CVS commit: pkgsrc/audio/py-music21

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Oct 29 07:14:59 UTC 2026

Modified Files:
        pkgsrc/audio/py-music21: Makefile distinfo

Log Message:
py-music21: updated to 10.5.2

10.5.2

Security release. These problems affect v10.5.1 and every earlier version of music21; only v10 gets the fix, so everyone should upgrade to 10.5.2 (pip install --upgrade music21, Python 3.11 or newer) 
or the latest v11 master branch (which is g

On shared Unix machines, another user could plant files in music21's temp/cache folder or settings file and run code as you. music21 now uses only a temp folder you own that no one else can write to. 
(Linux and other Unixes have never been officially supported, and problems like these are exactly why, but many, many users run music21 on them.)
Titles and lyrics written to LilyPond are now fully escaped, and LilyPond is run without a shell.
Clercq-Temperley text passed to parseData() is no longer opened as a file path.
converter.parse() no longer reads a file from data such as 'tinyNotation: ...' that contains /.. segments (#2109).

Behavior changes:

On Unix accounts without a writable home folder (common for web servers), settings are kept in the private music21 temp folder. Settings saved earlier to /tmp/.music21rc are no longer read. Check 
your existing file for vulnerabilities and recreate it at the path shown by music21.environment.Environment().getSettingsPath() (normally /tmp/music21/.music21rc or 
/tmp/music21-userid-<uid>/.music21rc).
common.cleanpath() no longer collapses .. after a folder that does not exist.
ConverterClercqTemperley.parseData() raises on strings that are not Clercq-Temperley data; use converter.parse(path) for files.


To generate a diff of this commit:
cvs rdiff -u -r1.43 -r1.44 pkgsrc/audio/py-music21/Makefile
cvs rdiff -u -r1.25 -r1.26 pkgsrc/audio/py-music21/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/audio/py-music21/Makefile
diff -u pkgsrc/audio/py-music21/Makefile:1.43 pkgsrc/audio/py-music21/Makefile:1.44
--- pkgsrc/audio/py-music21/Makefile:1.43       Fri Oct 23 05:29:19 2026
+++ pkgsrc/audio/py-music21/Makefile    Thu Oct 29 07:14:59 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.43 2026/10/23 05:29:19 adam Exp $
+# $NetBSD: Makefile,v 1.44 2026/10/29 07:14:59 adam Exp $
 
-DISTNAME=      music21-noCorpus-10.5.1
+DISTNAME=      music21-noCorpus-10.5.2
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/-noCorpus//}
 CATEGORIES=    audio python
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=cuthbertLab/}
@@ -19,9 +19,10 @@ DEPENDS+=    ${PYPKGPREFIX}-jsonpickle>=0:.
 DEPENDS+=      ${PYPKGPREFIX}-matplotlib>=0:../../graphics/py-matplotlib
 DEPENDS+=      ${PYPKGPREFIX}-more-itertools>=0:../../devel/py-more-itertools
 DEPENDS+=      ${PYPKGPREFIX}-requests>=0:../../devel/py-requests
-DEPENDS+=      ${PYPKGPREFIX}-scipy>=0:../../math/py-scipy
-DEPENDS+=      ${PYPKGPREFIX}-Levenshtein>=0:../../textproc/py-Levenshtein
 DEPENDS+=      ${PYPKGPREFIX}-webcolors>=1.11:../../www/py-webcolors
+# extras
+DEPENDS+=      ${PYPKGPREFIX}-Levenshtein>=0:../../textproc/py-Levenshtein
+DEPENDS+=      ${PYPKGPREFIX}-scipy>=0:../../math/py-scipy
 
 # Some tests will fail because they depend on the score files that
 # are part of the full music21 distribution.

Index: pkgsrc/audio/py-music21/distinfo
diff -u pkgsrc/audio/py-music21/distinfo:1.25 pkgsrc/audio/py-music21/distinfo:1.26
--- pkgsrc/audio/py-music21/distinfo:1.25       Fri Oct 23 05:29:19 2026
+++ pkgsrc/audio/py-music21/distinfo    Thu Oct 29 07:14:59 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.25 2026/10/23 05:29:19 adam Exp $
+$NetBSD: distinfo,v 1.26 2026/10/29 07:14:59 adam Exp $
 
-BLAKE2s (music21-noCorpus-10.5.1.tar.gz) = e3c0ede49c37a3215822cb275ada6d606182dde42b604573a594708b26d9ecd7
-SHA512 (music21-noCorpus-10.5.1.tar.gz) = 3febc0f92905c620785a0f2467bcf65795d32dc3f486b5347a38083d3cd692ef7e8ea0a497fc1db0620676922dbb766842069d972822dad853343073d5afb9ad
-Size (music21-noCorpus-10.5.1.tar.gz) = 5435190 bytes
+BLAKE2s (music21-noCorpus-10.5.2.tar.gz) = cd3690388394953040b5bd3b990d5ac4b89f5ea90e6f4d973cb6fcb2bc4dc5da
+SHA512 (music21-noCorpus-10.5.2.tar.gz) = d313ea76fc7c979fb651a4b90cff27b7a1ca897e26cf7946ea36d67127a3d821d436ea8e10078bda61a54a0bb6119478b1faf05183b97e6f4bc10cd4ae8e0c3a
+Size (music21-noCorpus-10.5.2.tar.gz) = 5436988 bytes