CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct 26 13:03:35 UTC 2026

Modified Files:
        pkgsrc/lang/py312-html-docs: Makefile distinfo
        pkgsrc/lang/python312: PLIST dist.mk distinfo

Log Message:
python312 py312-html-docs: updated to 3.12.16

Python 3.12.16

Security

gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now 
ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: 
removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust 
store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), 
so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors 
instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses 
CVE 2026-12345.

Library

gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 pkgsrc/lang/py312-html-docs/Makefile \
    pkgsrc/lang/py312-html-docs/distinfo
cvs rdiff -u -r1.14 -r1.15 pkgsrc/lang/python312/PLIST
cvs rdiff -u -r1.16 -r1.17 pkgsrc/lang/python312/dist.mk
cvs rdiff -u -r1.19 -r1.20 pkgsrc/lang/python312/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py312-html-docs/Makefile
diff -u pkgsrc/lang/py312-html-docs/Makefile:1.16 pkgsrc/lang/py312-html-docs/Makefile:1.17
--- pkgsrc/lang/py312-html-docs/Makefile:1.16   Thu Oct  1 07:39:38 2026
+++ pkgsrc/lang/py312-html-docs/Makefile        Mon Oct 26 13:03:35 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.16 2026/10/01 07:39:38 adam Exp $
+# $NetBSD: Makefile,v 1.17 2026/10/26 13:03:35 adam Exp $
 
-VERS=          3.12.15
+VERS=          3.12.16
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py312-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py312-html-docs/distinfo
diff -u pkgsrc/lang/py312-html-docs/distinfo:1.16 pkgsrc/lang/py312-html-docs/distinfo:1.17
--- pkgsrc/lang/py312-html-docs/distinfo:1.16   Thu Oct  1 07:39:38 2026
+++ pkgsrc/lang/py312-html-docs/distinfo        Mon Oct 26 13:03:35 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.16 2026/10/01 07:39:38 adam Exp $
+$NetBSD: distinfo,v 1.17 2026/10/26 13:03:35 adam Exp $
 
-BLAKE2s (python-3.12.15-docs-html.tar.bz2) = b5ec4076f38fe59026d3dd442ed93182687dfb65fd81e41e0048d150dac296af
-SHA512 (python-3.12.15-docs-html.tar.bz2) = b477230f708aea9285d53a3cee785a7a2bc2a07bd8fd6aaa3682a43d7a03193a103ce7702a92af46dd5c21f65fdca4d111c2c9fa579f7ed6ec8ac3b135cbee6e
-Size (python-3.12.15-docs-html.tar.bz2) = 8523045 bytes
+BLAKE2s (python-3.12.16-docs-html.tar.bz2) = e01fd56ece0edf5795f61b75085623cf28a6992cd70698b06752170a19a1ccc1
+SHA512 (python-3.12.16-docs-html.tar.bz2) = a851df6b45f44ecfe9158dc56b394dd8395b46a049ba9205c95c48bda569cccb0458adb7e28f3c669191f0fa612dde6582c9ec53afd375855b3bc93fe6ab2570
+Size (python-3.12.16-docs-html.tar.bz2) = 8526064 bytes

Index: pkgsrc/lang/python312/PLIST
diff -u pkgsrc/lang/python312/PLIST:1.14 pkgsrc/lang/python312/PLIST:1.15
--- pkgsrc/lang/python312/PLIST:1.14    Fri Oct 10 11:53:08 2025
+++ pkgsrc/lang/python312/PLIST Mon Oct 26 13:03:35 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.14 2025/10/10 11:53:08 adam Exp $
+@comment $NetBSD: PLIST,v 1.15 2026/10/26 13:03:35 adam Exp $
 bin/2to3-${PY_VER_SUFFIX}
 bin/idle${PY_VER_SUFFIX}
 bin/pydoc${PY_VER_SUFFIX}
@@ -2310,6 +2310,7 @@ lib/python${PY_VER_SUFFIX}/test/certdata
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/99d0fa06.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/b1930218.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/ceff1710.0
+lib/python${PY_VER_SUFFIX}/test/certdata/distrusted.zip
 lib/python${PY_VER_SUFFIX}/test/certdata/ffdh3072.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/idnsans.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/keycert.passwd.pem

Index: pkgsrc/lang/python312/dist.mk
diff -u pkgsrc/lang/python312/dist.mk:1.16 pkgsrc/lang/python312/dist.mk:1.17
--- pkgsrc/lang/python312/dist.mk:1.16  Thu Oct  1 07:39:38 2026
+++ pkgsrc/lang/python312/dist.mk       Mon Oct 26 13:03:35 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.16 2026/10/01 07:39:38 adam Exp $
+# $NetBSD: dist.mk,v 1.17 2026/10/26 13:03:35 adam Exp $
 
-PY_DISTVERSION=        3.12.15
+PY_DISTVERSION=        3.12.16
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python312/distinfo

Index: pkgsrc/lang/python312/distinfo
diff -u pkgsrc/lang/python312/distinfo:1.19 pkgsrc/lang/python312/distinfo:1.20
--- pkgsrc/lang/python312/distinfo:1.19 Thu Oct  1 07:39:38 2026
+++ pkgsrc/lang/python312/distinfo      Mon Oct 26 13:03:35 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.19 2026/10/01 07:39:38 adam Exp $
+$NetBSD: distinfo,v 1.20 2026/10/26 13:03:35 adam Exp $
 
-BLAKE2s (Python-3.12.15.tar.xz) = 2033a145131204cdb4b1ae85164241850f7a286cea7b37cffeb79520dff924ea
-SHA512 (Python-3.12.15.tar.xz) = def68bdc3e3aba4d285ae8b305c90f2319297b5a7b1888f582b3cef979bf7f43db0d3047b23312935904576982336f9f78506183b109f388905bf4db33e6abea
-Size (Python-3.12.15.tar.xz) = 20829824 bytes
+BLAKE2s (Python-3.12.16.tar.xz) = a62c2caa60e4052e19c1f10e7fde28f03d8a3e2e187ec73f902748a5429a42a5
+SHA512 (Python-3.12.16.tar.xz) = adc13563d138248e5049e3d71f6497ff645e5fb3713fc14146fef8809608f447c7d205a6fa468434239504e56b9f826554e1a02c31c9e123e65b17030a7c2afc
+Size (Python-3.12.16.tar.xz) = 20839652 bytes
 SHA1 (patch-Lib_ctypes_util.py) = 3dec1b6b7a36e46cbfa0dfcd71c5e7fac9f60764
 SHA1 (patch-Lib_lib2to3_pgen2_driver.py) = 593c4e93c5653ab400f0a98b91db92630c0a7390
 SHA1 (patch-Lib_sysconfig.py) = bc6d91bf8f7121456b26ea7f080f588c96f2596f