CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Oct  1 07:39:38 UTC 2026

Modified Files:
        pkgsrc/lang/py312-html-docs: Makefile PLIST distinfo
        pkgsrc/lang/python312: dist.mk distinfo

Log Message:
python312 py312-html-docs: updated to 3.12.15

3.12.15

Security
gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any 
precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX.

gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning 
if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.)

gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits 
DeprecationWarning instead of ValueError.

In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn’t checked. (In Python 3.13 and later, this 
raises ValueError.)

gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name 
replaced with the link’s.

gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a 
file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049.

gh-157953: Update bundled libexpat to version 2.8.5.

gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could 
previously expand into an unbounded allocation even when read in small chunks.

gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as 
../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.

gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep 
their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445.

gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454.

gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a 
scheme continue to match any scheme.
Library
gh-156002: zipfile again reads members through a third-party decompressor installed by monkey-patching the private _get_decompressor() to return an object that only implements old BZ2Decompressor API 
from Python 3.3. Note that decompressors without needs_input and two-argument decompress() are vulnerable to CVE 2026-15310.
gh-156353: Fix configparser parsing when using whitespace in delimiters.
Build
gh-155757: Set the --argv0 argument to wasmtime for WASI builds so the test suite passes. Otherwise the calculated paths to the stdlib for frozen modules is incorrect.


To generate a diff of this commit:
cvs rdiff -u -r1.15 -r1.16 pkgsrc/lang/py312-html-docs/Makefile \
    pkgsrc/lang/py312-html-docs/distinfo
cvs rdiff -u -r1.9 -r1.10 pkgsrc/lang/py312-html-docs/PLIST
cvs rdiff -u -r1.15 -r1.16 pkgsrc/lang/python312/dist.mk
cvs rdiff -u -r1.18 -r1.19 pkgsrc/lang/python312/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py312-html-docs/Makefile
diff -u pkgsrc/lang/py312-html-docs/Makefile:1.15 pkgsrc/lang/py312-html-docs/Makefile:1.16
--- pkgsrc/lang/py312-html-docs/Makefile:1.15   Thu Aug 13 12:27:06 2026
+++ pkgsrc/lang/py312-html-docs/Makefile        Thu Oct  1 07:39:38 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.15 2026/08/13 12:27:06 adam Exp $
+# $NetBSD: Makefile,v 1.16 2026/10/01 07:39:38 adam Exp $
 
-VERS=          3.12.14
+VERS=          3.12.15
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py312-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py312-html-docs/distinfo
diff -u pkgsrc/lang/py312-html-docs/distinfo:1.15 pkgsrc/lang/py312-html-docs/distinfo:1.16
--- pkgsrc/lang/py312-html-docs/distinfo:1.15   Thu Aug 13 12:27:06 2026
+++ pkgsrc/lang/py312-html-docs/distinfo        Thu Oct  1 07:39:38 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.15 2026/08/13 12:27:06 adam Exp $
+$NetBSD: distinfo,v 1.16 2026/10/01 07:39:38 adam Exp $
 
-BLAKE2s (python-3.12.14-docs-html.tar.bz2) = 1b5ff17b6724be91c52bdaf632209ceee85e26ed7c6f62048bf5df9764fbc5d3
-SHA512 (python-3.12.14-docs-html.tar.bz2) = b2c3418efd1b0548a228773c3fe56ddba8e97ae6eb03ff6d0caf89e4babe4540248e95dea96df0906fc50a8ee20fca70b220afc440d4ec74290bcdc33950a5f1
-Size (python-3.12.14-docs-html.tar.bz2) = 8459739 bytes
+BLAKE2s (python-3.12.15-docs-html.tar.bz2) = b5ec4076f38fe59026d3dd442ed93182687dfb65fd81e41e0048d150dac296af
+SHA512 (python-3.12.15-docs-html.tar.bz2) = b477230f708aea9285d53a3cee785a7a2bc2a07bd8fd6aaa3682a43d7a03193a103ce7702a92af46dd5c21f65fdca4d111c2c9fa579f7ed6ec8ac3b135cbee6e
+Size (python-3.12.15-docs-html.tar.bz2) = 8523045 bytes

Index: pkgsrc/lang/py312-html-docs/PLIST
diff -u pkgsrc/lang/py312-html-docs/PLIST:1.9 pkgsrc/lang/py312-html-docs/PLIST:1.10
--- pkgsrc/lang/py312-html-docs/PLIST:1.9       Fri Oct 10 11:53:08 2025
+++ pkgsrc/lang/py312-html-docs/PLIST   Thu Oct  1 07:39:38 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.9 2025/10/10 11:53:08 adam Exp $
+@comment $NetBSD: PLIST,v 1.10 2026/10/01 07:39:38 adam Exp $
 share/doc/python3.12/.buildinfo
 share/doc/python3.12/_downloads/6dc1f3f4f0e6ca13cb42ddf4d6cbc8af/tzinfo_examples.py
 share/doc/python3.12/_images/hashlib-blake2-tree.png
@@ -516,6 +516,7 @@ share/doc/python3.12/_static/default.css
 share/doc/python3.12/_static/doctools.js
 share/doc/python3.12/_static/documentation_options.js
 share/doc/python3.12/_static/file.png
+share/doc/python3.12/_static/fonts/Vazirmatn-NL-VF.woff2
 share/doc/python3.12/_static/glossary.json
 share/doc/python3.12/_static/glossary_search.js
 share/doc/python3.12/_static/language_data.js

Index: pkgsrc/lang/python312/dist.mk
diff -u pkgsrc/lang/python312/dist.mk:1.15 pkgsrc/lang/python312/dist.mk:1.16
--- pkgsrc/lang/python312/dist.mk:1.15  Thu Aug 13 12:27:06 2026
+++ pkgsrc/lang/python312/dist.mk       Thu Oct  1 07:39:38 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.15 2026/08/13 12:27:06 adam Exp $
+# $NetBSD: dist.mk,v 1.16 2026/10/01 07:39:38 adam Exp $
 
-PY_DISTVERSION=        3.12.14
+PY_DISTVERSION=        3.12.15
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python312/distinfo

Index: pkgsrc/lang/python312/distinfo
diff -u pkgsrc/lang/python312/distinfo:1.18 pkgsrc/lang/python312/distinfo:1.19
--- pkgsrc/lang/python312/distinfo:1.18 Thu Aug 13 12:27:06 2026
+++ pkgsrc/lang/python312/distinfo      Thu Oct  1 07:39:38 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.18 2026/08/13 12:27:06 adam Exp $
+$NetBSD: distinfo,v 1.19 2026/10/01 07:39:38 adam Exp $
 
-BLAKE2s (Python-3.12.14.tar.xz) = 151a11cfe890d186d8f4f9e2f88427d039fe65a13e679a738ffef38ab5235b13
-SHA512 (Python-3.12.14.tar.xz) = 9007399ffdd3a493c91a98cd7a6cb93acfb8de80f3be2f5480cda36f134d49b5043a60bc6b5c62ed18cc6a2e4e3c81cb7556ac5f337e2cd58ff3449a8099ed22
-Size (Python-3.12.14.tar.xz) = 20820300 bytes
+BLAKE2s (Python-3.12.15.tar.xz) = 2033a145131204cdb4b1ae85164241850f7a286cea7b37cffeb79520dff924ea
+SHA512 (Python-3.12.15.tar.xz) = def68bdc3e3aba4d285ae8b305c90f2319297b5a7b1888f582b3cef979bf7f43db0d3047b23312935904576982336f9f78506183b109f388905bf4db33e6abea
+Size (Python-3.12.15.tar.xz) = 20829824 bytes
 SHA1 (patch-Lib_ctypes_util.py) = 3dec1b6b7a36e46cbfa0dfcd71c5e7fac9f60764
 SHA1 (patch-Lib_lib2to3_pgen2_driver.py) = 593c4e93c5653ab400f0a98b91db92630c0a7390
 SHA1 (patch-Lib_sysconfig.py) = bc6d91bf8f7121456b26ea7f080f588c96f2596f