CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct 26 13:02:36 UTC 2026

Modified Files:
        pkgsrc/lang/py313-html-docs: Makefile distinfo
        pkgsrc/lang/python313: PLIST dist.mk distinfo

Log Message:
python313 py313-html-docs: updated to 3.13.18

Python 3.13.18

Security

gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now 
ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: 
removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust 
store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), 
so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors 
instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses 
CVE 2026-12345.

Library

gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.

Tests

gh-159015: Fix test.test_math failing to import on musl-based systems. The skip condition of test_fma_zero_result compared the boolean returned by test.support.linked_to_musl() with a version tuple.


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/lang/py313-html-docs/Makefile \
    pkgsrc/lang/py313-html-docs/distinfo
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/python313/PLIST
cvs rdiff -u -r1.18 -r1.19 pkgsrc/lang/python313/dist.mk
cvs rdiff -u -r1.24 -r1.25 pkgsrc/lang/python313/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py313-html-docs/Makefile
diff -u pkgsrc/lang/py313-html-docs/Makefile:1.18 pkgsrc/lang/py313-html-docs/Makefile:1.19
--- pkgsrc/lang/py313-html-docs/Makefile:1.18   Thu Oct 22 07:47:53 2026
+++ pkgsrc/lang/py313-html-docs/Makefile        Mon Oct 26 13:02:36 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.18 2026/10/22 07:47:53 adam Exp $
+# $NetBSD: Makefile,v 1.19 2026/10/26 13:02:36 adam Exp $
 
-VERS=          3.13.17
+VERS=          3.13.18
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py313-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py313-html-docs/distinfo
diff -u pkgsrc/lang/py313-html-docs/distinfo:1.18 pkgsrc/lang/py313-html-docs/distinfo:1.19
--- pkgsrc/lang/py313-html-docs/distinfo:1.18   Thu Oct 22 07:47:53 2026
+++ pkgsrc/lang/py313-html-docs/distinfo        Mon Oct 26 13:02:36 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.18 2026/10/22 07:47:53 adam Exp $
+$NetBSD: distinfo,v 1.19 2026/10/26 13:02:36 adam Exp $
 
-BLAKE2s (python-3.13.17-docs-html.tar.bz2) = 244c49d5b2710d71a6d6072f94ee158239186ba9cb1ed0b565f5d9bcb752816b
-SHA512 (python-3.13.17-docs-html.tar.bz2) = acb543b51ae0c27ec18bea6d25a188334ba59ac108c06f4e73750b27328033db08675b262e9736558741d37c6479c5b38bd6dfaee15aab9957d6ba7a3cd40a98
-Size (python-3.13.17-docs-html.tar.bz2) = 8026399 bytes
+BLAKE2s (python-3.13.18-docs-html.tar.bz2) = c794d467e524258300a257d365d3aa7166eec127ea8c1769e8ded26d2081c0c5
+SHA512 (python-3.13.18-docs-html.tar.bz2) = c1916ad14d56beb82f6507f79d3dec9f160b63cb28a1479f75de4d3aa16a137b7042964021f22889614f12bda2a8196c151bf58bdc2d98d0870c4987c9c4bae8
+Size (python-3.13.18-docs-html.tar.bz2) = 8036553 bytes

Index: pkgsrc/lang/python313/PLIST
diff -u pkgsrc/lang/python313/PLIST:1.17 pkgsrc/lang/python313/PLIST:1.18
--- pkgsrc/lang/python313/PLIST:1.17    Thu Oct 22 07:47:53 2026
+++ pkgsrc/lang/python313/PLIST Mon Oct 26 13:02:36 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.17 2026/10/22 07:47:53 adam Exp $
+@comment $NetBSD: PLIST,v 1.18 2026/10/26 13:02:36 adam Exp $
 bin/idle${PY_VER_SUFFIX}
 bin/pydoc${PY_VER_SUFFIX}
 bin/python${PY_VER_SUFFIX}
@@ -2215,6 +2215,7 @@ lib/python${PY_VER_SUFFIX}/test/certdata
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/b1930218.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/ceff1710.0
 lib/python${PY_VER_SUFFIX}/test/certdata/cert3.pem
+lib/python${PY_VER_SUFFIX}/test/certdata/distrusted.zip
 lib/python${PY_VER_SUFFIX}/test/certdata/ffdh3072.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/idnsans.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/keycert.passwd.pem

Index: pkgsrc/lang/python313/dist.mk
diff -u pkgsrc/lang/python313/dist.mk:1.18 pkgsrc/lang/python313/dist.mk:1.19
--- pkgsrc/lang/python313/dist.mk:1.18  Thu Oct 22 07:47:53 2026
+++ pkgsrc/lang/python313/dist.mk       Mon Oct 26 13:02:36 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.18 2026/10/22 07:47:53 adam Exp $
+# $NetBSD: dist.mk,v 1.19 2026/10/26 13:02:36 adam Exp $
 
-PY_DISTVERSION=        3.13.17
+PY_DISTVERSION=        3.13.18
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python313/distinfo

Index: pkgsrc/lang/python313/distinfo
diff -u pkgsrc/lang/python313/distinfo:1.24 pkgsrc/lang/python313/distinfo:1.25
--- pkgsrc/lang/python313/distinfo:1.24 Thu Oct 22 07:47:53 2026
+++ pkgsrc/lang/python313/distinfo      Mon Oct 26 13:02:36 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.24 2026/10/22 07:47:53 adam Exp $
+$NetBSD: distinfo,v 1.25 2026/10/26 13:02:36 adam Exp $
 
-BLAKE2s (Python-3.13.17.tar.xz) = 7df947c8e8460e4b61973a137a883fe6c6e7c484fb6af5489576502ce355168a
-SHA512 (Python-3.13.17.tar.xz) = 461df4bca8b11cb2f76250ab38df3afdeb937a920132b3f8569c52261281d64d64ef8ba663c426ff613ad37dbcd1de871c5e15cc31f1b865982b8508adf986d9
-Size (Python-3.13.17.tar.xz) = 23233336 bytes
+BLAKE2s (Python-3.13.18.tar.xz) = 362eb54055260dacfed70529d258f879519a210d2db24ce6b8e454f2c8d7a164
+SHA512 (Python-3.13.18.tar.xz) = ef5cd2e1f31411cddb0f1ee8fe64cdcd94b6a3ab260d42e57182859d45345f447b0c0b0be0cd3302fad653e919af39881cd8368e0cb7932df6d90999b5335953
+Size (Python-3.13.18.tar.xz) = 23243936 bytes
 SHA1 (patch-Include_pymacro.h) = 7611315fefc305a48b4965f2f2b9bee53ae3d987
 SHA1 (patch-Lib_ctypes_util.py) = 3dec1b6b7a36e46cbfa0dfcd71c5e7fac9f60764
 SHA1 (patch-Lib_sysconfig_____init____.py) = 6c151d3dca0367cbb38c1175b9dba894509cf1a4