[Midnightbsd-cvs] [MidnightBSD/mports] 2869f9: net/py-urllib3: update to 2.8.0 (CVE-2026-97688) (...

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: 2869f9e0340d17b3534ef9b03e2d7e19c8227bbb
      https://github.com/MidnightBSD/mports/commit/2869f9e0340d17b3534ef9b03e2d7e19c8227bbb
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-30 (Wed, 30 Sep 2026)

  Changed paths:
    M net/py-urllib3/Makefile
    M net/py-urllib3/distinfo

  Log Message:
  -----------
  net/py-urllib3: update to 2.8.0 (CVE-2026-97688) (#1659)

Updates net/py-urllib3 2.7.0 → 2.8.0 to fix CVE-2026-97688 /
GHSA-gh4c-6fx4-qh6g (infinite loop in chunked Deflate streaming with
trailing bytes).

Closes #1657. The path in the Mend report
(`textproc/xml2rfc/files/patch-requirements.txt`) was removed in #171;
the actual exposure was our urllib3 port, which was in the affected
range.

- distfile sha256 matches PyPI
- build backend (hatchling/hatch-vcs/setuptools-scm) and LICENSE
unchanged
- `bmake build fake package` OK (py312)
- Upstream regression case
`test_read_chunked_with_trailing_data_does_not_hang` reproduced
standalone: hangs on 2.7.0, passes on 2.8.0 (deflate, raw deflate, gzip)
- Full `bmake test` not run: test deps py-pyopenssl and py-quart (via
py-flask) fail to install on the build box due to stale `py312-openssl`
/ `py311-flask` packages
- portlint: 0 fatal, only pre-existing PORTEPOCH warning

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Bug Fixes:
- Update urllib3 to 2.8.0 to address the infinite-loop vulnerability
when processing chunked Deflate streams with trailing bytes
(CVE-2026-97688 / GHSA-gh4c-6fx4-qh6g).

Signed-off-by: Lucas Holt <luke at foolishgames.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications