security/py-certifi: Update to 2026.10.23
The bundle drops "emSign ECC Root CA - G3", "emSign Root CA - C1" and
"emSign ECC Root CA - C3", following the eMudhra emSign CA compromise:
2026.10.18 removed the emSign roots, 2026.10.19 restored the ones that
are not affected, and 2026.10.23 removed two more. The package layout
and the build are unchanged.
Commit log:
https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.23
PR: 299779
Approved by: sunpoet (maintainer timeout, 13 days)
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 8f6ec8f61ee24a69eaac2b1131a0f411bde9a004)
security/py-certifi: Update to 2026.10.23
The bundle drops "emSign ECC Root CA - G3", "emSign Root CA - C1" and
"emSign ECC Root CA - C3", following the eMudhra emSign CA compromise:
2026.10.18 removed the emSign roots, 2026.10.19 restored the ones that
are not affected, and 2026.10.23 removed two more. The package layout
and the build are unchanged.
Commit log:
https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.23
PR: 299779
Approved by: sunpoet (maintainer timeout, 13 days)
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
[RISCV][P-ext] Optimize i64 funnel shift by constant RV32 using NSRLI. (#237399)
Using multiple slx or srx instructions causes extra mvs due to the tied
operand. Since one of set of registers will often be a valid GPR pair,
we can use NSRLI which doesn't have a tied operand.
Assisted-by: Claude
openssl: stop generating asm that nothing builds
Makefile.asm generated eight perlasm outputs that neither libcrypto nor
the kernel builds. Additionally, upstream does not build them for these
architectures with FreeBSD's configuration:
- aarch64: ecp_sm2p256-armv8, sm3-armv8, sm4-armv8, vpsm4-armv8 and
vpsm4_ex-armv8. SM2, SM3 and SM4 are disabled (disable-sm2/sm3/sm4).
- i386: cast-586 (upstream's x86 configuration uses the C CAST code)
and rc5-586 (RC5 is disabled by default).
- powerpc: aes-gcm-ppc. Upstream builds it only for 64-bit
little-endian; libcrypto and ossl(4) use it only on powerpc64 and
powerpc64le, whose copies stay.
Remove them from Makefile.asm and delete the generated files, so the
next vendor import does not regenerate them. If one of these algorithms
is ever enabled, add its script back to Makefile.asm and run "make
buildasm".
[10 lines not shown]
sysutils/bsdisks: add HintAuto and TimeMediaDetected for automount
gvfs only marks a udisks2 volume for automount when Block.HintAuto is
true and the volume appears within 5 seconds of the drive's
TimeMediaDetected. bsdisks implemented neither, so both read as
false/0 and Caja never automounted USB drives on MATE.
HintAuto is now true for partitions on USB, removable or optical
drives. TimeDetected and TimeMediaDetected are set when the drive
appears.
Fixes: https://github.com/ghostbsd/issues/issues/391
mvc:ApiControllerBase - introduce basic locking in configdStream handler to avoid the ui locking when too many streams are open.
For now, be conservative with 5, when needed, we could investigate better defaults, before this change with the default dashboard one could lock the UI when opening 2 browsers on the same client.
2026Q4: compose of DeltaPorts 3bbca580f43 on FreeBSD 2026Q4 1628c8b6998f
DeltaPorts master and FreeBSD 2026Q4 as of 08-Nov-2026, with DPorts
master (e2f31ebea3a) as lock repo.
lang/python311, python312, python313, python314 and python-doc-html
stay at the previous compose: their 2026Q4 updates would rebuild
everything that uses Python on the package builders.
[libc][math] Improve math implementation selection and exp*f dispatch. (#240169)
- Allow users to specify functions
- Add `LIBC_MATH_IMPL_IS` in `src/__support/macros/optimization.h` and
guard `LIBC_MATH_<FUNC>_IMPL` definitions with `#ifndef` across math
dispatch headers so external overrides only include the selected
`*_eval.h` header.
- Require `LIBC_TARGET_CPU_HAS_FPU_FLOAT` before selecting float_eval in
expf.h, exp2f.h, and exp10f.h so soft-float targets fall through to
`integer_eval` or `double_eval`.
- Change `exp2f_eval_bits` from `LIBC_ALWAYS_INLINE` to `LIBC_INLINE` in
`exp2f_integer_utils.h` to allow outlining when optimizing for code
size.
Assisted-by: Gemini
py-pdf: update to 7.0.0.
## Version 7.0.0, 2026-11-06
### Security (SEC)
- Make file identifiers non-deterministic (#4366)
- Block not strictly increasing offsets in object streams (#4364)
- Limit XFA form decoding work (#4363)
- Apply image size limits more strictly (#4361)
### Deprecations (DEP)
- Cleanup deprecations for the next major release (#4306)
- Remove support for cryptography<43 (#4304)
- Drop support for Python 3.9 (#4292)
### New Features (ENH)
- Allow setting border color for rectangle annotations (#4297)
### Performance Improvements (PI)
[11 lines not shown]
[Clang][OpenMP] Fix crash on a range-based for loop counted by `ordered(n)` but not collapsed (#240126)
Fixes #199449
Sema analyzes `max(collapse, ordered)` loops and hoists their bounds
into the pre-inits, which for a range-based `for` refer to its implicit
`__range`, `__begin` and `__end`. CodeGen emitted those only for the
collapsed loops, so a loop counted by `ordered(n)` alone hit
`llvm_unreachable("DeclRefExpr for Decl not entered in LocalDeclMap?")`.
The collapsed shape from the report was already fixed by #146772; this
one still crashed on main.
CodeGen now walks the same loops Sema did. The helpers of the extra
loops serve the pre-inits only, since such a loop is emitted as an
ordinary loop in the body and declares its own, so their mappings are
dropped afterwards.
AI Assisted!
