It looks like the build failure with both LTO and DTrace enabled was reported upstream some time ago.

As mentioned in D31489, the inability of LTO and DTrace to work together is unacceptable.

In D31489#1384532, @0mp wrote:

In D31489#1384510, @vishwin wrote:

In D31489#1239048, @0mp wrote:

maybe helpful: https://antranigv.am/posts/2025/02/dtrace-python-freebsd-again/

DTrace and LTO being mutually exclusive according to this experience is a non-starter.

Hello Charlie,

What do you mean by a non-starter?

In D31489#1239048, @0mp wrote:

maybe helpful: https://antranigv.am/posts/2025/02/dtrace-python-freebsd-again/

Please upstream this first, the last few commits to this file there were by us.

Upstream is explicitly not allowing cython 3.3 for the 6.1 branch. The 7.0 branch, which is still only in beta, requires cython 3.3 or later, however.

I will need to rebase this at the very least, lots of changes since I originally opened this up too.

I guess I didn't make myself clear enough.

Most of the D58861 cases are abusing PEP517_BUILD_CMD or PEP517_INSTALL_CMD in some way. Documenting those variables' availability does not necessarily mean they should be used except in exceptional circumstances, such as when build is not available due to circular dependencies.

The correct fix for imaplib (CVE-2025-15366) included in the latest release, 3.13.15. poplib (CVE-2025-15367) remains not backported upstream for good reason. For commentary's sake however:

The correct fix for imaplib (CVE-2025-15366) included in the latest release, 3.14.7. poplib (CVE-2025-15367) remains not backported upstream for good reason. For commentary's sake however: