Download raw body.
(no subject)
update to the next point release of Python which allows removal of the
cherry picked fixes.
I've been running it locally on amd64 since it was released with no
issues.
ok?
Index: Makefile
===================================================================
RCS file: /cvs/ports/lang/python/3/Makefile,v
diff -u -p -u -r1.29 Makefile
--- Makefile 16 May 2026 21:56:52 -0000 1.29
+++ Makefile 31 May 2026 12:33:14 -0000
@@ -3,8 +3,7 @@
# requirement of the PSF license, if it constitutes a change to
# Python itself.
-FULL_VERSION = 3.14.4
-REVISION-main = 1
+FULL_VERSION = 3.14.5
SHARED_LIBS = python3.14 0.0
VERSION_SPEC = >=3.14
PORTROACH = limit:^3\.14
Index: distinfo
===================================================================
RCS file: /cvs/ports/lang/python/3/distinfo,v
diff -u -p -u -r1.12 distinfo
--- distinfo 12 May 2026 13:45:10 -0000 1.12
+++ distinfo 31 May 2026 12:33:14 -0000
@@ -1,2 +1,2 @@
-SHA256 (Python-3.14.4.tgz) = tMBZ1YlfAw59+WY4lM43Mr+hsyzTqyiDmAJmpFzjyzs=
-SIZE (Python-3.14.4.tgz) = 31148035
+SHA256 (Python-3.14.5.tgz) = nCK/6ZOabFQY/HSyiaXxzEGFmugqxrFjAWtYRL0Khrw=
+SIZE (Python-3.14.5.tgz) = 31197461
Index: files/CHANGES.OpenBSD
===================================================================
RCS file: /cvs/ports/lang/python/3/files/CHANGES.OpenBSD,v
diff -u -p -u -r1.6 CHANGES.OpenBSD
--- files/CHANGES.OpenBSD 14 Apr 2026 10:51:23 -0000 1.6
+++ files/CHANGES.OpenBSD 31 May 2026 12:33:14 -0000
@@ -24,7 +24,5 @@ which results in loading an incorrect ve
8. Work around expat_config.h missing from base.
-9. Cherry-pick fixes for CVE-2026-4519, CVE-2026-6100.
-
These changes are available in the OpenBSD CVS repository
<http://www.openbsd.org/anoncvs.html> in ports/lang/python/3.
Index: patches/patch-Lib_test_test_webbrowser_py
===================================================================
RCS file: patches/patch-Lib_test_test_webbrowser_py
diff -N patches/patch-Lib_test_test_webbrowser_py
--- patches/patch-Lib_test_test_webbrowser_py 12 May 2026 13:45:10 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,26 +0,0 @@
-Fix fix for CVE 2026-4519
-
-A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
-the dash-prefix safety check.
-
-https://github.com/python/cpython/pull/148517
-
-Index: Lib/test/test_webbrowser.py
---- Lib/test/test_webbrowser.py.orig
-+++ Lib/test/test_webbrowser.py
-@@ -119,6 +119,15 @@ class ChromeCommandTest(CommandTestMixin, unittest.Tes
- arguments=[URL],
- kw=dict(new=999))
-
-+ def test_reject_action_dash_prefixes(self):
-+ browser = self.browser_class(name=CMD_NAME)
-+ with self.assertRaises(ValueError):
-+ browser.open('%action--incognito')
-+ # new=1: action is "--new-window", so "%action" itself expands to
-+ # a dash-prefixed flag even with no dash in the original URL.
-+ with self.assertRaises(ValueError):
-+ browser.open('%action', new=1)
-+
-
- class EdgeCommandTest(CommandTestMixin, unittest.TestCase):
-
Index: patches/patch-Lib_webbrowser_py
===================================================================
RCS file: patches/patch-Lib_webbrowser_py
diff -N patches/patch-Lib_webbrowser_py
--- patches/patch-Lib_webbrowser_py 12 May 2026 13:45:10 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,28 +0,0 @@
-Fix fix for CVE 2026-4519
-
-A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
-the dash-prefix safety check.
-
-https://github.com/python/cpython/pull/148517
-Index: Lib/webbrowser.py
---- Lib/webbrowser.py.orig
-+++ Lib/webbrowser.py
-@@ -274,7 +274,6 @@ class UnixBrowser(BaseBrowser):
-
- def open(self, url, new=0, autoraise=True):
- sys.audit("webbrowser.open", url)
-- self._check_url(url)
- if new == 0:
- action = self.remote_action
- elif new == 1:
-@@ -288,7 +287,9 @@ class UnixBrowser(BaseBrowser):
- raise Error("Bad 'new' parameter to open(); "
- f"expected 0, 1, or 2, got {new}")
-
-- args = [arg.replace("%s", url).replace("%action", action)
-+ self._check_url(url.replace("%action", action))
-+
-+ args = [arg.replace("%action", action).replace("%s", url)
- for arg in self.remote_args]
- args = [arg for arg in args if arg]
- success = self._invoke(args, True, autoraise, url)
Index: patches/patch-Makefile_pre_in
===================================================================
RCS file: /cvs/ports/lang/python/3/patches/patch-Makefile_pre_in,v
diff -u -p -u -r1.3 patch-Makefile_pre_in
--- patches/patch-Makefile_pre_in 12 May 2026 13:45:10 -0000 1.3
+++ patches/patch-Makefile_pre_in 31 May 2026 12:33:14 -0000
@@ -3,7 +3,7 @@ Make bsd make happy
Index: Makefile.pre.in
--- Makefile.pre.in.orig
+++ Makefile.pre.in
-@@ -607,8 +607,6 @@ LIBMPDEC_OBJS= \
+@@ -609,8 +609,6 @@ LIBMPDEC_OBJS= \
Modules/_decimal/libmpdec/numbertheory.o \
Modules/_decimal/libmpdec/sixstep.o \
Modules/_decimal/libmpdec/transpose.o
Index: patches/patch-Modules__bz2module_c
===================================================================
RCS file: patches/patch-Modules__bz2module_c
diff -N patches/patch-Modules__bz2module_c
--- patches/patch-Modules__bz2module_c 12 May 2026 13:45:10 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,21 +0,0 @@
-CVE-2026-6100:
-
-Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
-:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor`
-when memory allocation fails with :exc:`MemoryError`, which could let a
-subsequent :meth:`!decompress` call read or write through a stale pointer to
-the already-released caller buffer.
-
-https://github.com/python/cpython/pull/148479
-
-Index: Modules/_bz2module.c
---- Modules/_bz2module.c.orig
-+++ Modules/_bz2module.c
-@@ -593,6 +593,7 @@ decompress(BZ2Decompressor *d, char *data, size_t len,
- return result;
-
- error:
-+ bzs->next_in = NULL;
- Py_XDECREF(result);
- return NULL;
- }
Index: patches/patch-Modules__lzmamodule_c
===================================================================
RCS file: patches/patch-Modules__lzmamodule_c
diff -N patches/patch-Modules__lzmamodule_c
--- patches/patch-Modules__lzmamodule_c 12 May 2026 13:45:10 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,21 +0,0 @@
-CVE-2026-6100:
-
-Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
-:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor`
-when memory allocation fails with :exc:`MemoryError`, which could let a
-subsequent :meth:`!decompress` call read or write through a stale pointer to
-the already-released caller buffer.
-
-https://github.com/python/cpython/pull/148479
-
-Index: Modules/_lzmamodule.c
---- Modules/_lzmamodule.c.orig
-+++ Modules/_lzmamodule.c
-@@ -1120,6 +1120,7 @@ decompress(Decompressor *d, uint8_t *data, size_t len,
- return result;
-
- error:
-+ lzs->next_in = NULL;
- Py_XDECREF(result);
- return NULL;
- }
Index: patches/patch-Modules_zlibmodule_c
===================================================================
RCS file: patches/patch-Modules_zlibmodule_c
diff -N patches/patch-Modules_zlibmodule_c
--- patches/patch-Modules_zlibmodule_c 14 Apr 2026 10:51:23 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,21 +0,0 @@
-CVE-2026-6100:
-
-Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
-:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor`
-when memory allocation fails with :exc:`MemoryError`, which could let a
-subsequent :meth:`!decompress` call read or write through a stale pointer to
-the already-released caller buffer.
-
-https://github.com/python/cpython/pull/148479
-
-Index: Modules/zlibmodule.c
---- Modules/zlibmodule.c.orig
-+++ Modules/zlibmodule.c
-@@ -1675,6 +1675,7 @@ decompress(ZlibDecompressor *self, uint8_t *data,
- return result;
-
- error:
-+ self->zst.next_in = NULL;
- Py_XDECREF(result);
- return NULL;
- }
Index: patches/patch-configure_ac
===================================================================
RCS file: /cvs/ports/lang/python/3/patches/patch-configure_ac,v
diff -u -p -u -r1.6 patch-configure_ac
--- patches/patch-configure_ac 12 May 2026 13:45:10 -0000 1.6
+++ patches/patch-configure_ac 31 May 2026 12:33:14 -0000
@@ -49,7 +49,7 @@ Index: configure.ac
# Any changes made here should be reflected in the GCC+Darwin case below
PGO_PROF_GEN_FLAG="-fprofile-instr-generate"
PGO_PROF_USE_FLAG="-fprofile-instr-use=\"\$(shell pwd)/code.profclangd\""
-@@ -4417,11 +4418,7 @@ dnl Detect Tcl/Tk. Use pkg-config if available.
+@@ -4439,11 +4440,7 @@ dnl Detect Tcl/Tk. Use pkg-config if available.
dnl
found_tcltk=no
for _QUERY in \
Index: pkg/PLIST-main
===================================================================
RCS file: /cvs/ports/lang/python/3/pkg/PLIST-main,v
diff -u -p -u -r1.21 PLIST-main
--- pkg/PLIST-main 16 May 2026 21:56:52 -0000 1.21
+++ pkg/PLIST-main 31 May 2026 12:33:15 -0000
@@ -1918,7 +1918,7 @@ lib/${PY_VERSION}/ensurepip/__pycache__/
lib/${PY_VERSION}/ensurepip/__pycache__/_uninstall.${PYC_MAGIC_TAG}.opt-2.pyc
lib/${PY_VERSION}/ensurepip/__pycache__/_uninstall.${PYC_MAGIC_TAG}.pyc
lib/${PY_VERSION}/ensurepip/_bundled/
-lib/${PY_VERSION}/ensurepip/_bundled/pip-26.0.1-py3-none-any.whl
+lib/${PY_VERSION}/ensurepip/_bundled/pip-26.1.1-py3-none-any.whl
lib/${PY_VERSION}/ensurepip/_uninstall.py
lib/${PY_VERSION}/enum.py
lib/${PY_VERSION}/filecmp.py
Index: pkg/PLIST-tests
===================================================================
RCS file: /cvs/ports/lang/python/3/pkg/PLIST-tests,v
diff -u -p -u -r1.14 PLIST-tests
--- pkg/PLIST-tests 12 May 2026 13:45:10 -0000 1.14
+++ pkg/PLIST-tests 31 May 2026 12:33:16 -0000
@@ -31,9 +31,6 @@ lib/${PY_VERSION}/test/__pycache__/_test
lib/${PY_VERSION}/test/__pycache__/_test_embed_structseq.${PYC_MAGIC_TAG}.opt-1.pyc
lib/${PY_VERSION}/test/__pycache__/_test_embed_structseq.${PYC_MAGIC_TAG}.opt-2.pyc
lib/${PY_VERSION}/test/__pycache__/_test_embed_structseq.${PYC_MAGIC_TAG}.pyc
-lib/${PY_VERSION}/test/__pycache__/_test_gc_fast_cycles.${PYC_MAGIC_TAG}.opt-1.pyc
-lib/${PY_VERSION}/test/__pycache__/_test_gc_fast_cycles.${PYC_MAGIC_TAG}.opt-2.pyc
-lib/${PY_VERSION}/test/__pycache__/_test_gc_fast_cycles.${PYC_MAGIC_TAG}.pyc
lib/${PY_VERSION}/test/__pycache__/_test_monitoring_shutdown.${PYC_MAGIC_TAG}.opt-1.pyc
lib/${PY_VERSION}/test/__pycache__/_test_monitoring_shutdown.${PYC_MAGIC_TAG}.opt-2.pyc
lib/${PY_VERSION}/test/__pycache__/_test_monitoring_shutdown.${PYC_MAGIC_TAG}.pyc
@@ -1362,7 +1359,6 @@ lib/${PY_VERSION}/test/_crossinterp_defi
lib/${PY_VERSION}/test/_test_atexit.py
lib/${PY_VERSION}/test/_test_eintr.py
lib/${PY_VERSION}/test/_test_embed_structseq.py
-lib/${PY_VERSION}/test/_test_gc_fast_cycles.py
lib/${PY_VERSION}/test/_test_monitoring_shutdown.py
lib/${PY_VERSION}/test/_test_multiprocessing.py
lib/${PY_VERSION}/test/_test_venv_multiprocessing.py
@@ -3951,6 +3947,7 @@ lib/${PY_VERSION}/test/test_json/__pycac
lib/${PY_VERSION}/test/test_json/__pycache__/test_unicode.${PYC_MAGIC_TAG}.opt-1.pyc
lib/${PY_VERSION}/test/test_json/__pycache__/test_unicode.${PYC_MAGIC_TAG}.opt-2.pyc
lib/${PY_VERSION}/test/test_json/__pycache__/test_unicode.${PYC_MAGIC_TAG}.pyc
+lib/${PY_VERSION}/test/test_json/json_lines.jsonl
lib/${PY_VERSION}/test/test_json/test_decode.py
lib/${PY_VERSION}/test/test_json/test_default.py
lib/${PY_VERSION}/test/test_json/test_dump.py
(no subject)