mk"
 .include "../../security/zxcvbn-c/buildlink3.mk"
 .include "../../sysutils/desktop-file-utils/desktopdb.mk"
-# no qt6 support yet
-# https://github.com/keepassxreboot/keepassxc/issues/7774
-.include "../../x11/qt5-qtbase/buildlink3.mk"
-.include "../../x11/qt5-qtsvg/buildlink3.mk"
-.include "../../x11/qt5-qttools/buildlink3.mk"
-.include "../../x11/qt5-qtx11extras/buildlink3.mk"
-# does not support editline
-.include "../../devel/readline/buildlink3.mk"
 .include "../../x11/libXtst/buildlink3.mk"
+.include "../../x11/qt6-qtbase/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/security/keepassxc/PLIST
diff -u pkgsrc/security/keepassxc/PLIST:1.15 pkgsrc/security/keepassxc/PLIST:1.16
--- pkgsrc/security/keepassxc/PLIST:1.15        Sun Mar 15 12:48:07 2026
+++ pkgsrc/security/keepassxc/PLIST     Tue Oct 27 07:59:32 2026
@@ -1,8 +1,9 @@
-@comment $NetBSD: PLIST,v 1.15 2026/03/15 12:48:07 wiz Exp $
+@comment $NetBSD: PLIST,v 1.16 2026/10/27 07:59:32 wiz Exp $
 bin/keepassxc
 bin/keepassxc-cli
 bin/keepassxc-proxy
-lib/keepassxc/libkeepassxc-autotype-xcb.so
+man/man1/keepassxc-cli.1
+man/man1/keepassxc.1
 share/applications/org.keepassxc.KeePassXC.desktop
 share/icons/hicolor/256x256/apps/keepassxc.png
 share/icons/hicolor/scalable/apps/keepassxc-locked.svg
@@ -13,6 +14,9 @@ share/icons/hicolor/scalable/apps/keepas
 share/icons/hicolor/scalable/apps/keepassxc-unlocked.svg
 share/icons/hicolor/scalable/apps/keepassxc.svg
 share/icons/hicolor/scalable/mimetypes/application-x-keepassxc.svg
+share/keepassxc/docs/KeePassXC_GettingStarted.html
+share/keepassxc/docs/KeePassXC_KeyboardShortcuts.html
+share/keepassxc/docs/KeePassXC_UserGuide.html
 share/keepassxc/icons/application/256x256/apps/keepassxc.png
 share/keepassxc/translations/keepassxc_ar.qm
 share/keepassxc/translations/keepassxc_be.qm
@@ -31,12 +35,14 @@ share/keepassxc/translations/keepassxc_f
 share/keepassxc/translations/keepassxc_fil.qm
 share/keepassxc/translations/keepassxc_fr.qm
 share/keepassxc/translations/keepassxc_fr_CA.qm
+share/keepassxc/translations/keepassxc_gl.qm
 share/keepassxc/translations/keepassxc_he.qm
 share/keepassxc/translations/keepassxc_hr.qm
 share/keepassxc/translations/keepassxc_hu.qm
 share/keepassxc/translations/keepassxc_id.qm
 share/keepassxc/translations/keepassxc_it.qm
 share/keepassxc/translations/keepassxc_ja.qm
+share/keepassxc/translations/keepassxc_kab.qm
 share/keepassxc/translations/keepassxc_km.qm
 share/keepassxc/translations/keepassxc_ko.qm
 share/keepassxc/translations/keepassxc_lt.qm

Index: pkgsrc/security/keepassxc/distinfo
diff -u pkgsrc/security/keepassxc/distinfo:1.28 pkgsrc/security/keepassxc/distinfo:1.29
--- pkgsrc/security/keepassxc/distinfo:1.28     Sun Mar 15 12:48:07 2026
+++ pkgsrc/security/keepassxc/distinfo  Tue Oct 27 07:59:32 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.28 2026/03/15 12:48:07 wiz Exp $
+$NetBSD: distinfo,v 1.29 2026/10/27 07:59:32 wiz Exp $
 
-BLAKE2s (keepassxc-2.7.12-src.tar.xz) = ceb9154eca45d5096478e13b215b26e664e93f8ec5d5ee4b5c099e009df983f9
-SHA512 (keepassxc-2.7.12-src.tar.xz) = dd0ee7a728aab3559ed628b966c8e018e62829e19dd9d6c7fd43f2248ab5288543fda36395cda2924a81e1224150ca5ff8a705e1009063392db6dd507a745f36
-Size (keepassxc-2.7.12-src.tar.xz) = 10618652 bytes
+BLAKE2s (keepassxc-2.8.0-src.tar.xz) = 8f770fec8f854985a1737998697a506ea7008f1bfdc124f28b0cffb617ebd126
+SHA512 (keepassxc-2.8.0-src.tar.xz) = 8aab62815bd30b72dc9da7c5fb9f69eb40de324eb137f6332ea3c1188869ba6a4a329ef6697fee30e22331da7973e2199619cb99c80578907e762f490e3c866d
+Size (keepassxc-2.8.0-src.tar.xz) = 10867052 bytes

Index: pkgsrc/security/keepassxc/options.mk
diff -u pkgsrc/security/keepassxc/options.mk:1.3 pkgsrc/security/keepassxc/options.mk:1.4
--- pkgsrc/security/keepassxc/options.mk:1.3    Mon Feb 10 20:03:36 2025
+++ pkgsrc/security/keepassxc/options.mk        Tue Oct 27 07:59:32 2026
@@ -1,61 +1,36 @@
-# $NetBSD: options.mk,v 1.3 2025/02/10 20:03:36 wiz Exp $
+# $NetBSD: options.mk,v 1.4 2026/10/27 07:59:32 wiz Exp $
 
 PKG_OPTIONS_VAR=               PKG_OPTIONS.keepassxc
-PKG_SUPPORTED_OPTIONS=         keepassxc-browser keepassxc-browser-passkey \
-                               keepassxc-fdosecrets keepassxc-keeshare \
-                               keepassxc-networking keepassxc-sshagent \
-                               keepassxc-yubikey
+PKG_SUPPORTED_OPTIONS=         keepassxc-browser keepassxc-fdosecrets
+PKG_SUPPORTED_OPTIONS+=                keepassxc-networking keepassxc-sshagent
 PKG_SUGGESTED_OPTIONS=         keepassxc-browser
 
 .include "../../mk/bsd.options.mk"
 
 # Enable/Disable KeePassXC-Browser extension support
 .if !empty(PKG_OPTIONS:Mkeepassxc-browser)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_BROWSER=ON
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_BROWSER=ON
 .else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_BROWSER=OFF
-.endif
-
-# Enable/Disable Passkeys support for browser integration
-.if !empty(PKG_OPTIONS:Mkeepassxc-browser-passkey)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_BROWSER_PASSKEYS=ON
-.else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_BROWSER_PASSKEYS=OFF
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_BROWSER=OFF
 .endif
 
 # Enable/Disable Freedesktop.org Secrets Service support
 .if !empty(PKG_OPTIONS:Mkeepassxc-fdosecrets)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_FDOSECRETS=ON
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_FDOSECRETS=ON
 .else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_FDOSECRETS=OFF
-.endif
-
-# Enable/Disable KeeShare group synchronization extension
-.if !empty(PKG_OPTIONS:Mkeepassxc-keeshare)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_KEESHARE==ON
-.else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_KEESHARE==OFF
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_FDOSECRETS=OFF
 .endif
 
 # Enable/Disable Networking support
 .if !empty(PKG_OPTIONS:Mkeepassxc-networking)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_NETWORKING=ON
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_NETWORK=ON
 .else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_NETWORKING=OFF
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_NETWORK=OFF
 .endif
 
 # Enable/Disable SSHAgent support
 .if !empty(PKG_OPTIONS:Mkeepassxc-sshagent)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_SSHAGENT=ON
-.else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_SSHAGENT=OFF
-.endif
-
-# Enable/Disable YubiKey HMAC-SHA1 authentication support
-.if !empty(PKG_OPTIONS:Mkeepassxc-yubikey)
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_YUBIKEY=ON
-.include "../../devel/libusb1/buildlink3.mk"
-.include "../../security/pcsc-lite/buildlink3.mk"
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_SSHAGENT=ON
 .else
-CMAKE_CONFIGURE_ARGS+= -DWITH_XC_YUBIKEY=OFF
+CMAKE_CONFIGURE_ARGS+= -DKPXC_FEATURE_SSHAGENT=OFF
 .endif