Re: Status of Python 3.11

On 8/7/26 16:24, Dan Langille wrote:
> On Wed, Jun 24, 2026, at 12:45 AM, Matthias Fechner wrote:
>> Hi,
>>
>> Am 23.06.26 um 20:49 schrieb Nuno Teixeira:
>>> I see that https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285957 is
>>> staled.
>>>
>>> I'm unsure if it is the right time to start doing local builds with 3.13.
>>
>>
>> I switched now to 3.13 and all seems at first to run fine.
>> Will test it the next days.
> 
> I have been using Python 3.14 for some time and have switched over from 3.12
> 
> Two issues vex me and the alerts are overwhelming.
> 
> CVE-2025-15367
> CVE-2025-15366
> 
> Every host is alerts with those, some for over 70 days.
> 
> Alert fatigue is a real thing.
> 
> I yearn for a way to easily silence specific vulns in the output of pkg-audit. I'm all for recording in vuxml. Yet at the same time, I want relief from pages of red alerts and having to scan them all to see if there's anything new.

   Until such a useful feature is added, you could self-filter one way 
or another:

pkg audit >~/vuln.old
# edit list to contain only vulnerabilities you do not care about
pkg audit -F >~/vuln.new
# a simple general output
diff ~/vuln.*|egrep "^<"|less
# an easily modified general output, in case you want it to help
# you review things you can now remove.
diff -y ~/vuln.*|egrep ">"|less

   You can end up with a short name script or alias that does the 
fetch+diff.
   Alternatively you can maintain your own vulnerability database 
variation where you apply select removals and rebuild with other new 
changes as they come along.
   Its easy to find yourself in a situation where a vulnerability is not 
relevant, but if another relevant vulnerability is used then preexisting 
vulnerability threats should be reconsidered.
   I's also find it helpful if we could run a check against the current 
pkg repo, and separately against the ports tree, to see if current 
versions include any fixes. I normally do that one port at a time by 
taking `pkg audit -q` output as a list of packages to check and running 
a series of repeats of it with an additional parameter like

pkg audit -q `make -C /usr/ports/\`pkg query %o python311-3.11.15_4\` 
-VPKGNAME`

   I should probably script that too but never got around to it and just 
manually pass the few names in, usually as a variable set at the start 
or a separate command for easy editing.