rust199: i386 hosts cannot build the RISCV LLVM target, so omit it.
...but keep all the others, at least for now, for the i386 rust target.
This is related to
https://github.com/llvm/llvm-project/issues/230790
[LSR] Fix LCSSA preservation in RewriteForPHI (#235361)
There was a call to SplitLandingPadPredecessors that did not specify
LCSSA preservation. Set it to ShouldPreserveLCSSA so we preserve LCSSA
here in the NewPM.
Found when doing a build of the LLVM test-suite with LCSSA preservation
enabled for LSR. This was not found in my initial testing (bootstrapping
LLVM) given we compile with -fno-exceptions.
Assisted-by: LLM
model:ContainerField - exclude volatile fields in isFieldChanged()
Volatile fields are usually initialized during model setup, but when untouched (no setter being called), they are marked changed.
Found this one by accident while looking at https://github.com/opnsense/core/issues/11048 which triggers validations for unchanged records.
(cherry picked from commit 92c30965427aa2ee1c0f8a81b2d987dbc4870b61)
[libc][math] Fix `tanpif` and `tanpif16` error handling (#235296)
Relates to
https://github.com/llvm/llvm-project/pull/147192#issuecomment-5726874002.
- Set ERANGE when tanpif and tanpif16 underflow.
- Set ERANGE instead of EDOM at half-integer poles.
- Raise underflow and inexact exceptions explicitly in tanpif16.
- Return exact results for odd multiples of one quarter without raising
inexact.
Tested both functions with CORE-MATH's exhaustive checker in all four
rounding modes. With `CORE_MATH_SUPPORT_ERRNO` and
`CORE_MATH_CHECK_INEXACT` enabled.
[InstCombine] Remove redundant add one folds (#235664)
These are fully subsumed by the `sext(bool) + C -> bool ? C - 1 : C` and
`(iN X s>> (N - 1)) + 1 --> zext (X > -1)` folds higher up in the
function.
[CGP] Remove handling of lifetime.end via bitcast (NFC) (#235712)
Nowadays lifetimes are required to have a direct alloca argument,
there cannot be a bitcast in between.
[IR] Remove handling for removed constant expressions (NFC) (#235702)
Support for these casts as constant expressions has been dropped,
so don't handle them in getWithOperands().
python311 py311-html-docs: updated to 3.11.18
Python 3.11.18
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE-2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE-2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
[AMDGPU] GFX125x: Relax global_inv/wb when NC MTYPE is not used
When the driver doesn't use MTYPE NC on gfx125x, the hardware ensures coherency
of the L2 caches. Then, the global_inv/wb instructions we emit only need to
reach the L2s to acquire/release data to device or system scope.
That's the case for gfx1250, gfx1250-strict, and gfx1251. gfx12-5-generic is
intentionally left out.
python312 py312-html-docs: updated to 3.12.16
Python 3.12.16
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
python313 py313-html-docs: updated to 3.13.18
Python 3.13.18
Security
gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning cookies with a negative Version attribute without checking their domain against the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose path resolves to the destination directory itself, as tarfile.data_filter() already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. When working around file system permission errors, files are now removed relative to open directory file descriptors instead of resolving their path again, so that replacing a directory of the tree with a symbolic link can no longer make the cleanup delete files outside of the temporary directory. This addresses CVE 2026-12345.
Library
gh-87720: Fixed error in email new policies where header folding failed to detect the need to re-quote text obtained from encoded words in certain cases.
Tests
gh-159015: Fix test.test_math failing to import on musl-based systems. The skip condition of test_fma_zero_result compared the boolean returned by test.support.linked_to_musl() with a version tuple.
Test system.truenas_setattr through an overlay and the ctime of omitted times.
The TrueNAS kernel refuses system.truenas_setattr and
system.nfs4_acl_xdr through overlayfs, which would otherwise run the
handler with the mounter's credentials. Three tests mount an overlay on
each dataset and check that a set as the owner, another user or root
gets EOPNOTSUPP, leaves the file as it was and copies nothing up, that
the ACL xattr can be neither read, written nor listed, and that user.*
and POSIX ACLs still pass through.
test_omitted_times_change_nothing now compares the whole stat and runs
as another user too, since the handler used to bump the ctime of any
file the caller could reach. test_reparse checks that ZFS_REPARSE among
the bits to clear is a no-op, as it is for ZFS_IOC_SETDOSFLAGS, and
test_birth_time_now covers UTIME_NOW for the birth time. The tests need
a kernel with the overlayfs change beside the ZFS of truenas/zfs#490.
[Loads] Sign-extend narrow constant GEP indices in decomposeLinearExpression (#235092)
Constant GEP indices narrower than the index type were multiplied by the
stride without being widened, which asserted on mismatched APInt widths.
Redisable tests to unbreak on archs where char is unsigned
Spotted on arm64. Issue mentioned in
https://github.com/jbeder/yaml-cpp/pull/1513 but instead of adding
a patch let's see what upstream thinks.
ok tb
