* Fri Aug 07 2026 mcepl@cepl.eu
- Update to 3.14.7:
- Security
- gh-153030: Fixed quadratic complexity in incremental
parsing of long unterminated constructs (such as tags or
comments) in html.parser.HTMLParser, which could be
exploited for a denial of service (bsc#1271192,
CVE-2026-15308).
- gh-152674: The xml.etree.ElementTree.Element methods
findall(), iterfind() and find() avoid quadratic behavior
when using XPath index predicates ([1], [last()],
[last()-N]) on XML documents with many same-tag siblings.
- gh-152216: Update bundled libexpat to version 2.8.2.
- gh-151987: The tarfile.TarFile.extract() method now applies
the given filter when it extracts a link target from the
archive as a fallback (bsc#1269959, CVE-2026-4360).
- gh-151981: In tarfile, seeking a stream now stops when end
of the stream is reached (bsc#1269788, CVE-2026-11972).
- gh-151544: Modules/Setup.local is no longer used as
a landmark to discover whether Python is running in
a source tree, as it could potentially affect actual
installs. The pybuilddir.txt file is now the sole indicator
of running in a source tree.
- gh-151558: Fixed an vulnerability in the tarfile data and
tar extraction filters where crafted archives could create
a symlink pointing outside the destination directory. This
was a bypass of CVE 2025-4330 (bsc#1268977,
CVE-2026-11940).
- gh-150743: http.client now limits the number of
chunked-response trailer lines it will read to 100, and the
number of interim (1xx) responses it will skip to 100.
A malicious or broken server could previously stream
trailer lines or 100 Continue responses forever, hanging
the client even when a socket timeout was in use. Reported
by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
- gh-143927: Normalize all line endings (CR, CRLF, and LF) to
LF+TAB when writing multi-line configparser values.
- gh-143921: Reject NUL, CR and LF characters in IMAP
commands. Other control characters are allowed and sent
quoted (bsc#1257044, CVE-2025-15366).
- Core and Builtins
- gh-133931: Fix data races when setting attributes of
function objects on the free threaded build.
- gh-154709: Fix an out-of-bounds access in reverse
dictionary iterators when the underlying dictionary is
cleared and modified after the iterator is created.
- gh-154695: Fix asyncio.Task raising AttributeError when
created with eager_start=True and no explicit loop
argument.
- gh-153809: Fix interpreter crash while deallocating objects
of asyncio.Task on free-threaded builds. Contributed by
Sergey Miryanov.
- gh-154275: Fix a crash when getting deeply nested
__parameters__ from a types.GenericAlias objects.
- gh-153932: Fix thread safety issue in the __reduce__ method
of enumerate.
- gh-153298: Fixes a data race in types.GenericAlias
__parameters__ initialization on free-threading builds.
- gh-153205: Fix a potential SystemError during vector calls
when memory allocation fails. A MemoryError is now raised
instead.
- gh-152682: Fix NULL pointer dereference in compile() when
a reserved name (e.g. __classdict__) is used as a type
parameter name and memory allocation fails while formatting
the error message.
- gh-152635: Fix a crash caused when running out of memory
creating a _interpchannels channel. Now a MemoryError is
correctly raised.
- gh-152375: Fix undefined behaviour when a sys.monitoring
callback raised an exception while the program was
following a branch or loop.
- gh-152235: Defer GC tracking of set.intersection(),
set.difference(), set.symmetric_difference(), set.union()
and set.__sub__. Patch by Donghee Na.
- gh-152235: Defer GC tracking of a set or frozenset to the
end of its construction from iterable. Patch by Donghee Na.
- gh-152228: Fix an assertion failure when python is built in
a debug mode that happened in str.replace() under a limited
memory situation.
- gh-151763: Fixes possible crash on types.CodeType
deallocation.
- gh-152020: On the free-threaded build, asyncio.all_tasks()
no longer loses eager-started tasks when called from
a thread other than the one running the event loop.
- gh-151763: Fix a potential crash in compile(), exec(),
eval() and ast.parse() when an allocation fails: the parser
or compiler could return without setting an exception.
- gh-151912: Fixed a crash in type() when selecting
a metaclass whose tp_new slot is NULL. Such metaclasses are
now rejected with TypeError instead of causing a NULL
pointer dereference.
- gh-151905: Fix OOM error handling in PyFrame_GetBack() to
propagate exceptions instead of masking them as None.
- gh-151773: Fix a crash in contextvars.ContextVar.set() when
memory allocation fails.
- gh-151126: Fix a crash when sharing memoryview objects
between interpreters fails due to running out of memory. It
now raises a proper MemoryError.
- gh-151644: Fix a data race in sys.setdlopenflags() and
sys.getdlopenflags() when called concurrently in the
free-threaded build. The underlying
_PyImport_GetDLOpenFlags and _PyImport_SetDLOpenFlags
functions now use atomic load/store operations.
- gh-151126: Avoid possible crash in _winapi.c where a device
has no memory left. Now it properly raises a MemoryError.
Patch by Ivy Xu.
- gh-151546: Fix the stack limit check if Python is linked to
musl (ex: Alpine Linux). Use the stack size set by the
linker to compute the stack limits. Patch by Victor
Stinner.
- gh-151461: Fix direct execution of files with invalid
source encodings to report the underlying codec lookup or
decoding error instead of the generic SyntaxError: encoding
problem message. Patch by Bartosz Sławecki.
- gh-151218: PyConfig_Set() and sys.set_int_max_str_digits()
now replace sys.flags (create a new object), instead of
modifying sys.flags in-place. Patch by Victor Stinner.
- gh-151253: If import encodings (first import) fails at
Python startup, dump the Python path configuration to help
users debugging their configuration. Patch by Victor
Stinner.
- gh-151238: Fix a crash when compiling a concatenated
f-string or t-string if an error occurs when processing one
of it’s parts.
- gh-151126: Fix a crash, when there’s no memory left on
a device, which happened in _interpchannels module.
- Now it raises proper MemoryError errors.
- gh-150902: Apply an existing optimization of
PyCriticalSection (single mutex) to PyCriticalSection2:
avoid acquiring the same locks that the current CS has
already acquired.
- gh-151065: Fix memory leak when using the mimalloc memory
allocator.
- gh-151029: On Linux, fix sys.remote_exec() unable to find
remote writable memory when libpython replaced on disk.
- gh-150988: Fix a reference leak in OSError when attributes
are set before super().__init__().
- gh-144774: Fix data race in BaseException when an exception
is copied while being mutated.
- gh-150411: Fix a data race in the free-threaded build when
gc.get_count() reads the young generation allocation count
while another thread updates it.
- gh-149689: Fix missing error propagation in parser action
helpers when memory allocation fails. Patch by Thomas
Kowalski.
- gh-149162: Fix a potential deadlock in
PyUnicode_InternFromString() and other interning functions
in the free-threaded build when called from C++ static
local initializers.
- Library
- gh-155009: Fix argparse.ArgumentParser to preserve the
program name from sys.argv[0] when a named module is
executed as the main program without replacing sys.argv[0].
- gh-155063: Bump the version of pip bundled in ensurepip to
version 26.2.1
- gh-155063: Bump the version of pip bundled in ensurepip to
version 26.2
- gh-154936: Fix the pure Python json decoder to report the
correct position for invalid literal control characters in
JSON strings.
- gh-154892: Fix a bug in the C accelerator for zoneinfo
where datetime.datetime subclasses returning -1 for hour,
minute, or second could incorrectly raise a SystemError.
- gh-154848: The pickle C accelerator now enforces frame
boundaries when unpickling, as the pure Python
implementation already did. An argument that straddles
a frame boundary, or a frame that begins before the
previous one has ended, now raises pickle.UnpicklingError
instead of being silently read across the boundary. This
prevents the loaded data from diverging from the
pickletools disassembly of the same pickle.
- gh-109638: Fix exponential time in csv.Sniffer.sniff() for
a sample which contains many quote characters. A doubled
quote character is now also detected in a field which
contains the delimiter or a line break.
- gh-98820: Fix quadratic time in csv.Sniffer.sniff() for
a sample which contains quoted fields, in particular for
a single column of quoted fields.
- gh-154738: Fix ExternalEntityParserCreate() not propagating
the reparse-deferral setting to the subparser, which left
GetReparseDeferralEnabled() returning an uninitialized
value. Patch by tonghuaroot.
- gh-93251: Fix UnicodeDecodeError in socket functions (such
as getaddrinfo() and gethostbyaddr()) when the localized
error message of the C library is not UTF-8: decode it from
the locale encoding.
- gh-154551: Fix ctypes.util.find_library() returning None in
non-UTF-8 locales.
- gh-79366: Fixed a race condition in logging: if a handler
was removed while a record was being emitted, the following
handlers of the same logger could be skipped.
- gh-73458: Fix logging.config.listen(): it left the caller
waiting for the ready event forever if the server could not
be started, for example if the port was invalid or already
in use. It now also binds to an IPv6 address if the host
has no IPv4 address, for example if localhost is only
aliased to ::1.
- gh-154460: Fix time.strftime() and
datetime.datetime.strftime() returning a wrong ISO 8601
week number (%V) on OpenBSD.
- gh-154435: Fix os.posix_fadvise() and os.posix_fallocate()
on DragonFly BSD: they raised OSError with a meaningless
error code, because these functions return -1 and set errno
there.
- gh-154399: Fix venv activation in a non-interactive csh:
activate.csh no longer fails when the prompt variable is
not set.
- gh-154389: Fix uuid.uuid1() on OpenBSD: it returned
a version 4 UUID, because uuid_create() generates random
UUIDs on this platform.
- gh-154324: Fix os.sendfile() on illumos: it no longer
reports a successful transfer when the underlying system
call failed without writing any data.
- gh-154307: Fix tempfile.TemporaryDirectory.cleanup() on
DragonFly BSD, where removing a file with the UF_NOUNLINK
flag failed with EISDIR instead of EPERM.
- gh-154291: Fix socket.has_dualstack_ipv6() to return False
on platforms such as DragonFly BSD where setting
IPV6_V6ONLY to 0 silently has no effect.
- gh-154283: On DragonFly BSD, threading.get_native_id() now
returns a value that is unique across processes, matching
the other platforms.
- gh-154258: Fix a crash in mmap.mmap.resize() on NetBSD when
growing a shared anonymous mapping. resize() now raises
ValueError in this case, as it already did on Linux.
- gh-131565: ctypes.util.dllist() now works on NetBSD. It is
implemented in the _ctypes extension module so that
dl_iterate_phdr() reports all loaded shared libraries: on
NetBSD it only reports the link-map group of the calling
object, which excluded them when called through ctypes.
- gh-154225: Fix os.openpty() on Solaris and illumos: it no
longer leaves the pseudo-terminal as the controlling
terminal of the calling process.
- gh-154227: Fix os.posix_openpt() on OpenBSD, where it
rejected the O_CLOEXEC flag.
- gh-145030: Fix asyncio write pipe transports for named
FIFOs on macOS and Solaris. Unread data sitting in the FIFO
made the transport misinterpret a poll event as the reader
disconnecting, wrongly closing the transport.
- gh-154001: Fix random.binomialvariate() raising
ZeroDivisionError when random.random() returns zero.
- gh-153908: Fix data race when calling repr() on
itertools.count under the free-threaded build.
- gh-153896: Deduplicate unhashable args in typing.Literal.
- gh-153864: On a wide curses build, curses.window.insch()
now inserts a non-ASCII byte as the character it encodes in
the window’s encoding, consistently with addch(), instead
of its code point.
- gh-153862: On a wide curses build, curses.window.inch() now
returns the locale-encoded byte of a non-ASCII character,
matching instr(), instead of the low byte of its code
point.
- gh-146011: Fix a heap-use-after-free in the
C implementation of decimal when calling repr() after
deleting the Context.
- gh-153761: Fix cancelling asyncio.loop.sock_accept()
dropping a pending connection.
- gh-153695: Hashing a sqlite3.Row that contains an
unhashable value now raises TypeError instead of
SystemError. Patch by tonghuaroot.
- gh-127049: Fix a race condition in asyncio on Unix where
asyncio.subprocess.Process.send_signal(), terminate() or
kill() could signal an unrelated process that was recycled
onto the PID of the already-reaped child when
ThreadedChildWatcher is used. Patch by Kumar Aditya.
- gh-153658: Fix sqlite3.Connection.iterdump() raising
sqlite3.OperationalError when a table name contains
a single quote. Patch by tonghuaroot.
- gh-85943: Fix struct functions raising BytesWarning under
the -bb command line option when a str format is used after
an equal bytes format (or vice versa). The internal format
cache no longer mixes str and bytes keys.
- gh-153404: urllib.robotparser.RobotFileParser now silently
ignores a Crawl-delay or Request-rate value written with
non-decimal digits (such as U+00B2 SUPERSCRIPT TWO) instead
of raising ValueError and aborting the parse of the whole
robots.txt file.
- gh-153417: Error messages from imaplib.IMAP4.select() and
imaplib.IMAP4.uid() no longer raise BytesWarning under -bb
when the mailbox or command argument is bytes.
- gh-153406: email.utils.parsedate_to_datetime() now raises
ValueError instead of OverflowError when the parsed year or
timezone offset is out of range, matching its documented
behavior.
- gh-153083: Defer GC tracking of an array.array to the end
of its construction. Patch by Donghee Na.
- gh-153292: Fix data race in repr of threading.RLock in
free-threading build.
- gh-143990: A tkinter.font.Font created from a named font,
including by copy(), now copies its configured options
rather than the options resolved by Tcl’s font actual,
preserving a size specified in pixels (a negative size).
- gh-148286: Fix undefined behavior in
compression.zstd.ZstdDecompressor.unused_data when
a complete frame was decompressed in a single call.
- gh-153210: Fix crash on array import under a memory
pressure.
- gh-153200: Fix math.isqrt() returning an incorrect result
for arguments not less than 2**64 that are instances of an
int subclass with an overridden comparison operator.
- gh-153068: Fix cProfile.Profile.enable() to no longer
overwrite errors from sys.monitoring.
- gh-153062: Fix a crash when concurrently iterating an
itertools.tee() iterator on the free-threaded build.
- gh-153056: Fix string.Template raising a spurious
ValueError when the pattern attribute is a compiled regular
expression object, which the documentation allows. On the
free-threaded build this also occurred as a data race on
the first concurrent use.
- gh-153037: Fix ZstdFile raising AttributeError instead of
io.UnsupportedOperation when iterating over a file that is
not open for reading.
- gh-135661: Fix html.parser.HTMLParser: an abruptly closed
empty comment (<!--> or <!--->) no longer extends up to
a later --> in the same feed() call.
- gh-152851: Prevent a crash when allocation fails while
copying a BLAKE-2s/2b object. Patch by Bénédikt Tran.
- gh-54930: Error responses of
http.server.BaseHTTPRequestHandler to malformed request
lines now include a status line and headers instead of
being sent in the bare HTTP/0.9 style. Only a valid
HTTP/0.9 request (a two-word GET request line) now receives
an HTTP/0.9 style response.
- gh-119592: Fix concurrent.futures.ProcessPoolExecutor
stranding submitted work forever when a worker process
exited upon reaching its max_tasks_per_child limit after
shutdown() was called with wait=False: a replacement worker
is now spawned and the remaining work executed as
documented. If the executor has instead been garbage
collected without shutdown() (gh-152967), or a replacement
worker cannot be started, the remaining futures now fail
with BrokenProcessPool instead of never resolving. A worker
exit racing shutdown(wait=False) can also no longer crash
the executor management thread.
- gh-152951: collections.deque prevent rare crash when
calling extend under high memory pressure conditions.
- gh-150880: Normalize non-extended Windows paths before
appending the wildcard used by os.listdir() and
os.scandir(), making paths with trailing spaces behave
consistently with other filesystem APIs.
- gh-152849: Out-of-range float and integer timestamps now
raise OverflowError with the same message. Patch by
tonghuaroot.
- gh-152847: Reject a POSIX TZ transition rule with non-digit
characters in the day-of-year field in the pure-Python
zoneinfo parser. Patch by tonghuaroot.
- gh-108280: Connecting imaplib to a server that does not
send a valid IMAP4 greeting (for example a POP3 server
answering on the IMAP port) now raises an error reporting
the server’s response instead of imaplib.IMAP4.error: None.
- gh-63121: imaplib now refreshes the cached capability list
after a successful login() or authenticate(), using the
CAPABILITY response sent by the server or, if none was
sent, by querying it, so that capabilities that become
available only after authentication (such as ENABLE on
Gmail) are recognized. Capabilities advertised in the
server greeting are now also used, avoiding a redundant
CAPABILITY command.
- gh-88574: imaplib no longer fails when a server sends
a spurious blank line after the counted data of a literal,
including after a literal that terminates a response (such
as a mailbox name returned by LIST). Such blank lines are
now skipped without swallowing the following line.
- gh-152502: Detect the curses mouse interface (getmouse(),
the BUTTON* constants, and others) with a configure
capability probe or library macros instead of gating it on
ncurses-specific macros. It is now also available with
other curses implementations that provide it, such as
NetBSD curses and PDCurses (the latter underpins
windows-curses).
- gh-151842: Fix a crash in _interpreters.capture_exception()
when MemoryError happens. Patch by Amrutha Modela.
- gh-40038: imaplib now again quotes command arguments when
necessary, for example mailbox names containing a space.
Such quoting was inadvertently disabled when the module was
ported to Python 3, and the arguments are now quoted
according to the RFC 3501 grammar. For backward
compatibility, an argument already enclosed in double
quotes is left unchanged, so code that quotes arguments
itself keeps working.
- gh-50966: Fix unbounded recursion in turtle when a mouse
event handler that moves the turtle is reentered while the
screen is being redrawn, for example with
screen.ondrag(turtle.goto). This could previously crash the
interpreter.
- gh-152569: Fix asyncio.wait() leaking waiting tasks via the
await-graph when racing a future that never resolves. The
waiting task is now discarded from every future’s
awaited_by set once wait() returns, even for pending
futures.
- gh-78335: Update the docstrings of tkinter and tkinter.ttk
widget classes to list all supported widget options,
including options added in Tk 9.0 and 9.1.
tkinter.Menubutton and tkinter.Message previously had no
option list at all.
- gh-152431: Fix asyncio.StreamWriter.start_tls() to keep the
linked StreamReader transport in sync with the upgraded
transport.
- gh-151126: Fix two crashes in tkinter and socket modules
initialization under a memory pressure. Sets missing
MemoryError.
- gh-133031: curses.textpad.Textbox now enters and reads back
the non-ASCII characters of an 8-bit locale encoding,
instead of mangling them with a 7-bit mask.
- gh-71880: curses.textpad.Textbox now lets the lower-right
cell of the window be edited. Writing it with addch() would
move the cursor past the end of the window, raising an
error and scrolling a scrollable window, so it is now
written with insch(), which keeps the cursor in place.
- gh-83274: Deallocating a tkinter application from a thread
other than the one it was created in no longer crashes the
interpreter. The underlying Tcl interpreter is leaked
instead, and a RuntimeWarning is reported.
- gh-152305: Fix the pure-Python datetime.time.strftime()
implementation raising AttributeError for the year
directives. Patch by tonghuaroot.
- gh-88758: tkinter.Misc.focus_get(), focus_displayof(),
focus_lastfor() and winfo_containing() now return None
instead of raising KeyError when the widget was not created
by tkinter (for example a torn-off menu).
- gh-38464: tkinter.Misc.nametowidget() now resolves the
auto-generated names of cloned menus (a menu used as
a menubar or a cascade) back to the original widget.
- gh-152248: Make the C and pure-Python zoneinfo parsers
validate POSIX TZ abbreviations consistently, rejecting
unquoted abbreviations with non-letter characters and empty
quoted abbreviations. Patch by tonghuaroot.
- gh-80937: Fix a memory leak in tkinter when a Tcl command
created with createcommand was not explicitly removed
before the interpreter was deleted. The command no longer
keeps the interpreter alive through a reference cycle.
- gh-152246: Fix the pure-Python zoneinfo parser accepting an
invalid POSIX TZ transition rule with a non-period
separator. Patch by tonghuaroot.
- gh-139816: Fix a hang in tkinter on interactive Python
built without readline. An exception raised in a callback
no longer causes the event loop to stop and wait for the
user to press Enter; pending callbacks now keep running
until input is actually available on stdin.
- gh-139145: Fix a busy loop in tkinter on interactive
Python. When a Tcl command running its own event loop (such
as vwait or wait_variable()) was active and input arrived
on stdin, the event loop kept spinning at 100% CPU. The
stdin file handler is now removed as soon as input is
available. Based on a patch by Michiel de Hoon.
- gh-152212: Fix the pure-Python zoneinfo parser accepting
a POSIX TZ string with a std abbreviation but no offset.
This is invalid per POSIX and now raises ValueError,
matching the C accelerator. Patch by tonghuaroot.
- gh-152156: Fix a possible crash in
concurrent.interpreters.create() under limited memory
conditions.
- gh-152157: The C implementations of fromisoformat() and
fromisoformat() now reject a decimal separator that is not
followed by any fractional digit before a timezone
designator.
- gh-151763: Fix crash in _interpqueues.create() whe
MemoryError happens on queue creation.
- gh-105895: Add match and case to the list of supported
topics by help().
- gh-152079: Fix datetime.datetime.fromisoformat() in the
C implementation dropping the sub-second part of a UTC
offset whose whole-second part is zero, matching the
pure-Python implementation.
- gh-152052: The json C accelerator now correctly reports an
unterminated string for a \uXXXX escape at the end of the
input.
- gh-152060: Fix datetime.datetime.fromisoformat() raising
AssertionError instead of ValueError for some malformed
strings in the pure-Python implementation, matching the
C implementation.
- gh-126219: Fixed a crash in tkinter.Tk when className
contains a non-BMP character and tkinter is built against
Tcl/Tk 8.x. Such a name is now rejected with a ValueError.
- gh-86165: Fix imaplib.Time2Internaldate() to use the local
timezone offset for time.struct_time values with tm_gmtoff
set to None, as returned by datetime.datetime.timetuple().
Contributed by Xiao Yuan.
- gh-151814: Fix unbounded memory growth in io.TextIOWrapper
when repeatedly writing an empty string.
- gh-151770: Fix datetime.datetime.fromisoformat() raising
AssertionError instead of ValueError for an out-of-range
month combined with a 24:00 time.
- gh-151665: inspect.signature() now works on the lazy
evaluators of type aliases and type parameters instead of
raising ValueError.
- gh-151695: Fix a use-after-free in the curses module. The
encoding of the initial screen, used by curses.unctrl() and
curses.ungetch() to encode non-ASCII characters, is now
kept as a private copy instead of a borrowed pointer to
a window object that may be deallocated.
- gh-151596: Add missing size positional argument to the
pure-Python implementation of io.TextIOBase.readline().
- gh-151640: Fix a data race in io.BytesIO in free-threaded
builds when whole-buffer reads or peeks, or getvalue(),
share the internal buffer with concurrent writes.
- gh-148660: Fix a crash in collections.OrderedDict.copy()
when a key’s __eq__ or a subclass method mutates the dict
during the copy. Now raises RuntimeError instead, as
iteration does.
- gh-151497: Opening a tarfile archive no longer attempts to
pre-allocate a huge buffer when a crafted or truncated
member claims an oversized extended header (a GNU long
name/link or a pax header). The extended header is now read
in bounded chunks, so its size field can no longer trigger
memory exhaustion.
- gh-151403: Fixed a crash in subprocess.Popen (and
_posixsubprocess.fork_exec) when an argv item’s
__fspath__() concurrently mutates the args sequence being
converted.
- gh-151390: Colorize match in the REPL when followed by
a unary + or - operator. Patch by Bartosz Sławecki.
- gh-151126: Fix crash on unset MemoryError on allocation
failure in ctypes.get_errno().
- gh-151416: Fix a crash in os.spawnv() and os.spawnve() when
an argv item’s __fspath__() method mutates the argv list
during argument conversion. os.spawnv() argument conversion
errors other than TypeError, such as the ValueError for an
embedded null, are no longer replaced with a generic
TypeError.
- gh-151337: Avoid possible memory leak in tkinter.c on
Windows.
- gh-151126: Fix a crash when MemoryError in
os._path_splitroot() was not set properly.
- gh-151126: Fix a crash, when there’s no memory left on
a device, which happened in _interpchannels module.
- Now it raises proper MemoryError errors.
- gh-119710: Fix asyncio subprocess wait() hanging when the
process has exited but one of its pipes is kept open by an
inherited child process (so the pipe never reaches EOF).
wait() now returns as soon as the process exits, regardless
of the pipes’ state.
- gh-151295: Fixed a crash (use-after-free) in bytes.join()
and bytearray.join() that could occur if an item’s
__buffer__() concurrently mutates the sequence being
joined. The mutation is now reported as a RuntimeError
instead.
- gh-109940: Fix Windows venv activation in cmd.exe to
respect VIRTUAL_ENV_DISABLE_PROMPT.
- gh-117807: Fix mimetypes initialization from MIME map files
containing invalid UTF-8 bytes.
- gh-150583: Correctly set the default compression level in
compression.zstd when passing a digested dictionary during
compression.
- gh-150641: Fix bug where typing.evaluate_forward_ref() with
the STRING format could leak internal names used by the
annotation machinery.
- gh-150484: Fix unittest.mock.mock_open() __exit__ raising
TypeError when used with contextlib.ExitStack.
- gh-149816: Fix a potential use after free condition in
pickle.dumps() in free-threaded mode when serializing
lists.
- gh-149319: The asyncio REPL now ignores PYTHONSTARTUP and
PYTHON_BASIC_REPL when -E or -I is used. Patch by Jonathan
Dung.
- gh-47005: Fix urllib.request.AbstractHTTPHandler.do_open()
to give regular headers set via add_header() priority over
unredirected headers, consistent with get_header() and
header_items().
- gh-123471: Make concurrent iteration over
itertools.zip_longest safe under free-threading.
- gh-123720: asyncio: Fix asyncio.Server.serve_forever()
shutdown regression. Since 3.12, cancelling serve_forever()
could hang waiting for a handler blocked on a read from
a client that never closed (effectively requiring two
interrupts to stop); the shutdown sequence now ensures
client streams are closed so serve_forever() exits promptly
and handlers observe EOF.
- gh-123471: Make concurrent iteration over
itertools.accumulate safe under free-threading.
- gh-123471: Make concurrent iteration over
itertools.combinations_with_replacement and
itertools.permutations safe under free-threading.
- gh-143988: Fixed crashes in socket.socket.sendmsg() and
socket.socket.recvmsg_into() that could occur if buffer
sequences are concurrently mutated.
- gh-130796: Undeprecate the locale.getdefaultlocale()
function. Patch by Victor Stinner.
- gh-115634: Fix a deadlock in
concurrent.futures.ProcessPoolExecutor when using
max_tasks_per_child, present since the feature was
introduced in Python 3.11. The executor stopped scheduling
queued tasks after a worker process exited upon reaching
its task limit. Based on a fix proposed by Tabrez Mohammed.
- gh-140326: Fix the asyncio REPL namespace so that relative
imports no longer resolve against the asyncio package and
__file__ is no longer set.
- gh-79638: Disallow all access in urllib.robotparser if the
robots.txt file is unreachable due to server or network
errors.
- gh-123471: Make concurrent iterations over itertools.chain
safe under free threading.
- gh-123471: Make concurrent iterations over
itertools.combinations and itertools.product safe under
free-threading.
- gh-123471: Make concurrent iterations over itertools.cycle
safe under free-threading.
- gh-120665: Fixed an issue where unittest loaders would load
and instantiate unittest.TestCase-derived subclasses that
are also abstract base classes, which can’t be
instantiated.
- gh-105708: Accept an uppercase V prefix in IPvFuture
addresses in urllib.parse.urlsplit().
- gh-103925: Fix csv.Sniffer.sniff() for a sample with \r\n
line endings in which a quoted field ends a line: a letter
could be detected as the delimiter.
- gh-101267: When a worker process terminates unexpectedly,
concurrent.futures.ProcessPoolExecutor now sets a separate
BrokenProcessPool exception on each pending future instead
of sharing a single instance among them all. Sharing one
exception produced malformed tracebacks: each
Future.result() call re-raised the same object, appending
another copy of the traceback to it.
- Documentation
- gh-118150: Clarify in the difflib documentation what junk
actually does, its drawbacks, and how to control it.
- gh-86726: Greatly expand the tkinter documentation to cover
the full public API of the package and its submodules. The
descriptions are oriented towards Python rather than
Tcl/Tk, with corrected return types and
versionadded/versionchanged information.
- Tests
- gh-155109: Add test.support.run_with_limited_c_stack() and
use it in tests that exhaust the C stack with a fixed
number of recursive calls, so that their outcome no longer
depends on the C stack size.
- gh-76595: Add C API tests for PyCapsule_Import().
- gh-154211: Add test.support.skip_if_huge_c_stack() and use
it to skip tests that exhaust the C stack if the stack
limit is very large (e.g. on DragonFly BSD or with ulimit
- s unlimited).
- gh-154167: The test runner (regrtest) now restores the
default SIGINT handler if it was inherited as ignored, so
the test suite no longer hangs when run as a shell
background job.
- gh-154144: Fix building the _testcapi module on NetBSD.
- gh-152548: Add the test.support.isolation.runInSubprocess()
decorator to run a test method or TestCase subclass in
a fresh interpreter subprocess, isolated from the rest of
the test run.
- gh-151626: Fix several tests in test.test_inspect,
test.test_import, test.test_importlib, test.test_py_compile
and test.test_compileall that failed when the test suite
was run with PYTHONPYCACHEPREFIX set. These tests now
neutralize the pycache prefix where they assume the default
__pycache__ bytecode layout.
- gh-151096: Fix test_embed failing when CPython is
configured with a split exec prefix (--exec-prefix
differing from --prefix).
- gh-148853: Fix tests failing on FreeBSD in test.support’s
in_systemd_nspawn_sync_suppressed() due to unreadable /run
directory.
- Build
- gh-154070: Build the curses module against a wide-character
capable ncurses even when it is not named ncursesw – for
example the pkgsrc ncurses on NetBSD and illumos, or the
system ncurses on macOS. Such a library previously produced
a narrow build.
- gh-126877: Fix the configure check for Tcl/Tk which could
wrongly succeed with optimizing compilers when the
libraries are missing.
- gh-153438: Update Windows build and installer tooling and
documentation to use the current download URL for
nuget.exe.
- gh-152502: The curses module now detects set_escdelay(),
set_tabsize() and the ESCDELAY and TABSIZE variables with
configure capability probes instead of the ncurses-specific
NCURSES_EXT_FUNCS macro, so they are exposed when building
against other curses implementations such as NetBSD curses
that provide them.
- gh-148260: On Linux when Python is linked to the musl
C library, use a thread stack size of at least 1 MiB
instead of musl default which is 128 kiB. Patch by Victor
Stinner.
- gh-138800: Fix library name in python3.pc on Android.
- IDLE
- gh-82183: When the shell is busy running code, using “Run…
Customized” with “Restart shell” unchecked now reports that
the shell is executing instead of restarting it anyway.
- gh-83653: Blanking an integer entry in IDLE’s Settings
dialog, such as “Auto squeeze min lines”, no longer saves
an empty string as an invalid configuration value.
- gh-65339: Saving the IDLE Shell or an Output window now
defaults to a .txt extension and lists text files before
Python files, since their content is not Python source.
- gh-80504: The “In files:” field of IDLE’s Find in Files
dialog now always contains a full directory path, even for
an unsaved editor or the Shell. This shows in the grep
output which directory was searched.
- gh-134300: Do not add the idlelib directory to the path of
the IDLE user process. User code run in IDLE can no longer
import idlelib submodules as top-level modules, such as
import help.
- gh-89360: Fix a rare crash in the IDLE editor when the
completion window is closed: deleting a key binding for
a sequence that is not bound to the virtual event is now
ignored instead of raising a ValueError.
- gh-71956: Fix Replace All in the IDLE editor’s Replace
dialog when the search direction is “Up” and “Wrap around”
is off: it now replaces all matches above the current
position instead of only the first one.
- gh-152728: Move functions run.fix_scaling,
editor.fixwordbreaks (as fix_word_breaks) and
pyshell.fix_x11_paste to idlelib.util.
- gh-66331: Set the WM_CLASS window property of IDLE’s
windows to Idle on X11, so that window managers group and
label them correctly instead of using the default Toplevel.
- gh-85320: IDLE now reads and writes its configuration files
and the breakpoints file using UTF-8 instead of the locale
encoding. This keeps non-ASCII data (such as non-ASCII
paths) from being corrupted and makes the files portable
between environments.
- gh-94523: Detect file if modified at local disk and prompt
to ask refresh. Patch by Shixian Li.
- gh-139551: Support rendering BaseExceptionGroup in IDLE.
- gh-89520: Make IDLE extension configuration look at user
config files, allowing user-installed extensions to have
settings and key bindings defined in ~/.idlerc.
- Tools/Demos
- gh-155218: Fix Argument Clinic generating the flags of the
optional groups in different order on 32-bit and 64-bit
platforms.
- gh-155207: Argument Clinic now supports the --dry-run and
- -diff options. They list the files which would be changed,
or write a unified diff of the changes to the standard
output, without modifying any file.
- gh-154580: Fix python-gdb.py raising UnicodeEncodeError
when pretty-printing a non-ASCII str in a locale whose host
charset cannot encode it, such as any non-ASCII string in
the C locale.
- C API
- gh-152132: Fix Py_RunMain() to return an exit code, rather
than calling Py_Exit(), when running a script, a command,
or the REPL. Patch by Victor Stinner.
- gh-153300: PyConfig_Set() now also set global configuration
variables. For example, PyConfig_Set("inspect", value) now
also sets Py_InspectFlag. Patch by Victor Stinner.
- gh-123619: PyUnstable_Object_EnableDeferredRefcount() now
returns 0 if the object is not tracked by the garbage
collector: if gc.is_tracked() is false. Patch by Victor
Stinner.
- Remove upstreamed patches:
- CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2026-11940-tarfile-escape.patch
* Tue Jun 16 2026 mcepl@cepl.eu
- Update to 3.14.6:
- Security
- gh-151159: Update Android and iOS installers to use OpenSSL
3.5.7.
- gh-150599: Fix a possible stack buffer overflow in bz2 when
a bz2.BZ2Decompressor is reused after a decompression
error. The decompressor now becomes unusable after libbz2
reports an error. (bsc#1267974, CVE-2026-9669)
- gh-149835: shutil.move() now resolves symlinks via
os.path.realpath() when checking whether the destination is
inside the source directory, preventing a symlink-based
bypass of that guard.
- gh-149698: Update bundled libexpat to version 2.8.1 for the
fix for CVE 2026-45186.
- gh-87451: The ftplib module’s undocumented ftpcp function
no longer trusts the IPv4 address value returned from the
source server in response to the PASV command by default,
completing the fix for CVE-2021-4189. As with ftplib.FTP,
the former behavior can be re-enabled by setting the
trust_server_pasv_ipv4_address attribute on the source
ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape
AI for the report (bsc#1265268, CVE-2026-8328).
- gh-149486: tarfile.data_filter() now validates link targets
using the same normalised value that is written to disk,
strips trailing separators from the member name when
resolving a symlink’s directory, and rejects link members
that would replace the destination directory itself. This
closes several path-traversal bypasses of the data
extraction filter (bsc#1267821, CVE-2026-7774).
- gh-149079: Fix a potential denial of service in
unicodedata.normalize(). The canonical ordering step of
Unicode normalization used a quadratic-time insertion sort
for reordering combining characters, which could be
exploited with crafted input containing many combining
characters in non-canonical order. Replaced with
a linear-time counting sort for long runs (bsc#1267581,
CVE-2026-3276).
- gh-149018: Improved protection against XML hash-flooding
attacks in xml.parsers.expat and xml.etree.ElementTree when
Python is compiled with libExpat 2.8.0 or later
(bsc#1264962, CVE-2026-7210).
- Core and Builtins
- gh-151112: Fix a crash in the compiler that could occur
when running out of memory.
- gh-151126: Fix a crash, when there’s no memory left on
a device, which happened in:
- code compilation - _winapi.CreateProcess()
- Now these places raise proper MemoryError errors.
- gh-150700: Fix a SystemError when compiling a class-scope
comprehension containing a lambda that references
__class__, __classdict__, or __conditional_annotations__.
Patch by Bartosz Sławecki.
- gh-150633: Fix the frozen importer accepting module names
with embedded null bytes, which caused it to bypass the
sys.modules cache and create duplicate module objects.
- gh-148613: Fix a data race in the free-threaded build
between gc.set_threshold() and garbage collection
scheduling during object allocation.
- gh-149156: Fix an intermittent crash after os.fork() when
perf trampoline profiling is enabled and the child returns
through trampoline frames inherited from the parent
process.
- gh-149449: Fix a use-after-free crash when the unicodedata
module was removed from sys.modules and garbage-collected
between calls that decode \N{...} escapes or use the
namereplace codec error handler.
- gh-150207: Fix a crash when a memory allocation fails
during tokenizer initialization. A proper MemoryError is
now raised instead.
- gh-150107: asyncio: sendfile() and sock_sendfile() event
loop methods now call file.seek(offset) if file has
a seek() method, even if offset is 0 (default value).
- gh-150146: Fix a crash on a complex type variable
substitution.
- from typing import TypeVar;
memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to
fail due to missing NULL check on _unpack_args C function
call.
- gh-149590: Fix crash when faulthandler is imported more
than once.
- gh-149816: Fix a race condition in _PyBytes_FromList in
free-threading mode.
- gh-149816: Fix a race condition in memoryview with
free-threading.
- gh-149805: Fix a SystemError when compiling a compiling
__classdict__ class annotation. Found by OSS-Fuzz in
[#512907042].
- gh-149738: sqlite3: Disallow removing row_factory and
text_factory attributes of a connection to prevent a crash
on a query.
- gh-139808: Add branch protections for AArch64 (BTI/PAC) in
assembly code used by -X perf_jit (Linux perf profiler
integration).
- gh-148450: Fix abc.register() so it invalidates type
version tags for registered classes.
- Library
- gh-151039: Fix a crash when static datetime types outlive
the _datetime module.
- gh-150913: Fix sqlite3.Blob slice assignment to raise
TypeError and IndexError for type and size mismatches
respectively, even when the target slice is empty.
- gh-143008: Fix race conditions when re-initializing
a io.TextIOWrapper object.
- gh-150750: Fix a race condition in
collections.deque.index() with free-threading.
- gh-150685: Update bundled pip to 26.1.2
- gh-150406: Fix a possible crash occurring during socket
module initialization when the system is out of memory on
platforms without a reentrant gethostbyname.
- gh-150372: readline: Fix a potential crash during tab
completion caused by an out-of-memory error during module
initialization.
- gh-150157: Fix a crash in free-threaded builds that occurs
when pickling by name objects without a __module__
attribute while sys.modules is concurrently being modified.
- gh-150175: Fix race condition in
unittest.mock.ThreadingMock where concurrent calls could
lose increments to call_count and other attributes due to
a missing lock in _increment_mock_call.
- gh-84353: Preserve non-UTF-8 encoded filenames when
appending to a zipfile.ZipFile. Previously, non-ASCII names
stored in a legacy encoding (without the UTF-8 flag bit
set) could be corrupted when the central directory was
rewritten: they were decoded as cp437 and then re-stored as
UTF-8.
- gh-149816: Fix race condition in
ssl.SSLContext.sni_callback
- gh-149995: Update various docstrings in typing.
- gh-88726: The email package now uses standard MIME charset
names “gb2312” and “big5” instead of non-standard names
“eucgb2312_cn” and “big5_tw”.
- gh-149571: Fix the C implementation of
xml.etree.ElementTree.Element.itertext(): it no longer
emits text for comments and processing instructions.
- gh-149921: Fix reference leaks in error paths of the
_interpchannels and _interpqueues extension modules.
- gh-149816: Fix a race condition in _random.Random.__init__
method in free-threading mode.
- gh-149801: Add IANA registered names and aliases with
leading zeros before number (like IBM00858, CP00858,
IBM01140, CP01140) for corresponding codecs.
- gh-149701: Fix bad return code from Lib/venv/bin/activate
if hashing is disabled
- gh-112821: In the REPL, autocompletion might run arbitrary
code in the getter of a descriptor. If that getter raised
an exception, autocompletion would fail to present any
options for the entire object. Autocompletion now works as
expected for these objects.
- gh-149489: Fix ElementTree serialization to HTML. The
content of elements “xmp”, “iframe”, “noembed”, “noframes”,
and “plaintext” is no longer escaped. The “plaintext”
element no longer have the closing tag.
- gh-149231: In tomllib, the number of parts in TOML keys is
now limited.
- gh-149046: io: Fix io.StringIO serialization: no longer
call str(obj) on str subclasses. Patch by Thomas Kowalski.
- gh-148954: Fix XML injection vulnerability in
xmlrpc.client.dumps() where the methodname was not being
escaped before interpolation into the XML body.
- gh-148441: xml.parsers.expat: prevent a crash in
CharacterDataHandler() when the character data size exceeds
the parser’s buffer size.
- gh-146452: Fix segfault in pickle when pickling
a dictionary concurrently mutated by another thread in the
free-threaded build.
- gh-142831: Fix a crash in the json module where
a use-after-free could occur if the object being encoded is
modified during serialization.
- gh-90949: Add
SetBillionLaughsAttackProtectionActivationThreshold() and
SetBillionLaughsAttackProtectionMaximumAmplification() to
xmlparser objects to tune protections against billion
laughs attacks. Patch by Bénédikt Tran.
- gh-134261: zip: On reproducible builds, ZipFile uses UTC
instead of the local time when writing file datetimes to
avoid underflows.
- gh-128110: Fix bug in the parsing of email address headers
that could result in extraneous spaces in the decoded text
when using a modern email policy. Space between pairs of
adjacent RFC 2047 encoded-words is now ignored, per section
6.2 (and consistent with existing parsing of unstructured
headers like Subject).
- gh-107398: Fix tarfile stream mode exception when process
the file with the gzip extra field.
- gh-123853: Update the table of Windows language code
identifiers (LCIDs) used by locale.getdefaultlocale() on
Windows to protocol version 16.0 (2024-04-23).
- gh-91099: imaplib.IMAP4.login() now raises exceptions with
str instead of bytes. Patch by Florian Best.
- Documentation
- gh-150319: Generic builtin and standard library types now
document the meaning of their type parameters.
- gh-109503: Fix documentation for shutil.move() on usage of
os.rename() since nonatomic move might be used even if the
files are on the same filesystem. Patch by Fang Li
- Tests
- gh-151130: Add more tests for PyWeakref_* C API.
- gh-149776: Fix test_socket on Linux kernel 7.1 and newer:
skip UDP Lite tests if it’s not supported. Patch by Victor
Stinner.
- Build
- gh-148294: Corrected the use of AC_PATH_TOOL in
configure.ac to allow a C++ compiler to be found on PATH.
- IDLE
- bpo-6699: Warn the user if a file will be overwritten when
saving.
- C API
- gh-150907: Fix dynamic_annotations.h header file when built
with C++ and Valgrind: add extern "C++" scope for the C++
template. Patch by Victor Stinner.
- gh-145235: Made PyDict_AddWatcher(), PyDict_ClearWatcher(),
PyDict_Watch(), and PyDict_Unwatch() thread-safe on the
free threaded build.
- Refreshed patches:
- bpo-31046_ensurepip_honours_prefix.patch
- CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch
- CVE-2024-6923-follow-up-EOL-email-headers.patch
- CVE-2025-12781-b64decode-alt-chars.patch
- CVE-2025-15366-imap-ctrl-chars.patch
- gh139257-Support-docutils-0.22.patch
- test_UDPLITE_support.patch
* Tue Jun 09 2026 mcepl@cepl.eu
- Upgrade to 3.14.5:
- Security
- gh-148178: Hardened _remote_debugging by validating remote
debug offset tables before using them to size memory reads
or interpret remote layouts (bsc#1262132, CVE-2026-5713).
- gh-149254: Update Android and iOS installer to use OpenSSL
3.0.20.
- gh-149017: Update bundled libexpat to version 2.8.0.
- gh-90309: Base64-encode values when embedding cookies to
JavaScript using the http.cookies.BaseCookie.js_output()
method to avoid injection and escaping (bsc#1262654,
CVE-2026-6019).
- gh-148808: Added buffer boundary check when using nbytes
parameter with
asyncio.AbstractEventLoop.sock_recvfrom_into(). Only
relevant for Windows and the asyncio.ProactorEventLoop.
- gh-148395: Fix a dangling input pointer in
lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal
zlib._ZlibDecompressor when memory allocation fails with
MemoryError, which could let a subsequent decompress() call
read or write through a stale pointer to the
already-released caller buffer (bsc#1262098, CVE-2026-6100).
- gh-148169: A bypass in webbrowser allowed URLs prefixed
with %action to pass the dash-prefix safety check
(bsc#1262319, CVE-2026-4786).
- gh-146581: Fix vulnerability in shutil.unpack_archive() for
ZIP files on Windows which allowed to write files outside
of the destination tree if the patch in the archive
contains a Windows drive prefix. Now such invalid paths
will be skipped. Files containing “..” in the name (like
“foo..bar”) are no longer skipped.
- gh-146333: Fix quadratic backtracking in
configparser.RawConfigParser option parsing regexes (OPTCRE
and OPTCRE_NV). A crafted configuration line with many
whitespace characters could cause excessive CPU usage.
- gh-146211: Reject CR/LF characters in tunnel request
headers for the HTTPConnection.set_tunnel() method
(bsc#1261969, CVE-2026-1502).
- Core and Builtins
- gh-146270: Fix a sequential consistency bug in
structmember.c.
- gh-137293: Fix SystemError when searching ELF Files in
sys.remote_exec().
- gh-149122: Fix a crash in optimized calls to all(), any(),
tuple(), list(), and set() with an async generator
expression argument (for example, tuple(await x for x in
y)). These calls now correctly raise TypeError instead of
crashing.
- gh-113956: Fix a data race in sys.intern() in the
free-threaded build when interning a string owned by
another thread. An interned copy owned by the current
thread is used instead when it is not safe to immortalize
the original.
- gh-148820: Fix a race in _PyRawMutex on the free-threaded
build where a Py_PARK_INTR return from _PySemaphore_Wait
could let the waiter destroy its semaphore before the
unlocking thread’s _PySemaphore_Wakeup completed, causing
a fatal ReleaseSemaphore error.
- gh-148653: Forbid marshalling recursive code objects and
slice objects which cannot be correctly unmarshalled.
- gh-142516: Forward-port the generational cycle garbage
collector to the default 3.14 build, replacing the
incremental collector while leaving the free-threaded
collector unchanged.
- gh-148390: Fix an undefined behavior in memoryview when
using the native boolean format (?) in cast(). Previously,
on some common platforms, calling
memoryview(b).cast("?").tolist() incorrectly returned
[False] instead of [True] for any even byte b. Patch by
Bénédikt Tran.
- gh-148418: Fix a possible reference leak in a corrupted
TYPE_CODE marshal stream.
- gh-148393: Fix data races between PyDict_Watch()
/ PyDict_Unwatch() and concurrent dict mutation in the
free-threaded build.
- gh-148284: Fix high stack consumption in Python’s
interpreter loop on Clang 22 by setting function limits for
inlining when building with computed gotos.
- gh-148037: Remove critical section from PyCode_Addr2Line()
in free-threading.
- gh-148222: Fix vectorcall support in types.GenericAlias
when the underlying type does not support the vectorcall
protocol. Fix possible leaks in types.GenericAlias and
types.UnionType in case of memory error.
- gh-148208: Fix recursion depth leak in PyObject_Print()
- gh-137814: Fix the __qualname__ attribute of __annotate__
functions on functions.
- gh-147998: Fixed a memory leak in interpreter helper calls
so cleanup works when an operation falls across interpreter
boundaries. Patch by Maurycy Pawłowski-Wieroński.
- gh-146455: Fix O(N²) compile-time regression in constant
folding after it was moved from AST to CFG optimizer.
- Library
- gh-149388: Make asyncio.windows_utils.PipeHandle closing
idempotent.
- gh-149377: Update bundled pip to 26.1.1
- gh-138907: Support RFC 9309 in urllib.robotparser.
- gh-148615: Fix pdb to accept standard – end of options
separator. Reported by haampie. Patched by Shrey Naithani.
- gh-130750: Restore quoting of choices in argparse error
messages for improved clarity and consistency with
documentation.
- gh-141449: Improve tests and documentation for non-function
callables as annotate functions.
- gh-149221: Catch rare math domain error for
random.binomialvariate().
- gh-149117: Fix runpy.run_module() and runpy.run_path() to
set the name attribute on the ImportError they raise.
- gh-149148: ensurepip: Upgrade bundled pip to 26.1. This
version fixes the CVE 2026-3219 vulnerability. Patch by
Victor Stinner.
- gh-148093: Fix an out-of-bounds read of one byte in
binascii.a2b_uu(). Raise binascii.Error, instead of reading
past the buffer end.
- gh-148914: Fix memoization of in-band PickleBuffer in the
Python implementation of pickle. Previously, identical
PickleBuffers did not preserve identity, and empty writable
PickleBuffer memoized an empty bytearray object in place of
b'', so the following references to b'' were unpickled as
an empty bytearray object.
- gh-148947: Fix crash in @dataclasses.dataclass with
slots=True that occurred when a function found within the
class had an empty __class__ cell.
- gh-148680: ForwardRef objects that contain internal names
to represent known objects now show the type_repr of the
known object rather than the internal
__annotationlib_name_x__ name when evaluated as strings.
- gh-148801: xml.etree.ElementTree: Fix a crash in
Element.__deepcopy__ on deeply nested trees.
- gh-148735: xml.etree.ElementTree: Fix a use-after-free in
Element.findtext when the element tree is mutated
concurrently during the search.
- gh-148740: Fix usage for uuid command-line interface to
support a custom namespace be provided for uuid3 and uuid5.
- gh-148651: Fix reference leak in
compression.zstd.ZstdDecompressor when an invalid option
key is passed.
- gh-146553: Fix infinite loop in typing.get_type_hints()
when __wrapped__ forms a cycle. Patch by Shamil Abdulaev.
- gh-148508: An intermittent timing error when running SSL
tests on iOS has been resolved.
- gh-148518: If an email containing an address header that
ended in an open double quote was parsed with
a non-compat32 policy, accessing the username attribute of
the mailbox accessed through that header object would
result in an IndexError. It now correctly returns an empty
string as the result.
- gh-148464: Add missing __ctype_le/be__ attributes for
c_float_complex and c_double_complex. Patch by Sergey
B Kirpichev.
- gh-148370: configparser: prevent quadratic behavior when
a ParsingError is raised after a parser fails to parse
multiple lines. Patch by Bénédikt Tran.
- gh-148254: Use singular “sec” instead of “secs” in timeit
verbose output for consistency with other time units.
- gh-148192: email.generator.Generator._make_boundary could
fail to detect a duplicate boundary string if linesep was
not n. It now correctly detects boundary strings when
linesep is rn as well.
- gh-146313: Fix a deadlock in multiprocessing’s resource
tracker where the parent process could hang indefinitely in
os.waitpid() during interpreter shutdown if a child created
via os.fork() still held the resource tracker’s pipe open.
- gh-145831: Fix email.quoprimime.decode() leaving a stray \r
when eol='\r\n' by stripping the full eol string instead of
one character.
- gh-145105: Fix crash in csv reader when iterating with
a re-entrant iterator that calls next() on the same reader
from within __next__.
- gh-105936: Attempting to mutate non-field attributes of
dataclasses with both frozen and slots being True now
raises FrozenInstanceError instead of TypeError. Their
non-dataclass subclasses can now freely mutate non-field
attributes, and the original non-slotted class can be
garbage collected.
- gh-140287: The asyncio REPL now handles exceptions when
executing PYTHONSTARTUP scripts. Patch by Bartosz Sławecki.
- gh-132631: Fix “I/O operation on closed file” when parsing
JSON Lines file with JSON CLI.
- gh-70039: Fixed bug where smtplib.SMTP.starttls() could
fail if smtplib.SMTP.connect() is called explicitly rather
than implicitly.
- gh-83281: email: improve handling trailing garbage in
address lists to avoid throwing AttributeError in certain
edge cases
- Documentation
- gh-148663: Document that calendar.IllegalMonthError is
a subclass of both ValueError and IndexError since Python
3.12.
- gh-146646: Document that glob.glob(), glob.iglob(),
pathlib.Path.glob(), and pathlib.Path.rglob() silently
suppress OSError exceptions raised from scanning the
filesystem.
- Build
- gh-149351: Avoid possible broken macOS framework install
names when DESTDIR is specified during builds.
- gh-146475: Block Apple Clang from being used to build the
JIT as it ships without required LLVM tools.
- gh-148535: No longer use the gcc -fprofile-update=atomic
flag on i686. The flag has been added to fix a random GCC
internal error on PGO build (gh-145801) caused by
corruption of profile data (.gcda files). The problem is
that it makes the PGO build way slower (up to 47x slower)
on i686. Since the GCC internal error was not seen on i686
so far, don’t use -fprofile-update=atomic on i686 anymore.
Patch by Victor Stinner.
- gh-146264: Fix static module builds on non-WASI targets by
linking HACL dependencies as static libraries when
MODULE_BUILDTYPE=static, preventing duplicate _Py_LibHacl_*
symbol errors at link time.
- Remove upstreamed patches:
- CVE-2026-6019-Morsel-js_output.patch
- CVE-2026-1502-reject-CRLF-HTTP-tunnel.patch
- CVE-2026-5713-validate-debug-load.patch
- CVE-2026-4786-webbrowser-open-action.patch
- CVE-2026-6100-use-after-free-decompression.patch