diff --git a/mail/fetchmail/Makefile b/mail/fetchmail/Makefile
index b95a08f9ff4c..0bcc67a95a21 100644
--- a/mail/fetchmail/Makefile
+++ b/mail/fetchmail/Makefile
@@ -1,109 +1,110 @@
 PORTNAME?=	fetchmail
-DISTVERSION=	6.4.39
+DISTVERSION=	6.5.0
 PORTREVISION?=	0
 CATEGORIES=	mail
 # The next line is inherited by the fetchmailconf dependent port,
 # do NOT replace fetchmail by ${PORTNAME}
-MASTER_SITES=	SF/fetchmail/branch_6.4/
+MASTER_SITES=	SF/fetchmail/branch_6.5/
 
 MAINTAINER=	chalpin@cs.wisc.edu
 COMMENT?=	Batch mail retrieval utility for IMAP/POP3/ETRN/ODMR
 WWW=		https://www.fetchmail.info/
 
 LICENSE=	GPLv2+
 
 .if empty(MASTERDIR)
 USES=		cpe gmake tar:xz
 IGNORE_SSL=	libressl libressl-devel
 IGNORE_SSL_REASON=	incompatible license/no GPLv2 clause 2b exception for LibreSSL
 # The Free Software Foundation asserts that a GPL v2 clause 2b exception is
 # required even for dynamically linked binaries. See
 # https://www.gnu.org/licenses/gpl-faq.en.html#GPLStaticVsDynamic
 
 USE_RC_SUBR=	fetchmail
 
 GNU_CONFIGURE=	yes
 GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
 
 # the added PYTHON=: suppresses python builds,
 # see ../../mail/fetchmailconf/ for the configuration tool
-CONFIGURE_ARGS=	--enable-fallback=no \
+CONFIGURE_ARGS=	--enable-opie \
 		--enable-RPA \
 		--enable-SDPS \
 		--without-hesiod \
 		PYTHON=:
 
 # -Wl,--as-needed suppresses unneeded library references,
 # for instance, libcom_err.so on GSSAPI_NONE builds:
 LDFLAGS+=	-L${LOCALBASE}/lib -Wl,--as-needed
 
-PATCH_STRIP=	-p1
 SUB_FILES=	pkg-message
 USERS=		${PORTNAME}
 GROUPS=		${USERS}
 
 PORTDOCS=	FAQ FEATURES NEWS NOTES OLDNEWS README README.SSL \
 		README.SSL-SERVER design-notes.html esrs-design-notes.html \
 		fetchmail-FAQ.html fetchmail-features.html todo.html
 
 OPTIONS_DEFINE=		DOCS NLS
 OPTIONS_DEFAULT=	GSSAPI_BASE OPENSSL
 OPTIONS_SINGLE=		GSSAPI TLS
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 OPTIONS_SINGLE_TLS=	OPENSSL WOLFSSL
 
 OPTIONS_SUB=	yes
 
 GSSAPI_BASE_USES=		gssapi
 GSSAPI_BASE_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-gssapi=${GSSAPIBASEDIR}
 GSSAPI_HEIMDAL_USES=		gssapi:heimdal
 GSSAPI_HEIMDAL_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-gssapi=${GSSAPIBASEDIR}
 GSSAPI_MIT_USES=		gssapi:mit
 GSSAPI_MIT_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-kerberos5=${GSSAPIBASEDIR}
 GSSAPI_NONE_CONFIGURE_ON=	--without-gssapi
 
 NLS_USES=		gettext
 NLS_CONFIGURE_ENABLE=	nls
 
 OPENSSL_CONFIGURE_WITH=	ssl=${OPENSSLBASE}
 
 WOLFSSL_LIB_DEPENDS=	libwolfssl.so:security/wolfssl
 WOLFSSL_USES_OFF=	ssl
 WOLFSSL_CONFIGURE_ON=	WOLFSSL_TRUST_FILE=${LOCALBASE}/share/certs/ca-root-nss.crt
 WOLFSSL_CONFIGURE_WITH=	wolfssl=${LOCALBASE}
 
 post-patch:
 	@${REINPLACE_CMD} -e 's,krb5_des_string_to_key,krb5int_des_init_state,g' ${WRKSRC}/configure
 .if !exists(/usr/lib/libcom_err.so)
 	@${REINPLACE_CMD} -e "s,-lcom_err,,g" ${WRKSRC}/configure
 .endif
 
 .endif
 
 .if empty(MASTERDIR)
 post-build:
 	${MAKE_CMD} -C ${WRKSRC} check ; { r=$$? ; ( set -x ; ${CAT} "${WRKSRC}/test-suite.log" ) ; exit $$r ; }
 
 post-install:
 	${INSTALL} -d ${STAGEDIR}/var/run/fetchmail
 	${INSTALL_DATA} ${FILESDIR}/fetchmailrc.sample \
 		${STAGEDIR}${PREFIX}/etc/fetchmailrc.sample
 	${RM} ${STAGEDIR}${PREFIX}/bin/fetchmailconf
 	${RM} ${STAGEDIR}${PREFIX}/share/man/man1/fetchmailconf.1*
 
 post-install-DOCS-on:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	cd ${WRKSRC} && ${INSTALL_DATA} ${PORTDOCS} ${STAGEDIR}${DOCSDIR}
 
 .endif
 
 .include <bsd.port.pre.mk>
 
-.if (${OPSYS} == FreeBSD && ${OSVERSION} < 1400072) || ${OPSYS} != FreeBSD
-CONFIGURE_ARGS+=	--enable-opie
+.if ${MASTERDIR} == ${.CURDIR} && ${OPSYS} == FreeBSD
+. if ${OSVERSION} >= 1400072
+LIB_DEPENDS+=	libopie.so:security/opie	# moved to port (from base in 13.X)
+. endif
 .endif
 
 .include <bsd.port.post.mk>
diff --git a/mail/fetchmail/distinfo b/mail/fetchmail/distinfo
index 76b39ab54187..df6589e2c6cd 100644
--- a/mail/fetchmail/distinfo
+++ b/mail/fetchmail/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1721468814
-SHA256 (fetchmail-6.4.39.tar.xz) = 75109a1f307b538155fa05f5ef298e8298cb4deae95aed24c16b38d36ff0a186
-SIZE (fetchmail-6.4.39.tar.xz) = 1221596
+TIMESTAMP = 1730243037
+SHA256 (fetchmail-6.5.0.tar.xz) = 42611aea4861a5311e5116843f01c203dceadf440bf2eb1b4a43a445f2977668
+SIZE (fetchmail-6.5.0.tar.xz) = 1108148
diff --git a/mail/fetchmail/files/patch-ZZZ-87626c2707cc0d82e49e160ab3c85430ff33534f b/mail/fetchmail/files/patch-ZZZ-87626c2707cc0d82e49e160ab3c85430ff33534f
deleted file mode 100644
index 3c6d085a19c9..000000000000
--- a/mail/fetchmail/files/patch-ZZZ-87626c2707cc0d82e49e160ab3c85430ff33534f
+++ /dev/null
@@ -1,160 +0,0 @@
-From 87626c2707cc0d82e49e160ab3c85430ff33534f Mon Sep 17 00:00:00 2001
-From: Matthias Andree <matthias.andree@gmx.de>
-Date: Sat, 24 Aug 2019 17:53:08 +0200
-Subject: [PATCH] Properly report size of mailboxes of 2 GibiB or above.
-
-To fix Debian Bug#873668, reported by Andreas Schmidt.
-This requires C99's new long long type.
----
- NEWS        | 7 +++++++
- driver.c    | 7 ++++---
- etrn.c      | 2 +-
- fetchmail.h | 2 +-
- imap.c      | 2 +-
- odmr.c      | 2 +-
- pop2.c      | 2 +-
- pop3.c      | 4 ++--
- 8 files changed, 18 insertions(+), 10 deletions(-)
-
-diff -up work/fetchmail-6.4.10/NEWS.orig work/fetchmail-6.4.10/NEWS
---- a/NEWS
-+++ b/NEWS
-@@ -63,7 +63,13 @@ removed from a 6.5.0 or newer release.)
- * Fetchmail does not guarantee compatibility with EOL OpenSSL versions. Support
-   for end-of-life OpenSSL versions may be removed even from patchlevel releases.
- 
-----------------------------------------------------------------------------------
-+--------------------------------------------------------------------------------
-+## BUG FIXES
-+* fetchmail can now report mailbox sizes of 2^31 octets and beyond.
-+  This requires C99 support (for the long long type).
-+  Fixes Debian Bug#873668, reported by Andreas Schmidt.
-+
-+--------------------------------------------------------------------------------
- fetchmail-6.4.10 (released 2020-08-27, 27596 LoC):
- 
- # REGRESSION FIX:
-diff --git a/driver.c b/driver.c
-index d21a32ab..a5033729 100644
---- a/driver.c
-+++ b/driver.c
-@@ -932,7 +932,7 @@ static int do_session(
-     {
- 	/* sigsetjmp returned zero -> normal operation */
- 	char buf[MSGBUFSIZE+1], *realhost;
--	int count, newm, bytes;
-+	int count, newm;
- 	int fetches, dispatches, transient_errors, oldphase;
- 	struct idlist *idp;
- 
-@@ -1306,6 +1306,7 @@ is restored."));
- 
- 		/* compute # of messages and number of new messages waiting */
- 		stage = STAGE_GETRANGE;
-+		unsigned long long bytes;
- 		err = (ctl->server.base_protocol->getrange)(mailserver_socket, ctl, idp->id, &count, &newm, &bytes);
- 		if (err != 0)
- 		    goto cleanUp;
-@@ -1335,10 +1336,10 @@ is restored."));
- 							  "%d messages for %s",
- 							  count), 
- 				  count, buf);
--			if (bytes == -1)
-+			if (bytes == (unsigned long long)-1) // mailbox size unsupported
- 			    report_complete(stdout, ".\n");
- 			else
--			    report_complete(stdout, GT_(" (%d octets).\n"), bytes);
-+			    report_complete(stdout, GT_(" (%llu octets).\n"), bytes);
- 		    }
- 		    else
- 		    {
-diff --git a/etrn.c b/etrn.c
-index f3fab0ce..12b9d3fd 100644
---- a/etrn.c
-+++ b/etrn.c
-@@ -31,7 +31,7 @@ static int etrn_ok (int sock, char *argbuf)
- }
- 
- static int etrn_getrange(int sock, struct query *ctl, const char *id, 
--			 int *countp, int *newp, int *bytes)
-+			 int *countp, int *newp, unsigned long long *bytes)
- /* send ETRN and interpret the response */
- {
-     int ok, opts;
-diff --git a/fetchmail.h b/fetchmail.h
-index 23ba6e6e..72259e10 100644
---- a/fetchmail.h
-+++ b/fetchmail.h
-@@ -210,7 +210,7 @@ struct method		/* describe methods for protocol state machine */
- 				/* response_parsing function */
-     int (*getauth)(int, struct query *, char *);
- 				/* authorization fetcher */
--    int (*getrange)(int, struct query *, const char *, int *, int *, int *);
-+    int (*getrange)(int, struct query *, const char *, int *, int *, unsigned long long *);
- 				/* get message range to fetch */
-     int (*getsizes)(int, int, int *);
- 				/* get sizes of messages */
-diff --git a/imap.c b/imap.c
-index 7b80679a..7836acd7 100644
---- a/imap.c
-+++ b/imap.c
-@@ -883,7 +883,7 @@ static int imap_search(int sock, struct query *ctl, int count)
- static int imap_getrange(int sock, 
- 			 struct query *ctl, 
- 			 const char *folder, 
--			 int *countp, int *newp, int *bytes)
-+			 int *countp, int *newp, unsigned long long *bytes)
- /* get range of messages to be fetched */
- {
-     int ok;
-diff --git a/odmr.c b/odmr.c
-index 85decb6d..d1c011c4 100644
---- a/odmr.c
-+++ b/odmr.c
-@@ -36,7 +36,7 @@ static int odmr_ok (int sock, char *argbuf)
- }
- 
- static int odmr_getrange(int sock, struct query *ctl, const char *id, 
--			 int *countp, int *newp, int *bytes)
-+			 int *countp, int *newp, unsigned long long *bytes)
- /* send ODMR and then run a reverse SMTP session */
- {
-     int ok, opts, smtp_sock;
-diff --git a/pop2.c b/pop2.c
-index 7c843616..5a5a1bd1 100644
---- a/pop2.c
-+++ b/pop2.c
-@@ -80,7 +80,7 @@ static int pop2_getauth(int sock, struct query *ctl, char *buf)
- }
- 
- static int pop2_getrange(int sock, struct query *ctl, const char *folder, 
--			 int *countp, int *newp, int *bytes)
-+			 int *countp, int *newp, unsigned long long *bytes)
- /* get range of messages to be fetched */
- {
-     (void)ctl;
-diff --git a/pop3.c b/pop3.c
-index 6efe1b7e..25efbaad 100644
---- a/pop3.c
-+++ b/pop3.c
-@@ -969,7 +969,7 @@ static int pop3_slowuidl( int sock,  struct query *ctl, int *countp, int *newp)
- static int pop3_getrange(int sock, 
- 			 struct query *ctl,
- 			 const char *folder,
--			 int *countp, int *newp, int *bytes)
-+			 int *countp, int *newp, unsigned long long *bytes)
- /* get range of messages to be fetched */
- {
-     int ok;
-@@ -992,7 +992,7 @@ static int pop3_getrange(int sock,
-     if (ok == 0) {
- 	int asgn;
- 
--	asgn = sscanf(buf,"%d %d", countp, bytes);
-+	asgn = sscanf(buf,"%d %llu", countp, bytes);
- 	if (asgn != 2)
- 		return PS_PROTOCOL;
-     } else
--- 
-2.22.0
-
diff --git a/mail/fetchmail/files/patch-socket.c b/mail/fetchmail/files/patch-socket.c
new file mode 100644
index 000000000000..d8faa1a79534
--- /dev/null
+++ b/mail/fetchmail/files/patch-socket.c
@@ -0,0 +1,24 @@
+FreeBSD's security team needs to maintain OpenSSL 1.1.1's
+security to a sane level without upstream support... but permit the build
+for FreeBSD 13.3 and 13.4:
+
+--- socket.c.orig	2024-09-28 09:20:10 UTC
++++ socket.c
+@@ -375,7 +375,7 @@ enum { SSL_min_security_level = 2 };
+ # ifndef TLSprovider
+ #  define TLSprovider "OpenSSL"
+ # endif
+-# define fm_MIN_OPENSSL_VER 0x30000090L
++# define fm_MIN_OPENSSL_VER 0x1010117fL
+ /* do not warn about OpenSSL 3.2.0, the 3.2.1 fix is of low priority */
+ # if OPENSSL_VERSION_NUMBER >= 0x30100000L && OPENSSL_VERSION_NUMBER < 0x30200000L
+ #  if OPENSSL_VERSION_NUMBER < 0x30100040L
+@@ -402,7 +402,7 @@ enum { SSL_min_security_level = 2 };
+ #endif /* USING_WOLFSSL */
+ 
+ /* workaround for EVP_MD_fetch API - missing on wolfSSL and LibreSSL */
+-#if defined(USING_WOLFSSL) || defined(LIBRESSL_VERSION_NUMBER)
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ # define EVP_MD_fetch(x, digest, y) (EVP_get_digestbyname(digest))
+ # define EVP_MD_free(x) /* NOOP */
+ # define fm_EVP_MD_const const // compatibility const EVP_MD* from EVP_get_digestbyname()
diff --git a/mail/fetchmail/files/patch-tls-aux.h b/mail/fetchmail/files/patch-tls-aux.h
new file mode 100644
index 000000000000..54f9ba55daa6
--- /dev/null
+++ b/mail/fetchmail/files/patch-tls-aux.h
@@ -0,0 +1,18 @@
+Cherry-pick from upstream 8f00c607, see 
+https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282413#c4
+
+--- tls-aux.h.orig	2024-08-18 17:42:19 UTC
++++ tls-aux.h
+@@ -18,12 +18,6 @@
+ # ifdef LIBWOLFSSL_VERSION_HEX
+ #  define USING_WOLFSSL 1
+ #  define OSSL110_API 1
+-#  ifndef OPENSSL_COMPATIBLE_DEFAULTS
+-#   error "wolfSSL was compiled without -DOPENSSL_COMPATIBLE_DEFAULTS. Recompile and reinstall wolfSSL!"
+-#  endif
+-#  ifndef HAVE_EX_DATA
+-#   error "wolfSSL was configured without --enable-context-extra-user-data. Recompile and reinstall wolfSSL!"
+-#  endif
+ # else
+ #  if OPENSSL_VERSION_NUMBER < 0x1010000fL
+ #   undef OSSL110_API
diff --git a/mail/fetchmail/pkg-plist b/mail/fetchmail/pkg-plist
index fb4645320d4b..da6a0834dac3 100644
--- a/mail/fetchmail/pkg-plist
+++ b/mail/fetchmail/pkg-plist
@@ -1,30 +1,14 @@
 bin/fetchmail
 share/man/man1/fetchmail.1.gz
-@comment %%NLS%%share/locale/ca/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/cs/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/da/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/de/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/el/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/en_GB/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/eo/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/es/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/fi/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/fr/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/gl/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/id/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/it/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/ja/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/nl/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/pl/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/pt_BR/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/ro/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/ru/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/sk/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/sq/LC_MESSAGES/fetchmail.mo
-%%NLS%%share/locale/sr/LC_MESSAGES/fetchmail.mo
 %%NLS%%share/locale/sv/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/tr/LC_MESSAGES/fetchmail.mo
-%%NLS%%share/locale/vi/LC_MESSAGES/fetchmail.mo
-@comment %%NLS%%share/locale/zh_CN/LC_MESSAGES/fetchmail.mo
 @sample(fetchmail,fetchmail,600) etc/fetchmailrc.sample
 @dir(fetchmail,fetchmail,755) /var/run/fetchmail
diff --git a/mail/fetchmailconf/Makefile b/mail/fetchmailconf/Makefile
index 4d98b71e3041..3ed6267b7973 100644
--- a/mail/fetchmailconf/Makefile
+++ b/mail/fetchmailconf/Makefile
@@ -1,47 +1,47 @@
 PORTNAME=	fetchmailconf
-PORTREVISION=	1
+PORTREVISION=	0
 DISTNAME=	fetchmail-${DISTVERSIONPREFIX}${DISTVERSION}${DISTVERSIONSUFFIX}
 # NOTE: MASTER_SITES in ../fetchmail must NOT use the $PORTNAME variable,
 # else _this_ port (fetchmailconf) becomes unfetchable
 
 MAINTAINER=	chalpin@cs.wisc.edu
 COMMENT=	Python-based GUI to configure fetchmail
 
 LICENSE=	GPLv2+
 
 # minimum required version 6.4.2 - not codified, on the assumption
 # that fetchmail port updated at the same time
 RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}future>=0:devel/py-future@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}tkinter>=0:x11-toolkits/py-tkinter@${PY_FLAVOR} \
 		fetchmail>=${PORTVERSION}:mail/fetchmail
 BUILD_DEPENDS+=	${RUN_DEPENDS}
 
 USES=		python shebangfix tar:xz
 USE_PYTHON=	py3kplist
 
 GNU_CONFIGURE=	yes
 GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
 CONFIGURE_ARGS=	PKG_CONFIG=:
 ALL_TARGET=	fetchmailconf
 INSTALL_TARGET=	install-data-am install-nodist_binSCRIPTS install-man
 
 FILESDIR=	${.CURDIR}/files
 PATCHDIR=	${FILESDIR}
 NO_ARCH=	yes
 
 SUB_FILES=	fetchmailconf
 SUB_LIST=	PYTHON_CMD=${PYTHON_CMD} \
 		PYTHON_SITELIBDIR=${PYTHON_SITELIBDIR}
 PLIST=		${.CURDIR}/pkg-plist
 
 post-install:
 # first, run smoke tests - the version check makes sure we have all
 # modules listed in the *_DEPENDS variables:
 		${PYTHON_CMD} ${WRKSRC}/fetchmailconf.py -V
 # then install:
 		${INSTALL_SCRIPT} ${WRKDIR}/fetchmailconf ${STAGEDIR}${PREFIX}/bin
 		${RM} ${STAGEDIR}${PREFIX}/share/man/man1/fetchmail.1*
 
 MASTERDIR=	${.CURDIR}/../fetchmail
 
 .include "${MASTERDIR}/Makefile"