CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct 26 12:53:07 UTC 2026

Modified Files:
        pkgsrc/lang/py314-html-docs: Makefile PLIST distinfo
        pkgsrc/lang/python314: PLIST dist.mk distinfo

Log Message:
python314 py314-html-docs: updated to 3.14.10

Python 3.14.10

Security

gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now 
ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: 
removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust 
store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), 
so it also covers the cross-signed certificates that reuse one of the distrusted keys.

Core and Builtins

gh-160491: Fix the location reported for invalid escape sequences in f-strings and t-strings. The SyntaxError now points at the literal part that contains the escape, instead of at the closing quote.
gh-160268: Fix a crash in tokenize when a mismatched closing bracket follows the opening brace of an f-string or t-string replacement field, as in f'{]a'. It now raises the same “unmatched” error as 
the parser.
gh-106045: Fix venv path discovery when the base executable resolves to a location outside the installation pointed to by the home key in pyvenv.cfg. The standard library is now found from home, and 
extension modules from the resolved executable’s installation, instead of falling back to the compiled-in prefix.
gh-160162: Fix a crash on 32-bit platforms when left shifting an int by a count close to sys.maxsize * sys.int_info.bits_per_digit. OverflowError is now raised, as for other too large counts.
gh-160179: Fix bytearray.__init__() leaving uninitialized memory in the object when it fails on a list or tuple containing an integer not in range(256). The object is now empty after the failed call.
gh-159739: Fix a possible crash when assigning metadata to classmethod or staticmethod objects.
gh-159739: Fix a race in list.__sizeof__() when a list is concurrently resized on a free-threaded build.
gh-159739: Fix a reference leak when the value of a type alias is evaluated recursively or concurrently.
gh-159739: Fix a crash in free-threaded builds when codecs.unregister() is called concurrently.
gh-159739: Fix reference leaks when free-threaded garbage collection aborts early because of an allocation error.
gh-159739: Prevent free-threaded builds from interning and immortalizing complex subclasses in code object constants.
gh-159739: Fix a reference leak in binary, ternary, and comparison operations on weak reference proxies when another operand is a dead proxy.
gh-159739: Fix a crash when constructing an error for invalid generic alias arguments.
gh-159739: Allow the garbage collector to break reference cycles involving property accessors or names.
gh-159739: Fix a crash in warnings.warn() when skip_file_prefixes is an empty tuple subclass. Propagate allocation errors when creating the fallback filename.
gh-159431: Fix an assertion failure, or an immortal object becoming mortal, on the free threaded build when an object passed to the internal delayed decref mechanism is immortal or becomes immortal 
before the delayed decref is processed by the garbage collector.
gh-159294: Fix a crash in a debug build when creating an ExceptionGroup or BaseExceptionGroup fails with MemoryError. Patch by Christian Aurich Zanettini Martins.
gh-159244: Fix a crash in dict and dict.update() in the free-threaded build when another thread concurrently mutates a list used as a key/value pair. Patch by Christian Aurich Zanettini Martins.
gh-159111: Update mimalloc version from 2.1.2 to 2.5.2. Patch by Donghee Na.
gh-156459: Fix cleanup on error in compiler_set_qualname. Previously it was called in _PyCompile_EnterScope, after the scope had been entered, and this was not reversed in case of an error.
gh-154318: Fix a crash when hashing a deeply nested tuple. A RecursionError is now raised instead of overflowing the C stack.
Library
gh-160549: Fix a crash when a compression.zstd.ZstdCompressor that uses worker threads and a ZstdDict is deallocated, or the interpreter exits, while data passed to compress() is still being 
compressed.
gh-160535: Fix a crash in compression.zstd when the garbage collector frees a ZstdCompressor that uses worker threads together with its ZstdDict before the compression of already submitted data has 
finished.
gh-160520: Fix asyncio SSL transports not applying ssl_shutdown_timeout when the peer has sent EOF but does not read the data still queued for it. Closing such a connection could wait indefinitely; 
it is now aborted with TimeoutError once the timeout expires.
gh-160326: Raise ValueError for a NaN timeout in threading.Condition.wait() and the blocking calls built on it, such as threading.Event.wait(), threading.Semaphore.acquire() and queue.Queue.get(), 
instead of returning at once or looping without ever timing out.
gh-159739: Fix crashes in xml.parsers.expat when a character data callback disables buffering or clears another handler during a flush, or when interning an attribute name changes ordered_attributes.
gh-160299: Fix symtable.Symbol.is_referenced() for local and nonlocal symbols in function scopes when their only uses are in inlined comprehensions.
gh-159739: Fix a crash when a ctypes structure subclass cannot be created due to an allocation failure.
gh-159739: Fix clearing a pickle.Unpickler memo so that the unpickler can be reused for independent records. Preserve a valid memo if allocation fails or releasing an old entry runs a destructor that 
accesses the memo.
gh-160171: On the server side, ssl.SSLSocket.get_unverified_chain() now returns the client’s certificate when the session was resumed from a session ticket, instead of an empty list, and returns an 
empty list instead of raising AttributeError when the client sent no certificate.
gh-159739: Fix a possible crash in abc.ABCMeta instance checks when a subclass-checking callback changes the instance’s class.
gh-159739: Fix the truncate method on io.BytesIO when converting its size argument closes the stream or exports its buffer.
gh-159739: Raise TypeError if a string subclass returns a non-string during newline translation in io.TextIOWrapper. Recheck the stream state if the replacement callback closes, detaches or 
reinitializes the stream.
gh-159739: Fix contextvars.ContextVar returning a stale value after a reentrant finalizer changes it during reset().
gh-159739: Detect recursive _as_parameter_ chains for ctypes calls without argument types.
gh-159739: Fix a possible crash when a list of sqlite3 parameters is modified concurrently on a free-threaded build.
gh-159739: Avoid a crash when a threading.local subclass finalizer accesses attributes after construction fails.
gh-159739: Avoid a crash when a queue.SimpleQueue subclass finalizer adds an item after construction fails.
gh-100609: str() of a zipfile.Path whose underlying zipfile has no filename, such as one constructed from an io.BytesIO, now renders that filename as :zipfile: instead of raising TypeError. The root 
of a zipfile is also no longer rendered with a trailing slash. Synchronized with zipp 3.23.1.
gh-159864: Fix a crash in syslog.openlog() under the free-threaded build when sys.argv is modified concurrently.
gh-159690: Fix logging.handlers.TimedRotatingFileHandler permanently stopping rollover after a rollover failed or its backup file already existed, for example at a DST change.
gh-159739: Fix allocation error handling in the fallback implementation of getaddrinfo().
gh-159739: Fix a double free if remote unwinder initialization runs out of memory.
gh-159739: Fix io.IOBase.readline() returning more bytes than requested when a stream supports peek() and returns short reads.
gh-159739: Fix multibyte encoders silently consuming a non-BMP character when looking up a two-character mapping.
gh-159739: Fix off-by-one output buffer checks in the fallback implementation of getnameinfo().
gh-159706: Fix the pure-Python zoneinfo.ZoneInfo setting fold=0 in fromutc() for times in the fold created by the only transition of a zone with a single transition.
gh-159714: Fix zoneinfo.ZoneInfo interpreting the Julian day rule J59 as February 29 in leap years instead of February 28.
gh-158287: Fix a bug in asyncio where stopping a child process (such as with SIGSTOP) on macOS caused the event loop to block indefinitely.
gh-130698: Fix PyREPL to convert sys.ps1 and sys.ps2 to strings before use, and fall back to the default prompts if the conversion raises.
gh-158126: Speed up pickle.dumps() and creating a pickle.Pickler by avoiding the creation of an AttributeError when looking up the optional reducer_override and dispatch_table attributes.
gh-157880: Fix mailbox.Babyl to write the visible headers of a mailbox.BabylMessage to the mailbox file.
gh-157621: Fix a crash when a weak-reference callback is attached to a typing.ParamSpecArgs or typing.ParamSpecKwargs instance.
gh-156078: zipfile.ZipFile.mkdir() now raises ValueError when the archive is closed or when a writable member handle is open.
gh-155428: Ensure that hmac.digest() and hmac.HMAC.digest() output identical values when using a digest’s block size smaller than 16. Patch by Bénédikt Tran.
gh-153679: zipimport.zipimporter now raises zipimport.ZipImportError instead of UnicodeDecodeError for a UTF-8-flagged file name that is not valid UTF-8. Patch by tonghuaroot.
gh-149816: hashlib: fix a crash arising from a race condition when looking up an OpenSSL hash algorithm by name the first time. Patch by Bénédikt Tran.
gh-127636: Fix tarfile.TarFile.extract() to accept archive member names with a trailing forward slash, including those returned by tarfile.TarFile.getnames(). Contributed by Xiao Yuan.
gh-149527: multiprocessing: fix creation of temporary socket files following gh-137335.
gh-146169: xml.parsers.expat: raise RuntimeError when an Expat handler calls parser.Parse or parser.ParseFile on the parser that called the handler. Patch by Bénédikt Tran.
gh-140036: Avoid hanging in floor division of pure Python decimal.Decimal instances when the context precision is very large. Patch by Bénédikt Tran.

Build

gh-128883: Fix crashes with -X perf and -X perf_jit in BOLT builds. The ELF perf trampoline templates now use read-only data sections.
gh-160004: Fix the paths in the PEP 739 build-details.json file generated by Tools/build/generate-build-details.py with both --relative-paths and --config-file-path. Previously, every path except 
base_prefix was wrong and depended on the directory the script was run from.
gh-159998: Fix libpython.dynamic in the PEP 739 build-details.json file for macOS and iOS framework builds. It now points at the framework’s library instead of a nonexistent path under lib/.
gh-144942: Fix the macOS shared library and framework builds not linking the libraries required by built-in modules, such as the HACL* objects needed by _blake2 when it is built in via 
Modules/Setup.local.
gh-159819: Fix the shell version of python3-config (used on all POSIX platforms except macOS) when the installation prefix contains spaces or other characters special to the shell or sed: it printed 
an empty --prefix and wrong --includes/--ldflags paths while exiting successfully. The script now also exits with status 1 if it cannot determine its installation prefix.
gh-157354: Fix the --with-name-sanitizer=no and --without-name-sanitizer configure options enabling the sanitizer instead of disabling it.
gh-155813: On macOS, LIBFFI_CFLAGS and LIBFFI_LIBS are no longer ignored when the SDK provides libffi, so ctypes can again be built against a different libffi. Patch by Advit Arora.

C API

gh-159739: Avoid a crash if a context watcher is cleared while other context watchers are being notified.


To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 pkgsrc/lang/py314-html-docs/Makefile
cvs rdiff -u -r1.7 -r1.8 pkgsrc/lang/py314-html-docs/PLIST
cvs rdiff -u -r1.10 -r1.11 pkgsrc/lang/py314-html-docs/distinfo
cvs rdiff -u -r1.9 -r1.10 pkgsrc/lang/python314/PLIST
cvs rdiff -u -r1.10 -r1.11 pkgsrc/lang/python314/dist.mk
cvs rdiff -u -r1.14 -r1.15 pkgsrc/lang/python314/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py314-html-docs/Makefile
diff -u pkgsrc/lang/py314-html-docs/Makefile:1.12 pkgsrc/lang/py314-html-docs/Makefile:1.13
--- pkgsrc/lang/py314-html-docs/Makefile:1.12   Thu Oct 22 08:01:58 2026
+++ pkgsrc/lang/py314-html-docs/Makefile        Mon Oct 26 12:53:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.12 2026/10/22 08:01:58 adam Exp $
+# $NetBSD: Makefile,v 1.13 2026/10/26 12:53:06 adam Exp $
 
-VERS=          3.14.9
+VERS=          3.14.10
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py314-html-docs-${VERS}
 CATEGORIES=    lang python

Index: pkgsrc/lang/py314-html-docs/PLIST
diff -u pkgsrc/lang/py314-html-docs/PLIST:1.7 pkgsrc/lang/py314-html-docs/PLIST:1.8
--- pkgsrc/lang/py314-html-docs/PLIST:1.7       Thu Oct 22 08:01:58 2026
+++ pkgsrc/lang/py314-html-docs/PLIST   Mon Oct 26 12:53:06 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.7 2026/10/22 08:01:58 adam Exp $
+@comment $NetBSD: PLIST,v 1.8 2026/10/26 12:53:06 adam Exp $
 share/doc/python3.14/.buildinfo
 share/doc/python3.14/404.html
 share/doc/python3.14/_downloads/6dc1f3f4f0e6ca13cb42ddf4d6cbc8af/tzinfo_examples.py
@@ -114,6 +114,7 @@ share/doc/python3.14/c-api/objimpl.html
 share/doc/python3.14/c-api/perfmaps.html
 share/doc/python3.14/c-api/picklebuffer.html
 share/doc/python3.14/c-api/profiling.html
+share/doc/python3.14/c-api/pyexpat.html
 share/doc/python3.14/c-api/refcounting.html
 share/doc/python3.14/c-api/reflection.html
 share/doc/python3.14/c-api/sequence.html

Index: pkgsrc/lang/py314-html-docs/distinfo
diff -u pkgsrc/lang/py314-html-docs/distinfo:1.10 pkgsrc/lang/py314-html-docs/distinfo:1.11
--- pkgsrc/lang/py314-html-docs/distinfo:1.10   Thu Oct 22 08:01:58 2026
+++ pkgsrc/lang/py314-html-docs/distinfo        Mon Oct 26 12:53:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.10 2026/10/22 08:01:58 adam Exp $
+$NetBSD: distinfo,v 1.11 2026/10/26 12:53:06 adam Exp $
 
-BLAKE2s (python-3.14.9-docs-html.tar.bz2) = 45b0dd7c2f34a751237985725b731116b8181909fdce371d4f130839fa7b1eb7
-SHA512 (python-3.14.9-docs-html.tar.bz2) = 4e3e5a5dae2938771b099f7f77be87c6460136f931a1e6dcc77f4eec5c0500e48bdec9d92bd5c632db7847904e3c864e857455c40f9640668335b148323e8174
-Size (python-3.14.9-docs-html.tar.bz2) = 8471710 bytes
+BLAKE2s (python-3.14.10-docs-html.tar.bz2) = af554daa9becc32a3889cdac6ee6fb3c74c2aad5f5e75e5037e214a3c6a96378
+SHA512 (python-3.14.10-docs-html.tar.bz2) = 06cbcfe40fb8c0e0ddaa1577a5e2d9338cc613f70798816d56dd313ee18be76a16ee0071d8b258ae592f117cde3fe246cfb885db02d19014227d8864e157e29f
+Size (python-3.14.10-docs-html.tar.bz2) = 8485984 bytes

Index: pkgsrc/lang/python314/PLIST
diff -u pkgsrc/lang/python314/PLIST:1.9 pkgsrc/lang/python314/PLIST:1.10
--- pkgsrc/lang/python314/PLIST:1.9     Thu Oct 22 08:01:58 2026
+++ pkgsrc/lang/python314/PLIST Mon Oct 26 12:53:06 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.9 2026/10/22 08:01:58 adam Exp $
+@comment $NetBSD: PLIST,v 1.10 2026/10/26 12:53:06 adam Exp $
 bin/idle${PY_VER_SUFFIX}
 bin/pydoc${PY_VER_SUFFIX}
 bin/python${PY_VER_SUFFIX}
@@ -87,6 +87,7 @@ include/python${PY_VER_SUFFIX}/floatobje
 include/python${PY_VER_SUFFIX}/frameobject.h
 include/python${PY_VER_SUFFIX}/genericaliasobject.h
 include/python${PY_VER_SUFFIX}/import.h
+include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc-stats.h
 include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc.h
 include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc/atomic.h
 include/python${PY_VER_SUFFIX}/internal/mimalloc/mimalloc/internal.h
@@ -2304,6 +2305,7 @@ lib/python${PY_VER_SUFFIX}/test/certdata
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/b1930218.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/ceff1710.0
 lib/python${PY_VER_SUFFIX}/test/certdata/cert3.pem
+lib/python${PY_VER_SUFFIX}/test/certdata/distrusted.zip
 lib/python${PY_VER_SUFFIX}/test/certdata/ffdh3072.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/idnsans.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/keycert.passwd.pem

Index: pkgsrc/lang/python314/dist.mk
diff -u pkgsrc/lang/python314/dist.mk:1.10 pkgsrc/lang/python314/dist.mk:1.11
--- pkgsrc/lang/python314/dist.mk:1.10  Thu Oct 22 08:01:58 2026
+++ pkgsrc/lang/python314/dist.mk       Mon Oct 26 12:53:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.10 2026/10/22 08:01:58 adam Exp $
+# $NetBSD: dist.mk,v 1.11 2026/10/26 12:53:06 adam Exp $
 
-PY_DISTVERSION=        3.14.9
+PY_DISTVERSION=        3.14.10
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python314/distinfo

Index: pkgsrc/lang/python314/distinfo
diff -u pkgsrc/lang/python314/distinfo:1.14 pkgsrc/lang/python314/distinfo:1.15
--- pkgsrc/lang/python314/distinfo:1.14 Thu Oct 22 08:01:58 2026
+++ pkgsrc/lang/python314/distinfo      Mon Oct 26 12:53:06 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.14 2026/10/22 08:01:58 adam Exp $
+$NetBSD: distinfo,v 1.15 2026/10/26 12:53:06 adam Exp $
 
-BLAKE2s (Python-3.14.9.tar.xz) = 8974601304cdf29afd03c6ae961480b2104986d626fd363dfb65826206bc51df
-SHA512 (Python-3.14.9.tar.xz) = 2bf44a9efc3f056f7358fe8d6bd3c105cdb420705cefee2f45a3739fb07af923dbe4e7b38ff21acd9f306b55cb00c6a34f34c5e46ca859d8d820113081dc4714
-Size (Python-3.14.9.tar.xz) = 24176992 bytes
+BLAKE2s (Python-3.14.10.tar.xz) = 25d03f60fcff32960c9070b4e54e5dbb819cdc92f645b2095daec23fca2085c5
+SHA512 (Python-3.14.10.tar.xz) = 730ea64f7e8815a5e1a4280b1205d77719875de630e6807b3140987b44e7b91215918cf75ed77250cf6feb5de98ff4175555cbba96eaf32564d2f421e723994a
+Size (Python-3.14.10.tar.xz) = 24240392 bytes
 SHA1 (patch-Include_pymacro.h) = 7611315fefc305a48b4965f2f2b9bee53ae3d987
 SHA1 (patch-Lib___pyrepl_terminfo.py) = 905a1b281afa0a97302db22b55a9d6b7880c73ad
 SHA1 (patch-Lib_ctypes_util.py) = 671f4fcccb738ec96c4ba8ad62b66ea016172651