db5-5.3.28_8: Tag: expiration_date - Not sure how to continue

[Aknot]

I'm getting the following in my daily security run output

Checking for packages with security vulnerabilities:
db5-5.3.28_8: Tag: expiration_date Value: 2022-06-30
db5-5.3.28_8: Tag: deprecated Value: EOLd, potential security issues, maybe use db18 instead

The command pkg info -rx db5 is giving me
db5-5.3.28_8:
apr-1.7.0.1.6.1_1

In /usr/ports/Mk/bsd.default-versions.mk I can read:

# Possible values: 5, 6, 18
BDB_DEFAULT?=5

Should I make changes to /etc/make.conf and then run portmaster -o databases/db5 db18?

Thanks,

 

[micski]

I also got that the expiration date too during last upgrade of packages. I wonder, if it is safe to switch to db18, or, if this is automatically taken cafe up during a later update.

 

[SirDice]

If you don't need it you could disable DBD support on devel/apr1. That will remove the dependency entirely.

 

[cmicallef]

See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=261523#c2

I had a similar problem with databases/p5-BerkeleyDB

Added the following to my /etc/make.conf

# DB5 to DB18 migration
WITH_BDB6_PERMITTED=yes # Needed to use db18!
DEFAULT_VERSIONS+=bdb=18

After doing this, package built. Package also passed all tests written for the Perl module.

Re compatibility between bdb5, bdb6 and bdb18, I haven't had time to look at Upgrade Guides on Oracle because I'm so time poor, but see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248415#c2 in the interim.

I've rolled it out onto one (very minor) service of mine that uses bdb for caching purposes only. Upgraded the db files with db_upgrade-18.1. I'll see how it goes. If you hear nothing further from me, it means I haven't had any problems. Silence is golden.