py-qwt-qt5: try fixing PLIST for Python != 3.10

(wiz)

py-sip6: does not support Python 2

(wiz)

py-sip-qt5: does not support Python 2

(wiz)

doc: Updated ham/chirp to 20221207nb1

(gdt)

ham/chirp: Update to 20221207

Upstream snapshots are always micro-ish

(gdt)

Updated lang/python38, lang/python39, lang/python310, lang/python311, lang/py38-html-docs, lang/py39-html-docs, lang/py310-html-docs, lang/py311-html-docs

(adam)

python311 py311-html-docs: updated to 3.11.1

Python 3.11.1 final

Security

gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log.

This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing.

gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module

gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name.

gh-98739: Update bundled libexpat to 2.5.0

gh-97612: Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run openssl commands. Issue reported and initial fix by Caleb Shortt. Patch by Victor Stinner.
Core and Builtins
gh-99886: Fix a crash when an object which does not have a dictionary frees its instance values.
gh-99891: Fix a bug in the tokenizer that could cause infinite recursion when showing syntax warnings that happen in the first line of the source. Patch by Pablo Galindo
gh-99729: Fix an issue that could cause frames to be visible to Python code as they are being torn down, possibly leading to memory corruption or hard crashes of the interpreter.
gh-99578: Fix a reference bug in _imp.create_builtin() after the creation of the first sub-interpreter for modules builtins and sys. Patch by Victor Stinner.
gh-99581: Fixed a bug that was causing a buffer overflow if the tokenizer copies a line missing the newline caracter from a file that is as long as the available tokenizer buffer. Patch by Pablo galindo
gh-99553: Fix bug where an ExceptionGroup subclass can wrap a BaseException.
gh-99370: Fix zip path for venv created from a non-installed python on POSIX platforms.
gh-99298: Fix an issue that could potentially cause incorrect error handling for some bytecode instructions.
gh-99205: Fix an issue that prevented PyThreadState and PyInterpreterState memory from being freed properly.
gh-99181: Fix failure in except* with unhashable exceptions.
gh-99204: Fix calculation of sys._base_executable when inside a POSIX virtual environment using copies of the python binary when the base installation does not provide the executable name used by the venv. Calculation will fall back to alternative names (窶徘ython<MAJOR>窶�, 窶徘ython<MAJOR>.<MINOR>窶�).
gh-96055: Update faulthandler to emit an error message with the proper unexpected signal number. Patch by Dong-hee Na.
gh-99153: Fix location of SyntaxError for a try block with both except and except*.
gh-99103: Fix the error reporting positions of specialized traceback anchors when the source line contains Unicode characters.
gh-98852: Fix subscription of type aliases containing bare generic types or types like TypeVar: for example tuple[A, T][int] and tuple[TypeVar, T][int], where A is a generic type, and T is a type variable.
gh-98925: Lower the recursion depth for marshal on WASI to support wasmtime 2.0/main.
gh-98783: Fix multiple crashes in debug mode when str subclasses are used instead of str itself.
gh-99257: Fix an issue where member descriptors (such as those for __slots__) could behave incorrectly or crash instead of raising a TypeError when accessed via an instance of an invalid type.
gh-98374: Suppress ImportError for invalid query for help() command. Patch by Dong-hee Na.
gh-98415: Fix detection of MAC addresses for uuid on certain OSs. Patch by Chaim Sanders
gh-92119: Print exception class name instead of its string representation when raising errors from ctypes calls.
gh-96078: os.sched_yield() now release the GIL while calling sched_yield(2). Patch by Dong-hee Na.
gh-93354: Fix an issue that could delay the specialization of PRECALL instructions.
gh-97943: Bugfix: PyFunction_GetAnnotations() should return a borrowed reference. It was returning a new reference.
gh-97779: Ensure that all Python frame objects are backed by 窶彡omplete窶� frames.
gh-97591: Fixed a missing incref/decref pair in Exception.__setstate__(). Patch by Ofey Chan.
gh-94526: Fix the Python path configuration used to initialized sys.path at Python startup. Paths are no longer encoded to UTF-8/strict to avoid encoding errors if it contains surrogate characters (bytes paths are decoded with the surrogateescape error handler). Patch by Victor Stinner.
gh-95921: Fix overly-broad source position information for chained comparisons used as branching conditions.
gh-96387: At Python exit, sometimes a thread holding the GIL can wait forever for a thread (usually a daemon thread) which requested to drop the GIL, whereas the thread already exited. To fix the race condition, the thread which requested the GIL drop now resets its request before exiting. Issue discovered and analyzed by Mingliang ZHAO. Patch by Victor Stinner.
gh-96864: Fix a possible assertion failure, fatal error, or SystemError if a line tracing event raises an exception while opcode tracing is enabled.
gh-96678: Fix undefined behaviour in C code of null pointer arithmetic.
gh-96754: Make sure that all frame objects created are created from valid interpreter frames. Prevents the possibility of invalid frames in backtraces and signal handlers.
gh-95196: Disable incorrect pickling of the C implemented classmethod descriptors.
gh-96005: On WASI ENOTCAPABLE is now mapped to PermissionError. The errno modules exposes the new error number. getpath.py now ignores PermissionError when it cannot open landmark files pybuilddir.txt and pyenv.cfg.
gh-93696: Allow pdb to locate source for frozen modules in the standard library.
bpo-31718: Raise ValueError instead of SystemError when methods of uninitialized io.IncrementalNewlineDecoder objects are called. Patch by Oren Milman.
bpo-38031: Fix a possible assertion failure in io.FileIO when the opener returns an invalid file descriptor.
Library
gh-100001: Also escape s in the http.server BaseHTTPRequestHandler.log_message so that it is technically possible to parse the line and reconstruct what the original data was. Without this a xHH is ambiguious as to if it is a hex replacement we put in or the characters r窶捶窶� came through in the original request line.

gh-93453: asyncio.get_event_loop() now only emits a deprecation warning when a new event loop was created implicitly. It no longer emits a deprecation warning if the current event loop was set.

gh-51524: Fix bug when calling trace.CoverageResults with valid infile.

gh-99645: Fix a bug in handling class cleanups in unittest.TestCase. Now addClassCleanup() uses separate lists for different TestCase subclasses, and doClassCleanups() only cleans up the particular class.

gh-97001: Release the GIL when calling termios APIs to avoid blocking threads.

gh-99341: Fix ast.increment_lineno() to also cover ast.TypeIgnore when changing line numbers.

gh-99418: Fix bug in urllib.parse.urlparse() that causes URL schemes that begin with a digit, a plus sign, or a minus sign to be parsed incorrectly.

gh-99382: Check the number of arguments in substitution in user generics containing a TypeVarTuple and one or more TypeVar.

gh-99379: Fix substitution of ParamSpec followed by TypeVarTuple in generic aliases.

gh-99344: Fix substitution of TypeVarTuple and ParamSpec together in user generics.

gh-74044: Fixed bug where inspect.signature() reported incorrect arguments for decorated methods.

gh-99275: Fix SystemError in ctypes when exception was not set during __initsubclass__.

gh-99277: Remove older version of _SSLProtocolTransport.get_write_buffer_limits in asyncio.sslproto

gh-99248: fix negative numbers failing in verify()

gh-99155: Fix statistics.NormalDist pickle with 0 and 1 protocols.

gh-93464: enum.auto() is now correctly activated when combined with other assignment values. E.g. ONE = auto(), 'some text' will now evaluate as (1, 'some text').

gh-99134: Update the bundled copy of pip to version 22.3.1.

gh-83004: Clean up refleak on failed module initialisation in _zoneinfo

gh-83004: Clean up refleaks on failed module initialisation in in _pickle

gh-83004: Clean up refleak on failed module initialisation in _io.

gh-98897: Fix memory leak in math.dist() when both points don窶冲 have the same dimension. Patch by Kumar Aditya.

gh-98706: [3.11] Applied changes from importlib_metadata 4.11.4 through 4.13, including compatibility and robustness fixes for Distribution objects without _normalized_name, disallowing invalid inputs to Distribution.from_name, and refined behaviors in PathDistribution._name_from_stem and PathDistribution._normalized_name.

gh-98793: Fix argument typechecks in _overlapped.WSAConnect() and _overlapped.Overlapped.WSASendTo() functions.

gh-98744: Prevent crashing in traceback when retrieving the byte-offset for some source files that contain certain unicode characters.

gh-98740: Fix internal error in the re module which in very rare circumstances prevented compilation of a regular expression containing a conditional expression without the 窶彳lse窶� branch.

gh-98703: Fix asyncio.StreamWriter.drain() to call protocol.connection_lost callback only once on Windows.

gh-98624: Add a mutex to unittest.mock.NonCallableMock to protect concurrent access to mock attributes.

gh-89237: Fix hang on Windows in subprocess.wait_closed() in asyncio with ProactorEventLoop. Patch by Kumar Aditya.

gh-98458: Fix infinite loop in unittest when a self-referencing chained exception is raised

gh-97928: tkinter.Text.count() raises now an exception for options starting with 窶�-窶� instead of silently ignoring them.

gh-97966: On uname_result, restored expectation that _fields and _asdict would include all six properties including processor.

gh-98307: A createSocket() method was added to SysLogHandler.

gh-96035: Fix bug in urllib.parse.urlparse() that causes certain port numbers containing whitespace, underscores, plus and minus signs, or non-ASCII digits to be incorrectly accepted.

gh-98251: Allow venv to pass along PYTHON* variables to ensurepip and pip when they do not impact path resolution

gh-98178: On macOS, fix a crash in syslog.syslog() in multi-threaded applications. On macOS, the libc syslog() function is not thread-safe, so syslog.syslog() no longer releases the GIL to call it. Patch by Victor Stinner.

gh-96151: Allow BUILTINS to be a valid field name for frozen dataclasses.

gh-87730: Wrap network errors consistently in urllib FTP support, so the test suite doesn窶冲 fail when a network is available but the public internet is not reachable.

gh-98086: Make sure patch.dict() can be applied on async functions.

gh-90985: Earlier in 3.11 we deprecated asyncio.Task.cancel("message"). We realized we were too harsh, and have undeprecated it.

gh-97837: Change deprecate warning message in unittest from

It is deprecated to return a value!=None

to

It is deprecated to return a value that is not None from a test case

gh-97825: Fixes AttributeError when subprocess.check_output() is used with argument input=None and either of the arguments encoding or errors are used.

gh-82836: Fix is_private properties in the ipaddress module. Previously non-private networks (0.0.0.0/0) would return True from this method; now they correctly return False.

gh-96827: Avoid spurious tracebacks from asyncio when default executor cleanup is delayed until after the event loop is closed (e.g. as the result of a keyboard interrupt).

gh-97592: Avoid a crash in the C version of asyncio.Future.remove_done_callback() when an evil argument is passed.

gh-97639: Remove tokenize.NL check from tabnanny.

gh-73588: Fix generation of the default name of tkinter.Checkbutton. Previously, checkbuttons in different parent widgets could have the same short name and share the same state if arguments 窶從ame窶� and 窶忻ariable窶� are not specified. Now they are globally unique.

gh-97005: Update bundled libexpat to 2.4.9

gh-85760: Fix race condition in asyncio where process_exited() called before the pipe_data_received() leading to inconsistent output. Patch by Kumar Aditya.

gh-96819: Fixed check in multiprocessing.resource_tracker that guarantees that the length of a write to a pipe is not greater than PIPE_BUF.

gh-96741: Corrected type annotation for dataclass attribute pstats.FunctionProfile.ncalls to be str.

gh-95987: Fix repr of Any subclasses.

gh-96388: Work around missing socket functions in socket窶冱 __repr__.

gh-96073: In inspect, fix overeager replacement of 窶徼yping.窶� in formatting annotations.

gh-96192: Fix handling of bytes path-like objects in os.ismount().

gh-96052: Fix handling compiler warnings (SyntaxWarning and DeprecationWarning) in codeop.compile_command() when checking for incomplete input. Previously it emitted warnings and raised a SyntaxError. Now it always returns None for incomplete input without emitting any warnings.

gh-88863: To avoid apparent memory leaks when asyncio.open_connection() raises, break reference cycles generated by local exception and future instances (which has exception instance as its member var). Patch by Dong Uk, Kang.

gh-91212: Fixed flickering of the turtle window when the tracer is turned off. Patch by Shin-myoung-serp.

gh-88050: Fix asyncio subprocess transport to kill process cleanly when process is blocked and avoid RuntimeError when loop is closed. Patch by Kumar Aditya.

gh-93858: Prevent error when activating venv in nested fish instances.

gh-91078: TarFile.next() now returns None when called on an empty tarfile.

bpo-47220: Document the optional callback parameter of WeakMethod. Patch by Gﾃｩry Ogam.

bpo-46364: Restrict use of sockets instead of pipes for stdin of subprocesses created by asyncio to AIX platform only.

bpo-38523: shutil.copytree() now applies the ignore_dangling_symlinks argument recursively.

bpo-36267: Fix IndexError in argparse.ArgumentParser when a store_true action is given an explicit argument.

Documentation

gh-92892: Document that calling variadic functions with ctypes requires special care on macOS/arm64 (and possibly other platforms).
gh-85525: Remove extra row
gh-95588: Clarified the conflicting advice given in the ast documentation about ast.literal_eval() being 窶徭afe窶� for use on untrusted input while at the same time warning that it can crash the process. The latter statement is true and is deemed unfixable without a large amount of work unsuitable for a bugfix. So we keep the warning and no longer claim that literal_eval is safe.
bpo-41825: Restructured the documentation for the os.wait* family of functions, and improved the docs for os.waitid() with more explanation of the possible argument constants.

Tests

gh-99892: Skip test_normalization() of test_unicodedata if it fails to download NormalizationTest.txt file from pythontest.net. Patch by Victor Stinner.
gh-99934: Correct test_marsh on (32 bit) x86: test_deterministic sets was failing.
gh-99659: Optional big memory tests in test_sqlite3 now catch the correct sqlite.DataError exception type in case of too large strings and/or blobs passed.
gh-98713: Fix a bug in the typing tests where a test relying on CPython-specific implementation details was not decorated with @cpython_only and was not skipped on other implementations.
gh-87390: Add tests for star-unpacking with PEP 646, and some other miscellaneous PEP 646 tests.
gh-96853: Added explicit coverage of Py_Initialize (and hence Py_InitializeEx) back to the embedding tests (all other embedding tests migrated to Py_InitializeFromConfig in Python 3.11)
bpo-34272: Some C API tests were moved into the new Lib/test/test_capi/ directory.

Build

gh-99086: Fix -Wimplicit-int, -Wstrict-prototypes, and -Wimplicit-function-declaration compiler warnings in configure checks.
gh-99337: Fix a compilation issue with GCC 12 on macOS.
gh-99086: Fix -Wimplicit-int compiler warning in configure check for PTHREAD_SCOPE_SYSTEM.
gh-98872: Fix a possible fd leak in Programs/_freeze_module.c introduced in Python 3.11.
gh-99016: Fix build with PYTHON_FOR_REGEN=python3.8.
gh-97731: Specify the full path to the source location for make docclean (needed for cross-builds).
gh-98707: Don窶冲 use vendored libmpdec headers if --with-system-libmpdec is passed to configure. Don窶冲 use vendored libexpat headers if --with-system-expat is passed to !configure.
gh-96761: Fix the build process of clang compiler for _bootstrap_python if LTO optimization is applied. Patch by Matthias Gﾃｶrgens and Dong-hee Na.
gh-96883: wasm32-emscripten builds for browsers now include concurrent.futures for asyncio and unittest.mock.
gh-84461: wasm32-emscripten platform no longer builds resource module, getresuid(), getresgid(), and their setters. The APIs are stubs and not functional.
gh-94280: Updated pegen regeneration script on Windows to find and use Python 3.9 or higher. Prior to this, pegen regeneration already required 3.9 or higher, but the script may have used lower versions of Python.

Windows

gh-99345: Use faster initialization functions to detect install location for Windows Store package
gh-98629: Fix initialization of sys.version and sys._git on Windows
gh-99442: Fix handling in Python Launcher for Windows when argv[0] does not include a file extension.
gh-98689: Update Windows builds to zlib v1.2.13. v1.2.12 has CVE-2022-37434, but the vulnerable inflateGetHeader API is not used by Python.
gh-98790: Assumes that a missing DLLs directory means that standard extension modules are in the executable窶冱 directory.
gh-98745: Update py.exe launcher to install 3.11 by default and 3.12 on request.
gh-98692: Fix the Python Launcher for Windows ignoring unrecognized shebang lines instead of treating them as local paths
gh-94328: Update Windows installer to use SQLite 3.39.4.
gh-97728: Fix possible crashes caused by the use of uninitialized variables when pass invalid arguments in os.system() on Windows and in Windows-specific modules (like winreg).
gh-96965: Update libffi to 3.4.3
gh-94781: Fix pcbuild.proj to clean previous instances of ouput files in Python\deepfreeze and Python\frozen_modules directories on Windows. Patch by Charlie Zhao.
bpo-40882: Fix a memory leak in multiprocessing.shared_memory.SharedMemory on Windows.

macOS

gh-87235: On macOS python3 /dev/fd/9 9</path/to/script.py failed for any script longer than a couple of bytes.
gh-98940: Fix Mac/Extras.install.py file filter bug.
gh-94328: Update macOS installer to SQLite 3.39.4.

IDLE

gh-97527: Fix a bug in the previous bugfix that caused IDLE to not start when run with 3.10.8, 3.12.0a1, and at least Microsoft Python 3.10.2288.0 installed without the Lib/test package. 3.11.0 was never affected.

Tools/Demos

gh-95853: The wasm_build.py script now pre-builds Emscripten ports, checks for broken EMSDK versions, and warns about pkg-config env vars.
gh-95853: The new tool Tools/wasm/wasm_builder.py automates configure, compile, and test steps for building CPython on WebAssembly platforms.
gh-95731: Fix handling of module docstrings in Tools/i18n/pygettext.py.

C API

gh-98680: PyBUF_* constants were marked as part of Limited API of Python 3.11+. These were available in 3.11.0 with Py_LIMITED_API defined for 3.11, and are necessary to use the buffer API.
gh-98978: Fix use-after-free in Py_SetPythonHome(NULL), Py_SetProgramName(NULL) and _Py_SetProgramFullPath(NULL) function calls. Issue reported by Benedikt Reinartz. Patch by Victor Stinner.
gh-96853: Py_InitializeEx now correctly calls PyConfig_Clear after initializing the interpreter (the omission didn窶冲 cause a memory leak only because none of the dynamically allocated config fields are populated by the wrapper function)

(adam)

python310 py310-html-docs: updated to 3.10.9

Python 3.10.9 final

Security

gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log.

This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing.

gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module

gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name.

gh-98739: Update bundled libexpat to 2.5.0

gh-98517: Port XKCP���s fix for the buffer overflows in SHA-3 (CVE-2022-37454).

gh-97514: On Linux the multiprocessing module returns to using filesystem backed unix domain sockets for communication with the forkserver process instead of the Linux abstract socket namespace. Only code that chooses to use the ���forkserver��� start method is affected.

Abstract sockets have no permissions and could allow any user on the system in the same network namespace (often the whole system) to inject code into the multiprocessing forkserver process. This was a potential privilege escalation. Filesystem based socket permissions restrict this to the forkserver process user as was the default in Python 3.8 and earlier.

This prevents Linux CVE-2022-42919.

Core and Builtins

gh-99578: Fix a reference bug in _imp.create_builtin() after the creation of the first sub-interpreter for modules builtins and sys. Patch by Victor Stinner.
gh-99581: Fixed a bug that was causing a buffer overflow if the tokenizer copies a line missing the newline caracter from a file that is as long as the available tokenizer buffer. Patch by Pablo galindo
gh-96055: Update faulthandler to emit an error message with the proper unexpected signal number. Patch by Dong-hee Na.
gh-98852: Fix subscription of types.GenericAlias instances containing bare generic types: for example tuple[A, T][int], where A is a generic type, and T is a type variable.
gh-98415: Fix detection of MAC addresses for uuid on certain OSs. Patch by Chaim Sanders
gh-92119: Print exception class name instead of its string representation when raising errors from ctypes calls.
gh-93696: Allow pdb to locate source for frozen modules in the standard library.
bpo-31718: Raise ValueError instead of SystemError when methods of uninitialized io.IncrementalNewlineDecoder objects are called. Patch by Oren Milman.
bpo-38031: Fix a possible assertion failure in io.FileIO when the opener returns an invalid file descriptor.

Library

gh-100001: Also escape s in the http.server BaseHTTPRequestHandler.log_message so that it is technically possible to parse the line and reconstruct what the original data was. Without this a xHH is ambiguious as to if it is a hex replacement we put in or the characters r���x��� came through in the original request line.
gh-93453: asyncio.get_event_loop() now only emits a deprecation warning when a new event loop was created implicitly. It no longer emits a deprecation warning if the current event loop was set.
gh-51524: Fix bug when calling trace.CoverageResults with valid infile.
gh-99645: Fix a bug in handling class cleanups in unittest.TestCase. Now addClassCleanup() uses separate lists for different TestCase subclasses, and doClassCleanups() only cleans up the particular class.
gh-97001: Release the GIL when calling termios APIs to avoid blocking threads.
gh-99341: Fix ast.increment_lineno() to also cover ast.TypeIgnore when changing line numbers.
gh-74044: Fixed bug where inspect.signature() reported incorrect arguments for decorated methods.
gh-99275: Fix SystemError in ctypes when exception was not set during __initsubclass__.
gh-99155: Fix statistics.NormalDist pickle with 0 and 1 protocols.
gh-99134: Update the bundled copy of pip to version 22.3.1.
gh-99130: Apply bugfixes from importlib_metadata 4.11.4, namely: In PathDistribution._name_from_stem, avoid including parts of the extension in the result. In PathDistribution._normalized_name, ensure names loaded from the stem of the filename are also normalized, ensuring duplicate entry points by packages varying only by non-normalized name are hidden.
gh-83004: Clean up refleak on failed module initialisation in _zoneinfo
gh-83004: Clean up refleaks on failed module initialisation in in _pickle
gh-83004: Clean up refleak on failed module initialisation in _io.
gh-98897: Fix memory leak in math.dist() when both points don���t have the same dimension. Patch by Kumar Aditya.
gh-98793: Fix argument typechecks in _overlapped.WSAConnect() and _overlapped.Overlapped.WSASendTo() functions.
gh-98740: Fix internal error in the re module which in very rare circumstances prevented compilation of a regular expression containing a conditional expression without the ���else��� branch.
gh-98703: Fix asyncio.StreamWriter.drain() to call protocol.connection_lost callback only once on Windows.
gh-98624: Add a mutex to unittest.mock.NonCallableMock to protect concurrent access to mock attributes.
gh-89237: Fix hang on Windows in subprocess.wait_closed() in asyncio with ProactorEventLoop. Patch by Kumar Aditya.
gh-98458: Fix infinite loop in unittest when a self-referencing chained exception is raised
gh-97928: tkinter.Text.count() raises now an exception for options starting with ���-��� instead of silently ignoring them.
gh-97966: On uname_result, restored expectation that _fields and _asdict would include all six properties including processor.
gh-98331: Update the bundled copies of pip and setuptools to versions 22.3 and 65.5.0 respectively.
gh-96035: Fix bug in urllib.parse.urlparse() that causes certain port numbers containing whitespace, underscores, plus and minus signs, or non-ASCII digits to be incorrectly accepted.
gh-98251: Allow venv to pass along PYTHON* variables to ensurepip and pip when they do not impact path resolution
gh-98178: On macOS, fix a crash in syslog.syslog() in multi-threaded applications. On macOS, the libc syslog() function is not thread-safe, so syslog.syslog() no longer releases the GIL to call it. Patch by Victor Stinner.
gh-96151: Allow BUILTINS to be a valid field name for frozen dataclasses.
gh-98086: Make sure patch.dict() can be applied on async functions.
gh-88863: To avoid apparent memory leaks when asyncio.open_connection() raises, break reference cycles generated by local exception and future instances (which has exception instance as its member var). Patch by Dong Uk, Kang.
gh-93858: Prevent error when activating venv in nested fish instances.
bpo-46364: Restrict use of sockets instead of pipes for stdin of subprocesses created by asyncio to AIX platform only.
bpo-38523: shutil.copytree() now applies the ignore_dangling_symlinks argument recursively.
bpo-36267: Fix IndexError in argparse.ArgumentParser when a store_true action is given an explicit argument.

Documentation

gh-92892: Document that calling variadic functions with ctypes requires special care on macOS/arm64 (and possibly other platforms).

Tests

gh-99892: Skip test_normalization() of test_unicodedata if it fails to download NormalizationTest.txt file from pythontest.net. Patch by Victor Stinner.
bpo-34272: Some C API tests were moved into the new Lib/test/test_capi/ directory.

Build

gh-99086: Fix -Wimplicit-int, -Wstrict-prototypes, and -Wimplicit-function-declaration compiler warnings in configure checks.
gh-99086: Fix -Wimplicit-int compiler warning in configure check for PTHREAD_SCOPE_SYSTEM.
gh-97731: Specify the full path to the source location for make docclean (needed for cross-builds).
gh-98671: Fix NO_MISALIGNED_ACCESSES being not defined for the SHA3 extension when HAVE_ALIGNED_REQUIRED is set. Allowing builds on hardware that unaligned memory accesses are not allowed.

Windows

gh-99345: Use faster initialization functions to detect install location for Windows Store package
gh-98689: Update Windows builds to zlib v1.2.13. v1.2.12 has CVE-2022-37434, but the vulnerable inflateGetHeader API is not used by Python.
gh-94328: Update Windows installer to use SQLite 3.39.4.
bpo-40882: Fix a memory leak in multiprocessing.shared_memory.SharedMemory on Windows.

macOS

gh-94328: Update macOS installer to SQLite 3.39.4.

IDLE

gh-97527: Fix a bug in the previous bugfix that caused IDLE to not start when run with 3.10.8, 3.12.0a1, and at least Microsoft Python 3.10.2288.0 installed without the Lib/test package. 3.11.0 was never affected.

Tools/Demos

gh-95731: Fix handling of module docstrings in Tools/i18n/pygettext.py.

(adam)

python39 py39-html-docs: updated to 3.9.16

Python 3.9.16 final

Security
gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log.

This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing.
gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module
gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name.
gh-98739: Update bundled libexpat to 2.5.0
gh-98517: Port XKCP窶冱 fix for the buffer overflows in SHA-3 (CVE-2022-37454).
gh-97514: On Linux the multiprocessing module returns to using filesystem backed unix domain sockets for communication with the forkserver process instead of the Linux abstract socket namespace. Only code that chooses to use the 窶彷orkserver窶� start method is affected.

Abstract sockets have no permissions and could allow any user on the system in the same network namespace (often the whole system) to inject code into the multiprocessing forkserver process. This was a potential privilege escalation. Filesystem based socket permissions restrict this to the forkserver process user as was the default in Python 3.8 and earlier.

This prevents Linux CVE-2022-42919.
gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed).

(adam)

python38 py38-html-docs: updated to 3.8.16

Python 3.8.16 final

Security
gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log.

This is done by changing the http.server BaseHTTPRequestHandler .log_message method to replace control characters with a \xHH hex escape before printing.
gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module
gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name.
gh-98739: Update bundled libexpat to 2.5.0
gh-98517: Port XKCP窶冱 fix for the buffer overflows in SHA-3 (CVE-2022-37454).
gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed).

(adam)

libcxx: Fix build on SunOS.

(jperkin)

Updated devel/py-prompt_toolkit, devel/py-hatch-vcs

(adam)

py-hatch-vcs: updated to 0.2.1

0.2.1
Fixed:
- Allow `root` in `raw-options`

(adam)

py-prompt_toolkit: updated to 3.0.36

3.0.36: 2022-12-06
------------------
Fixes:
- Another Python 3.6 fix for a bug that was introduced in 3.0.34.

3.0.35: 2022-12-06
------------------
Fixes:
- Fix bug introduced in 3.0.34 for Python 3.6. Use asynccontextmanager
  implementation from prompt_toolkit itself.

3.0.34: 2022-12-06
------------------
Fixes:
- Improve completion performance in various places.
- Improve renderer performance.
- Handle `KeyboardInterrupt` when the stacktrace of an unhandled error is
  displayed.
- Use correct event loop in `Application.create_background_task()`.
- Fix `show_cursor` attribute in `ScrollablePane`.

(adam)

Updated net/dnsmasq, graphics/graphviz

(adam)

graphviz: updated to 7.0.4

7.0.4

Fixed

- The `alt` attributes are once again set in the cmap output. This was a
regression in Graphviz 7.0.2, that intentionally removed these but did not
account for the W3C specification making these attributes required when the
`href` attribute is set.
- Building Graphviz from source using the Autotools build system in now possible
on NetBSD.
- The ortho library now allocates trapezoid structures on-demand, removing the
���Trapezoid-table overflow��� error that previously occurred when its upfront
estimation was exceeded.

7.0.3

Changed

* Support for the Intel C Compiler in the Autotools build system has been
removed.
* Fallback typedefs for `ssize_t` have been removed from the CMake build system.

(adam)

x11/xidle: define _OPENBSD_SOURCE on NetBSD to declare strtonum().

In addition:
* Switch distfile hosting from SDF.org to ftp.netbsd.org.
* Replace MAKEFLAGS with MAKE_FLAGS.

(vins)

xymon: Use pkgsrc/system c-ares instead of bundled.

Fixes build on systems that happen to put link libraries in LDFLAGS due to
incredibly strict configure script.  Bump PKGREVISION.

(jperkin)

dnsmasq: updated to 2.88

version 2.88

Fix bug in --dynamic-host when an interface has /16 IPv4
address. Thanks to Mark Dietzer for spotting this.

Add --fast-dns-retry option. This gives dnsmasq the ability
to originate retries for upstream DNS queries itself, rather
than relying on the downstream client. This is most useful
when doing DNSSEC over unreliable upstream networks. It comes
with some cost in memory usage and network bandwidth.

Add --use-stale-cache option. When set, if a DNS name exists
in the cache, but its time-to-live has expired, dnsmasq will
return the data anyway. (It attempts to refresh the
data with an upstream query after returning the stale data.)
This can improve speed and reliability. It comes
at the expense of sometimes returning out-of-date data and
less efficient cache utilisation, since old data cannot be
flushed when its TTL expires, so the cache becomes
strictly least-recently-used.

Make --hostsdir (but NOT --dhcp-hostsdir and --dhcp-optsdir)
handle removal of whole files or entries within files.
Thanks to Dominik Derigs for the initial patches for this.

Fix bug, introduced in 2.87, which could result in DNS
servers being removed from the configuration when reloading
server configuration from DBus, or re-reading /etc/resolv.conf
Only servers from the same source should be replaced, but some
servers from other sources (i.e., hard coded or another dynamic source)
could mysteriously disappear. Thanks to all reporting this,
but especially Christopher J. Madsen who reduced the problem
to an easily reproducible case which saved much labour in
finding it.

Add --no-round-robin option.

Allow domain names as well as IP addresses when specifying
upstream DNS servers. There are some gotchas associated with this
(it will mysteriously fail to work if the dnsmasq instance
being started is in the path from the system resolver to the DNS),
and a seemingly sensible configuration like
--server=domain.name@1.2.3.4 is unactionable if domain.name
only resolves to an IPv6 address). There are, however,
cases where is can be useful. Thanks to Dominik Derigs for
the patch.

Handle DS records for unsupported crypto algorithms correctly.
Such a DS, as long as it is validated, should allow answers
in the domain it attests to be returned as unvalidated, and not
as a validation error.

Optimise reading large numbers of --server options. When re-reading
upstream servers from /etc/resolv.conf or other sources that
can change dnsmasq tries to avoid memory fragmentation by re-using
existing records that are being re-read unchanged. This involves
seaching all the server records for each new one installed.
During startup this search is pointless, and can cause long
start times with thousands of --server options because the work
needed is O(n^2). Handle this case more intelligently.
Thanks to Ye Zhou for spotting the problem and an initial patch.

If we detect that a DNS reply from upstream is malformed don't
return it to the requestor; send a SEVFAIL rcode instead.

(adam)

Updated graphics/png, graphics/jpegoptim

(adam)

jpegoptim: updated to 1.5.0

v1.5.0
Parallel processing support added. Use option -w max or --workers=max to enable.
Fix --stdin option
Other minor fixes

(adam)

png: updated to 1.6.39

libpng 1.6.39, is a maintenance release with various fixes and improvements, including a change to signal large PNG chunks as benign errors rather than hard errors.

(adam)

net/tut: Also install sample themes.

(vins)

doc: Added x11/xlax version 2.4

(vins)

Add xlax to x11/Makefile.

(vins)

x11/xlax: import package from wip.

xlax is an X11 input multiplexer: keyboard input can be set from a xlax
instance to a group of windows simultaneously.
It allows the user to assign a custom string to each window (e.g. a
hostname) that can be sent with a button click.

An included script handles starting up and arranging windows, and
permits to define commonly used window groupings in a config file.

(vins)

Added devel/ccache3; Updated devel/pcre2

(adam)

pcre2: updated to 2.10.41

PCRE2-10.41
Mainly bug fixes and tidies; pcre2grep has been made more like GNU grep for multiple patterns that match more than once on a line.

(adam)

doc: Updated time/py-vdirsyncer to 0.19.0

(wiz)

py-vdirsyncer: update to 0.19.0.

Version 0.19.0
==============

- Add "shell" password fetch strategy to pass command string to a shell.
- Add "description" and "order" as metadata.  These fetch the CalDAV:
  calendar-description, ``CardDAV:addressbook-description`` and
  ``apple-ns:calendar-order`` properties respectively.
- Add a new ``showconfig`` status. This prints *some* configuration values as
  JSON. This is intended to be used by external tools and helpers that interact
  with ``vdirsyncer``, and considered experimental.
- Update TLS-related tests that were failing due to weak MDs. :gh:`903`
- ``pytest-httpserver`` and ``trustme`` are now required for tests.
- ``pytest-localserver`` is no longer required for tests.
- Multithreaded support has been dropped. The ``"--max-workers`` has been removed.
- A new ``asyncio`` backend is now used. So far, this shows substantial speed
  improvements in ``discovery`` and ``metasync``, but little change in `sync`.
  This will likely continue improving over time. :gh:`906`
- The ``google`` storage types no longer require ``requests-oauthlib``, but
  require ``python-aiohttp-oauthlib`` instead.
- Vdirsyncer no longer includes experimental support for `EteSync
  <https://www.etesync.com/>`_. The existing integration had not been supported
  for a long time and no longer worked. Support for external storages may be
  added if anyone is interested in maintaining an EteSync plugin. EteSync
  users should consider using `etesync-dav`_.
- The ``plist`` for macOS has been dropped. It was broken and homebrew
  generates their own based on package metadata. macOS users are encouraged to
  use that as a reference.

.. _etesync-dav: https://github.com/etesync/etesync-dav

Changes to SSL configuration
----------------------------

Support for ``md5`` and ``sha1`` certificate fingerprints has been dropped. If
you're validating certificate fingerprints, use ``sha256`` instead.

When using a custom ``verify_fingerprint``, CA validation is always disabled.

If ``verify_fingerprint`` is unset, CA verification is always active. Disabling
both features is insecure and no longer supported.

The ``verify`` parameter no longer takes boolean values, it is now optional and
only takes a string to a custom CA for verification.

The ``verify`` and ``verify_fingerprint`` will likely be merged into a single
parameter in future.

(wiz)

ccache3: resurrected version 3 of ccache

(adam)

doc: Added devel/py-test-httpserver version 1.0.6

(wiz)

devel/Makefile: + py-test-httpserver

(wiz)

devel/py-test-httpserver: import py-test-httpserver-1.0.6

This library is designed to help to test http clients without
contacting the real http server. In other words, it is a fake http
server which is accessible via localhost can be started with the
pre-defined expected http requests and their responses.

(wiz)

doc: Updated www/py-aiohttp to 3.8.3nb1

(wiz)

py-aiohttp: unrestrict charset-normalizer dependency

pkgsrc has a newer version

Bump PKGREVISION.

Fix pkglint while here.

(wiz)

doc: Added devel/py-aiostream version 0.4.5

(wiz)

devel/Makefile: + py-aiostream

(wiz)

devel/py-aiostream: import py310-aiostream-0.4.5

aiostream provides a collection of stream operators that can be
combined to create asynchronous pipelines of operations.

It can be seen as an asynchronous version of itertools, although
some aspects are slightly different. Essentially, all the provided
operators return a unified interface called a stream. A stream is
an enhanced asynchronous iterable providing the following features:

* Operator pipe-lining - using pipe symbol |
* Repeatability - every iteration creates a different iterator
* Safe iteration context - using async with and the stream method
* Simplified execution - get the last element from a stream using await
* Slicing and indexing - using square brackets []
* Concatenation - using addition symbol +

(wiz)

doc: Updated audio/musicpd to 0.23.11

(wiz)

musicpd: update to 0.23.11.

ver 0.23.11 (2022/11/28)
* database
  - simple: move default database to ~/.cache/mpd/db from ~/.cache/mpd.db
  - simple: default "cache_directory" to ~/.cache/mpd/mounts
* macOS: fix build failure "no archive members specified"
* Windows
  - fix crash bug (stack buffer overflow) after I/O errors
  - fix path traversal bug because backslash was allowed in playlist names
* Android/Windows
  - update OpenSSL to 3.0.7
  - re-enable CURL's verbose error strings

(wiz)

graphics/ximaging: Reset maintainer to reflect changed mail address.

(vins)

doc: Updated multimedia/libbluray to 1.3.4

(wiz)

libbluray: update to 1.3.4.

2022-11-25: Version 1.3.4
- Improve API documentation.
- Improve JVM probing.
- Improve support for FreeBSD and Solaris.
- Improve .jar file search.
- Add configure option to build without external libudfread.

(wiz)

doc: Updated devel/gtexinfo to 7.0.1

(wiz)

gtexinfo: update to 7.0.1.

7.0.1 (30 November 2022)
This is a bug-fix release with minimal changes.

* texi2any
  . avoid crashes on empty @image argument and other potential crashes
    (with "Can't use an undefined value as an ARRAY reference" message)
  . avoid hang on @ref command inside section command

* info
  . fix recoding of UTF-8 files to ASCII when run in C locale

* js
  . index search fixed for new HTML output
  . some obsolete files removed from distribution

(wiz)

shells/etsh: Makefile revision.

* Replace the SUBST routine with REPLACE_INTERPRETER.
* Replace MAKEFLAGS with MAKE_FLAGS.
* Corrently set INSTALL_ENV in the post-install target.

(vins)

Updated databases/prometheus

(adam)

prometheus: updated to 2.40.5

2.40.5 / 2022-12-01
[BUGFIX] TSDB: Fix queries involving native histograms due to improper reset of iterators.

2.40.4 / 2022-11-29
[SECURITY] Fix basic authentication bypass vulnerability (CVE-2022-46146).

2.40.3 / 2022-11-23
[BUGFIX] TSDB: Fix compaction after a deletion is called.

2.40.2 / 2022-11-16
[BUGFIX] UI: Fix black-on-black metric name color in dark mode.

2.40.1 / 2022-11-09
[BUGFIX] TSDB: Fix alignment for atomic int64 for 32 bit architecture.
[BUGFIX] Scrape: Fix accept headers.

2.40.0 / 2022-11-08
This release introduces an experimental, native way of representing and storing histograms.

It can be enabled in Prometheus via --enable-feature=native-histograms to accept native histograms.
Enabling native histograms will also switch the preferred exposition format to protobuf.

To instrument your application with native histograms, use the v1.14.0 or later of client_golang and set the NativeHistogramBucketFactor in your HistogramOpts (1.1 is a good starting point).
Your existing histograms won't switch to native histograms until NativeHistogramBucketFactor is set.

[FEATURE] Add experimental support for native histograms. Enable with the flag --enable-feature=native-histograms.
[FEATURE] SD: Add service discovery for OVHcloud.
[ENHANCEMENT] Kubernetes SD: Use protobuf encoding.
[ENHANCEMENT] TSDB: Use golang.org/x/exp/slices for improved sorting speed.
[ENHANCEMENT] Consul SD: Add enterprise admin partitions. Adds __meta_consul_partition label. Adds partition config in consul_sd_config.
[BUGFIX] API: Fix API error codes for /api/v1/labels and /api/v1/series.

(adam)

ccache: update compiler requirements

(adam)

README.Cygwin: if using git, make sure to checkout with Unix line endings.

(schmonz)

doc: Added x11/xcursor-core-hr version 20220127

(vins)

Add xcursor-core-hr to x11/Makefile.

(vins)

x11/xcursor: import package from wip.

This Xcursor theme contains 24 and 32 pixel pointer sets built upon the
look of X11 core cursors. These should work well with screens around 100
to 150 DPI.

(vins)

Reset maintainer for my packages to reflect new mail address.

(vins)

doc: Added misc/plan9port version 20220912

(vins)

Add plan9port to misc/Makefile.

(vins)

mk: Use gcc12 for gfortran on Darwin/aarch64.

(jperkin)

misc/plan9port: import package from wip.

Plan 9 from User Space (aka plan9port) is a port of many Plan 9
programs from their native Plan 9 environment to Unix-like operating
systems.

(vins)

gcc12: Support Darwin/aarch64.

(jperkin)

Add print/poppler-qt6 version 22.10.0 to pkgsrc-current

This is the QT6 wrapper for poppler, a PDF rendering library. It
is a fork of the xpdf 3.0 PDF viewer developed by Derek Noonburg
of Glyph and Cog, LLC.

Poppler provides PDF rendering functionality as a shared library,
to centralize the maintenence effort and to reduce duplicated
effort. And the poppler developers would like to move libpoppler
forward in a number of areas that doesn't fit within the goals of
xpdf.

(nros)

doc: Updated lang/rakudo to 2022.12

(mef)

(lang/rakudo) Updated 2022.06 to 2022.12

New in 2022.12:

+ Improvements:
    + Improve flow of calling set-env.sh from a script [57337212]
    + Make the "needle (elem) list" message more clear [958537b1]
    + Make X::TypeCheck::Assignment message better [05d60e21]
    + Simplify X::TypeCheck::Assignment for containers [1e30b43c]

+ Additions:
    + Allow for --no-foo as alternative to --/foo when
      %SUB-MAIN-OPTS<allow-no> is set [61617b12]
    + Allow for -j2 as an alternative to --j=2 when
      %SUB-MAIN-OPTS<numeric-suffix-as-value> [388924d6]
    + Allow for .skip(produce,skip,produce,skip,...) in 6.e [2a1ace84]
    + Introduce "nano" term in 6.e [10feda11][feb97323]
    + Add IO::Path.created returning the Instant a path was created [dbf035d8]
    + Introduce // as a definedness prefix operator in 6.e [d05f7eed]
    + Add method Any.snitch in 6.e [10066021]
    + Introduce Dateish.days-in-year method [3d181c89][4d43bbf9][67513cb8]
    + Add rotor-like capability to Str.comb in 6.e [84abeb52]
    + Make sure Type.are also works [983cf3ec]
    + Implement IO::Path.chown and chown() [1e02f566]

+ Efficiency:
    + Add a lot of uint candidates for a lot of ops [47f9b286]
    + Add proper support for uint comparisons [25c76aed]

+ Fixes:
    + Make List:D.iterator a multi so that List:U.iterator works [5ad2c0c6]
    + Add missing Allomorph.words method [59a34853]
    + Revert "Add CUR::Staging.candidates method" to fix issue with
      precompiling modules for packaging [9360c650][6937da17][454752e3]
    + Implement nominalizable transparency for definites [71de2232][c915b07c]
    + Make World's `is_type` method more reliable [13f7416c]
    + Don't blindly make a Version object for vN [7ddb90ce]
    + Add missing $obj? to Perl6::Metamodel::JavaHOW.archetypes [d059921b]
    + Fix role parameterization over generics [94f3028e]
    + Get job done well for coercive nominalizeables [9e18b391]
    + Make generics work with return type in signature [a3021944][47c35cab]
      [4cdb5585]
    + Make (1,2,3,4,1,2).QuantHash>>-- work [63d03eb8][d0ec99a8]
    + Report deprecated subs/methods that are hidden-from-backtrace [43a6575b]
    + Feeds require .append to work, not .push [29eadbb2]
    + Make feed error message more comprehensible [2070ceeb]
    + Fix module installation writing precomp files into the wrong precomp
      store [cc7193d0]
    + Fix NEXT / LEAVE phaser interaction on JVM [ce1af0fa]
    + Fix definite type parameterization [07164fec] [8a7d84c5]
    + Fix a regression introduced by new 'dispatch' path related to
      smartmatch [35b180b8]
    + Make sure that Array.raku doesn't die on a lazy iterator [2037ffba]
    + Make sure .elems don't mention the class [3859d6cb]
    + Fix smartmatch in EVAL regression [0a9e2014][2702b001]
    + Avoid loss in precision on FatRat .Str conversion [441e71a5]
    + Revert "Simplify setting up standard handles" to fix seemingly
      unrelated issue with IO::Notifications not working [64f552f3]

+ Removals:
    + Remove nqp::p6client* ops [126aa804]

+ Internal:
    + Tune Java in response to nqp's (de)serialization rewrite [018e549b]
      [5a57f84e][18122e02][a78033f1]
    + Reuse $v-how instead of calling HOW again [191964c5]
    + Change internal API of RI:Snip [feb04dbe]
    + Move the iterator logic of Str.comb(N) to RI::Ngrams [e826dbdc][d12461b0]
    + Actions: Avoid repeated $<sym> eq 'S' [bc3b5824]

New in 2022.07:

+ Changes:
    + Re-imagine DateTime.new(Str) / Str.DateTime [aa462b41]
    + Make sort() a runtime error [0c9169dc]
    + Implement coercion via new-disp and re-consider return typechecking
      dispatcher [7774c331][4ab61720][efd610cb][b4a26fbe][3e45f709][6c3cb859]
      [f448ac47][a9606b29]
    + Make Iterable.hyper|race take Any as a default for :batch and :degree
      [d73d035e]

+ Additions:
    + Implement fallback support for MRO [1128d5cf][83197e34][9710a85e]
    + Add IO::Path inode, dev, and devtype methods [5c4970c5][599a6362]
      [6dc2f92c]
    + Add sub version of .head / .skip / .tail [af31b1df]
    + Implement Haskell's "span" as "snip" in 6.e [16ccb573]

+ Removals:

+ Efficiency:
    + Add native sub versions for .elems and .end (up to 4x speedup) [4fedb6f0]
    + Make coercions up to 1.6x as fast [5a8aa66b]
    + Add candidates for sub substr(str,int,int) for up to 2.8x speedup
      [09ead96e]

+ Fixes:
    + Fix cases where we try calling methods on BOOTCode [4130846b]
    + Make PostionalBindFailover.iterator die [dd7f3eb9]
    + Fix subclasses of .Date(Time) coercion [1a7b4b1b]
    + Revert relaxation of positional bind failover binding [bb944723]
    + Fix an LTA error message on passing Seq to a List parameter [db13e402]
    + Fix copy-pasto in error message for native unsigned ints [ffdeecd1]
    + Add missing private error handling method in Buf[32a40791]
    + Consider Positional/Associative type parameters in optional defaults
      [7148da1c]
    + Fix a deep recursion issue in return typecheck dispatcher [9fa76ec6]
      [808b0768]
    + Fix a regression where coercing into a role didn't work [0e09a287]
    + Implement lazy 'handles' trait application for methods [6430d41d]
    + Get around a problem where a module duplicates method objects [324adc5a]
    + Fix lone "-" in MAIN handling with :named-anywhere [3d3966b0]
    + Add ACCEPTS method for DateTime [31779f47][621d69e0]
    + Fix some cases of coercion over containerized values [fbe3acd0]
      [02f32d51]
    + Make code object based delegation 6.e feature [c6c8dfee]

+ Internal:
    + Micro-opt on CoercionHOW.typecheck [41e07ab9]
    + Make coercion more easily inlineable [eceea95c]
    + Simplify $has_varname setting [378a89e6]
    + Simplify native value / container check in binder [750487c6]
    + Further simplify native binding check [fc149e22]
    + Streamline native match check [a2f92b2b]
    + Ternearize lexpad binding of natives [f2546b44]

(mef)

doc: Added graphics/ximaging version 1.6

(vins)

Add ximaging to graphics/Makefile.

(vins)

graphics/ximaging: import package from wip.

+Ximaging is a lightweight, multithreaded, open source image viewer for
+FreeBSD, Linux and other Unix like platforms running X11.

(vins)

doc: Added chat/toot version 0.30.1

(vins)

Add toot to chat/Makefile.

(vins)

chat/toot: import package from wip.

toot is a command line and TUI client for interacting with instances
on the distributed social network known as 'the Fediverse' using the
Mastodon.social API.

(vins)

doc: Added sysutils/xosview2 version 2.3.1

(vins)

Add xosview2 to sysutils/Makefile

(vins)

sysutils/xosview2: import package from wip.

xosview2 is the experimental new branch of the xosview system monitor.

xosview is a lightweight program that gathers information from your
operating system and displays it in graphical form. It attempts to show
you in a quick glance an overview of how your system resources are
being utilized.

(vins)

editors/ee: reset maintainer

(vins)

doc: Added editors/ee version 1.5.2

(vins)

oracle-jdk17: Fix EMUL_PLATFORMS.

(jperkin)

oracle-jdk17: Revert OPSYSVARS change.

It doesn't work as intended, appending to WRKSRC rather than setting it.

(jperkin)

Remoive accidentally generated duplicates.

(vins)

doc: Added editors/jupp version 3.1.41

(vins)

editors/ee: import package from wip.

EasyEdit is an easy to use text editor. Intended to be usable with little
or no instruction. Provides a terminal (curses based) interface. Features
pop-up menus. Born in HP-UX, included in FreeBSD.

(vins)

doc: Added editors/jupp version 3.1.41

(vins)

add jupp to editors/Makefile.

(vins)

editors/jupp: import package from wip.

This is the portable version of JOE's Own Editor from the MirBSD
project.
This version has been enhanced by several functions intended for
programmers or other professional users, and includes a lot of bug
fixes.

(vins)

Note update of devel/gdb to 10.1nb5.

(he)

devel/gdb: make this build on NetBSD/macppc.

* Follow up struct member renames in callframe and stackframe.
* Import fixes to ppc-nbsd-tdep.c from our in-tree gdb.
* Fix up sim/ppc/emul_netbsd.c to use the versioned syscall names
  for gettimeofday and getrusage.

Bump PKGREVISION.

(he)

doc: Updated www/unit-python to 1.28.0nb1

(wiz)

unit-python: add Python 3.11 support using upstream patch

Bump PKGREVISION.

(wiz)

Updated net/haproxy, devel/py-pylint

(adam)

py-pylint: updated to 2.15.8

1.5.4

Merge StringMethodChecker with StringFormatChecker. This fixes a bug where disabling all the messages and enabling only a handful of messages from the StringFormatChecker would have resulted in no messages at all.
Don窶冲 apply unneeded-not over sets.

(adam)

haproxy: updated to 2.7.0

2.7.0
- MINOR: ssl: forgotten newline in error messages on ca-file
- BUG/MINOR: ssl: shut the ca-file errors emitted during httpclient init
- DOC: config: provide some configuration hints for "http-reuse"
- DOC: config: refer to section about quoting in the "add_item" converter
- DOC: halog: explain how to use -ac and -ad in the help message
- DOC: config: clarify the fact that SNI should not be used in HTTP scenarios
- DOC: config: mention that a single monitor-uri rule is supported
- DOC: config: explain how default matching method for ACL works
- DOC: config: clarify the fact that "retries" is not just for connections
- BUILD: halog: fix missing double-quote at end of help line
- DOC: config: clarify the -m dir and -m dom pattern matching methods
- MINOR: activity: report uptime in "show activity"
- REORG: activity/cli: move the "show activity" handler to activity.c
- DEV: poll: add support for epoll
- DEV: tcploop: centralize the polling code into wait_for_fd()
- DEV: tcploop: add support for POLLRDHUP when supported
- DEV: tcploop: do not report an error on POLLERR
- DEV: tcploop: add optional support for epoll
- SCRIPTS: announce-release: add a link to the data plane API
- CLEANUP: stick-table: fill alignment holes in the stktable struct
- MINOR: stick-table: store a per-table hash seed and use it
- MINOR: stick-table: show the shard number in each entry's "show table" output
- CLEANUP: ncbuf: remove ncb_blk args by value
- CLEANUP: ncbuf: inline small functions
- CLEANUP: ncbuf: use standard BUG_ON with DEBUG_STRICT
- BUG/MINOR: quic: Endless loop during retransmissions
- MINOR: mux-h2: add the expire task and its expiration date in "show fd"
- BUG/MINOR: peers: always initialize the stksess shard value
- REGTESTS: fix peers-related regtests regarding "show table"
- BUG/MEDIUM: mux-h1: Close client H1C on EOS when there is no output data
- MINOR: stick-table: change the API of the function used to calculate the shard
- CLEANUP: peers: factor out the key len calculation in received updates
- BUG/MINOR: peers: always update the stksess shard number on incoming updates
- CLEANUP: assorted typo fixes in the code and comments
- MINOR: mux-h1: add the expire task and its expiration date in "show fd"
- MINOR: debug: improve error handling on the memstats command parser
- BUILD: quic: allow build with USE_QUIC and USE_OPENSSL_WOLFSSL
- CLEANUP: anon: clarify the help message on "debug dev hash"
- MINOR: debug: relax access restrictions on "debug dev hash" and "memstats"
- SCRIPTS: run-regtests: add a version check
- MINOR: version: mention that it's stable now

(adam)

Updated devel/py-virtualenv, sysutils/py-xattr, textproc/py-ujson, devel/py-types-ujson

(adam)

py-types-ujson: updated to 5.6.0.0

5.6.0.0 (2022-12-02)

Bump ujson to 5.6.*

(adam)

py-ujson: updated to 5.6.0

5.6.0

Added

Update vendored double-conversion to 3.2.1

Fixed

Fix len integer overflow issue

(adam)