CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Aug 13 12:27:06 UTC 2026

Modified Files:
        pkgsrc/lang/py312-html-docs: Makefile distinfo
        pkgsrc/lang/python312: dist.mk distinfo

Log Message:
python312 py312-html-docs: updated to 3.12.14

3.12.14

macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it’s not supported. Patch by Victor Stinner.
Security
gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE 2026-72522.
gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in html.parser.HTMLParser, which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and find() avoid quadratic behavior when using XPath index predicates ([1], [last()], [last()-N]) on XML documents with many 
same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover whether Python is running in a source tree, as it could potentially affect actual installs. The pybuilddir.txt file is now 
the sole indicator of running in a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters where crafted archives could create a symlink pointing outside the destination directory. This was a bypass of CVE 
2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines it will read to 100, and the number of interim (1xx) responses it will skip to 100. A malicious or broken server could 
previously stream trailer lines or 100 Continue responses forever, hanging the client even when a socket timeout was in use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for 
CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at 
Aurascape AI for the report.
gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s 
directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, 
which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation fails with MemoryError, which could let a subsequent 
decompress() call read or write through a stale pointer to the already-released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check.
gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive 
prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive 
CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method.
gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with ElementDeclHandler(). This addresses CVE 2026-4224.
gh-145599: Reject control characters in http.cookies.Morsel update() and js_output(). This addresses CVE 2026-3644.
gh-145506: Fixes CVE 2026-2297 by ensuring that SourcelessFileLoader uses io.open_code() when opening .pyc files.
gh-144370: Disallow usage of control characters in status in wsgiref.handlers to prevent HTTP header injections. Patch by Benedikt Johannes.
gh-143930: Reject leading dashes in URLs passed to webbrowser.open().
gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing multi-line configparser values.
Library
gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a 
line break.
gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.
gh-149231: In tomllib, the number of parts in TOML keys is now limited.
gh-146083: Update bundled libexpat to version 2.7.5.
gh-141707: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers.
gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. 
Patch by Bénédikt Tran.
Documentation
gh-136155: We are now checking for fatal errors in EPUB builds in CI.
Core and Builtins
gh-139808: Add branch protections for AArch64 (BTI/PAC) in assembly code used by -X perf_jit (Linux perf profiler integration).
Build
gh-153438: Update Windows build and installer tooling and documentation to use the current download URL for nuget.exe.


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 pkgsrc/lang/py312-html-docs/Makefile \
    pkgsrc/lang/py312-html-docs/distinfo
cvs rdiff -u -r1.14 -r1.15 pkgsrc/lang/python312/dist.mk
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/python312/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py312-html-docs/Makefile
diff -u pkgsrc/lang/py312-html-docs/Makefile:1.14 pkgsrc/lang/py312-html-docs/Makefile:1.15
--- pkgsrc/lang/py312-html-docs/Makefile:1.14   Wed Mar  4 06:50:49 2026
+++ pkgsrc/lang/py312-html-docs/Makefile        Thu Aug 13 12:27:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.14 2026/03/04 06:50:49 adam Exp $
+# $NetBSD: Makefile,v 1.15 2026/08/13 12:27:06 adam Exp $
 
-VERS=          3.12.13
+VERS=          3.12.14
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py312-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py312-html-docs/distinfo
diff -u pkgsrc/lang/py312-html-docs/distinfo:1.14 pkgsrc/lang/py312-html-docs/distinfo:1.15
--- pkgsrc/lang/py312-html-docs/distinfo:1.14   Wed Mar  4 06:50:49 2026
+++ pkgsrc/lang/py312-html-docs/distinfo        Thu Aug 13 12:27:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.14 2026/03/04 06:50:49 adam Exp $
+$NetBSD: distinfo,v 1.15 2026/08/13 12:27:06 adam Exp $
 
-BLAKE2s (python-3.12.13-docs-html.tar.bz2) = 28856215c508d2b33b560fd917abd242595e1e562bef3cd8a1becaaf3973ace4
-SHA512 (python-3.12.13-docs-html.tar.bz2) = 16786246a0c3c6e10335881457480ffd92865430d09b0e36b3246117e830376981fd45717113099b4e14c7137366c8a5f2cce6f19142cf827e801b1a66397447
-Size (python-3.12.13-docs-html.tar.bz2) = 8433277 bytes
+BLAKE2s (python-3.12.14-docs-html.tar.bz2) = 1b5ff17b6724be91c52bdaf632209ceee85e26ed7c6f62048bf5df9764fbc5d3
+SHA512 (python-3.12.14-docs-html.tar.bz2) = b2c3418efd1b0548a228773c3fe56ddba8e97ae6eb03ff6d0caf89e4babe4540248e95dea96df0906fc50a8ee20fca70b220afc440d4ec74290bcdc33950a5f1
+Size (python-3.12.14-docs-html.tar.bz2) = 8459739 bytes

Index: pkgsrc/lang/python312/dist.mk
diff -u pkgsrc/lang/python312/dist.mk:1.14 pkgsrc/lang/python312/dist.mk:1.15
--- pkgsrc/lang/python312/dist.mk:1.14  Wed Mar  4 06:50:49 2026
+++ pkgsrc/lang/python312/dist.mk       Thu Aug 13 12:27:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.14 2026/03/04 06:50:49 adam Exp $
+# $NetBSD: dist.mk,v 1.15 2026/08/13 12:27:06 adam Exp $
 
-PY_DISTVERSION=        3.12.13
+PY_DISTVERSION=        3.12.14
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python312/distinfo

Index: pkgsrc/lang/python312/distinfo
diff -u pkgsrc/lang/python312/distinfo:1.17 pkgsrc/lang/python312/distinfo:1.18
--- pkgsrc/lang/python312/distinfo:1.17 Wed Mar  4 06:50:49 2026
+++ pkgsrc/lang/python312/distinfo      Thu Aug 13 12:27:06 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.17 2026/03/04 06:50:49 adam Exp $
+$NetBSD: distinfo,v 1.18 2026/08/13 12:27:06 adam Exp $
 
-BLAKE2s (Python-3.12.13.tar.xz) = 74832fc98fa9f02b3d9c242b072bc41987fd73c0f785f97a31ff45d9d6bd5443
-SHA512 (Python-3.12.13.tar.xz) = e1eb66f0b34581f0155e3ce25ba72cf0b4b1107672ed0ad3e86bcfe616945c9204c41ffc492f32b1066b9154913ff88343038967ad8711dd05e6f2332fdb735b
-Size (Python-3.12.13.tar.xz) = 20801708 bytes
+BLAKE2s (Python-3.12.14.tar.xz) = 151a11cfe890d186d8f4f9e2f88427d039fe65a13e679a738ffef38ab5235b13
+SHA512 (Python-3.12.14.tar.xz) = 9007399ffdd3a493c91a98cd7a6cb93acfb8de80f3be2f5480cda36f134d49b5043a60bc6b5c62ed18cc6a2e4e3c81cb7556ac5f337e2cd58ff3449a8099ed22
+Size (Python-3.12.14.tar.xz) = 20820300 bytes
 SHA1 (patch-Lib_ctypes_util.py) = 3dec1b6b7a36e46cbfa0dfcd71c5e7fac9f60764
 SHA1 (patch-Lib_lib2to3_pgen2_driver.py) = 593c4e93c5653ab400f0a98b91db92630c0a7390
 SHA1 (patch-Lib_sysconfig.py) = bc6d91bf8f7121456b26ea7f080f588c96f2596f