lang/python3143.14.8

lang/python314: update to 3.14.8

Changelog: https://docs.python.org/3.14/whatsnew/changelog.html#python-3-14-8-final

lang/python314: update to 3.14.7

Changelog: https://docs.python.org/3.14/whatsnew/changelog.html#python-3-14-7-final

lang/python314: fix/restore nxb-bin bytecode compile copypasta

_sysconfigdata no longer includes the FreeBSD major version, and
have ${REINPLACE_CMD} operate over all lines in the file.

Reported by: Christian Ullrich
PR: 296040

lang/python314: fix plist

Event: Works Must Run

lang/python314: update to 3.14.6

Changelog: https://docs.python.org/3.14/whatsnew/changelog.html#python-3-14-6-final

While here:
- rebase formatting similar to lang/python313
- expose JIT option (disabled by default)
- allow LibreSSL

PR: 296007
Event: Works Must Run

lang/python3*: give maintainership to the python@ team

Thank you for your past maintainership, but these ports should always be
maintained by a team, not individuals.

lang/python314: Update to 3.14.5

This release swaps out the incremental garbage collector for the
generational one used in 3.13 due to reports of memory pressure.

Backport the post-release upstream fix for:
Heap Buffer Overflow in pyexpat Character Data Buffering #148441
which is believed to be only triggered in rare circumstances.

Changelog: https://www.python.org/downloads/release/python-3145/

PR:		295200
MFH:		2026Q2

lang/python314: enable LTO on powerpc64

Also drop sparc64 conditional.

lang/python314: Fix incomplete mitigation of webbrowser.open()

Cherry-pick fix to resolve
Incomplete mitigation of CVE-2026-4519,
%action expansion for command injection to webbrowser.open()

Obtained from:	GitHub repo
		https://github.com/python/cpython/pull/148516
Security:       CVE-2026-4786
		cf75f572-378a-11f1-a119-e36228bfe7d4

lang/python314: Security update + other fixes

Fix critical use-after-free bug in LZMA/BZ2/ZLib decompressor routines
when reusing decompressor instances after a MemoryError was raised from
one.

While here:

- fix DEBUG build/package (several %%ABI%% were in the wrong place
  in pkg-plist that caused failed installs)
- switch to using system textproc/expat2 library
- issue warnings in pre-test that IPV6, PYMALLOC are required and
  DEBUG also breaks one self-test
- bump PORTREVISION
- drop LTOFULL again and make LTO use =full

References:
https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3
https://www.cve.org/CVERecord?id=CVE-2026-6100
https://github.com/python/cpython/pull/148396

Obtained from:	GitHub repo
		https://github.com/python/cpython/commit/c8d8173c4b06d06902c99ec010ad785a30952880
Security:	CVE-2026-6100
		b8e9f33c-375d-11f1-a119-e36228bfe7d4

lang/python314: Security update to 3.14.4

Add a -flto=full option, which can speed up the port build
in terms of wallclock time at the expense of overall more
CPU time.

Issue a warning that test_ssl will fail from pre-test
if DEBUG is enabled.

Changelog:	https://docs.python.org/release/3.14.4/whatsnew/changelog.html

PR:		294324

Which contains these security fixes:

pyexpat.c: Unbounded C recursion in conv_content_model causes crash
Security:	https://github.com/python/cpython/issues/145986
		/ CVE-2026-4224

Reject control characters in more places in http.cookies.Morsel
Security:	https://github.com/python/cpython/issues/145599
		/ CVE-2026-3644

SourcelessFileLoader does not use io.open_code()
Security:	https://github.com/python/cpython/issues/145506
		/ CVE-2026-2297

Disallow usage of control characters in status, headers and
values for security in Lib/wsgiref/handlers.py
Security:	https://github.com/python/cpython/issues/144370

Reject leading dashes in webbrowser.open()
Security:	https://github.com/python/cpython/issues/143930
		/ 9fdad262-2e0f-11f1-88c7-00a098b42aeb
		/ CVE-2026-4519

Excess Base64 data ignored after padding by default
Security:	https://github.com/python/cpython/issues/145264
		/ CVE-2026-3446

Additional security related PRs from upstream

HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
Obtained from:	https://github.com/python/cpython/pull/148342
Security	https://github.com/python/cpython/issues/146212
		/ CVE-2026-1502

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to
quadratic backtracking
Obtained from:	https://github.com/python/cpython/pull/148287
Security:	https://github.com/python/cpython/issues/146333

devel/libtextstyle, devel/gettext*: Update to 1.0

devel/gettext-tools: Use external libunistring and libxml2.

lang/python*: Remove dependency on gettext-tools.  It isn't used and
it is gettext-tools that depends on python now.

PR:		293963
Exp-run by:	antoine

lang/python314: SECURITY update to v3.14.3

ChangeLog:	https://docs.python.org/release/3.14.3/whatsnew/changelog.html
MFH:		2026Q1 (immediately)

Security fixes:

* gh-144125: BytesGenerator will now refuse to serialize (write) headers
  that are unsafely folded or delimited; see verify_generated_headers.
  (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650).

* gh-143935: Fixed a bug in the folding of comments when flattening an
  email message using a modern email policy. Comments consisting of a
  very long sequence of non-foldable characters could trigger a forced
  line wrap that omitted the required leading space on the continuation
  line, causing the remainder of the comment to be interpreted as a new
  header field. This enabled header injection with carefully crafted
  inputs.

* gh-143925: Reject control characters in data: URL media types.

* gh-143919: Reject control characters in http.cookies.Morsel fields and
  values.

* gh-143916: Reject C0 control characters within wsgiref.headers.Headers
  fields, values, and parameters.

Security:       CVE-2026-0865
Security:       CVE-2026-1299
Security:       bfe9adc8-0224-11f1-8790-c5fb948922ad

lang/python314: limit compileall to MAKE_JOBS_NUMBER

This seems to help with cross-builds (qemu) for RISC-V machines.

Obtained from:		Siva Mahadevan
Differential Revision:	https://reviews.freebsd.org/D55050

lang/python314: Fix cross build with native-xtools

- Python 3.14 does not include the OS version in the name of the
  sysconfigdata file anymore.
- There are at least two commands on a single line that should have
  their /nxb-bin/ prefix removed.

PR:             292222

lang/python314: security update to 3.14.2

https://github.com/python/cpython/issues/142145 CVE-2025-12084
"Remove quadratic behavior in node ID cache clearing"

https://github.com/python/cpython/issues/119451 CVE-2025-13836
"Out-of-memory when reading a HTTP response with large Content-Length"

Announcement:	https://pythoninsider.blogspot.com/2025/12/python-3142-and-31311-are-now-available.html
Changelog:	https://docs.python.org/release/3.14.2/whatsnew/changelog.html
Security:       613d0f9e-d477-11f0-9e85-03ddfea11990
Security:       CVE-2025-12084
Security:       CVE-2025-13836

lang/python314: security update to 3.14.1

Changelog: 	https://docs.python.org/release/3.14.1/whatsnew/changelog.html

Remove empty lines at the end of Makefile(s)

Approved by:	portmgr blanket

lang/python314: split out _sqlite3 again.

to avoid a dependency loop through ICU.

Reported by:    diizzy@

lang/python314: add 'sigstore-verify' target

lang/python314: avoid posix_fallocate test failure

that stems from our posix_fallocate() returning ENOTSUP
in accordance with the Open Group Base Specifications Issue 8.

Patch test to trap that return code on FreeBSD as well (it
was handled for NetBSD already.)

lang/python314: get port ready to ship

claim maintainership on the new port - not doing that with the
previous commit by wen@ to have a clear distinction who contributed
what.

- require archivers/zstd since it's part of the Python standard library:
  https://docs.python.org/3.14/whatsnew/3.14.html#whatsnew314-zstandard

- refresh Makefile.pre.in patch

- skip test_gdb without WITH_DEBUG

  test_gdb has test_pretty_print, which requires debug symbols.
  Skip it if WITH_DEBUG is not defined.

- drop --with-system-ffi configure option, which is no longer supported
  and its behaviour is now the default

- move sqlite3 extension back into port
  because the separate port fails to build
  (mark the external python:-3.13)

PR:		282176

lang/python314: add new port

-----
committer's note by mandree@:
This does not enable the optional free-threaded build.

PR:		282176