Update to 7.0.34

* CVE-2012-4431 is fixed in 7.0.32

Changelog:
Tomcat 7.0.34 (markt)	2012-12-12

    Catalina

        fix	53871: Improve error message if annotation scanning fails during web application start due to poor configuration or illegal cyclic inheritance with the application's classes. (markt)
        fix	Fix unit test for AccessLogValve when using non-GMT time zone. (rjung)
        fix	54170: Ensure correct registration of Filters and Servlets in the JMX registry if the Filter or Servlet name includes a character that must be quoted if used in an ObjectName value. (markt)
        add	Add new attribute renameOnRotate to the AccessLogValve. (rjung)
        fix	54190: Correct unit tests for BASIC authentication so that session timeout is correctly tested. Also refactor unit test to make it easier to add additional tests. Patch by Brian Burch. (markt)
        fix	54220: Ensure the ErrorReportValve only generates an error report if the error flag on the response has been set. (markt)
        fix	Simplify time zone handling in the access log valve and correctly handle various edge cases for non-standard DST changes. (markt)

    Web applications

        fix	54198: Clarify that HttpServletResponse.sendError(int) results in an HTML response by default. (markt)
        fix	54207: Correct JNDI factory package name in Javadoc for org.apache.naming.java.javaURLContextFactory. (markt)

    jdbc-pool

        code	Fix a handful of Eclipse warnings in the JDBC pool source code including the warnings reported in 53565. (markt)
        fix	54150: Make sure that SlowQueryReportJmx mbean deregistered during webapp shutdown. Reported by Alex Franken. (kfujino)
        fix	54194: Make sure that connection pool mbean is not registered when jmxEnabled is false. Patch provided by tobias.gierke. (kfujino)

    Other

        update	Update to Eclipse JDT Compiler 4.2.1. (markt)

Tomcat 7.0.33 (markt)	2012-11-21

    Catalina

        add	53960, 54115: Extensions to HttpClient test helper class. Patches by Brian Burch. (markt/kkolinko)
        fix	53993: Avoid a possible NPE in the AccessLogValve when the session ID is logged and a session is invalidated. (markt)
        fix	Add support for LAST_ACCESS_AT_START system property to PersistentManager. (kfujino)
        add	Update MIME type mapping with additional / updated mime.types from the Apache web server. (markt)
        fix	54007: Fix a memory leak that prevented deletion of a context.xml file associated with a Context that had failed to deploy. Also fix the problems uncovered with undeploying such a Context once the leak had been fixed and the file could be deleted. (markt)
        fix	54044: Correct bug in timestamp cache used by logging (including the access log valve) that meant entries could be made with an earlier timestamp than the true timestamp. (markt)
        fix	54054: Do not share shell environment variables between multiple instances of the CGI servlet. (markt)
        fix	54060: Use a simple parser rather than a regular expression to parse HTTP Digest authentication headers so the header is correctly parsed. The new approach is also faster and generates less garbage. (markt)
        fix	54068: Rewrite the web fragment ordering algorithm to resolve multiple issues that resulted in incorrect ordering or failure to find a correct, valid order. (markt)
        update	The HTTP header parser added to address 52811 has been removed and replaced with the light-weight HTTP header parser created to address 54060. The new parser includes a work-around for a bug in the Adobe Acrobat Reader 9.x plug-in for Microsoft Internet Explorer that was identified when the old parser was introduced (53814).
        fix	54076: Add an alternative work-around for clients that use SPNEGO authentication and expect the authenticated user to be cached per connection (Tomcat only does this if an HTTP session is available). (markt)
        fix	54087: Correctly handle (ignore) invalid If-Modified-Since header rather than throwing an exception. (markt)
        fix	54096: In web.xml, <env-entry> should accept any type that has a constructor that takes a single String or char. (markt)
        add	54127: Add support for sending a WebSocket Ping. Patch provided by Sean Winterberger. (markt)
        fix	In FormAuthenticator: If it is configured to change Session IDs, do the change before displaying the login form. (kkolinko)
        fix	Ensure AsyncListener.timeout() and AsyncListener.complete() are called with the correct thread context class loader. (fhanik)
        fix	54123: If an asynchronous request times out without any AsyncListeners defined, a 500 error will be triggered. (markt)
        fix	54124: Correct provided value of request attribute javax.servlet.async.request_uri and add missing request attribute javax.servlet.async.path_info. (markt)
        add	Add denyStatus initialization parameter to CsrfPreventionFilter, allowing to customize the HTTP status code used for denied requests. (kkolinko)
        fix	54141: Increase the permitted number of nested Realm levels from 2 to 3 by default and make the limit configurable via a system property. (markt)
        fix	Revert occasional API change in BaseDirContext class that was done in 7.0.32. Methods should not be final. (kkolinko)
        fix	Prevent failures in the AccessLogValve when running under a SecurityManager and the first request received is an asynchronous one. (markt)

    Coyote

        fix	Correct an issue that prevented WebSockets from being used over SSL when using the HTTP NIO connector. (markt)
        fix	54022: Ensure the Comet END event is triggered on client disconnect with APR/native on Windows Vista/2k8 or later. Patch provided by Douglas Beachy. (markt)
        fix	54067: Ensure responses with 1xx response codes are correctly marked as not containing an entity body. This caused an issue for some WebSocket clients when an Transfer-Encoding header was sent with the 101 (HTTP upgrade) response. (markt)

    Jasper

        code	53867: Optimise the XML escaping provided by the PageContext implementation. Based on a patch by Sheldon Shao. (markt)
        code	53896: Use an optimised CompositeELResolver for Jasper that skips resolvers that are known to be unable to resolve the value. Patch by Jarek Gawor. (markt)
        fix	53986: Correct a regression introduced by the fix for 53713. JSP comments that ended with the sequence ---%> (or any similar sequence with a odd number of - characters) was not correctly parsed. (markt)
        fix	54011: Fix a bug in the tag plug-in for <c:out> that triggered a JSP compilation error if the escapeXml attribute was used. Patch provided by Sheldon Shao. (markt)
        code	Follow up to 5401. Simplify generated code for <c:out>. Based on a patch by Sheldon Shao. (markt)
        fix	54012: Fix a bug in the tag plug-in infrastructure that meant the <c:set> triggered a JSP compilation error when used in a tag file. Based on a patch provided byx	54144: Fix a bug in the tag plug-in for <c:out> that meant that if the value of the tag evaluated to a java.io.Reader object then it was not correctly handled. (markt)

    Cluster

        fix	Add getSessionIdsFull operation to mbeans-descriptor. listSpplications

        add	54143: Add display of the memory pools usage (including PermGen) to the Status page of the Manager web application. (kkolinko)

    Tribes

        fix	54045: Make sure getMembers() returns available member when TcpFailureDetector   fix	Revert multiple operation support for the JMXProxyServlet pending further discussion. (schultz)
        fix	CVE-2012-4431: Fix bypass of CsrfPreventionFilter when there is no session. Improve session management in the filter. (kkolinko)

    Web apit servlets (JSP and default) are marked as override-able when using embedded mode. (markt)
        fix	When the DefaultServlet is under heavy load, the HTTP header parser added to address 52811 generates large amounts of garbage and uses significant CPU time. A cache has been added that significantly reduces the overhead of this parser. (markt)
        fix	53854: Make directory listings work correctly when aliases are used. (markt)

    Jasper

        code	53713: Performance improvement of up to four times faster parsing of JSP pages. Patch provided by Sheldon Shao. (markt)

    Cluster

        add	Make the cluster members and the cluster deployer associated with the cluster accessible via JMX. (markt)
        fix	Fix a behavior of TcpPingInterceptor#uhread. If set to false, ping thread is never started. (kfujino)

    Web applications

        add	Improve the documentation web application to clarify the difference between the tag and version parameters when using text interface of the Manager web application. (markt)
        add	Make sessions saved in the Store associated with a Manager that extends PersistentManager optionally visible (via the showProxySessions Servlet initialisation parameter in web.xml) to the Manager web application. (markt)
Reset PKGREVISION.
Updated www/apache-tomcat7 to 7.0.34
Update to 1.12.6:


(same backwards compat warnings related to 1.13 as in 1.12.5)

Bugs fixed in 1.12.6:

* Python-related bugs:

  - The default installation location for python modules has been improved
    for Python 3 on Debian and Ubuntu systems, changing from:

        ${prefix}/lib/python3/dist-packages

    to

        ${prefix}/lib/python3.x/site-packages

    This change should ensure modules installed using the default ${prefix}
    "/usr/local" are found by default by system python 3.x installations.
    See automake bug#10227.

  - Python byte-compilation supports the new layout mandated by PEP-3147,
    with its __pycache__ directory (automake bug#8847).

* Build system issues:

  - The maintainer rebuild rules for Makefiles and aclocal.m4 in
    Automake's own build system works correctly again (bug introduced
    in Automake 1.12.5).

* Testsuite issues:

  - The Vala-related tests has been changed to adjust to the removal of
    the 'posix' profile in the valac compiler.  See automake bug#12934
    a.k.a. bug#12522.

  - Some spurious testsuite failures related to older tools and systems
    have been fixed.
Updated devel/automake to 1.12.6
+ bison-2.7, global-6.2.6, libidn-1.26, xf86-video-intel-2.20.16.
Update to 2.7:

* Noteworthy changes in release 2.7 (2012-12-12) [stable]

** Bug fixes

  Warnings about uninitialized yylloc in yyparse have been fixed.

  Restored C90 compliance (yet no report was ever made).

** Diagnostics are improved

*** Changes in the format of error messages

  This used to be the format of many error reports:

    input.y:2.7-12: %type redeclaration for exp
    input.y:1.7-12: previous declaration

  It is now:

    input.y:2.7-12: error: %type redeclaration for exp
    input.y:1.7-12:     previous declaration

*** New format for error reports: carets

  Caret errors have been added to Bison:

    input.y:2.7-12: error: %type redeclaration for exp
     %type <sval> exp
           ^^^^^^
    input.y:1.7-12:     previous declaration
     %type <ival> exp
           ^^^^^^

  or

    input.y:3.20-23: error: ambiguous reference: '$exp'
     exp: exp '+' exp { $exp = $1 + $3; };
                        ^^^^
    input.y:3.1-3:       refers to: $exp at $$
     exp: exp '+' exp { $exp = $1 + $3; };
     ^^^
    input.y:3.6-8:       refers to: $exp at $1
     exp: exp '+' exp { $exp = $1 + $3; };
          ^^^
    input.y:3.14-16:     refers to: $exp at $3
     exp: exp '+' exp { $exp = $1 + $3; };
                  ^^^

  The default behaviour for now is still not to display these unless
  explictly asked with -fcaret (or -fall). However, in a later release, it
  will be made the default behavior (but may still be deactivated with
  -fno-caret).

** New value for %define variable: api.pure full

  The %define variable api.pure requests a pure (reentrant) parser. However,
  for historical reasons, using it in a location-tracking Yacc parser
  resulted in a yyerror function that did not take a location as a
  parameter. With this new value, the user may request a better pure parser,
  where yyerror does take a location as a parameter (in location-tracking
  parsers).

  The use of "%define api.pure true" is deprecated in favor of this new
  "%define api.pure full".

** New %define variable: api.location.type (glr.cc, lalr1.cc, lalr1.java)

  The %define variable api.location.type defines the name of the type to use
  for locations.  When defined, Bison no longer generates the position.hh
  and location.hh files, nor does the parser will include them: the user is
  then responsible to define her type.

  This can be used in programs with several parsers to factor their location
  and position files: let one of them generate them, and the others just use
  them.

  This feature was actually introduced, but not documented, in Bison 2.5,
  under the name "location_type" (which is maintained for backward
  compatibility).

  For consistency, lalr1.java's %define variables location_type and
  position_type are deprecated in favor of api.location.type and
  api.position.type.

** Exception safety (lalr1.cc)

  The parse function now catches exceptions, uses the %destructors to
  release memory (the lookahead symbol and the symbols pushed on the stack)
  before re-throwing the exception.

  This feature is somewhat experimental.  User feedback would be
  appreciated.

** Graph improvements in DOT and XSLT

  The graphical presentation of the states is more readable: their shape is
  now rectangular, the state number is clearly displayed, and the items are
  numbered and left-justified.

  The reductions are now explicitly represented as transitions to other
  diamond shaped nodes.

  These changes are present in both --graph output and xml2dot.xsl XSLT
  processing, with minor (documented) differences.

** %language is no longer an experimental feature.

  The introduction of this feature, in 2.4, was four years ago. The
  --language option and the %language directive are no longer experimental.

** Documentation

  The sections about shift/reduce and reduce/reduce conflicts resolution
  have been fixed and extended.

  Although introduced more than four years ago, XML and Graphviz reports
  were not properly documented.

  The translation of mid-rule actions is now described.
Updated devel/bison to 2.7
Update to 1.26:

* Version 1.26 (released 2012-12-11) [stable]

** libidn, idna_to_ascii: Propagate error on malloc failure.
Reported by Sarat Chandra Addepalli <s.addepalli@samsung.com>.

** libidn, tld_get_4: Fix out of bounds read access violation.

** i18n: Added Croatian translation.  Updated Vietnamese translation.
Thanks to Tomislav Krznar and Trần Ngọc Quân.

** java: Permit usage by Apache projects.
Thanks to Oliver Hitz and Angus Turner.

** tests: Improve tld self-tests.

** API and ABI is backwards compatible with the previous version.
Updated devel/libidn to 1.26
Update to 2.10.2:

    Bump version to 2.10.2

    Bug 57286 - Remove UnBatang and Baekmuk Batang from monospace in
    65-nonlatin.conf

    Those two fonts are serif fonts. shouldn't be added to monospace.

    Update CaseFolding.txt to Unicode 6.2

    No real updates between 6.1 and 6.2, but anyway.

    Bug 57114 - regression on FcFontMatch with namelang

    After 7587d1c99d9476b6dd4dbe523c0204da700fed8d applied, family,
    style, and fullname is localized against current locale or lang
    if any though, the string in other languages were dropped from
    the pattern. this caused unexpected mismatch on the target="font"
    rules.

    This fix adds other strings at the end of the list.

    Bug 56531 - autogen.sh fails due to missing 'm4' directory

    Keep m4 directory in git.

    Use automake variable instead of cleaning files in clean-local

    just for git.mk coming up from Behdad's threadsafe branch

    autogen.sh: Add -I option to tell aclocal a place for external
    m4 files

    Fix syntax errors in fonts.dtd.

    Patch from Steve Simpson

    Fix wrongly squashing for the network path on Win32.

    Patch from Diego Santa Cruz

    deal with warnings as errors for the previous change

    missed this change to commit. doh!

    Bug 52573 - patch required to build 2.10.x with oldish GNU C library
    headers

    On older libc, _POSIX_C_SOURCE didn't satisfy to use posix_fadvise()
    and AC_CHECK_FUNCS doesn't check a header file if the function is
    declared there properly. so use AC_LINK_IFELSE instead.

    Bug 54138 - X_OK permission is invalid for win32 access(..) calls

    X_OK checking was added back in
    8ae1e3d5dc323542e7def06a42deea62c7ba7027
    which was removed due to the same reason in
    238489030a64fa883f8f9fc3d73247b7f7257899.
    apparently the test case in Bug#18934 still works without it.
    so I'm removing it again to get this working on Windows.

    Remove _CONFIG_FIXUPS_H_ guards, so multiple includes of "config.h"
    result in the correct values

    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

    Fix for libtoolize's warnings

    Fix N'ko orthography

    Bug 53585 - Two highly-visible typos in src/fcxml.c
Updated fonts/fontconfig to 2.10.2
Update to 4.13a.
Karl Berry:
I had missed some files in the 4.13 tarball, hence 4.13a.
Updated devel/gtexinfo to 4.13a
Update to 2.0.21:

Changes in version 2.0.21-stable (18 Nov 2012)
BUGFIXES:
 o ssl: Don't discard SSL read event when timeout and read come close together (576b29f)
 o ssl: Stop looping in "consider_reading" if reading is suspended. (f719b8a Joachim Bauch)
 o ssl: No need to reserve space if reading is suspended. (1acf2eb Joachim Bauch)
 o dns: Avoid a memory-leak on OOM in evdns. (73e85dd, f2bff75 George Danchev)
 o build: Use python2 rather than python (0eb0109 Ross Lagerwall)
 o build: Compile without warnings on mingw64 (94866c2)
 o build: Fix compilation on mingw64 with -DUSE_DEBUG (62bd2c4)
 o build: Make rpcgen_wrapper.sh work on systems without a "python2" binary (f3009e4)
 o iocp: Close IOCP listener socket on free when LEV_OPT_CLOSE_ON_FREE is set (cb853ea Juan Pablo Fernandez)
 o core: Avoid crash when event_pending() called with no event_base set on event (e3cccf3)
 o misc: remove stray 'x' so print_err will compile when uncommented (ac35650 Patrick Pelletier)
 o tests: Fix renegotiation test to work around openssl 1.0.1 bug (c2f3086)
 o tests: Warn when openssl version in unit test mismatches compiled version. (ac009f9)


Changes in version 2.0.20-stable (23 Aug 2012)
BUGFIXES:
 o core: Make event_pending() threadsafe. (be7a95c Simon Liu)
 o win32: avoid crash when waiting forever on zero fds. (160e58b)
 o evhttp: Fix a memory leak on error in evhttp_uriencode (11c8b31)
 o evbuffer: Avoid possible needless call to writev. Found by coverity. (6a4ec5c)
 o evdns: memset sockaddr_in before using it. Found by coverity. (a1a0e67)
 o evhttp: Check more setsockopt return values when binding sockets. Found by coverity (a0912e3)
 o evdns: Avoid segfault on weird timeout during name lookup. (dc32077 Greg Hazel)
 o bufferevent_ssl: Correctly invoke callbacks when a SSL bufferevent reads some and then blocks. (606ac43)


PORTABILITY FIXES:
 o check for arc4random_buf at runtime, on OS X (bff5f94 Greg Hazel)
 o Correctly check for arc4random_buf (fcec3e8 Sebastian Hahn)
 o Add explicit AC_PROG_SED to configure.in so all autoconfs will expose $(SED) (ca80ea6)

BUILD FIXES:
 o Add GCC annotations so that the vsprintf functions get checked properly (117e327)
 o Fix an unused variable warning on *BSD. (c0720c1)

UNIT TEST FIXES:
 o Fix a couple of memory leaks (found with Valgrind). (3b2529a Ross Lagerwall)
 o Remove deadcode in http regression tests. Found by coverity. (5553346)
 o Fix possible uninitialized read in dns regression tests. Found by coverity. (2259777)
 o Set umask before calling mkstemp in unit tests. Found by coverity (f1ce15d)
 o Fix various check-after-dereference issues in unit tests: found by coverity (4f3732d)
 o Fix resource leaks in the unit tests; found by coverity (270f279)
 o Add some missing null checks to unit tests; found by coverity (f021c3d)
 o Avoid more crashes/bad calls in unit tests; found by coverity (3cde5bf)
 o Remove unused variable; spotted by coverity (6355b2a)
 o Add checks to various return values in unit tests. Found by coverity (b9e7329)
 o Move assignment outside tt_assert in ssl unit tests. Appeases coverity. (a2006c0)
Updated devel/libevent to 2.0.21
Update to 0.0.23:
	For VSD6 and VSD11 trust more the cached hex then the colour index
Updated converters/libvisio to 0.0.23