- Update to 3.13.2:
- Tools/Demos
- gh-128152: Fix a bug where Argument Clinic’s C
pre-processor parser tried to parse pre-processor
directives inside C comments. Patch by Erlend Aasland.
- Tests
- gh-127906: Test the limited C API in test_cppext. Patch by
Victor Stinner.
- gh-127637: Add tests for the dis command-line
interface. Patch by Bénédikt Tran.
- gh-126925: iOS test results are now streamed during test
execution, and the deprecated xcresulttool is no longer
used.
- Security
- gh-105704: When using urllib.parse.urlsplit() and
urllib.parse.urlparse() host parsing would not reject
domain names containing square brackets ([ and ]). Square
brackets are only valid for IPv6 and IPvFuture hosts
according to RFC 3986 Section 3.2.2. (CVE-2025-0938,
bsc#1236705)
- gh-127655: Fixed the
asyncio.selector_events._SelectorSocketTransport
transport not pausing writes for the protocol when
the buffer reaches the high water mark when using
asyncio.WriteTransport.writelines() (CVE-2024-12254,
bsc#1234290).
- gh-126108: Fix a possible NULL pointer dereference in
PySys_AddWarnOptionUnicode().
- gh-80222: Fix bug in the folding of quoted strings
when flattening an email message using a modern email
OBS-URL: https://build.opensuse.org/request/show/1243939
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=18
- Tools/Demos
- gh-128152: Fix a bug where Argument Clinic’s C
pre-processor parser tried to parse pre-processor
directives inside C comments. Patch by Erlend Aasland.
- Tests
- gh-127906: Test the limited C API in test_cppext. Patch by
Victor Stinner.
- gh-127637: Add tests for the dis command-line
interface. Patch by Bénédikt Tran.
- gh-126925: iOS test results are now streamed during test
execution, and the deprecated xcresulttool is no longer
used.
- Security
- gh-105704: When using urllib.parse.urlsplit() and
urllib.parse.urlparse() host parsing would not reject
domain names containing square brackets ([ and ]). Square
brackets are only valid for IPv6 and IPvFuture hosts
according to RFC 3986 Section 3.2.2. (CVE-2025-0938,
bsc#1236705)
- gh-127655: Fixed the
asyncio.selector_events._SelectorSocketTransport
transport not pausing writes for the protocol when
the buffer reaches the high water mark when using
asyncio.WriteTransport.writelines() (CVE-2024-12254,
bsc#1234290).
- gh-126108: Fix a possible NULL pointer dereference in
PySys_AddWarnOptionUnicode().
- gh-80222: Fix bug in the folding of quoted strings
when flattening an email message using a modern email
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=76
- Add CVE-2024-12254-unbound-mem-buffering-SelectorSocketTransport.writelines.patch
preventing exhaustion of memory (gh#python/cpython#127655,
bsc#1234290, CVE-2024-12254).
- Update to 3.13.1:
- Tools/Demos
- gh-126807: Fix extraction warnings in pygettext.py caused
by mistaking function definitions for function calls.
- gh-126167: The iOS testbed was modified so that it can be
used by third-party projects for testing purposes.
- Tests
- gh-126909: Fix test_os extended attribute tests to work on
filesystems with 1 KiB xattr size limit.
- gh-125041: Re-enable skipped tests for zlib on the
s390x architecture: only skip checks of the compressed
bytes, which can be different between zlib’s software
implementation and the hardware-accelerated implementation.
- gh-124295: Add translation tests to the argparse module.
- Security
- gh-126623: Upgrade libexpat to 2.6.4
- gh-125140: Remove the current directory from sys.path when
using PyREPL.
- gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
consistently use the mapped IPv4 address value for deciding
properties. Properties which have their behavior fixed are
is_multicast, is_reserved, is_link_local, is_global, and
is_unspecified.
- Library
- gh-127321: pdb.set_trace() will not stop at an opcode that
does not have an associated line number anymore.
OBS-URL: https://build.opensuse.org/request/show/1228971
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=16
- Tools/Demos
- gh-126807: Fix extraction warnings in pygettext.py caused
by mistaking function definitions for function calls.
- gh-126167: The iOS testbed was modified so that it can be
used by third-party projects for testing purposes.
- Tests
- gh-126909: Fix test_os extended attribute tests to work on
filesystems with 1 KiB xattr size limit.
- gh-125041: Re-enable skipped tests for zlib on the
s390x architecture: only skip checks of the compressed
bytes, which can be different between zlib’s software
implementation and the hardware-accelerated implementation.
- gh-124295: Add translation tests to the argparse module.
- Security
- gh-126623: Upgrade libexpat to 2.6.4
- gh-125140: Remove the current directory from sys.path when
using PyREPL.
- gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
consistently use the mapped IPv4 address value for deciding
properties. Properties which have their behavior fixed are
is_multicast, is_reserved, is_link_local, is_global, and
is_unspecified.
- Library
- gh-127321: pdb.set_trace() will not stop at an opcode that
does not have an associated line number anymore.
- gh-127303: Publicly expose EXACT_TOKEN_TYPES in
token.__all__.
- gh-123967: Fix faulthandler for trampoline frames. If the
top-most frame is a trampoline frame, skip it. Patch by
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=70
- Update to 3.13.0:
Major new features of the 3.13 series, compared to 3.12
Some of the new major new features and changes in Python 3.13 are:
- New features
- A new and improved interactive interpreter, based on
PyPy's, featuring multi-line editing and color support, as
well as colorized exception tracebacks.
- An experimental free-threaded build mode, which disables
the Global Interpreter Lock, allowing threads to run
more concurrently. The build mode is available as an
experimental feature in the Windows and macOS installers as
well.
- A preliminary, experimental JIT, providing the ground work
for significant performance improvements.
- The locals() builtin function (and its C equivalent)
now has well-defined semantics when mutating the
returned mapping, which allows debuggers to operate more
consistently.
- A modified version of mimalloc is now included, optional
but enabled by default if supported by the platform, and
required for the free-threaded build mode.
- Docstrings now have their leading indentation stripped,
reducing memory use and the size of .pyc files. (Most tools
handling docstrings already strip leading indentation.)
- The dbm module has a new dbm.sqlite3 backend that is used
by default when creating new files.
- WASI is now a Tier 2 supported platform. Emscripten is
no longer an officially supported platform (but Pyodide
continues to support Emscripten).
- Typing
- Support for type defaults in type parameters.
- A new type narrowing annotation, typing.TypeIs.
- A new annotation for read-only items in TypeDicts.
- A new annotation for marking deprecations in the type
system.
- Removals and new deprecations
- PEP 594 (Removing dead batteries from the standard library)
scheduled removals of many deprecated modules: aifc,
audioop, chunk, cgi, cgitb, crypt, imghdr, mailcap, msilib,
nis, nntplib, ossaudiodev, pipes, sndhdr, spwd, sunau,
telnetlib, uu, xdrlib, lib2to3.
- Many other removals of deprecated classes, functions and
methods in various standard library modules.
- C API removals and deprecations. (Some removals present
in alpha 1 were reverted in alpha 2, as the removals were
deemed too disruptive at this time.)
- New deprecations, most of which are scheduled for removal
from Python 3.15 or 3.16.
- For more details on the changes to Python 3.13, see What's
new in Python 3.13 in the documentation.
OBS-URL: https://build.opensuse.org/request/show/1206252
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=11
Major new features of the 3.13 series, compared to 3.12
Some of the new major new features and changes in Python 3.13 are:
- New features
- A new and improved interactive interpreter, based on
PyPy's, featuring multi-line editing and color support, as
well as colorized exception tracebacks.
- An experimental free-threaded build mode, which disables
the Global Interpreter Lock, allowing threads to run
more concurrently. The build mode is available as an
experimental feature in the Windows and macOS installers as
well.
- A preliminary, experimental JIT, providing the ground work
for significant performance improvements.
- The locals() builtin function (and its C equivalent)
now has well-defined semantics when mutating the
returned mapping, which allows debuggers to operate more
consistently.
- A modified version of mimalloc is now included, optional
but enabled by default if supported by the platform, and
required for the free-threaded build mode.
- Docstrings now have their leading indentation stripped,
reducing memory use and the size of .pyc files. (Most tools
handling docstrings already strip leading indentation.)
- The dbm module has a new dbm.sqlite3 backend that is used
by default when creating new files.
- WASI is now a Tier 2 supported platform. Emscripten is
no longer an officially supported platform (but Pyodide
continues to support Emscripten).
- Typing
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=56
- Update to 3.13.0~rc3:
- The most important change is rolling back the incremental
cyclic garbage collector (GC), which was added in one of
the alpha releases. The incremental GC had more significant
performance regressions in specific workloads than we
expected.
- Tests
- gh-124378: Updated test_ttk to pass with Tcl/Tk 8.6.15.
- Library
- gh-124538: Fixed crash when using gc.get_referents() on a
capsule object.
- gh-124498: Fix typing.TypeAliasType not to be generic, when
type_params is an empty tuple.
- gh-123017: Due to unreliable results on some devices,
time.strftime() no longer accepts negative years on
Android.
- gh-123014: os.pidfd_open() and signal.pidfd_send_signal()
are now unavailable when building against Android API
levels older than 31, since the underlying system calls may
cause a crash.
- gh-124248: Fixed potential crash when using struct to
process zero-width ‘Pascal string’ fields (0p).
- gh-87041: Fix a bug in argparse where lengthy subparser
argument help is incorrectly indented.
- gh-124212: Fix invalid variable in venv handling of failed
symlink on Windows
- gh-124171: Add workaround for broken fmod() implementations
on Windows, that loose zero sign (e.g. fmod(-10, 1) returns
0.0). Patch by Sergey B Kirpichev.
- gh-123934: Fix unittest.mock.MagicMock reseting magic
methods return values after .reset_mock(return_value=True)
was called.
- gh-123968: Fix the command-line interface for the random
module to select floats between 0 and N, not 1 and N.
- gh-123892: Add "_wmi" to sys.stdlib_module_names. Patch by
Victor Stinner.
- gh-123339: Fix inspect.getsource() for classes
in collections.abc and decimal (for pure Python
implementation) modules. inspect.getcomments() now raises
OSError instead of IndexError if the __firstlineno__ value
for a class is out of bound.
- gh-121735: When working with zip archives,
importlib.resources now properly honors module-adjacent
references (e.g. files(pkg.mod) and not just files(pkg)).
- gh-122145: Fix an issue when reporting tracebacks
corresponding to Python code emitting an empty AST
body. Patch by Nikita Sobolev and Bénédikt Tran.
- gh-119004: Fix a crash in OrderedDict.__eq__ when operands
are mutated during the check. Patch by Bénédikt Tran.
- bpo-44864: Do not translate user-provided strings in
argparse.ArgumentParser.
- IDLE
- gh-112938: Fix uninteruptable hang when Shell gets rapid
continuous output.
- gh-120104: Fix padding in config and search dialog windows
in IDLE.
- Documentation
- gh-124720: Update “Using Python on a Mac” section of the
“Python Setup and Usage” document and include information
on installing free-threading support.
- gh-116622: Add an Android platform guide, and flag modules
not available on Android.
- Core and Builtins
- gh-124567: Revert the incremental GC (in 3.13), since it’s
not clear the benefits outweigh the costs at this point.
- gh-124642: Fixed scalability issue in free-threaded builds
for lock-free reads from dictionaries in multi-threaded
scenarios
- gh-116510: Fix a bug that can cause a crash when
sub-interpreters use “basic” single-phase extension
modules. Shared objects could refer to PyGC_Head nodes that
had been freed as part of interpreter cleanup.
- gh-124547: When deallocating an object with inline values
whose __dict__ is still live: if memory allocation for the
inline values fails, clear the dictionary. Prevents an
interpreter crash.
- gh-124513: Fix a crash in FrameLocalsProxy constructor:
check the number of arguments. Patch by Victor Stinner.
- gh-124442: Fix nondeterminism in compilation by sorting the
value of __static_attributes__. Patch by kp2pml30.
- gh-123856: Fix PyREPL failure when a keyboard interrupt is
triggered after using a history search
- gh-65961: Document the deprecation of setting and using
__package__ and __cached__.
- gh-124027: Support <page up>, <page down>, and <delete>
keys in the Python REPL when $TERM is set to vt100.
- gh-77894: Fix possible crash in the garbage collector when
it tries to break a reference loop containing a memoryview
object. Now a memoryview object can only be cleared if
there are no buffers that refer it.
- gh-123339: Setting the __module__ attribute for a class now
removes the __firstlineno__ item from the type’s dict, so
they will no longer be inconsistent.
- C API
- gh-124160: Fix crash when importing modules containing
state and single-phase initialization in a subinterpreter.
- gh-123880: Fixed a bug that prevented circular imports of
extension modules that use single-phase initialization.
- Build
- gh-124487: Windows builds now use Windows 8.1 as their API
baseline (installation already required Windows 8.1).
- gh-124043: Building using --with-trace-refs is
(temporarily) disallowed when the GIL is disabled.
- Remove upstreamed patch:
- gh-124040-fix-test-math-i586.patch
OBS-URL: https://build.opensuse.org/request/show/1205032
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=9
- The most important change is rolling back the incremental
cyclic garbage collector (GC), which was added in one of
the alpha releases. The incremental GC had more significant
performance regressions in specific workloads than we
expected.
- Tests
- gh-124378: Updated test_ttk to pass with Tcl/Tk 8.6.15.
- Library
- gh-124538: Fixed crash when using gc.get_referents() on a
capsule object.
- gh-124498: Fix typing.TypeAliasType not to be generic, when
type_params is an empty tuple.
- gh-123017: Due to unreliable results on some devices,
time.strftime() no longer accepts negative years on
Android.
- gh-123014: os.pidfd_open() and signal.pidfd_send_signal()
are now unavailable when building against Android API
levels older than 31, since the underlying system calls may
cause a crash.
- gh-124248: Fixed potential crash when using struct to
process zero-width ‘Pascal string’ fields (0p).
- gh-87041: Fix a bug in argparse where lengthy subparser
argument help is incorrectly indented.
- gh-124212: Fix invalid variable in venv handling of failed
symlink on Windows
- gh-124171: Add workaround for broken fmod() implementations
on Windows, that loose zero sign (e.g. fmod(-10, 1) returns
0.0). Patch by Sergey B Kirpichev.
- gh-123934: Fix unittest.mock.MagicMock reseting magic
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=51
- Update to 3.13.0~rc2:
- Tools/Demos
- gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
- Tests
- gh-119727: Add --single-process command line option to
Python test runner (regrtest). Patch by Victor Stinner.
- gh-101525: Skip test_gdb if the binary is relocated by
BOLT. Patch by Donghee Na.
- Security
- gh-123678: Upgrade libexpat to 2.6.3
- gh-121285: Remove backtracking from tarfile header parsing
for hdrcharset, PAX, and GNU sparse headers (bsc#1230227,
CVE-2024-6232).
- Library
- gh-123448: Fixed memory leak of typing.NoDefault by moving
it to the static types array.
- gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
according to RFC 3596, §2.5. Patch by Bénédikt Tran.
- gh-123270: Applied a more surgical fix for malformed
payloads in zipfile.Path causing infinite loops (gh-122905)
without breaking contents using legitimate characters
(bsc#1229704, CVE-2024-8088).
- gh-123228: Fix return type for
_pyrepl.readline._ReadlineWrapper.get_line_buffer() to be
str(). Patch by Sergey B Kirpichev.
- gh-123240: Raise audit events for the input() in the new
REPL.
- gh-123243: Fix memory leak in _decimal.
- gh-122546: Consistently use same file name for different
OBS-URL: https://build.opensuse.org/request/show/1199398
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=7
- Tools/Demos
- gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
- Tests
- gh-119727: Add --single-process command line option to
Python test runner (regrtest). Patch by Victor Stinner.
- gh-101525: Skip test_gdb if the binary is relocated by
BOLT. Patch by Donghee Na.
- Security
- gh-123678: Upgrade libexpat to 2.6.3
- gh-121285: Remove backtracking from tarfile header parsing
for hdrcharset, PAX, and GNU sparse headers (bsc#1230227,
CVE-2024-6232).
- Library
- gh-123448: Fixed memory leak of typing.NoDefault by moving
it to the static types array.
- gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
according to RFC 3596, §2.5. Patch by Bénédikt Tran.
- gh-123270: Applied a more surgical fix for malformed
payloads in zipfile.Path causing infinite loops (gh-122905)
without breaking contents using legitimate characters
(bsc#1229704, CVE-2024-8088).
- gh-123228: Fix return type for
_pyrepl.readline._ReadlineWrapper.get_line_buffer() to be
str(). Patch by Sergey B Kirpichev.
- gh-123240: Raise audit events for the input() in the new
REPL.
- gh-123243: Fix memory leak in _decimal.
- gh-122546: Consistently use same file name for different
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=46
- Add gh122136-test_asyncio-kernel-buffer-data.patch fixing
gh#python/cpython#122136 (changes in kernel provide different
amount of data in the socket buffers).
- Remove skip_test_abort_clients.patch, which is not needed any
more.
- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
malformed payload to cause infinite loops in zipfile.Path
(bsc#1229704, CVE-2024-8088).
OBS-URL: https://build.opensuse.org/request/show/1197482
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=6
- Add CVE-2024-6923-email-hdr-inject.patch to prevent email
header injection due to unquoted newlines (bsc#1228780,
CVE-2024-6923).
- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
adding reproducibility patches from gh#python/cpython!121872
and gh#python/cpython!121883.
- Add skip_test_abort_clients.patch (gh#python/cpython#122136)
skip not yet fixed failing test
- %{profileopt} variable is set according to the variable
%{do_profiling} (bsc#1227999)
- Update bluez-devel-vendor.tar.xz
- Update to 3.13.0~rc1:
- Tests
- gh-59022: Add tests for pkgutil.extend_path(). Patch by
Andreas Stocker.
- gh-99242: os.getloadavg() may throw OSError when
running regression tests under certain conditions (e.g.
chroot). This error is now caught and ignored, since
reporting load average is optional.
- Security
- gh-122133: Authenticate the socket connection for the
socket.socketpair() fallback on platforms where AF_UNIX is
not available like Windows.
- Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson
<seth@python.org>. Reported by Ellie <el@horse64.org>
- gh-121957: Fixed missing audit events around interactive
use of Python, now also properly firing for python -i, as
well as for python -m asyncio. The events in question are
cpython.run_stdin and cpython.run_startup.
OBS-URL: https://build.opensuse.org/request/show/1192376
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python313?expand=0&rev=4
- Tests
- gh-59022: Add tests for pkgutil.extend_path(). Patch by
Andreas Stocker.
- gh-99242: os.getloadavg() may throw OSError when
running regression tests under certain conditions (e.g.
chroot). This error is now caught and ignored, since
reporting load average is optional.
- Security
- gh-122133: Authenticate the socket connection for the
socket.socketpair() fallback on platforms where AF_UNIX is
not available like Windows.
- Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson
<seth@python.org>. Reported by Ellie <el@horse64.org>
- gh-121957: Fixed missing audit events around interactive
use of Python, now also properly firing for python -i, as
well as for python -m asyncio. The events in question are
cpython.run_stdin and cpython.run_startup.
- Library
- gh-122400: Handle ValueErrors raised by os.stat() in
filecmp.dircmp and filecmp.cmpfiles(). Patch by Bénédikt
Tran.
- gh-122311: Fix some error messages in pickle.
- gh-122332: Fixed segfault with asyncio.Task.get_coro() when
using an eager task factory.
- gh-105733: ctypes.ARRAY() is now soft deprecated: it no
longer emits deprecation warnings and is not scheduled for
removal.
- gh-122087: Restore inspect.ismethoddescriptor() and
inspect.isroutine() returning False for functools.partial
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=31
