pkg/51274: Mercurial needs updating to fix a bunch for remote code exec CVEs

[lloyd%must-have-coffee.gen.nz@localhost]

>Number:         51274
>Category:       pkg
>Synopsis:       Mercurial needs updating to fix a bunch for remote code exec CVEs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jun 26 02:50:00 +0000 2016
>Originator:     Lloyd Parkes
>Release:        pkgsrc-current
>Organization:
Must Have Coffee
>Environment:
NetBSD thallid.must-have-coffee.gen.nz 7.0_STABLE NetBSD 7.0_STABLE (GENERIC) #0: Sun Apr 17 16:48:35 NZST 2016  lloyd%castigate.must-have-coffee.gen.nz@localhost:/Users/lloyd/scratch/build7/obj.amd64/sys/arch/amd64/compile/GENERIC amd64
>Description:
Pkgsrc contains version 3.4 of Mercurial and this version of Mercurial has a number of known remote code execution bugs related to the conversion of git repos. The current version of Mercurial is version 3.8.3
>How-To-Repeat:
Compile devel/py-mercurial and note that it fails the pkg-vulnerabilities audit.
>Fix:
I updated my local pkgsrc to build Mercurial 3.8.3 on NetBSD/amd64 and OS X El Capitan and it seems to work fine without needed any patches. All the built in tests passed on OS X and four tests failed on NetBSD. At least one of the failed tests was due to whitespace issues with the output from the unzip command.

I can supply diffs, but since it's just a change in distribution version, they aren't very exciting.