CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

lang/python3133.13.16

Interpreted object-oriented programming language

Maintainer
python@FreeBSD.org
Packages
python313 3.13.16
Upstream
Higher version available: 3.15.1
CPE
python:python from the port
WWW
https://www.python.org/
Links
cgit · VuXML

Unaddressed (1) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-30876.0published 2026-04-27

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

VuXML only (1) · listed, port not fixed yet

Fixed (8)

VuXML entries whose affected range this version has left.

Commits (16)

Charlie Li (vishwin) · 3.13.16
lang/python313: update to 3.13.16

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-16-final
88b2738e0a
Charlie Li (vishwin)
lang/python313: update to 3.13.15

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-15-final
50cbadb3f8
Charlie Li (vishwin)
lang/python313: update to 3.13.14

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-14-final
2c3d157701
Charlie Li (vishwin)
lang/python3: use textproc/expat2 for pyexpat instead of bundled

...to match lang/python314

Event: Works Must Run
b75df1fb4d
Charlie Li (vishwin)
lang/python313: prevent building JIT with newer CPython

While such combos build successfully outside of ports, a circular
build dependency forms when said newer ports also have JIT enabled.
25d1ba0de0
Piotr Kubaj (pkubaj)
lang/python313: enable LTO on powerpc64le
1449721ffb
Charlie Li (vishwin)
lang/python313: update to 3.13.13

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-13-final
cf5a0fc8e9
Charlie Li (vishwin)
lang/python313: pull in upstream commits addressing webbrowser.open() issue

Security: 9fdad262-2e0f-11f1-88c7-00a098b42aeb
PR: 294246
569e99b1df
Charlie Li (vishwin)
lang/python313: fix pkg-config link logic for suffixed
d4f2b67975
Tijl Coosemans (tijl)
devel/libtextstyle, devel/gettext*: Update to 1.0

devel/gettext-tools: Use external libunistring and libxml2.

lang/python*: Remove dependency on gettext-tools.  It isn't used and
it is gettext-tools that depends on python now.

PR:		293963
Exp-run by:	antoine
d7a065627c
Charlie Li (vishwin)
lang/python313: update to 3.13.12

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-12-final

Security: bfe9adc8-0224-11f1-8790-c5fb948922ad
056eb4a466
Siva Mahadevan (siva)
lang/python3{12,13}: limit parallel .pyc compilation to MAKE_JOBS

This option is available since python312[0]. This fixes
python312 and python313 builds with qemu-user-static
emulating riscv64.

[0] https://github.com/python/cpython/commit/9a7e9f9921804f3f90151ca42703e612697dd430

Approved by:		vishwin (#python), lwhsu (mentor)
Signed-off-by:		Siva Mahadevan <siva@FreeBSD.org>
Sponsored by:		The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D54906
c4faf46ff4
Charlie Li (vishwin)
lang/python313: update to 3.13.11

Changelog: https://docs.python.org/3.13/whatsnew/changelog.html#python-3-13-11-final
61f356631b
Wen Heping (wen)
lang/python313: Update to 3.13.10
6f5cc49fd2
Charlie Li (vishwin)
lang/python313: fix blake2s_impl regen mismatch

The only difference between "stock" and regenerated blake2s_impl.c
is where a variable is declared in py_blake2s_new_impl(). Patch the
stock file to the regenerated version so the regeneration script
does not get called.

Reported by: fluffy, jan[at]glaubitz[dot]org
PR: 274671
e0cbe08148
Charlie Li (vishwin)
lang/python313: add

What's new: https://docs.python.org/3/whatsnew/3.13.html

Most notably, introduce free-threaded mode. As this mode changes
the ABI, the entire distribution lives in a separate hierarchy, and
thus a new child port (lang/python313t) and FLAVOR (py313t) are
introduced.

Co-authored-by: vishwin
PR: 274671
Differential Revision: https://reviews.freebsd.org/D49680
edcf1d7d57