wip/bind920 9.20.29 NetBSD

Pkgsrc changes: * Update version number & checksums. Upstream changes: Notes for BIND 9.20.29 ---------------------- Security Fixes ~~~~~~~~~~~~~~ - Prevent excessive CPU use validating crafted DNSSEC responses. :cve:`2026-19668` A malicious authoritative server could serve a securely delegated zone whose DS and DNSKEY records carried many distinct key tags but no valid match, forcing a validating resolver into excessive key-tag matching and high CPU use for every query. This work is now bounded by the per-query validation limit (:any:`max-validations-per-fetch`). ISC would like to thank Zuyao Xu and Xiang Li of the All-in-One Security and Privacy Laboratory, Nankai University, for bringing this vulnerability to our attention. :gl:`#5349` …

Pkgsrc changes: * Update version number & checksums. Upstream changes: BIND 9.20.27 ------------ New Features ~~~~~~~~~~~~ - Disclose active Negative Trust Anchors with Extended DNS Error 33. ``566e7018278`` A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain, so a name that would normally fail validation resolves instead. named now marks such answers with Extended DNS Error code 33, "Negative Trust Anchor", so operators can see at a glance when a response came back only because an NTA was in effect. :gl:`#6268` :gl:`!12426` - Add development guidance for AI coding agents under .agents/skills/ ``ef651c93709`` This adds a set of skill documents that give AI coding agents the project's established practices up front instead of having them …

Pkgsrc changes: * Update version number & checksums. Upstream changes: BIND 9.20.26 ------------ Security Fixes ~~~~~~~~~~~~~~ - [CVE-2026-11331] Fix handling of rpz CNAME expansion that returns name too long. ``b950da5f625`` Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed. In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure. We now return a YXDOMAIN response, without the address. ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention. :gl:`#5856` …