CVS commit: pkgsrc/lang

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Oct 26 13:07:24 UTC 2026

Modified Files:
        pkgsrc/lang/py311-html-docs: Makefile distinfo
        pkgsrc/lang/python311: PLIST dist.mk distinfo

Log Message:
python311 py311-html-docs: updated to 3.11.18

Python 3.11.18

Security

gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now 
ignored.
CVE-2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE-2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: 
removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust 
store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), 
so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.

Library

gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/lang/py311-html-docs/Makefile \
    pkgsrc/lang/py311-html-docs/distinfo
cvs rdiff -u -r1.16 -r1.17 pkgsrc/lang/python311/PLIST
cvs rdiff -u -r1.18 -r1.19 pkgsrc/lang/python311/dist.mk
cvs rdiff -u -r1.26 -r1.27 pkgsrc/lang/python311/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/py311-html-docs/Makefile
diff -u pkgsrc/lang/py311-html-docs/Makefile:1.18 pkgsrc/lang/py311-html-docs/Makefile:1.19
--- pkgsrc/lang/py311-html-docs/Makefile:1.18   Thu Oct  1 07:48:34 2026
+++ pkgsrc/lang/py311-html-docs/Makefile        Mon Oct 26 13:07:24 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.18 2026/10/01 07:48:34 adam Exp $
+# $NetBSD: Makefile,v 1.19 2026/10/26 13:07:24 adam Exp $
 
-VERS=          3.11.17
+VERS=          3.11.18
 DISTNAME=      python-${VERS}-docs-html
 PKGNAME=       py311-html-docs-${VERS}
 CATEGORIES=    lang python
Index: pkgsrc/lang/py311-html-docs/distinfo
diff -u pkgsrc/lang/py311-html-docs/distinfo:1.18 pkgsrc/lang/py311-html-docs/distinfo:1.19
--- pkgsrc/lang/py311-html-docs/distinfo:1.18   Thu Oct  1 07:48:34 2026
+++ pkgsrc/lang/py311-html-docs/distinfo        Mon Oct 26 13:07:24 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.18 2026/10/01 07:48:34 adam Exp $
+$NetBSD: distinfo,v 1.19 2026/10/26 13:07:24 adam Exp $
 
-BLAKE2s (python-3.11.17-docs-html.tar.bz2) = f31e82b93b8e3c7a068a6e5c13535a990ef4209d33359fca5cb18859b5b606f2
-SHA512 (python-3.11.17-docs-html.tar.bz2) = fe809039a00bd353bf176e7f239c11d6ae14228cd734fabdbac6bb5d894e083fc87e65e47d40a58e0b5b2c27654a6e31379b36f42dd3631575e19d518b395117
-Size (python-3.11.17-docs-html.tar.bz2) = 8022556 bytes
+BLAKE2s (python-3.11.18-docs-html.tar.bz2) = 3af7d55f7c28432e2c3b136691b39a28fc902c61d148650ce386cd9970a174f4
+SHA512 (python-3.11.18-docs-html.tar.bz2) = a0150c891d09ec457b604be70cd0649a200fa739386d917cc1eefffdf5143b97b88440e1b98a96df5f5695e5b5586cab2b25026cd30079404c0a61b83f8f6614
+Size (python-3.11.18-docs-html.tar.bz2) = 8026271 bytes

Index: pkgsrc/lang/python311/PLIST
diff -u pkgsrc/lang/python311/PLIST:1.16 pkgsrc/lang/python311/PLIST:1.17
--- pkgsrc/lang/python311/PLIST:1.16    Fri Oct 10 12:57:12 2025
+++ pkgsrc/lang/python311/PLIST Mon Oct 26 13:07:23 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.16 2025/10/10 12:57:12 adam Exp $
+@comment $NetBSD: PLIST,v 1.17 2026/10/26 13:07:23 adam Exp $
 bin/2to3-${PY_VER_SUFFIX}
 bin/pydoc${PY_VER_SUFFIX}
 bin/python${PY_VER_SUFFIX}
@@ -2775,6 +2775,7 @@ lib/python${PY_VER_SUFFIX}/test/certdata
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/99d0fa06.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/b1930218.0
 lib/python${PY_VER_SUFFIX}/test/certdata/capath/ceff1710.0
+lib/python${PY_VER_SUFFIX}/test/certdata/distrusted.zip
 lib/python${PY_VER_SUFFIX}/test/certdata/ffdh3072.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/idnsans.pem
 lib/python${PY_VER_SUFFIX}/test/certdata/keycert.passwd.pem

Index: pkgsrc/lang/python311/dist.mk
diff -u pkgsrc/lang/python311/dist.mk:1.18 pkgsrc/lang/python311/dist.mk:1.19
--- pkgsrc/lang/python311/dist.mk:1.18  Thu Oct  1 07:48:34 2026
+++ pkgsrc/lang/python311/dist.mk       Mon Oct 26 13:07:23 2026
@@ -1,6 +1,6 @@
-# $NetBSD: dist.mk,v 1.18 2026/10/01 07:48:34 adam Exp $
+# $NetBSD: dist.mk,v 1.19 2026/10/26 13:07:23 adam Exp $
 
-PY_DISTVERSION=        3.11.17
+PY_DISTVERSION=        3.11.18
 DISTNAME=      Python-${PY_DISTVERSION}
 EXTRACT_SUFX=  .tar.xz
 DISTINFO_FILE= ${.CURDIR}/../../lang/python311/distinfo

Index: pkgsrc/lang/python311/distinfo
diff -u pkgsrc/lang/python311/distinfo:1.26 pkgsrc/lang/python311/distinfo:1.27
--- pkgsrc/lang/python311/distinfo:1.26 Thu Oct  1 07:48:34 2026
+++ pkgsrc/lang/python311/distinfo      Mon Oct 26 13:07:23 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.26 2026/10/01 07:48:34 adam Exp $
+$NetBSD: distinfo,v 1.27 2026/10/26 13:07:23 adam Exp $
 
-BLAKE2s (Python-3.11.17.tar.xz) = 3fec2ed80bf9a2a9abaef2fb2fe4a7b9590e83faeed217778af71ea52a7d1611
-SHA512 (Python-3.11.17.tar.xz) = 17bcb2ee4edc7431bc8a166b46288643ae37cae46a8f707a61c3b146f34e47d7e980a72e97a6376e3ca79d7dee3af6e88a1ffaf888df083573ac681afe3ac6f3
-Size (Python-3.11.17.tar.xz) = 20352864 bytes
+BLAKE2s (Python-3.11.18.tar.xz) = e92b1c4f8949493568207a055f379e03763ab5bef24c48ecc04366dc8691fbb4
+SHA512 (Python-3.11.18.tar.xz) = af4a2ddc18de03bf4f25db7934db1534ac580a29a7475ebd82e1cdc229db6781f71ebe0f7288416b9e3b34c0544e82e7534caa4887e49e84b8e75da05dd5ff49
+Size (Python-3.11.18.tar.xz) = 20351120 bytes
 SHA1 (patch-Include_pymacro.h) = 271a891892dca1a3aaa3bedcae626a68a36cae0b
 SHA1 (patch-Lib_ctypes_util.py) = 3dec1b6b7a36e46cbfa0dfcd71c5e7fac9f60764
 SHA1 (patch-Lib_distutils_unixccompiler.py) = 8a91e8f4f86517a62408c3a10ed5eb50c4091fbf