From nobody Tue Jun 9 02:23:10 2026 X-Original-To: python@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gZCPX6Wk6z6hBJs; Tue, 09 Jun 2026 02:23:12 +0000 (UTC) (envelope-from matthias.andree@tu-dortmund.de) Received: from unimail.uni-dortmund.de (mx1.hrz.uni-dortmund.de [129.217.128.51]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "unimail.tu-dortmund.de", Issuer "GEANT TLS RSA 1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gZCPW4vzkz3dLc; Tue, 09 Jun 2026 02:23:11 +0000 (UTC) (envelope-from matthias.andree@tu-dortmund.de) Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=pass (policy=none) header.from=tu-dortmund.de; spf=pass (mx1.freebsd.org: domain of matthias.andree@tu-dortmund.de designates 129.217.128.51 as permitted sender) smtp.mailfrom=matthias.andree@tu-dortmund.de Received: from [192.168.33.35] (p54a03d87.dip0.t-ipconnect.de [84.160.61.135]) (authenticated bits=0) by unimail.uni-dortmund.de (8.19.0.1/8.19.0.1) with ESMTPSA id 6592NAJ6016647 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 9 Jun 2026 04:23:10 +0200 (CEST) Message-ID: <7b4a06c3-1117-4b50-821d-a464f8cd2f35@tu-dortmund.de> Date: Tue, 9 Jun 2026 04:23:10 +0200 List-Id: FreeBSD-specific Python issues List-Archive: https://lists.freebsd.org/archives/freebsd-python List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-python@freebsd.org Sender: owner-freebsd-python@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Betterbird (Linux) From: Matthias Andree Subject: Python 3.14/3.15 maintenance on short notice Cc: ports-secteam , Gleb Popov Content-Language: en-US, de-DE, en-GB To: python@FreeBSD.org Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spamd-Result: default: False [-1.21 / 15.00]; NEURAL_HAM_LONG(-0.90)[-0.902]; NEURAL_SPAM_MEDIUM(0.83)[0.833]; DMARC_POLICY_ALLOW(-0.50)[tu-dortmund.de,none]; NEURAL_HAM_SHORT(-0.25)[-0.246]; ONCE_RECEIVED(0.20)[]; RCVD_IN_DNSWL_MED(-0.20)[129.217.128.51:from]; R_SPF_ALLOW(-0.20)[+ip4:129.217.128.0/24]; MIME_GOOD(-0.10)[text/plain]; RWL_MAILSPIKE_GOOD(-0.10)[129.217.128.51:from]; XM_UA_NO_VERSION(0.01)[]; MIME_TRACE(0.00)[0:+]; TO_DN_SOME(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; FROM_HAS_DN(0.00)[]; ASN(0.00)[asn:680, ipnet:129.217.0.0/16, country:DE]; RCVD_VIA_SMTP_AUTH(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MLMMJ_DEST(0.00)[ports-secteam@FreeBSD.org,python@FreeBSD.org]; ARC_NA(0.00)[]; R_DKIM_NA(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_TLS_ALL(0.00)[] X-Spamd-Bar: - X-Rspamd-Queue-Id: 4gZCPW4vzkz3dLc [resend, first didn't reach python@ team because I botched the To: address] Greetings, mat@ assigned my python ports 3.14 and 3.15 and assigned them to you. This wasn't authorized, there is no reason other than bullying, I don't recognize it, isn't in the project's best interest or portmgr@ charter, so this is on core.14@'s agenda. Still the focus is on our ports users, and now CVE-2026-9669 was just out (bzip2 compressor smashes stack when reused after error). I have a fix for the bzip2 stack smasher ready for 3.14 [1] albeit without reference to some VuXML entry, the pending medium CVE available in upstream PRs are not cherry-picked into the port - not sure if upstream will issue an extraordinary 3.14.6 or just pursue usual schedule. 3.15 not yet started to fix the CVE stuff, beta2 just landed, but the upstream pull request is available so we could have it, too. 1. So, until core@ decides on the unhelpful portmgr@ incursions (see below), how do we co-ordinate in the interim to get fixes to ports users quickly, which includes MFH 2026Q2? Proposals? 2. Who's having the VuXML? Please respond within 24h. Speak soon. Matthias [1] https://github.com/mandree/freebsd-ports/commit/5fed4d57a3b786583ad5572f22349998bced1654 P.S. Still you will have noticed I have been working on making Python 3.14 and 3.15b1/b2 smooth rides for our ports users, with swift updates, and arrowd@ already knows that something's cooking with upstream on 3.15 self-test failures, see what's on the burner. Some will trickle down to 3.14, some we should re-test and nudge there.