misc/mc: update Midnight Commander to the latest version 4.8.33
- Tentatively switch default renderer from S-Lang to ncurses which
is part of the base system and does not pull EoLed `devel/pcre'
- GC no longer needed USES+=shebangfix, adjust Python dependency
- Add support for entering and viewing FreeBSD packages, based on
the idea and patch by Walter von Entferndt
- Register installation conflict with `misc/mc6' port while at it
PR: 292865, 293259, 294086
Tie webshare lifecycle to TrueNAS Connect state
## Problem
Webshare's Caddy only picks up its TLS certificates when it starts, but middleware never stopped, started or restarted webshare on any TrueNAS Connect transition. Setting up TNC and webshare, then unsetting TNC left webshare running, and setting TNC up again left it serving zero or stale certificates until someone restarted it by hand. At boot systemd could also start webshare before middleware was ready, so it came up with no certificates at all.
## Solution
Webshare now only runs when the WEBSHARE entitlement is granted and TNC is configured, regardless of product type.
- **Start gate**: `before_start` refuses START and RESTART with a `CallError` explaining why, so a restart or failover restart can't bypass it either.
- **Following TNC**: webshare subscribes to the existing `tn_connect.config` event. When TNC stops being configured (disable or 401 auto-unset) webshare is stopped; when it becomes configured again and webshare is enabled, it is started; a certificate renewal restarts a running webshare. A restart is used rather than a reload because a reload does not make every webshare listener re-read its certificates.
- **Licence and boot**: the same check runs on licence updates and on `system.ready` (non-HA), where a running webshare is restarted so it loads the right certificates.
The persisted enable flag is never touched, so the user's intent survives TNC being unset and webshare comes back by itself once TNC is set up again.
Fix the thick grow test, drop dead pool.dataset shims and tidy stale zfs.resource comments and rules
## Problem
test_grow_thick_volume_keeps_it_thick read the refreservation off the entry returned by the second grow. Since thick re-reserve only adds refreservation=auto when the reservation equals the volsize, that grow sends volsize alone and ZFS grows its own auto reservation, so the returned entry carries no refreservation and the test failed with a KeyError. The private pool.dataset.path_in_locked_datasets and pool.dataset.kill_processes shims had no callers left, every user having moved to zfs.resource.path_is_locked and zfs.resource.kill_processes. A few comments were also stale: the create rule and the zfs.resource.create docstring compared the default thick refreservation to `zfs create -V`, which sets the larger auto value while zr reserves exactly the volsize, the create TODO had lost why auto isn't used yet, and the build_set_of_zfs_props docstring had the None and empty list cases backwards. A unit test named for announcing created ancestors and the leaf only checked that an internal path announces nothing, and the create and set force_size rules each carried their own copy of the refusal instead of a shared reject helper like every other rule both sides apply, with the create one also missing from __all__.
## Solution
- **Test:** read the reservation from the zvol itself, as the first grow already does.
- **Shims:** remove the two unused shims.
- **force_size rule:** both sides call a shared reject_force_size_on_filesystem, and the create rule is listed in __all__.
- **Unit test:** rename it to test_create_announces_nothing_for_an_internal_path and inline its single case.
- **Comments:** drop the `zfs create -V` comparison, restore the reason auto can't be used on create (zfs_create() doesn't resolve it, so create fails with "out of space") and that a grow switches these volumes to auto, and describe build_set_of_zfs_props as it behaves, including that its cache ignores req_props once filled.
[CIR][CodeGen][NFCI] Share the COMDAT and common-linkage predicates (#223419)
Deduplicates `shouldBeInCOMDAT` and `isVarDeclStrongDefinition` between
CIR and
classic CodeGen into `ModuleUtils.h`.
Assisted-by: Claude Code (Claude Fable 5.1).
python311 py311-html-docs: updated to 3.11.17
3.11.17
Security
gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX.
gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.)
gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits DeprecationWarning instead of ValueError.
In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn’t checked. (In Python 3.13 and later, this raises ValueError.)
gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s.
gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049.
gh-157953: Update bundled libexpat to version 2.8.5.
[14 lines not shown]
[Sparc] Declare command line options in TableGen (#227977)
Move the cl::opts into SparcOptions.td. SparcSubtarget.h declares the
struct and SparcSubtarget.cpp holds the generated definitions.
LLVMInitializeSparcTarget registers the options, so they cost no static
initializer. SparcTargetMachine holds a reference to
SparcOptions::Global, and SparcSubtarget forwards it, so code reads
Subtarget.getCLOpts() rather than the global.
`OptionsStruct<prefix = "sparc-">` is new: it strips the shared prefix
from member names, so -sparc-bpcc-offset-bits sets bpcc_offset_bits.
Aided by Opus 5.5
[flang] Let a directive keep the loop it owns when its body branches (#227707)
A loop whose branching is confined to its body keeps its structured
form, but the construct holding it stayed Unstructured. A directive does
not merely contain such a loop, it owns it, and its lowering reads the
construct's own classification to decide whether the loop op carries its
bounds. The directive was left with a bounds-free loop that nothing
could partition, and the loop it owns became a second one nested inside.
Reclassify a directive construct once the loops it holds no longer need
it to stay Unstructured. Children are visited first, so those loops have
already been reclassified by the time the construct is reached. A
construct whose branching leaves it is untouched, as is one holding a
branch of its own.
Taking a loop over also means genFIR(DoConstruct) -- where a plain loop
folds a body whose branching stays inside it into a region -- never runs
for that loop, so fold its body through the same helper. A construct
that takes over no loop, acc data or acc parallel without a loop
[4 lines not shown]
python312 py312-html-docs: updated to 3.12.15
3.12.15
Security
gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX.
gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True, emitting DeprecationWarning if server_hostname is missing. (This will raise ValueError in Python 3.13 and later.)
gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(), but for backward compatiblity reasons emits DeprecationWarning instead of ValueError.
In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now emits DeprecationWarning to indicate the hostname wasn’t checked. (In Python 3.13 and later, this raises ValueError.)
gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s.
gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049.
gh-157953: Update bundled libexpat to version 2.8.5.
[14 lines not shown]
Add various Intel models (Lakefield, Granite Rapids, Arrow Lake, Panther Lake,
WildCat, Clearwater Forest, Sierra Forest, Lunar Lake).
Fix Yonah name (missing comma between Pentium and Core Duo).
Add few more AMD K8 models (Lima, Sherman, Windsor FX, Tyler, Richmond).
python313 py313-html-docs: updated to 3.13.16
3.13.16
macOS
gh-158010: Updated macOS installer to use OpenSSL 3.5.9, jumping from the 3.0 series to 3.5 after 3.0’s end of public support in September 2026.
Windows
gh-158010: Updated Windows builds to use OpenSSL 3.5.9, jumping from the 3.0 series to 3.5 after 3.0’s end of public support in September 2026.
gh-72353: Reading from the console on Windows now continues if the read was cancelled by Ctrl+C, but the SIGINT handler did not raise an exception. Previously the read ended as if at end of file.
gh-86427: Fix the encoding of the standard streams in the legacy Windows stdio mode (PYTHONLEGACYWINDOWSSTDIO). It is now the code page of the console, as in Python 3.7, not the ANSI code page.
gh-87587: os.device_encoding() on Windows now returns the code page of any console file descriptor, not only 0, 1 and 2, and returns None for other character devices like NUL. The UTF-8 code page is now reported as "utf-8" instead of "cp65001".
Tools/Demos
gh-113318: Fix Argument Clinic for @getter and @setter in a preprocessor conditional block. It failed with an internal error. Argument Clinic now also rejects the accessors of the same attribute with different C basenames, and the same accessor defined twice, which silently generated invalid or duplicated entries of PyGetSetDef.
Tests
gh-158051: The iOS testbed has been updated for compatibilty with Xcode 27.
gh-155997: Fix test.support.interpreters.list_all(). It failed if an interpreter was destroyed during the call, in particular by a garbage collection which finalized the object owning the last reference to it.
gh-75876: A test decorated with bigmemtest() now runs in a subprocess if it really allocates the memory it asks for (that is, if the -M option is used), so that the memory it uses and the address space it fragments are released when it ends. A dummy run stays in the process. The separate memory watchdog process is no longer used.
gh-155411: Fix test.support.subTests() for asynchronous test methods. They were wrapped in a synchronous function, which discarded the coroutine without awaiting it, so the test silently did not run at all.
gh-132581: The list of tests which altered the execution environment now includes the reasons why the environment was considered altered, for example an unraisable exception or a modified sys.path. The final result no longer repeats the same state twice (like ENV CHANGED then ENV CHANGED).
[125 lines not shown]
llan: byte swap the receive queue entries
The receive queue of a PAPR logical LAN is filled in by the hypervisor, so
its fields are big endian, but llan_intr() read the offset and the length of
each frame natively. On a little endian kernel the length of a 134 byte
frame reads as 0x86000000, and ether_input() discards the mbuf because m_len
is not even large enough for an ethernet header. No frame is ever received.
Reproduced on a POWER9 pseries guest with a spapr-vlan interface. Before:
llan0: discard frame w/o leading ethernet header (len -2046820352
pkt len -2046820352)
llan0 1500 <Link#1> 52:54:00:12:34:56 123 118 0 5838733312 7 0
that is 118 input errors out of 123 packets, dhclient(8) never completes and
ping(8) loses every packet, although transmit works because the transmit
path passes the lengths in hcall registers rather than through memory.
Afterwards the interface gets a DHCP lease and ping reports no loss.
[5 lines not shown]
[CODEOWNERS] Request notifications (#227742)
The author is finding the mix of searches on the GitHub UI and the
notifications on PRs on which their review was explicitly requested in
their inbox a bit difficult to manage. They hence request notifications
for all PRs touching VPlan, LoopAccessAnalysis, LoopIdiomRecognize,
SCEVPatternMatch, and PatternMatchHelpers in their inbox, as a start.
start process of deprecating the -R flag. This was the old way of
performing a remote-to-remote copy that was basically executed scp on
the remote host. It barely worked (needing agent forwarding enabled or
usable credentials on the remote host) and has largely been replaced
by a better SFTP-protocol remote-to-remote copy that runs through the
host performing the copy.
We'll disable this option in a release or two; ok dtucker@
