CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct 26 05:37:44 UTC 2026

Modified Files:
        pkgsrc/lang/py315-html-docs: Makefile PLIST distinfo
        pkgsrc/lang/python315: PLIST dist.mk distinfo
        pkgsrc/lang/python315/patches: patch-Include_pymacro.h

Log Message:
python315 py315-html-docs: updated to 3.15.2

Python 3.15.2

Security

gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now 
ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: 
removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust 
store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), 
so it also covers the cross-signed certificates that reuse one of the distrusted keys.

Core and Builtins

gh-160491: Fix the location reported for invalid escape sequences in f-strings and t-strings. The SyntaxError now points at the literal part that contains the escape, instead of at the closing quote.
gh-160268: Fix a crash in tokenize when a mismatched closing bracket follows the opening brace of an f-string or t-string replacement field, as in f'{]a'. It now raises the same “unmatched” error as 
the parser.
gh-106045: Fix venv path discovery when the base executable resolves to a location outside the installation pointed to by the home key in pyvenv.cfg. The standard library is now found from home, and 
extension modules from the resolved executable’s installation, instead of falling back to the compiled-in prefix.
gh-160162: Fix a crash on 32-bit platforms when left shifting an int by a count close to sys.maxsize * sys.int_info.bits_per_digit. OverflowError is now raised, as for other too large counts.
gh-160179: Fix bytearray.__init__() leaving uninitialized memory in the object when it fails on a list or tuple containing an integer not in range(256). The object is now empty after the failed call.
gh-159739: Fix a possible crash when assigning metadata to classmethod or staticmethod objects.
gh-159739: Fix a race in list.__sizeof__() when a list is concurrently resized on a free-threaded build.
gh-159739: Fix a reference leak when the value of a type alias is evaluated recursively or concurrently.
gh-159739: Fix a crash in free-threaded builds when codecs.unregister() is called concurrently.
gh-159963: Fix a regression in Python 3.15.0 where threads importing submodules of packages for the first time could raise _DeadlockError or a spurious “partially initialized module” ImportError, or 
block one another, with no circular import involved. importlib.import_module() now returns the partially initialized module in a cross-thread circular import, as the import statement does, instead of 
raising _DeadlockError.
gh-159739: Fix reference leaks when free-threaded garbage collection aborts early because of an allocation error.
gh-159739: Prevent free-threaded builds from interning and immortalizing complex subclasses in code object constants.
gh-159739: Fix a reference leak in binary, ternary, and comparison operations on weak reference proxies when another operand is a dead proxy.
gh-159739: Fix a crash when constructing an error for invalid generic alias arguments.
gh-159739: Allow the garbage collector to break reference cycles involving property accessors or names.
gh-159739: Fix a crash in warnings.warn() when skip_file_prefixes is an empty tuple subclass. Propagate allocation errors when creating the fallback filename.
gh-159431: Fix an assertion failure, or an immortal object becoming mortal, on the free threaded build when an object passed to the internal delayed decref mechanism is immortal or becomes immortal 
before the delayed decref is processed by the garbage collector.
gh-159294: Fix a crash in a debug build when creating an ExceptionGroup or BaseExceptionGroup fails with MemoryError. Patch by Christian Aurich Zanettini Martins.
gh-159244: Fix a crash in dict and dict.update() in the free-threaded build when another thread concurrently mutates a list used as a key/value pair. Patch by Christian Aurich Zanettini Martins.
gh-159111: Update mimalloc version from 2.1.2 to 2.5.2. Patch by Donghee Na.
gh-154318: Fix a crash when hashing a deeply nested tuple or frozendict. A RecursionError is now raised instead of overflowing the C stack.
gh-151818: Fix a double-free crash in list.append() (the specialized CALL_LIST_APPEND instruction) when growing the list fails with MemoryError.
Library
gh-160549: Fix a crash when a compression.zstd.ZstdCompressor that uses worker threads and a ZstdDict is deallocated, or the interpreter exits, while data passed to compress() is still being 
compressed.
gh-160535: Fix a crash in compression.zstd when the garbage collector frees a ZstdCompressor that uses worker threads together with its ZstdDict before the compression of already submitted data has 
finished.
gh-160520: Fix asyncio SSL transports not applying ssl_shutdown_timeout when the peer has sent EOF but does not read the data still queued for it. Closing such a connection could wait indefinitely; 
it is now aborted with TimeoutError once the timeout expires.
gh-160326: Raise ValueError for a NaN timeout in threading.Condition.wait() and the blocking calls built on it, such as threading.Event.wait(), threading.Semaphore.acquire() and queue.Queue.get(), 
instead of returning at once or looping without ever timing out.
gh-159739: Fix crashes in profiling.tracing when a custom timer reinitializes the profiler or its result clears or disables the profiler during conversion or cleanup.
gh-159739: Fix crashes in xml.parsers.expat when a character data callback disables buffering or clears another handler during a flush, or when interning an attribute name changes ordered_attributes.
gh-160299: Fix symtable.Symbol.is_referenced() for local and nonlocal symbols in function scopes when their only uses are in inlined comprehensions.
gh-159739: Fix a crash when a ctypes structure subclass cannot be created due to an allocation failure.
gh-159739: Fix clearing a pickle.Unpickler memo so that the unpickler can be reused for independent records.
gh-160171: On the server side, ssl.SSLSocket.get_unverified_chain() now returns the client’s certificate when the session was resumed from a session ticket, instead of an empty list, and returns an 
empty list instead of raising AttributeError when the client sent no certificate.
gh-159739: Fix a possible crash in abc.ABCMeta instance checks when a subclass-checking callback changes the instance’s class.
gh-159739: Fix the truncate method on io.BytesIO when converting its size argument closes the stream or exports its buffer.
gh-159739: Fix contextvars.ContextVar returning a stale value after a reentrant finalizer changes it during reset().
gh-159739: Detect recursive _as_parameter_ chains for ctypes calls without argument types.
gh-159739: Fix a possible crash when a list of sqlite3 parameters is modified concurrently on a free-threaded build.
gh-159739: Avoid a crash when a threading.local subclass finalizer accesses attributes after construction fails.
gh-159739: Avoid a crash when a queue.SimpleQueue subclass finalizer adds an item after construction fails.
gh-100609: str() of a zipfile.Path whose underlying zipfile has no filename, such as one constructed from an io.BytesIO, now renders that filename as :zipfile: instead of raising TypeError. The root 
of a zipfile is also no longer rendered with a trailing slash. Synchronized with zipp 3.23.1.
gh-159690: Fix logging.handlers.TimedRotatingFileHandler permanently stopping rollover after a rollover failed or its backup file already existed, for example at a DST change.
gh-159739: Avoid undefined behavior when struct.pack_into() copies a bytearray into overlapping output.
gh-159739: Fix allocation error handling in the fallback implementation of getaddrinfo().
gh-159739: Fix a double free if remote unwinder initialization runs out of memory.
gh-159739: Fix io.IOBase.readline() returning more bytes than requested when a stream supports peek() and returns short reads.
gh-159739: Fix multibyte encoders silently consuming a non-BMP character when looking up a two-character mapping.
gh-159739: Fix off-by-one output buffer checks in the fallback implementation of getnameinfo().
gh-159739: Fix reference cycles involving the types of grapheme iterators and segments created by unicodedata.iter_graphemes().
gh-159706: Fix the pure-Python zoneinfo.ZoneInfo setting fold=0 in fromutc() for times in the fold created by the only transition of a zone with a single transition.
gh-159714: Fix zoneinfo.ZoneInfo interpreting the Julian day rule J59 as February 29 in leap years instead of February 28.
gh-159304: Fix AttributeError in email.message.EmailMessage.get_body() when a nested multipart part is malformed and its payload is a string.
gh-158287: Fix a bug in asyncio where stopping a child process (such as with SIGSTOP) on macOS caused the event loop to block indefinitely.
gh-130698: Fix PyREPL to convert sys.ps1 and sys.ps2 to strings before use, and fall back to the default prompts if the conversion raises.
gh-158126: Speed up pickle.dumps() and creating a pickle.Pickler by avoiding the creation of an AttributeError when looking up the optional reducer_override and dispatch_table attributes.
gh-157880: Fix mailbox.Babyl to write the visible headers of a mailbox.BabylMessage to the mailbox file.
gh-156784: asyncio.ProactorEventLoop no longer silently ignores ConnectionResetError on UDP sockets, matching asyncio.SelectorEventLoop.
gh-156078: zipfile.ZipFile.mkdir() now raises ValueError when the archive is closed or when a writable member handle is open.
gh-155833: Ensure that MD5 and SHA* objects are properly GC-untracked before freeing their internal HACL* state. Patch by Bénédikt Tran.
gh-155428: Ensure that hmac.digest() and hmac.HMAC.digest() output identical values when using a digest’s block size smaller than 16. Patch by Bénédikt Tran.
gh-155152: Improve performance of some zipimport archives that use Zstandard compression.
gh-153679: zipimport.zipimporter now raises zipimport.ZipImportError instead of UnicodeDecodeError for a UTF-8-flagged file name that is not valid UTF-8. Patch by tonghuaroot.
gh-153319: The turtledemo viewer now reads each demo script as UTF-8 instead of the locale encoding.
gh-127636: Fix tarfile.TarFile.extract() to accept archive member names with a trailing forward slash, including those returned by tarfile.TarFile.getnames(). Contributed by Xiao Yuan.
gh-149527: multiprocessing: fix creation of temporary socket files following gh-1373358.
gh-146169: xml.parsers.expat: raise RuntimeError when an Expat handler calls parser.Parse or parser.ParseFile on the parser that called the handler. Patch by Bénédikt Tran.
gh-140036: Avoid hanging in floor division of pure Python decimal.Decimal instances when the context precision is very large. Patch by Bénédikt Tran.

Build

gh-128883: Fix crashes with -X perf and -X perf_jit in BOLT builds. The ELF perf trampoline templates now use read-only data sections.
gh-160004: Fix the paths in the PEP 739 build-details.json file generated by Tools/build/generate-build-details.py with both --relative-paths and --config-file-path. Previously, every path except 
base_prefix was wrong and depended on the directory the script was run from.
gh-159998: Fix libpython.dynamic in the PEP 739 build-details.json file for macOS and iOS framework builds. It now points at the framework’s library instead of a nonexistent path under lib/.
gh-144942: Fix the macOS shared library and framework builds not linking the libraries required by built-in modules, such as the HACL* objects needed by _blake2 when it is built in via 
Modules/Setup.local.
gh-159819: Fix the shell version of python3-config (used on all POSIX platforms except macOS) when the installation prefix contains spaces or other characters special to the shell or sed: it printed 
an empty --prefix and wrong --includes/--ldflags paths while exiting successfully. The script now also exits with status 1 if it cannot determine its installation prefix.
gh-157354: Fix the --with-name-sanitizer=no and --without-name-sanitizer configure options enabling the sanitizer instead of disabling it.
gh-155813: On macOS, LIBFFI_CFLAGS and LIBFFI_LIBS are no longer ignored when the SDK provides libffi, so ctypes can again be built against a different libffi. Patch by Advit Arora.

C API

gh-159739: Avoid a crash if a context watcher is cleared while other context watchers are being notified.


To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 pkgsrc/lang/py315-html-docs/Makefile \
    pkgsrc/lang/py315-html-docs/PLIST pkgsrc/lang/py315-html-docs/distinfo
cvs rdiff -u -r1.2 -r1.3 pkgsrc/lang/python315/PLIST \
    pkgsrc/lang/python315/dist.mk pkgsrc/lang/python315/distinfo
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/lang/python315/patches/patch-Include_pymacro.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py315-html-docs/Makefile
diff -u pkgsrc/lang/py315-html-docs/Makefile:1.2 pkgsrc/lang/py315-html-docs/Makefile:1.3
--- pkgsrc/lang/py315-html-docs/Makefile:1.2    Thu Oct 22 08:08:54 2026
+++ pkgsrc/lang/py315-html-docs/Makefile        Mon Oct 26 05:37:44 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.2 2026/10/22 08:08:54 adam Exp $
+# $NetBSD: Makefile,v 1.3 2026/10/26 05:37:44 adam Exp $
 
-VERS=          3.15.1
+VERS=          3.15.2
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py315-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py315-html-docs/PLIST
diff -u pkgsrc/lang/py315-html-docs/PLIST:1.2 pkgsrc/lang/py315-html-docs/PLIST:1.3
--- pkgsrc/lang/py315-html-docs/PLIST:1.2       Thu Oct 22 08:08:54 2026
+++ pkgsrc/lang/py315-html-docs/PLIST   Mon Oct 26 05:37:44 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.2 2026/10/22 08:08:54 adam Exp $
+@comment $NetBSD: PLIST,v 1.3 2026/10/26 05:37:44 adam Exp $
 share/doc/python3.15/.buildinfo
 share/doc/python3.15/404.html
 share/doc/python3.15/_downloads/6dc1f3f4f0e6ca13cb42ddf4d6cbc8af/tzinfo_examples.py
@@ -129,6 +129,7 @@ share/doc/python3.15/c-api/objimpl.html
 share/doc/python3.15/c-api/perfmaps.html
 share/doc/python3.15/c-api/picklebuffer.html
 share/doc/python3.15/c-api/profiling.html
+share/doc/python3.15/c-api/pyexpat.html
 share/doc/python3.15/c-api/refcounting.html
 share/doc/python3.15/c-api/reflection.html
 share/doc/python3.15/c-api/sentinel.html
Index: pkgsrc/lang/py315-html-docs/distinfo
diff -u pkgsrc/lang/py315-html-docs/distinfo:1.2 pkgsrc/lang/py315-html-docs/distinfo:1.3
--- pkgsrc/lang/py315-html-docs/distinfo:1.2    Thu Oct 22 08:08:54 2026
+++ pkgsrc/lang/py315-html-docs/distinfo        Mon Oct 26 05:37:44 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.2 2026/10/22 08:08:54 adam Exp $
+$NetBSD: distinfo,v 1.3 2026/10/26 05:37:44 adam Exp $
 
-BLAKE2s (python-3.15.1-docs-html.tar.bz2) = eae6549f656ffcfdaced3b7438b9d3a7a76b2090f31f402250e154a0512b1a93
-SHA512 (python-3.15.1-docs-html.tar.bz2) = c7a021ca913b3b461a667fd89e2dad47230469f81000482513811e80e0bc529e80acadc9c1e6ff06e3ddf2b017367e8d41a94dbce8c872eafb26d8711b9724e6
-Size (python-3.15.1-docs-html.tar.bz2) = 19638289 bytes
+BLAKE2s (python-3.15.2-docs-html.tar.bz2) = 786fd61f61ab4070e090d4e7d1a2965cde1313b2a714aa1138f4f1bd3b14a657
+SHA512 (python-3.15.2-docs-html.tar.bz2) = 5c3ece4e5eafa4d654403b217a438ae642c02d42f5334fcfa192eb03b9847327f9b94493a555d7c0351691360afd0ad4e922cee0a564b91470a806b93a0e0ba8
+Size (python-3.15.2-docs-html.tar.bz2) = 11520005 bytes

Index: pkgsrc/lang/python315/PLIST
diff -u pkgsrc/lang/python315/PLIST:1.2 pkgsrc/lang/python315/PLIST:1.3
--- pkgsrc/lang/python315/PLIST:1.2     Thu Oct 22 08:08:54 2026
+++ pkgsrc/lang/python315/PLIST Mon Oct 26 05:37:44 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.2 2026/10/22 08:08:54 adam Exp $
+@comment $NetBSD: PLIST,v 1.3 2026/10/26 05:37:44 adam Exp $
 bin/idle${PY_VER_SUFFIX}
 bin/pydoc${PY_VER_SUFFIX}
 bin/python${PY_VER_SUFFIX}
@@ -91,6 +91,7 @@ include/python${PY_VER_SUFFIX}/floatobje
 include/python${PY_VER_SUFFIX}/frameobject.h
 include/python${PY_VER_SUFFIX}/genericaliasobject.h
 include/python${PY_VER_SUFFIX}/import.h
+include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc-stats.h
 include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc.h
 include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc/atomic.h
 include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc/internal.h
@@ -2455,6 +2456,7 @@ lib/python${PY_VER_SUFFIX}/test/certdata
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/b1930218.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/ceff1710.0
 lib/python${PY_VER_SUFFIX}/test/certdata/cert3.pem
+lib/python${PY_VER_SUFFIX}/test/certdata/distrusted.zip
 lib/python${PY_VER_SUFFIX}/test/certdata/ffdh3072.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/idnsans.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/keycert.passwd.pem
Index: pkgsrc/lang/python315/dist.mk
diff -u pkgsrc/lang/python315/dist.mk:1.2 pkgsrc/lang/python315/dist.mk:1.3
--- pkgsrc/lang/python315/dist.mk:1.2   Thu Oct 22 08:08:54 2026
+++ pkgsrc/lang/python315/dist.mk       Mon Oct 26 05:37:44 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.2 2026/10/22 08:08:54 adam Exp $
+# $NetBSD: dist.mk,v 1.3 2026/10/26 05:37:44 adam Exp $
 
-PY_DISTVERSION=        3.15.1
+PY_DISTVERSION=        3.15.2
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python315/distinfo
Index: pkgsrc/lang/python315/distinfo
diff -u pkgsrc/lang/python315/distinfo:1.2 pkgsrc/lang/python315/distinfo:1.3
--- pkgsrc/lang/python315/distinfo:1.2  Thu Oct 22 08:08:54 2026
+++ pkgsrc/lang/python315/distinfo      Mon Oct 26 05:37:44 2026
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.2 2026/10/22 08:08:54 adam Exp $
+$NetBSD: distinfo,v 1.3 2026/10/26 05:37:44 adam Exp $
 
-BLAKE2s (Python-3.15.1.tar.xz) = 1873308fee917887c1aaa988b849e2a4526a6e16c48c832d6c850f9962024587
-SHA512 (Python-3.15.1.tar.xz) = 6903df8c553f8bda2b5f807b21f1a948076522ffa5b17d9e8b452099294f78a085929565df7b2b79af153fc0e638928d87cccb35b48e505280ffa2c3e2b735ec
-Size (Python-3.15.1.tar.xz) = 35789408 bytes
-SHA1 (patch-Include_pymacro.h) = 7611315fefc305a48b4965f2f2b9bee53ae3d987
+BLAKE2s (Python-3.15.2.tar.xz) = cbb086d4e8d2c5b0bd985785f84aa93d369074fcc5ea7cf1f4cc00c5482612a3
+SHA512 (Python-3.15.2.tar.xz) = ee1040e04ad163ece3493a698d49c4e899be2ed4360e0409734f4bfbb67afe9e583a69aec4fd1534834eea71f3e601545d22f2be87220b8ba6ca2d8355c2f321
+Size (Python-3.15.2.tar.xz) = 27960396 bytes
+SHA1 (patch-Include_pymacro.h) = ed2b4bb36fd7882b7b6b900513e2acff30f76b41
 SHA1 (patch-Lib___pyrepl_terminfo.py) = 905a1b281afa0a97302db22b55a9d6b7880c73ad
 SHA1 (patch-Lib_ctypes_util.py) = 671f4fcccb738ec96c4ba8ad62b66ea016172651
 SHA1 (patch-Lib_sysconfig_____init____.py) = 76a35b78b098978209f9bcc0e5357d439f281c6b

Index: pkgsrc/lang/python315/patches/patch-Include_pymacro.h
diff -u pkgsrc/lang/python315/patches/patch-Include_pymacro.h:1.1 pkgsrc/lang/python315/patches/patch-Include_pymacro.h:1.2
--- pkgsrc/lang/python315/patches/patch-Include_pymacro.h:1.1   Sat Oct 10 10:34:19 2026
+++ pkgsrc/lang/python315/patches/patch-Include_pymacro.h       Mon Oct 26 05:37:44 2026
@@ -1,13 +1,13 @@
-$NetBSD: patch-Include_pymacro.h,v 1.1 2026/10/10 10:34:19 adam Exp $
+$NetBSD: patch-Include_pymacro.h,v 1.2 2026/10/26 05:37:44 adam Exp $
 
 Fix build on NetBSD: error: initializer element is not constant.
 
---- Include/pymacro.h.orig     2025-02-04 14:51:09.000000000 +0000
+--- Include/pymacro.h.orig     2026-10-25 16:57:51.000000000 +0000
 +++ Include/pymacro.h
-@@ -47,7 +47,7 @@
+@@ -145,7 +145,7 @@
  #define Py_CHARMASK(c) ((unsigned char)((c) & 0xff))
  
- #if (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L \
+ #if (defined(_Py_STDC_VERSION) && _Py_STDC_VERSION >= 201112L \
 -     && !defined(__cplusplus) && !defined(_MSC_VER))
 +     && !defined(__cplusplus) && !defined(_MSC_VER) && !defined(__NetBSD__) && !defined(__sun))
  #  define Py_BUILD_ASSERT_EXPR(cond) \