Created attachment 269486 [details] upgrade to 3.14.4 == Tests result: FAILURE then FAILURE == 10 slowest tests: - test_compileall: 1 min 55 sec - test.test_multiprocessing_spawn.test_processes: 1 min 36 sec - test_mailbox: 1 min 33 sec - test.test_multiprocessing_forkserver.test_processes: 1 min 28 sec - test.test_concurrent_futures.test_process_pool: 1 min 22 sec - test_subprocess: 1 min 18 sec - test_signal: 1 min 8 sec - test_logging: 48.1 sec - test.test_multiprocessing_fork.test_processes: 39.4 sec - test_multiprocessing_main_handling: 38.8 sec 27 tests skipped: test.test_asyncio.test_windows_events test.test_asyncio.test_windows_utils test_android test_apple test_dbm_gnu test_dbm_sqlite3 test_devpoll test_epoll test_free_threading test_idle test_launcher test_msvcrt test_perf_profiler test_perfmaps test_remote_pdb test_sqlite3 test_startfile test_tcl test_tkinter test_ttk test_ttk_textonly test_turtle test_winapi test_winconsoleio test_winreg test_winsound test_wmi 3 tests skipped (resource denied): test_peg_generator test_xpickle test_zipfile64 3 re-run tests: test_dtrace test_imaplib test_shutil 3 tests failed: test_dtrace test_imaplib test_shutil 454 tests OK. Total duration: 3 min 9 sec Total tests: run=46,530 failures=18 skipped=2,252 Total test files: run=487/487 failed=3 skipped=27 resource_denied=3 rerun=3 Result: FAILURE then FAILURE *** Error code 2 Stop. make: stopped making "test" in /usr/ports/lang/python314/work/Python-3.14.4 *** Error code 1 Stop. make: stopped making "test" in /usr/ports/lang/python314 # python -V Python 3.14.4
# pkg audit -F vulnxml file up-to-date python314-3.14.4 is vulnerable: Python -- The webbrowser.open() API allows leading dashes CVE: CVE-2026-4519 WWW: https://vuxml.FreeBSD.org/freebsd/9fdad262-2e0f-11f1-88c7-00a098b42aeb.html Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines CVE: CVE-2025-15367 WWW: https://vuxml.FreeBSD.org/freebsd/6d3488ae-2e0f-11f1-88c7-00a098b42aeb.html Python -- imaplib module, when passed a user-controlled command, can have additional commands injected using newlines CVE: CVE-2025-15366 WWW: https://vuxml.FreeBSD.org/freebsd/0be929a5-2e0f-11f1-88c7-00a098b42aeb.html 3 problem(s) in 1 package(s) found.
(In reply to Jordan Ostreff from comment #1) https://docs.python.org/release/3.14.4/whatsnew/changelog.html
I'll try to reduce the pkg-plist diff and see what I get in terms of self-tests. 3.14.3 is self-checking successfully on 15.0-RELEASE-p7 amd64 for me.
Created attachment 269492 [details] maintainer patch to security update Python 3.14 to 3.14.4 (from 3.14.3) Let's use this patch instead. Self-tests on 15.0-RELEASE amd64 pass, poudriere tests running.
Created attachment 269493 [details] VuXML update to mark CVE-2026-4519 fixed in Python 3.14.4 (the imaplib and poplib issues appear to still be unfixed)
Please commit both patches to main and MFH the Python patch to 2026Q2.
poudriere build tests have passed for each of these on FreeBSD 13.5, 14.3, 15.0 respectively (all amd64): lang/python314 databases/py-gdbm@py314 databases/py-sqlite3@py314 x11-toolkits/py-tkinter@py314
Comment on attachment 269492 [details] maintainer patch to security update Python 3.14 to 3.14.4 (from 3.14.3) Since this hasn't been committed yet, revoking maintainer approval. Will require to cherry-pick two more security fixes from upstream. New patch coming up.
Created attachment 269614 [details] VuXML: document two more python vulnerabilities unfixed in 3.14.4 & co. (not in 269493)
Created attachment 269615 [details] maintainer patch to security update Python 3.14 to 3.14.4_1 (adds fixes for gh-146211 and gh-146333) Please commit & MFH. Note I am the maintainer, not python@.
Patches also available for cherry-picking from my ports forks at https://gitlab.com/mandree/freebsd-ports/-/commits/main?ref_type=HEADS https://github.com/mandree/freebsd-ports/commits/main/
Created attachment 269616 [details] update VuXML entry for two recent Python vulns (now includes python310) post-3.14 Had to add python310 (which FreeBSD still claims to "support") to the VuXML entry.