Commit Graph

86 Commits

Author SHA256 Message Date
28396815e4 Update to 3.13.12:
- Tools/Demos
    - gh-142095: Make gdb ‘py-bt’ command use frame from thread
      local state when available. Patch by Sam Gross and Victor
      Stinner.
  - Tests
    - gh-144415: The Android testbed now distinguishes between
      stdout/stderr messages which were triggered by a newline,
      and those triggered by a manual call to flush. This fixes
      logging of progress indicators and similar content.
    - gh-65784: Add support for parametrized resource wantobjects
      in regrtests, which allows to run Tkinter tests with the
      specified value of tkinter.wantobjects, for example -u
      wantobjects=0.
    - gh-143553: Add support for parametrized resources, such as
      -u xpickle=2.7.
    - gh-142836: Accommodated Solaris in
      test_pdb.test_script_target_anonymous_pipe.
    - gh-129401: Fix a flaky test in test_repr_rlock that checks
      the representation of multiprocessing.RLock.
    - bpo-31391: Forward-port test_xpickle from Python 2 to
      Python 3 and add the resource back to test’s command line.
  - Security
    - gh-144125: BytesGenerator will now refuse to serialize
      (write) headers that are unsafely folded or delimited; see
      verify_generated_headers. (Contributed by Bas Bloemsaat and
      Petr Viktorin in gh-121650).
    - gh-143935: Fixed a bug in the folding of comments when
      flattening an email message using a modern email policy.
      Comments consisting of a very long sequence of non-foldable
      characters could trigger a forced line wrap that omitted
      the required leading space on the continuation line,
      causing the remainder of the comment to be interpreted as
      a new header field. This enabled header injection with
      carefully crafted inputs.
    - gh-143925: Reject control characters in data: URL media
      types.
    - gh-143919: Reject control characters in http.cookies.Morsel
      fields and values.
    - gh-143916: Reject C0 control characters within
      wsgiref.headers.Headers fields, values, and parameters.
  - Library
    - gh-144380: Improve performance of io.BufferedReader line
      iteration by ~49%.
    - gh-144169: Fix three crashes when non-string keyword
      arguments are supplied to objects in the ast module.
    - gh-144100: Fixed a crash in ctypes when using a deprecated
      POINTER(str) type in argtypes. Instead of aborting, ctypes
      now raises a proper Python exception when the pointer
      target type is unresolved.
    - gh-144050: Fix stat.filemode() in the pure-Python
      implementation to avoid misclassifying invalid mode values
      as block devices.
    - gh-144023: Fixed validation of file descriptor 0 in posix
      functions when used with follow_symlinks parameter.
    - gh-143999: Fix an issue where inspect.getgeneratorstate()
      and inspect.getcoroutinestate() could fail for generators
      wrapped by types.coroutine() in the suspended state.
    - gh-143706: Fix multiprocessing forkserver so that sys.argv
      is correctly set before __main__ is preloaded. Previously,
      sys.argv was empty during main module import in forkserver
      child processes. This fixes a regression introduced in
      3.13.8 and 3.14.1. Root caused by Aaron Wieczorek, test
      provided by Thomas Watson, thanks!
    - gh-143638: Forbid reentrant calls of the pickle.Pickler and
      pickle.Unpickler methods for the C implementation.
      Previously, this could cause crash or data corruption, now
      concurrent calls of methods of the same object raise
      RuntimeError.
    - gh-78724: Raise RuntimeError’s when user attempts to call
      methods on half-initialized Struct objects, For example,
      created by Struct.__new__(Struct). Patch by Sergey
      B Kirpichev.
    - gh-143602: Fix a inconsistency issue in write() that leads
      to unexpected buffer overwrite by deduplicating the buffer
      exports.
    - gh-143547: Fix sys.unraisablehook() when the hook raises an
      exception and changes sys.unraisablehook(): hold a strong
      reference to the old hook. Patch by Victor Stinner.
    - gh-143378: Fix use-after-free crashes when a BytesIO object
      is concurrently mutated during write() or writelines().
    - gh-143346: Fix incorrect wrapping of the Base64 data in
      plistlib._PlistWriter when the indent contains a mix of
      tabs and spaces.
    - gh-143310: tkinter: fix a crash when a Python list is
      mutated during the conversion to a Tcl object (e.g., when
      setting a Tcl variable). Patch by Bénédikt Tran.
    - gh-143309: Fix a crash in os.execve() on non-Windows
      platforms when given a custom environment mapping which is
      then mutated during parsing. Patch by Bénédikt Tran.
    - gh-143308: pickle: fix use-after-free crashes when
      a PickleBuffer is concurrently mutated by a custom buffer
      callback during pickling. Patch by Bénédikt Tran and Aaron
      Wieczorek.
    - gh-143237: Fix support of named pipes in the rotating
      logging handlers.
    - gh-143249: Fix possible buffer leaks in Windows overlapped
      I/O on error handling.
    - gh-143241: zoneinfo: fix infinite loop in
      ZoneInfo.from_file when parsing a malformed TZif file.
      Patch by Fatih Celik.
    - gh-142830: sqlite3: fix use-after-free crashes when the
      connection’s callbacks are mutated during a callback
      execution. Patch by Bénédikt Tran.
    - gh-143200: xml.etree.ElementTree: fix use-after-free
      crashes in __getitem__() and __setitem__() methods of
      Element when the element is concurrently mutated. Patch by
      Bénédikt Tran.
    - gh-142195: Updated timeout evaluation logic in subprocess
      to be compatible with deterministic environments like
      Shadow where time moves exactly as requested.
    - gh-143145: Fixed a possible reference leak in ctypes when
      constructing results with multiple output parameters on
      error.
    - gh-122431: Corrected the error message in
      readline.append_history_file() to state that nelements must
      be non-negative instead of positive.
    - gh-143004: Fix a potential use-after-free in
      collections.Counter.update() when user code mutates the
      Counter during an update.
    - gh-143046: The asyncio REPL no longer prints copyright and
      version messages in the quiet mode (-q). Patch by Bartosz
      Sławecki.
    - gh-140648: The asyncio REPL now respects the -I flag
      (isolated mode). Previously, it would load and execute
      PYTHONSTARTUP even if the flag was set. Contributed by
      Bartosz Sławecki.
    - gh-142991: Fixed socket operations such as recvfrom() and
      sendto() for FreeBSD divert(4) socket.
    - gh-143010: Fixed a bug in mailbox where the precise timing
      of an external event could result in the library opening an
      existing file instead of a file it expected to create.
    - gh-142881: Fix concurrent and reentrant call of
      atexit.unregister().
    - gh-112127: Fix possible use-after-free in
      atexit.unregister() when the callback is unregistered
      during comparison.
    - gh-142783: Fix zoneinfo use-after-free with descriptor
      _weak_cache. a descriptor as _weak_cache could cause
      crashes during object creation. The fix ensures proper
      reference counting for descriptor-provided objects.
    - gh-142754: Add the ownerDocument attribute to
      xml.dom.minidom elements and attributes created by directly
      instantiating the Element or Attr class. Note that this way
      of creating nodes is not supported; creator functions like
      xml.dom.Document.documentElement() should be used instead.
    - gh-142784: The asyncio REPL now properly closes the loop
      upon the end of interactive session. Previously, it could
      cause surprising warnings. Contributed by Bartosz Sławecki.
    - gh-142555: array: fix a crash in a[i] = v when converting
      i to an index via i.__index__ or i.__float__ mutates the
      array.
    - gh-142594: Fix crash in TextIOWrapper.close() when the
      underlying buffer’s closed property calls detach().
    - gh-142451: hmac: Ensure that the HMAC.block_size attribute
      is correctly copied by HMAC.copy. Patch by Bénédikt Tran.
    - gh-142495: collections.defaultdict now prioritizes
      __setitem__() when inserting default values from
      default_factory. This prevents race conditions where
      a default value would overwrite a value set before
      default_factory returns.
    - gh-142651: unittest.mock: fix a thread safety issue where
      Mock.call_count may return inaccurate values when the mock
      is called concurrently from multiple threads.
    - gh-142595: Added type check during initialization of the
      decimal module to prevent a crash in case of broken stdlib.
      Patch by Sergey B Kirpichev.
    - gh-142517: The non-compat32 email policies now correctly
      handle refolding encoded words that contain bytes that can
      not be decoded in their specified character set. Previously
      this resulted in an encoding exception during folding.
    - gh-112527: The help text for required options in argparse
      no longer extended with “ (default: None)”.
    - gh-142315: Pdb can now run scripts from anonymous pipes
      used in process substitution. Patch by Bartosz Sławecki.
    - gh-142282: Fix winreg.QueryValueEx() to not accidentally
      read garbage buffer under race condition.
    - gh-75949: Fix argparse to preserve | separators in mutually
      exclusive groups when the usage line wraps due to length.
    - gh-68552: MisplacedEnvelopeHeaderDefect and Missing header
      name defects are now correctly passed to the handle_defect
      method of policy in FeedParser.
    - gh-142006: Fix a bug in the email.policy.default folding
      algorithm which incorrectly resulted in a doubled newline
      when a line ending at exactly max_line_length was followed
      by an unfoldable token.
    - gh-105836: Fix asyncio.run_coroutine_threadsafe() leaving
      underlying cancelled asyncio task running.
    - gh-139971: pydoc: Ensure that the link to the online
      documentation of a stdlib module is correct.
    - gh-139262: Some keystrokes can be swallowed in the new
      PyREPL on Windows, especially when used together with the
      ALT key. Fix by Chris Eibl.
    - gh-138897: Improved license/copyright/credits display in
      the REPL: now uses a pager.
    - gh-79986: Add parsing for References and In-Reply-To
      headers to the email library that parses the header content
      as lists of message id tokens. This prevents them from
      being folded incorrectly.
    - gh-109263: Starting a process from spawn context in
      multiprocessing no longer sets the start method globally.
    - gh-90871: Fixed an off by one error concerning the backlog
      parameter in create_unix_server(). Contributed by Christian
      Harries.
    - gh-133253: Fix thread-safety issues in linecache.
    - gh-132715: Skip writing objects during marshalling once
      a failure has occurred.
    - gh-127529: Correct behavior of
      asyncio.selector_events.BaseSelectorEventLoop._accept_connection()
      in handling ConnectionAbortedError in a loop. This improves
      performance on OpenBSD.
  - IDLE
    - gh-143774: Better explain the operation of Format / Format
      Paragraph.
  - Documentation
    - gh-140806: Add documentation for enum.bin().
  - Core and Builtins
    - gh-144307: Prevent a reference leak in module teardown at
      interpreter finalization.
    - gh-144194: Fix error handling in perf jitdump
      initialization on memory allocation failure.
    - gh-141805: Fix crash in set when objects with the same hash
      are concurrently added to the set after removing an element
      with the same hash while the set still contains elements
      with the same hash.
    - gh-143670: Fixes a crash in ga_repr_items_list function.
    - gh-143377: Fix a crash in _interpreters.capture_exception()
      when the exception is incorrectly formatted. Patch by
      Bénédikt Tran.
    - gh-143189: Fix crash when inserting a non-str key into
      a split table dictionary when the key matches an existing
      key in the split table but has no corresponding value in
      the dict.
    - gh-143228: Fix use-after-free in perf trampoline when
      toggling profiling while threads are running or during
      interpreter finalization with daemon threads active. The
      fix uses reference counting to ensure trampolines are not
      freed while any code object could still reference them.
      Pach by Pablo Galindo
    - gh-142664: Fix a use-after-free crash in
      memoryview.__hash__ when the __hash__ method of the
      referenced object mutates that object or the view. Patch by
      Bénédikt Tran.
    - gh-142557: Fix a use-after-free crash in bytearray.__mod__
      when the bytearray is mutated while formatting the %-style
      arguments. Patch by Bénédikt Tran.
    - gh-143195: Fix use-after-free crashes in bytearray.hex()
      and memoryview.hex() when the separator’s __len__() mutates
      the original object. Patch by Bénédikt Tran.
    - gh-143135: Set sys.flags.inspect to 1 when PYTHONINSPECT is
      0. Previously, it was set to 0 in this case.
    - gh-143003: Fix an overflow of the shared empty buffer in
      bytearray.extend() when __length_hint__() returns 0 for
      non-empty iterator.
    - gh-143006: Fix a possible assertion error when comparing
      negative non-integer float and int with the same number of
      bits in the integer part.
    - gh-142776: Fix a file descriptor leak in import.c
    - gh-142829: Fix a use-after-free crash in
      contextvars.Context comparison when a custom __eq__ method
      modifies the context via set().
    - gh-142766: Clear the frame of a generator when
      generator.close() is called.
    - gh-142737: Tracebacks will be displayed in fallback mode
      even if io.open() is lost. Previously, this would crash the
      interpreter. Patch by Bartosz Sławecki.
    - gh-142554: Fix a crash in divmod() when
      _pylong.int_divmod() does not return a tuple of length two
      exactly. Patch by Bénédikt Tran.
    - gh-142560: Fix use-after-free in bytearray search-like
      methods (find(), count(), index(), rindex(), and rfind())
      by marking the storage as exported which causes
      reallocation attempts to raise BufferError. For contains(),
      split(), and rsplit() the buffer protocol is used for this.
    - gh-142343: Fix SIGILL crash on m68k due to incorrect
      assembly constraint.
    - gh-141732: Ensure the __repr__() for ExceptionGroup and
      BaseExceptionGroup does not change when the exception
      sequence that was original passed in to its constructor is
      subsequently mutated.
    - gh-100964: Fix reference cycle in exhausted generator
      frames. Patch by Savannah Ostrowski.
    - gh-140373: Correctly emit PY_UNWIND event when generator
      object is closed. Patch by Mikhail Efimov.
    - gh-138568: Adjusted the built-in help() function so that
      empty inputs are ignored in interactive mode.
    - gh-127773: Do not use the type attribute cache for types
      with incompatible MRO.
  - C API
    - gh-142571: PyUnstable_CopyPerfMapFile() now checks that
      opening the file succeeded before flushing.
  - Build
    - gh-142454: When calculating the digest of the JIT stencils
      input, sort the hashed files by filenames before adding
      their content to the hasher. This ensures deterministic
      hash input and hence deterministic hash, independent on
      filesystem order.
    - gh-141808: When running make clean-retain-profile, keep the
      generated JIT stencils. That way, the stencils are not
      generated twice when Profile-guided optimization (PGO) is
      used. It also allows distributors to supply their own
      pre-built JIT stencils.
    - gh-138061: Ensure reproducible builds by making JIT stencil
      header generation deterministic.
Remove upstreamed patches:
  - CVE-2024-6923-follow-up-EOL-email-headers.patch
  - gh138131-exclude-pycache-from-digest.patch
2026-02-06 11:42:54 +01:00
6230bce579 Add CVE-2024-6923-follow-up-EOL-email-headers.patch
It is a follow-up to the previous fix of CVE-2024-6923 further encoding
EOL possibly hidden in email headers (bsc#1257181).
2026-01-29 00:35:53 +01:00
8b786ccb53 Update to 3.13.11 2025-12-19 19:38:03 +01:00
6807e0fac4 Add pass-test_write_read_limited_history.patch:
Fix readline history truncation when length is reduced

  The `readline.set_history_length()` function did not previously
  truncate the in-memory history when the new length was set to
  a value smaller than the current number of history items. This
  could lead to unexpected behavior where `get_history_length()`
  would still report the old length and writing the history to a
  file would write more entries than the new limit.

  This patch modifies `set_history_length()` to explicitly
  remove the oldest history entries using `remove_history()`
  when the length is decreased, ensuring the in-memory history
  is correctly truncated to the new limit. This brings the
  function's behavior in line with expectations and fixes
  failures in `test_write_read_limited_history`.
2025-11-20 23:05:53 +01:00
a8f3f2707f Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
quadratic complexity vulnerabilities of os.path.expandvars()
(CVE-2025-6075, bsc#1252974).
2025-11-20 23:05:53 +01:00
02c7c3ac57 Add CVE-2025-8291-consistency-zip64.patch
Checks consistency of the zip64 end of central directory record,
and preventing obfuscation of the payload, i.e., you scanning for
malicious content in a ZIP file with one ZIP parser (let's say a
Rust one) then unpack it in production with another (e.g., the
Python one) and get malicious content that the other parser did
not see (CVE-2025-8291, bsc#1251305)

Readjust patches while synchronizing between openSUSE and SLE trees:
  - F00251-change-user-install-location.patch
  - doc-py38-to-py36.patch
  - gh126985-mv-pyvenv.cfg2getpath.patch
2025-11-20 23:05:53 +01:00
216aee44d2 Accepting request 1311480 from home:dgarcia:branches:devel:languages:python:Factory
- Update to 3.13.9:
  - Library
    - gh-139783: Fix inspect.getsourcelines() for the case when a
      decorator is followed by a comment or an empty line.
- Update to 3.13.8:
  - macOS
    - gh-124111: Update macOS installer to use Tcl/Tk 8.6.17.
    - gh-139573: Updated bundled version of OpenSSL to 3.0.18.
  - Windows
    - gh-139573: Updated bundled version of OpenSSL to 3.0.18.
    - gh-138896: Fix error installing C runtime on non-updated Windows
      machines
  - Tools/Demos
    - gh-139330: SBOM generation tool didn’t cross-check the version
      and checksum values against the Modules/expat/refresh.sh script,
      leading to the values becoming out-of-date during routine
      updates.
    - gh-137873: The iOS test runner has been simplified, resolving
      some issues that have been observed using the runner in GitHub
      Actions and Azure Pipelines test environments.
  - Tests
    - gh-139208: Fix regrtest --fast-ci --verbose: don’t ignore the
      --verbose option anymore. Patch by Victor Stinner.
  - Security
    - gh-139400: xml.parsers.expat: Make sure that parent Expat
      parsers are only garbage-collected once they are no longer
      referenced by subparsers created by
      ExternalEntityParserCreate(). Patch by Sebastian Pipping.
    - gh-139283: sqlite3: correctly handle maximum number of rows to
      fetch in Cursor.fetchmany and reject negative values for

OBS-URL: https://build.opensuse.org/request/show/1311480
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=128
2025-10-16 16:27:11 +00:00
6ccfd57cb6 Accepting request 1307678 from home:dgarcia:branches:devel:languages:python:Factory
- Add gh139257-Support-docutils-0.22.patch to fix build with latest
  docutils (>=0.22) gh#python/cpython#139257

OBS-URL: https://build.opensuse.org/request/show/1307678
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=126
2025-09-29 16:57:25 +00:00
97f2e50954 Accepting request 1306454 from home:dimstar:Factory
- Drop AppStream: this results in a different cycle than
  appstream-glib. As the appdata.xml is controlled by ourselves, we
  can get away with just manually validating it when changing it.

OBS-URL: https://build.opensuse.org/request/show/1306454
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=124
2025-09-22 12:45:38 +00:00
d782ad00ca - Require AppStream to validate appdata file instead of deprecated
appstream-glib.
- Update idle3.appdata.xml to pass the more pedantic appstreamcli.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=123
2025-09-18 14:05:23 +00:00
45ae9e0091 Accepting request 1303343 from home:dgarcia:branches:devel:languages:python:Factory
- Add gh138131-exclude-pycache-from-digest.patch fixing reproducible
  build for python-nogil.
  (bsc#1244680, gh#python/cpython#138131)

OBS-URL: https://build.opensuse.org/request/show/1303343
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=121
2025-09-12 07:39:47 +00:00
f819c56b57 - Update to 3.13.7:
- gh-137583: Fix a deadlock introduced in 3.13.6 when a call
    to ssl.SSLSocket.recv was blocked in one thread, and then
    another method on the object (such as ssl.SSLSocket.send) was
    subsequently called in another thread.
  - gh-137044: Return large limit values as positive integers
    instead of negative integers in resource.getrlimit().
    Accept large values and reject negative values (except
    RLIM_INFINITY) for limits in resource.setrlimit().
  - gh-136914: Fix retrieval of doctest.DocTest.lineno
    for objects decorated with functools.cache() or
    functools.cached_property.
  - gh-131788: Make ResourceTracker.send from multiprocessing
    re-entrant safe
  - gh-136155: We are now checking for fatal errors in EPUB
    builds in CI.
  - gh-137400: Fix a crash in the free threading build when
    disabling profiling or tracing across all threads with
    PyEval_SetProfileAllThreads() or PyEval_SetTraceAllThreads()
    or their Python equivalents threading.settrace_all_threads()
    and threading.setprofile_all_threads().
- Remove upstreamed patch:
  - gh137583-only-lock-SSL-context.patch

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=119
2025-08-15 12:33:36 +00:00
af83d0ea02 - Add gh137583-only-lock-SSL-context.patch fixing the
regression in 3.13.6 by breaking non-blocking TLS connections
  (gh#python/cpython#137583).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=117
2025-08-12 09:37:56 +00:00
588cd5ec7f declarations are automatically closed, tags are ignored
(CVE-2025-6069, bsc#1244705).
- Remove upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=116
2025-08-07 10:56:04 +00:00
4a974dadae - Update to 3.13.6:
Python 3.13.6 final
Release date: 2025-08-06
  - Tools/Demos
    - gh-135968: Stubs for strip are now provided as part of an
      iOS install.
  - Tests
    - gh-135966: The iOS testbed now handles the app_packages
      folder as a site directory.
    - gh-135494: Fix regrtest to support excluding tests from
      --pgo tests. Patch by Victor Stinner.
    - gh-135489: Show verbose output for failing tests during PGO
      profiling step with –enable-optimizations.
  - Security
    - gh-135661: Fix parsing start and end tags in
      html.parser.HTMLParser according to the HTML5 standard.
        - Whitespaces no longer accepted between </ and the tag
          name. E.g. </ script> does not end the script section.
        - Vertical tabulation (\v) and non-ASCII whitespaces no
          longer recognized as whitespaces. The only whitespaces
          are \t\n\r\f and space.
        - Null character (U+0000) no longer ends the tag name.
        - Attributes and slashes after the tag name in end tags
          are now ignored, instead of terminating after the first
          > in quoted attribute value. E.g. </script/foo=">"/>.
        - Multiple slashes and whitespaces between the last
          attribute and closing > are now ignored in both start
          and end tags. E.g. <a foo=bar/ //>.
        - Multiple = between attribute name and value are no
          longer collapsed. E.g. <a foo==bar> produces attribute

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=115
2025-08-07 10:16:41 +00:00
0c1f23a3d6 - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
validates archives to ensure member offsets are non-negative
  (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=113
2025-08-01 20:14:12 +00:00
8fc89fce82 - Fix gil/nogil package description, bsc#1246229
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=111
2025-07-10 10:18:09 +00:00
5584dde572 - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
case quadratic complexity when processing certain crafted
  malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=110
2025-07-02 14:51:36 +00:00
b30cd19ff8 - Add bsc1243155-sphinx-non-determinism.patch (bsc#1243155) to
generate ids for audit_events using docname (reproducible
  builds).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=109
2025-07-02 13:52:43 +00:00
cb554c7d4c Accepting request 1289841 from home:dgarcia:branches:devel:languages:python:Factory
- Use one core to build doc. This will make sphinx doc build
  reproducible.
  bsc#1243155

OBS-URL: https://build.opensuse.org/request/show/1289841
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=108
2025-07-02 11:27:27 +00:00
cf3b0e517c Add link to bsc#1244061 to changelog.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=106
2025-06-25 19:43:42 +00:00
7d8817d9bb - Substantially rewritten doc-py38-to-py36.patch patch to be more
flexible and covering even unexpected changes.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=104
2025-06-22 19:29:14 +00:00
308dfaef9b Accepting request 1287576 from home:msmeissn:branches:devel:languages:python:Factory
- adjusted sofilename for "nogil" build correctly.

OBS-URL: https://build.opensuse.org/request/show/1287576
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=103
2025-06-22 16:37:53 +00:00
c2d30804e6 - Update to 3.13.5:
- Tests
    - gh-135120: Add test.support.subTests().
  - Library
    - gh-133967: Do not normalize locale name ‘C.UTF-8’ to
      ‘en_US.UTF-8’.
    - gh-135326: Restore support of integer-like objects with
      __index__() in random.getrandbits().
    - gh-135321: Raise a correct exception for values greater
      than 0x7fffffff for the BINSTRING opcode in the C
      implementation of pickle.
    - gh-135276: Backported bugfixes in zipfile.Path from
      zipp 3.23. Fixed .name, .stem and other basename-based
      properties on Windows when working with a zipfile on disk.
    - gh-134151: email: Fix TypeError in
      email.utils.decode_params() when sorting RFC 2231
      continuations that contain an unnumbered section.
    - gh-134152: email: Fix parsing of email message ID with
      invalid domain.
    - gh-127081: Fix libc thread safety issues with os by
      replacing getlogin with getlogin_r re-entrant version.
    - gh-131884: Fix formatting issues in json.dump() when both
      indent and skipkeys are used.
  - Core and Builtins
    - gh-135171: Roll back changes to generator and list
      comprehensions that went into 3.13.4 to fix gh-127682,
      but which involved semantic and bytecode changes not
      appropriate for a bugfix release.
  - C API
    - gh-134989: Fix Py_RETURN_NONE, Py_RETURN_TRUE and

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=102
2025-06-11 22:06:33 +00:00
6072bbdbcd - Update to 3.13.4:
- Security
    - gh-135034: Fixes multiple issues that allowed tarfile
      extraction filters (filter="data" and filter="tar") to be
      bypassed using crafted symlinks and hard links.
      Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
      (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
      CVE-2025-4517 (bsc#1244032).
    - gh-133767: Fix use-after-free in the “unicode-escape”
      decoder with a non-“strict” error handler (CVE-2025-4516,
      bsc#1243273).
    - gh-128840: Short-circuit the processing of long IPv6
      addresses early in ipaddress to prevent excessive memory
      consumption and a minor denial-of-service.
  - Library
    - gh-134718: ast.dump() now only omits None and [] values if
      they are default values.
    - gh-128840: Fix parsing long IPv6 addresses with embedded
      IPv4 address.
    - gh-134696: Built-in HACL* and OpenSSL implementations of
      hash function constructors now correctly accept the same
      documented named arguments. For instance, md5() could be
      previously invoked as md5(data=data) or md5(string=string)
      depending on the underlying implementation but these calls
      were not compatible. Patch by Bénédikt Tran.
    - gh-134210: curses.window.getch() now correctly handles
      signals. Patch by Bénédikt Tran.
    - gh-80334: multiprocessing.freeze_support() now checks for
      work on any “spawn” start method platform rather than only
      on Windows.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=100
2025-06-09 21:38:15 +00:00
6d5d3f96b0 - Don't use %elif, it is supported only from rpm 4.15.0, which is
not in SLE-15.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=98
2025-05-28 09:47:26 +00:00
487ae82f04 - Add CVE-2025-4516-DecodeError-handler.patch fixing
CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
  vulnerability, which could lead to DoS.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=96
2025-05-17 07:34:05 +00:00
d8af743464 - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
since kernel 3.6-rc1)

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=94
2025-05-10 11:43:36 +00:00
bb17c93a2a This
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=92
2025-04-16 07:52:47 +00:00
b91bbdde1b - Add gh-126500-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
and gh-127257-ssl-OSError-ERR_LIB_SYS.patch to make the
  interpreter compatible with OpenSSL 3.5 (bsc#1241067).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=90
2025-04-16 07:15:35 +00:00
384d0f4194 - Add gh-132535-rsrc-warn-test_timeout.patch to fix
failing tests in the build system without network access
  (gh#python/cpython#132535).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=89
2025-04-15 22:19:57 +00:00
9e2287fa69 - Add gh126985-mv-pyvenv.cfg2getpath.patch to remove failing
tests in test_sysconfig.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=88
2025-04-15 14:09:42 +00:00
9624a1ae7e - Update to 3.13.3:
- Tools/Demos
    - gh-131852: msgfmt no longer adds the POT-Creation-Date to
      generated .mo files for consistency with GNU msgfmt.
    - gh-85012: Correctly reset msgctxt when compiling messages
      in msgfmt.
    - gh-130025: The iOS testbed now correctly handles symlinks
      used as Python framework references.
  - Tests
    - gh-131050: test_ssl.test_dh_params is skipped if the
      underlying TLS library does not support finite-field
      ephemeral Diffie-Hellman.
    - gh-129200: Multiple iOS testbed runners can now be started
      at the same time without introducing an ambiguity over
      simulator ownership.
    - gh-130292: The iOS testbed will now run successfully on a
      machine that has not previously run Xcode tests (such as CI
      configurations).
    - gh-130293: The tests of terminal colorization are no longer
      sensitive to the value of the TERM variable in the testing
      environment.
    - gh-126332: Add unit tests for pyrepl.
  - Security
    - gh-131809: Update bundled libexpat to 2.7.1
    - gh-131261: Upgrade to libexpat 2.7.0
    - gh-127371: Avoid unbounded buffering for
      tempfile.SpooledTemporaryFile.writelines(). Previously,
      disk spillover was only checked after the lines iterator
      had been exhausted. This is now done after each line is
      written.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=87
2025-04-11 19:56:43 +00:00
415df5f3cd Accepting request 1268534 from devel:languages:python:Factory
revert

OBS-URL: https://build.opensuse.org/request/show/1268534
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=86
2025-04-11 06:10:15 +00:00
3467717953 Accepting request 1253127 from devel:LoongArch:Factory
- don't require rpm-build-python for base to fix bootstrap issue
  after primary_python change
- replace rpm-build-python alias with python-rpm-packaging package name

OBS-URL: https://build.opensuse.org/request/show/1253127
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=85
2025-03-14 22:57:44 +00:00
3bce06d06a Fix bug reference in the changelog
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=83
2025-03-11 06:50:29 +00:00
1e079c98aa Fix bug reference in the changelog
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=82
2025-03-11 06:15:52 +00:00
347e286045 - Skip PGO with %want_reproducible_builds (boo#1040589)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=81
2025-03-10 18:35:58 +00:00
d6f4df3c91 Accepting request 1250070 from home:dgarcia:branches:devel:languages:python:Factory
- Do not build with experimental_jit when primary_python

OBS-URL: https://build.opensuse.org/request/show/1250070
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=79
2025-03-05 06:27:41 +00:00
875a6f6235 - Add doc-py38-to-py36.patch to make documentation buildable on
SLE with older Sphinx.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=77
2025-02-05 16:42:08 +00:00
c596c85ff5 - Update to 3.13.2:
- Tools/Demos
    - gh-128152: Fix a bug where Argument Clinic’s C
      pre-processor parser tried to parse pre-processor
      directives inside C comments. Patch by Erlend Aasland.
  - Tests
    - gh-127906: Test the limited C API in test_cppext. Patch by
      Victor Stinner.
    - gh-127637: Add tests for the dis command-line
      interface. Patch by Bénédikt Tran.
    - gh-126925: iOS test results are now streamed during test
      execution, and the deprecated xcresulttool is no longer
      used.
  - Security
    - gh-105704: When using urllib.parse.urlsplit() and
      urllib.parse.urlparse() host parsing would not reject
      domain names containing square brackets ([ and ]). Square
      brackets are only valid for IPv6 and IPvFuture hosts
      according to RFC 3986 Section 3.2.2. (CVE-2025-0938,
      bsc#1236705)
    - gh-127655: Fixed the
      asyncio.selector_events._SelectorSocketTransport
      transport not pausing writes for the protocol when
      the buffer reaches the high water mark when using
      asyncio.WriteTransport.writelines() (CVE-2024-12254,
      bsc#1234290).
    - gh-126108: Fix a possible NULL pointer dereference in
      PySys_AddWarnOptionUnicode().
    - gh-80222: Fix bug in the folding of quoted strings
      when flattening an email message using a modern email

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=76
2025-02-05 09:57:45 +00:00
dfcfb5ce90 Accepting request 1240511 from home:dgarcia:branches:devel:languages:python:Factory
- Configure externally_managed with a bcond
  https://en.opensuse.org/openSUSE:Python:Externally_managed
  bsc#1228165

OBS-URL: https://build.opensuse.org/request/show/1240511
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=74
2025-01-30 17:35:22 +00:00
d4f884437e - Add CVE-2024-12254-unbound-mem-buffering-SelectorSocketTransport.writelines.patch
preventing exhaustion of memory (gh#python/cpython#127655,
  bsc#1234290, CVE-2024-12254).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=72
2024-12-06 20:46:56 +00:00
d6003ec835 - Update to 3.13.1:
- Tools/Demos
    - gh-126807: Fix extraction warnings in pygettext.py caused
      by mistaking function definitions for function calls.
    - gh-126167: The iOS testbed was modified so that it can be
      used by third-party projects for testing purposes.
  - Tests
    - gh-126909: Fix test_os extended attribute tests to work on
      filesystems with 1 KiB xattr size limit.
    - gh-125041: Re-enable skipped tests for zlib on the
      s390x architecture: only skip checks of the compressed
      bytes, which can be different between zlib’s software
      implementation and the hardware-accelerated implementation.
    - gh-124295: Add translation tests to the argparse module.
  - Security
    - gh-126623: Upgrade libexpat to 2.6.4
    - gh-125140: Remove the current directory from sys.path when
      using PyREPL.
    - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
      consistently use the mapped IPv4 address value for deciding
      properties. Properties which have their behavior fixed are
      is_multicast, is_reserved, is_link_local, is_global, and
      is_unspecified.
  - Library
    - gh-127321: pdb.set_trace() will not stop at an opcode that
      does not have an associated line number anymore.
    - gh-127303: Publicly expose EXACT_TOKEN_TYPES in
      token.__all__.
    - gh-123967: Fix faulthandler for trampoline frames. If the
      top-most frame is a trampoline frame, skip it. Patch by

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=70
2024-12-04 22:01:51 +00:00
64423e0ba5 Accepting request 1227315 from home:dgarcia:branches:devel:languages:python:Factory
- Drop CVE-2023-52425-libexpat-2.6.0-backport-15.6.patch, not needed
  anymore because libexpat is updated to 2.6 in SP7. bsc#1233777

OBS-URL: https://build.opensuse.org/request/show/1227315
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=68
2024-11-29 12:38:51 +00:00
99d319aa5b Accepting request 1224886 from home:dimstar:Factory
hard-coded LLVM_version in the scripts.

Just a typo fixed

OBS-URL: https://build.opensuse.org/request/show/1224886
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=66
2024-11-18 14:04:00 +00:00
c9f290cdec Accepting request 1224835 from home:dimstar:Factory
- Allow building with default LLVM version 19: just replace the
  hard-coded LLVM_version in the scrpts.

OBS-URL: https://build.opensuse.org/request/show/1224835
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=65
2024-11-18 13:48:03 +00:00
6daf155ac4 - Require exact clang18 and llvm18, because apparently CPython is
not ready for 19 yet (gh#python/cpython!125499).

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=64
2024-11-14 17:26:42 +00:00
be126e03ea - Remove -IVendor/ from python-config boo#1231795
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=63
2024-11-14 16:11:33 +00:00
9fd773a946 - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
path names provided when creating a virtual environment
  (bsc#1232241, CVE-2024-9287)

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=61
2024-10-25 14:01:31 +00:00