From: Stuart Henderson Subject: python 3.13.14 for -stable To: ports , Kurt Mosiejczuk Date: Thu, 2 Jul 2026 16:45:32 +0100 ok? Index: Makefile =================================================================== RCS file: /cvs/ports/lang/python/3/Makefile,v diff -u -p -r1.25 Makefile --- Makefile 15 Apr 2026 15:57:02 -0000 1.25 +++ Makefile 2 Jul 2026 15:45:12 -0000 @@ -3,7 +3,7 @@ # requirement of the PSF license, if it constitutes a change to # Python itself. -FULL_VERSION = 3.13.13 +FULL_VERSION = 3.13.14 SHARED_LIBS = python3.13 0.0 VERSION_SPEC = >=3.13,<3.14 PORTROACH = limit:^3\.13 Index: distinfo =================================================================== RCS file: /cvs/ports/lang/python/3/distinfo,v diff -u -p -r1.11 distinfo --- distinfo 14 Apr 2026 10:51:23 -0000 1.11 +++ distinfo 2 Jul 2026 15:45:12 -0000 @@ -1,2 +1,2 @@ -SHA256 (Python-3.13.13.tgz) = +c3nsOLsgWXXMm4qD1nqJobOnQxhfbuz1mp+VNMbdLk= -SIZE (Python-3.13.13.tgz) = 29842908 +SHA256 (Python-3.13.14.tgz) = WuU1o2rw68pvyhduy4GX9ducHLjI8M0SzfF4cEbbH0E= +SIZE (Python-3.13.14.tgz) = 29914816 Index: files/CHANGES.OpenBSD =================================================================== RCS file: /cvs/ports/lang/python/3/files/CHANGES.OpenBSD,v diff -u -p -r1.6 CHANGES.OpenBSD --- files/CHANGES.OpenBSD 14 Apr 2026 10:51:23 -0000 1.6 +++ files/CHANGES.OpenBSD 2 Jul 2026 15:45:12 -0000 @@ -24,7 +24,5 @@ which results in loading an incorrect ve 8. Work around expat_config.h missing from base. -9. Cherry-pick fixes for CVE-2026-4519, CVE-2026-6100. - These changes are available in the OpenBSD CVS repository in ports/lang/python/3. Index: patches/patch-Lib_test_test_webbrowser_py =================================================================== RCS file: patches/patch-Lib_test_test_webbrowser_py diff -N patches/patch-Lib_test_test_webbrowser_py --- patches/patch-Lib_test_test_webbrowser_py 14 Apr 2026 10:51:23 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,26 +0,0 @@ -Fix fix for CVE 2026-4519 - -A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass -the dash-prefix safety check. - -https://github.com/python/cpython/pull/148517 - -Index: Lib/test/test_webbrowser.py ---- Lib/test/test_webbrowser.py.orig -+++ Lib/test/test_webbrowser.py -@@ -118,6 +118,15 @@ class ChromeCommandTest(CommandTestMixin, unittest.Tes - arguments=[URL], - kw=dict(new=999)) - -+ def test_reject_action_dash_prefixes(self): -+ browser = self.browser_class(name=CMD_NAME) -+ with self.assertRaises(ValueError): -+ browser.open('%action--incognito') -+ # new=1: action is "--new-window", so "%action" itself expands to -+ # a dash-prefixed flag even with no dash in the original URL. -+ with self.assertRaises(ValueError): -+ browser.open('%action', new=1) -+ - - class EdgeCommandTest(CommandTestMixin, unittest.TestCase): - Index: patches/patch-Lib_webbrowser_py =================================================================== RCS file: patches/patch-Lib_webbrowser_py diff -N patches/patch-Lib_webbrowser_py --- patches/patch-Lib_webbrowser_py 14 Apr 2026 10:51:23 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,28 +0,0 @@ -Fix fix for CVE 2026-4519 - -A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass -the dash-prefix safety check. - -https://github.com/python/cpython/pull/148517 -Index: Lib/webbrowser.py ---- Lib/webbrowser.py.orig -+++ Lib/webbrowser.py -@@ -275,7 +275,6 @@ class UnixBrowser(BaseBrowser): - - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -- self._check_url(url) - if new == 0: - action = self.remote_action - elif new == 1: -@@ -289,7 +288,9 @@ class UnixBrowser(BaseBrowser): - raise Error("Bad 'new' parameter to open(); " - f"expected 0, 1, or 2, got {new}") - -- args = [arg.replace("%s", url).replace("%action", action) -+ self._check_url(url.replace("%action", action)) -+ -+ args = [arg.replace("%action", action).replace("%s", url) - for arg in self.remote_args] - args = [arg for arg in args if arg] - success = self._invoke(args, True, autoraise, url) Index: patches/patch-Modules__bz2module_c =================================================================== RCS file: patches/patch-Modules__bz2module_c diff -N patches/patch-Modules__bz2module_c --- patches/patch-Modules__bz2module_c 14 Apr 2026 10:51:23 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,21 +0,0 @@ -CVE-2026-6100: - -Fix a dangling input pointer in :class:`lzma.LZMADecompressor`, -:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor` -when memory allocation fails with :exc:`MemoryError`, which could let a -subsequent :meth:`!decompress` call read or write through a stale pointer to -the already-released caller buffer. - -https://github.com/python/cpython/pull/148479 - -Index: Modules/_bz2module.c ---- Modules/_bz2module.c.orig -+++ Modules/_bz2module.c -@@ -589,6 +589,7 @@ decompress(BZ2Decompressor *d, char *data, size_t len, - return result; - - error: -+ bzs->next_in = NULL; - Py_XDECREF(result); - return NULL; - } Index: patches/patch-Modules__lzmamodule_c =================================================================== RCS file: patches/patch-Modules__lzmamodule_c diff -N patches/patch-Modules__lzmamodule_c --- patches/patch-Modules__lzmamodule_c 14 Apr 2026 10:51:23 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,21 +0,0 @@ -CVE-2026-6100: - -Fix a dangling input pointer in :class:`lzma.LZMADecompressor`, -:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor` -when memory allocation fails with :exc:`MemoryError`, which could let a -subsequent :meth:`!decompress` call read or write through a stale pointer to -the already-released caller buffer. - -https://github.com/python/cpython/pull/148479 - -Index: Modules/_lzmamodule.c ---- Modules/_lzmamodule.c.orig -+++ Modules/_lzmamodule.c -@@ -1112,6 +1112,7 @@ decompress(Decompressor *d, uint8_t *data, size_t len, - return result; - - error: -+ lzs->next_in = NULL; - Py_XDECREF(result); - return NULL; - } Index: patches/patch-Modules_zlibmodule_c =================================================================== RCS file: patches/patch-Modules_zlibmodule_c diff -N patches/patch-Modules_zlibmodule_c --- patches/patch-Modules_zlibmodule_c 14 Apr 2026 10:51:23 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,21 +0,0 @@ -CVE-2026-6100: - -Fix a dangling input pointer in :class:`lzma.LZMADecompressor`, -:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor` -when memory allocation fails with :exc:`MemoryError`, which could let a -subsequent :meth:`!decompress` call read or write through a stale pointer to -the already-released caller buffer. - -https://github.com/python/cpython/pull/148479 - -Index: Modules/zlibmodule.c ---- Modules/zlibmodule.c.orig -+++ Modules/zlibmodule.c -@@ -1675,6 +1675,7 @@ decompress(ZlibDecompressor *self, uint8_t *data, - return result; - - error: -+ self->zst.next_in = NULL; - Py_XDECREF(result); - return NULL; - } Index: patches/patch-configure_ac =================================================================== RCS file: /cvs/ports/lang/python/3/patches/patch-configure_ac,v diff -u -p -r1.5 patch-configure_ac --- patches/patch-configure_ac 14 Apr 2026 10:51:23 -0000 1.5 +++ patches/patch-configure_ac 2 Jul 2026 15:45:12 -0000 @@ -49,7 +49,7 @@ Index: configure.ac # Any changes made here should be reflected in the GCC+Darwin case below PGO_PROF_GEN_FLAG="-fprofile-instr-generate" PGO_PROF_USE_FLAG="-fprofile-instr-use=\"\$(shell pwd)/code.profclangd\"" -@@ -4369,11 +4370,7 @@ dnl Detect Tcl/Tk. Use pkg-config if available. +@@ -4391,11 +4392,7 @@ dnl Detect Tcl/Tk. Use pkg-config if available. dnl found_tcltk=no for _QUERY in \ Index: pkg/PLIST-main =================================================================== RCS file: /cvs/ports/lang/python/3/pkg/PLIST-main,v diff -u -p -r1.17 PLIST-main --- pkg/PLIST-main 14 Apr 2026 10:51:23 -0000 1.17 +++ pkg/PLIST-main 2 Jul 2026 15:45:12 -0000 @@ -1809,7 +1809,7 @@ lib/python3.13/ensurepip/__pycache__/_un lib/python3.13/ensurepip/__pycache__/_uninstall.cpython-313.opt-2.pyc lib/python3.13/ensurepip/__pycache__/_uninstall.cpython-313.pyc lib/python3.13/ensurepip/_bundled/ -lib/python3.13/ensurepip/_bundled/pip-26.0.1-py3-none-any.whl +lib/python3.13/ensurepip/_bundled/pip-26.1.2-py3-none-any.whl lib/python3.13/ensurepip/_uninstall.py lib/python3.13/enum.py lib/python3.13/filecmp.py Index: pkg/PLIST-tests =================================================================== RCS file: /cvs/ports/lang/python/3/pkg/PLIST-tests,v diff -u -p -r1.12 PLIST-tests --- pkg/PLIST-tests 14 Apr 2026 10:51:23 -0000 1.12 +++ pkg/PLIST-tests 2 Jul 2026 15:45:12 -0000 @@ -2284,6 +2284,9 @@ lib/python3.13/test/test_capi/__pycache_ lib/python3.13/test/test_capi/__pycache__/test_watchers.cpython-313.opt-1.pyc lib/python3.13/test/test_capi/__pycache__/test_watchers.cpython-313.opt-2.pyc lib/python3.13/test/test_capi/__pycache__/test_watchers.cpython-313.pyc +lib/python3.13/test/test_capi/__pycache__/test_weakref.cpython-313.opt-1.pyc +lib/python3.13/test/test_capi/__pycache__/test_weakref.cpython-313.opt-2.pyc +lib/python3.13/test/test_capi/__pycache__/test_weakref.cpython-313.pyc lib/python3.13/test/test_capi/check_config.py lib/python3.13/test/test_capi/test_abstract.py lib/python3.13/test/test_capi/test_bytearray.py @@ -2316,6 +2319,7 @@ lib/python3.13/test/test_capi/test_time. lib/python3.13/test/test_capi/test_tuple.py lib/python3.13/test/test_capi/test_unicode.py lib/python3.13/test/test_capi/test_watchers.py +lib/python3.13/test/test_capi/test_weakref.py lib/python3.13/test/test_cext/ lib/python3.13/test/test_cext/__init__.py lib/python3.13/test/test_cext/__pycache__/ @@ -3797,6 +3801,7 @@ lib/python3.13/test/test_json/__pycache_ lib/python3.13/test/test_json/__pycache__/test_unicode.cpython-313.opt-1.pyc lib/python3.13/test/test_json/__pycache__/test_unicode.cpython-313.opt-2.pyc lib/python3.13/test/test_json/__pycache__/test_unicode.cpython-313.pyc +lib/python3.13/test/test_json/json_lines.jsonl lib/python3.13/test/test_json/test_decode.py lib/python3.13/test/test_json/test_default.py lib/python3.13/test/test_json/test_dump.py