CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Oct  1 07:48:34 UTC 2026

Modified Files:
        pkgsrc/lang/py311-html-docs: Makefile distinfo
        pkgsrc/lang/python311: dist.mk distinfo

Log Message:
python311 py311-html-docs: updated to 3.11.17

3.11.17

Security
gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any 
precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX.

gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning 
if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.)

gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits 
DeprecationWarning instead of ValueError.

In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn’t checked. (In Python 3.13 and later, this 
raises ValueError.)

gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name 
replaced with the link’s.

gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a 
file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049.

gh-157953: Update bundled libexpat to version 2.8.5.

gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could 
previously expand into an unbounded allocation even when read in small chunks.

gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as 
../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.

gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep 
their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE-2026-19445.

gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454.

gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a 
scheme continue to match any scheme.
Library
gh-156002: zipfile again reads members through a third-party decompressor installed by monkey-patching the private _get_decompressor() to return an object that only implements old BZ2Decompressor API 
from Python 3.3. Note that decompressors without needs_input and two-argument decompress() are vulnerable to CVE 2026-15310.
gh-156353: Fix configparser parsing when using whitespace in delimiters.
Build
gh-155757: Set the --argv0 argument to wasmtime for WASI builds so the test suite passes. Otherwise the calculated paths to the stdlib for frozen modules is incorrect.


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/py311-html-docs/Makefile \
    pkgsrc/lang/py311-html-docs/distinfo
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/python311/dist.mk
cvs rdiff -u -r1.25 -r1.26 pkgsrc/lang/python311/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py311-html-docs/Makefile
diff -u pkgsrc/lang/py311-html-docs/Makefile:1.17 pkgsrc/lang/py311-html-docs/Makefile:1.18
--- pkgsrc/lang/py311-html-docs/Makefile:1.17   Thu Aug 13 12:26:36 2026
+++ pkgsrc/lang/py311-html-docs/Makefile        Thu Oct  1 07:48:34 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.17 2026/08/13 12:26:36 adam Exp $
+# $NetBSD: Makefile,v 1.18 2026/10/01 07:48:34 adam Exp $
 
-VERS=          3.11.16
+VERS=          3.11.17
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py311-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py311-html-docs/distinfo
diff -u pkgsrc/lang/py311-html-docs/distinfo:1.17 pkgsrc/lang/py311-html-docs/distinfo:1.18
--- pkgsrc/lang/py311-html-docs/distinfo:1.17   Thu Aug 13 12:26:36 2026
+++ pkgsrc/lang/py311-html-docs/distinfo        Thu Oct  1 07:48:34 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2026/08/13 12:26:36 adam Exp $
+$NetBSD: distinfo,v 1.18 2026/10/01 07:48:34 adam Exp $
 
-BLAKE2s (python-3.11.16-docs-html.tar.bz2) = a8c27d91d811e6090848b7d2861875e1d6a80094c8665c2b7cf2fabfefb07811
-SHA512 (python-3.11.16-docs-html.tar.bz2) = 051061ea5dae0c15840e3a6751a347a3ea069ce7d34275d56531155c016ad1a06a40d9f56b311670f70690b3765e738f0a982dee1e839294305c0aee91b3272c
-Size (python-3.11.16-docs-html.tar.bz2) = 8006278 bytes
+BLAKE2s (python-3.11.17-docs-html.tar.bz2) = f31e82b93b8e3c7a068a6e5c13535a990ef4209d33359fca5cb18859b5b606f2
+SHA512 (python-3.11.17-docs-html.tar.bz2) = fe809039a00bd353bf176e7f239c11d6ae14228cd734fabdbac6bb5d894e083fc87e65e47d40a58e0b5b2c27654a6e31379b36f42dd3631575e19d518b395117
+Size (python-3.11.17-docs-html.tar.bz2) = 8022556 bytes

Index: pkgsrc/lang/python311/dist.mk
diff -u pkgsrc/lang/python311/dist.mk:1.17 pkgsrc/lang/python311/dist.mk:1.18
--- pkgsrc/lang/python311/dist.mk:1.17  Thu Aug 13 12:26:36 2026
+++ pkgsrc/lang/python311/dist.mk       Thu Oct  1 07:48:34 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.17 2026/08/13 12:26:36 adam Exp $
+# $NetBSD: dist.mk,v 1.18 2026/10/01 07:48:34 adam Exp $
 
-PY_DISTVERSION=        3.11.16
+PY_DISTVERSION=        3.11.17
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python311/distinfo

Index: pkgsrc/lang/python311/distinfo
diff -u pkgsrc/lang/python311/distinfo:1.25 pkgsrc/lang/python311/distinfo:1.26
--- pkgsrc/lang/python311/distinfo:1.25 Thu Aug 13 12:26:36 2026
+++ pkgsrc/lang/python311/distinfo      Thu Oct  1 07:48:34 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.25 2026/08/13 12:26:36 adam Exp $
+$NetBSD: distinfo,v 1.26 2026/10/01 07:48:34 adam Exp $
 
-BLAKE2s (Python-3.11.16.tar.xz) = 90a08552297b89b9d2c1e7a67e0cf245724e55f4a7cc2229f6e495f0a301614b
-SHA512 (Python-3.11.16.tar.xz) = f4e168d35596c2df080663d8e8b3472f03bace987d46b49b8410f2425ba193215b9880c7d03d4653ec31c83b72209d95866fc1cb6d666799145075b092f64a48
-Size (Python-3.11.16.tar.xz) = 20328716 bytes
+BLAKE2s (Python-3.11.17.tar.xz) = 3fec2ed80bf9a2a9abaef2fb2fe4a7b9590e83faeed217778af71ea52a7d1611
+SHA512 (Python-3.11.17.tar.xz) = 17bcb2ee4edc7431bc8a166b46288643ae37cae46a8f707a61c3b146f34e47d7e980a72e97a6376e3ca79d7dee3af6e88a1ffaf888df083573ac681afe3ac6f3
+Size (Python-3.11.17.tar.xz) = 20352864 bytes
 SHA1 (patch-Include_pymacro.h) = 271a891892dca1a3aaa3bedcae626a68a36cae0b
 SHA1 (patch-Lib_ctypes_util.py) = 3dec1b6b7a36e46cbfa0dfcd71c5e7fac9f60764
 SHA1 (patch-Lib_distutils_unixccompiler.py) = 8a91e8f4f86517a62408c3a10ed5eb50c4091fbf