CVS commit: pkgsrc

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Tue Nov  3 20:22:01 UTC 2026

Modified Files:
        pkgsrc/devel/py-msgpack: Makefile distinfo
        pkgsrc/sysutils/py-borgbackup: Makefile distinfo
Added Files:
        pkgsrc/sysutils/py-borgbackup/patches: patch-pyproject.toml
            patch-src_borg_helpers_msgpack.py

Log Message:
py-msgpack: update to 1.2.4 (security)

Also allow this version in py-borgbackup, following upstream.

1.2.3

- Fix memory leaks in the C extension when map key validation or
  container hooks fail. See GHSA-j586-36cw-2gc2.
- wheels: also build for pyodide using emscripten
- Support packing Python 3.15 frozentdict (PEP 814)
- Reject negative array and map header sizes

1.2.4

- fallback: pass object_pairs_hook a list of pairs
- fallback: leave the object unread when a header type does not match
- fallback: return bytes from Unpacker.read_bytes
- dependency updates


To generate a diff of this commit:
cvs rdiff -u -r1.44 -r1.45 pkgsrc/devel/py-msgpack/Makefile
cvs rdiff -u -r1.28 -r1.29 pkgsrc/devel/py-msgpack/distinfo
cvs rdiff -u -r1.66 -r1.67 pkgsrc/sysutils/py-borgbackup/Makefile
cvs rdiff -u -r1.44 -r1.45 pkgsrc/sysutils/py-borgbackup/distinfo
cvs rdiff -u -r0 -r1.5 \
    pkgsrc/sysutils/py-borgbackup/patches/patch-pyproject.toml
cvs rdiff -u -r0 -r1.9 \
    pkgsrc/sysutils/py-borgbackup/patches/patch-src_borg_helpers_msgpack.py

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-msgpack/Makefile
diff -u pkgsrc/devel/py-msgpack/Makefile:1.44 pkgsrc/devel/py-msgpack/Makefile:1.45
--- pkgsrc/devel/py-msgpack/Makefile:1.44       Tue Jul 21 14:40:49 2026
+++ pkgsrc/devel/py-msgpack/Makefile    Tue Nov  3 20:22:00 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.44 2026/07/21 14:40:49 he Exp $
+# $NetBSD: Makefile,v 1.45 2026/11/03 20:22:00 bsiegert Exp $
 
-DISTNAME=      msgpack-1.2.1
+DISTNAME=      msgpack-1.2.4
 # Please note that py-borgackup has a "maximally supported version"
 # of this particular package coded into it, potentially causing
 # a run-time error for py-borgbackup after a package upgrade.

Index: pkgsrc/devel/py-msgpack/distinfo
diff -u pkgsrc/devel/py-msgpack/distinfo:1.28 pkgsrc/devel/py-msgpack/distinfo:1.29
--- pkgsrc/devel/py-msgpack/distinfo:1.28       Sun Jun 21 06:57:02 2026
+++ pkgsrc/devel/py-msgpack/distinfo    Tue Nov  3 20:22:00 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.28 2026/06/21 06:57:02 wiz Exp $
+$NetBSD: distinfo,v 1.29 2026/11/03 20:22:00 bsiegert Exp $
 
-BLAKE2s (msgpack-1.2.1.tar.gz) = f168cbd25767be9f57ba8aa616a3f0b8250419d732a8dbc58f17264231e109f1
-SHA512 (msgpack-1.2.1.tar.gz) = 3e018978b2b3ec04508c6b8a12a16daf23e95f7d7c1f846e09e27082197a92566e3c4c5a8a6db51c52b1c8ab66bb55d4d1498373bab99a7fd193efaba53834eb
-Size (msgpack-1.2.1.tar.gz) = 183960 bytes
+BLAKE2s (msgpack-1.2.4.tar.gz) = f7b345551ecbe32420f512dd9b64bfe141df5e5459bbd83b2cdb9606f8373b25
+SHA512 (msgpack-1.2.4.tar.gz) = 175b534cc3238afd65f3dddebee8e700ac9835df18b95d9f1739c122e440171c07328f12f6dcd0183f38fb152c38e68b66b223cf977d9d6fef88dd56376ed8a2
+Size (msgpack-1.2.4.tar.gz) = 197764 bytes

Index: pkgsrc/sysutils/py-borgbackup/Makefile
diff -u pkgsrc/sysutils/py-borgbackup/Makefile:1.66 pkgsrc/sysutils/py-borgbackup/Makefile:1.67
--- pkgsrc/sysutils/py-borgbackup/Makefile:1.66 Fri Oct 16 19:44:14 2026
+++ pkgsrc/sysutils/py-borgbackup/Makefile      Tue Nov  3 20:22:00 2026
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.66 2026/10/16 19:44:14 adam Exp $
+# $NetBSD: Makefile,v 1.67 2026/11/03 20:22:00 bsiegert Exp $
 
 DISTNAME=      borgbackup-1.4.5
+PKGREVISION=   1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    sysutils python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=b/borgbackup/}

Index: pkgsrc/sysutils/py-borgbackup/distinfo
diff -u pkgsrc/sysutils/py-borgbackup/distinfo:1.44 pkgsrc/sysutils/py-borgbackup/distinfo:1.45
--- pkgsrc/sysutils/py-borgbackup/distinfo:1.44 Mon Oct  5 13:18:29 2026
+++ pkgsrc/sysutils/py-borgbackup/distinfo      Tue Nov  3 20:22:00 2026
@@ -1,5 +1,7 @@
-$NetBSD: distinfo,v 1.44 2026/10/05 13:18:29 adam Exp $
+$NetBSD: distinfo,v 1.45 2026/11/03 20:22:00 bsiegert Exp $
 
 BLAKE2s (borgbackup-1.4.5.tar.gz) = 285c30ac4a29e1c1eb0c012da114f2b344f2eb22d786b1cb6b09c24c4deaab83
 SHA512 (borgbackup-1.4.5.tar.gz) = 1303e334b32dd62847918920777ca47eec072974859f612d054fc516fdab56eea588d34ae2f71e9c0757486769dd5ba057d5c6bb05294f40ff52a8b41f7e5801
 Size (borgbackup-1.4.5.tar.gz) = 4034652 bytes
+SHA1 (patch-pyproject.toml) = ed7d9d155be3f0746b8c1f116d7585a01f7189be
+SHA1 (patch-src_borg_helpers_msgpack.py) = 36d2b8b0fef24670fececb533b574b54f8898f5e

Added files:

Index: pkgsrc/sysutils/py-borgbackup/patches/patch-pyproject.toml
diff -u /dev/null pkgsrc/sysutils/py-borgbackup/patches/patch-pyproject.toml:1.5
--- /dev/null   Tue Nov  3 20:22:01 2026
+++ pkgsrc/sysutils/py-borgbackup/patches/patch-pyproject.toml  Tue Nov  3 20:22:01 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-pyproject.toml,v 1.5 2026/11/03 20:22:01 bsiegert Exp $
+
+Support newer msgpack.
+https://github.com/borgbackup/borg/commit/144a83ba8e30ad7edb2fb9512ccc276008c67074
+--- pyproject.toml.orig        2026-11-03 20:14:15.206002866 +0000
++++ pyproject.toml
+@@ -35,7 +35,7 @@ dependencies = [
+     # Please note:
+     # Using any other msgpack version is not supported by Borg development and
+     # any feedback related to issues caused by this will be ignored.
+-    "msgpack >=1.0.3, <=1.2.1",
++    "msgpack >=1.0.3, <=1.2.4",
+     "packaging",
+ ]
+ 

Index: pkgsrc/sysutils/py-borgbackup/patches/patch-src_borg_helpers_msgpack.py
diff -u /dev/null pkgsrc/sysutils/py-borgbackup/patches/patch-src_borg_helpers_msgpack.py:1.9
--- /dev/null   Tue Nov  3 20:22:01 2026
+++ pkgsrc/sysutils/py-borgbackup/patches/patch-src_borg_helpers_msgpack.py     Tue Nov  3 20:22:01 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-src_borg_helpers_msgpack.py,v 1.9 2026/11/03 20:22:01 bsiegert Exp $
+
+Support newer msgpack.
+https://github.com/borgbackup/borg/commit/144a83ba8e30ad7edb2fb9512ccc276008c67074
+--- src/borg/helpers/msgpack.py.orig   2026-11-03 20:14:48.773039630 +0000
++++ src/borg/helpers/msgpack.py
+@@ -145,7 +145,7 @@ def is_supported_msgpack():
+     version_check = os.environ.get('BORG_MSGPACK_VERSION_CHECK', 'yes').strip().lower()
+ 
+     return version_check == 'no' or (
+-        (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 1) and
++        (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 4) and
+         msgpack.version not in []
+     )
+