python-interpreters/python315 - python315 - openSUSE Gitea

python-interpreters/python315

SHA256

forked from pool/python315

Files

4 lines

133 B

Plaintext

Raw Normal View History

Update to 3.15.0~a3 Security - gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. - gh-42400: Fix buffer overflow in _Py_wrealpath() for paths exceeding MAXPATHLEN bytes by using dynamic memory allocation instead of fixed-size buffer. Patch by Shamil Abdulaev. - gh-119451: Fix a potential memory denial of service in the http.client module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13836, bsc#1254400). - gh-119342: Fix a potential memory denial of service in the plistlib module. When reading a Plist file received from untrusted source, it could cause an arbitrary amount of memory to be allocated. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes (CVE-2025-13837, bsc#1254401). Library - gh-142754: Add the ownerDocument attribute to xml.dom.minidom elements and attributes created by directly instantiating the Element or Attr class. Note that this way of creating nodes is not supported; creator functions like xml.dom.Document.documentElement() should be used instead. - gh-142594: Fix crash in TextIOWrapper.close() when the underlying buffer’s closed property calls detach(). - gh-76007: Deprecate __version__ from ctypes. Patch by Hugo van Kemenade. - gh-76007: Deprecate __version__ from wsgiref.simple_server. Patch by Hugo van Kemenade. - gh-142651: unittest.mock: fix a thread safety issue where Mock.call_count may return inaccurate values when the mock is called concurrently from multiple threads. - gh-76007: Deprecate __version__ from http.server. Patch by Hugo van Kemenade. - gh-138122: Add --subprocesses flag to profiling.sampling CLI to automatically profile subprocesses spawned by the target. When enabled, the profiler monitors for new Python subprocesses and profiles each one separately, writing results to individual output files. This is useful for profiling applications that use multiprocessing, ProcessPoolExecutor, or other subprocess-based parallelism. Patch by Pablo Galindo. - gh-142595: Added type check during initialization of the decimal module to prevent a crash in case of broken stdlib. Patch by Sergey B Kirpichev. - gh-142556: Fix crash when a task gets re-registered during finalization in asyncio. Patch by Kumar Aditya. - gh-138122: Add --mode=exception to the sampling profiler to capture samples only from threads with an active exception, useful for analyzing exception handling overhead. Patch by Pablo Galindo. - gh-142539: traceback: Fix location of carets in SyntaxErrors when the source contains wide characters. - gh-123241: Avoid reference count operations in garbage collection of ctypes objects. - gh-142451: hmac: correctly copy HMAC attributes for objects copied through HMAC.copy(). Patch by Bénédikt Tran. - gh-138122: The profiling.sampling flamegraph profiler now supports inverted flamegraph view that aggregates all leaf nodes. In a standard flamegraph, if a hot function is called from multiple locations, it appears multiple times as separate leaf nodes. In the inverted flamegraph, all occurrences of the same leaf function are merged into a single aggregated node at the root, showing the total hotness of that function in one place. The children of each aggregated node represent its callers, making it easier to identify which functions consume the most CPU time and where they are called from. - gh-112527: The help text for required options in argparse no longer extended with “ (default: None)”. - gh-142438: Fixed a possible leaked GIL in _PySSL_keylog_callback. - gh-138122: Add bytecode-level instruction profiling to the sampling profiler via the new --opcodes flag. When enabled, the profiler captures which bytecode opcode is executing at each sample, including Python 3.11+ adaptive specializations, and visualizes this data in the heatmap, flamegraph, gecko, and live output formats. Patch by Pablo Galindo - gh-142389: Add backtick markup support in argparse description and epilog text to highlight inline code when color output is enabled. - gh-142346: Fix usage formatting for mutually exclusive groups in argparse when they are preceded by positional arguments or followed or intermixed with other optional arguments. - gh-142374: Fix cumulative percentage calculation for recursive functions in the new sampling profiler. When profiling recursive functions, cumulative statistics (cumul%, cumtime) could exceed 100% because each recursive frame in a stack was counted separately. For example, a function recursing 500 times in every sample would show 50000% cumulative presence. The fix deduplicates locations within each sample so cumulative stats correctly represent “percentage of samples where this function was on the stack”. Patch by Pablo Galindo. - gh-142315: Pdb can now run scripts from anonymous pipes used in process substitution. Patch by Bartosz Sławecki. - gh-64532: Subparser help now includes required optional arguments from the parent parser in the usage, making it clearer what arguments are needed to run a subcommand. Patch by Savannah Ostrowski. - gh-142207: Fix: profiling.sampling may cause assertion !(has_gil && gil_requested) - gh-142332: Fix usage formatting for positional arguments in mutually exclusive groups in argparse. in argparse. - gh-142282: Fix winreg.QueryValueEx() to not accidentally read garbage buffer under race condition. - gh-142318: Fix typing 'q' at the help of the interactive tachyon profiler exiting the profiler. - gh-75949: Fix argparse to preserve \| separators in mutually exclusive groups when the usage line wraps due to length. - gh-142267: Improve argparse performance by caching the formatter used for argument validation. - gh-139862: Remove color parameter from argparse.HelpFormatter constructor. Color is controlled by ArgumentParser. - gh-68552: MisplacedEnvelopeHeaderDefect and Missing header name defects are now correctly passed to the handle_defect method of policy in FeedParser. - gh-142206: The resource tracker in the multiprocessing module can now understand messages from older versions of itself. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) - gh-142214: Fix two regressions in dataclasses in Python 3.14.1 related to annotations. An exception is no longer raised if slots=True is used and the __init__ method does not have an __annotate__ attribute (likely because init=False was used). An exception is no longer raised if annotations are requested on the __init__ method and one of the fields is not present in the class annotations. This can occur in certain dynamic scenarios. Patch by Jelle Zijlstra. - gh-142203: Remove the debug_override parameter from importlib.util.cache_from_source() which has been deprecated since Python 3.5. - gh-138122: The _remote_debugging module now implements frame caching in the RemoteUnwinder class to reduce memory reads when profiling remote processes. When cache_frames=True, unchanged portions of the call stack are reused from previous samples, significantly improving profiling performance for deep call stacks. - gh-116738: Fix cmath data race when initializing trigonometric tables with subinterpreters. - gh-141982: Allow pdb to set breakpoints on async functions with function names. - gh-74389: When the stdin being used by a subprocess.Popen instance is closed, this is now ignored in subprocess.Popen.communicate() instead of leaving the class in an inconsistent state. - gh-87512: Fix subprocess.Popen.communicate() timeout handling on Windows when writing large input. Previously, the timeout was ignored during stdin writing, causing the method to block indefinitely if the child process did not consume input quickly. The stdin write is now performed in a background thread, allowing the timeout to be properly enforced. - gh-141939: Add color to all interpolated values in argparse help, like %(default)s or %(choices)s. Patch by Alex Prengère. - gh-141473: When subprocess.Popen.communicate() was called with input and a timeout and is called for a second time after a TimeoutExpired exception before the process has died, it should no longer hang. - gh-141999: Correctly allow KeyboardInterrupt to stop the process when using profiling.sampling. - gh-142006: Fix a bug in the email.policy.default folding algorithm which incorrectly resulted in a doubled newline when a line ending at exactly max_line_length was followed by an unfoldable token. - gh-141968: Remove data copy from re compilation of regexes with large charsets by using bytearray.take_bytes(). - gh-141968: Remove data copy from encodings.idna encode() and encode() by using bytearray.take_bytes(). - gh-141968: Remove data copy from codecs punycode encoding by using bytearray.take_bytes(). - gh-141968: Remove data copy from wave.Wave_read.readframes() and wave.Wave_write.writeframes() by using bytearray.take_bytes(). - gh-141968: Remove a data copy from base64.b32decode() and base64.b32encode() by using bytearray.take_bytes(). - gh-59000: Fix pdb breakpoint resolution for class methods when the module defining the class is not imported. - gh-116738: Fix thread safety issue with re scanner objects in free-threaded builds. - gh-138122: The profiling.sampling flamegraph profiler now displays thread status statistics showing the percentage of time threads spend holding the GIL, running without the GIL, waiting for the GIL, and performing garbage collection. These statistics help identify GIL contention and thread behavior patterns. When filtering by thread, the display shows per-thread metrics. - gh-141781: Fixed an issue where pdb.line_prefix assignment was ignored if assigned after the module was imported. - gh-141863: Update Streams to use bytearray.take_bytes() for a over 10% performance improvement on pyperformance asyncio_tcp benchmark. - gh-141817: Add socket.IPV6_HDRINCL constant. - gh-105836: Fix asyncio.run_coroutine_threadsafe() leaving underlying cancelled asyncio task running. - gh-141570: Support file-like object raising OSError from fileno() in color detection (_colorize.can_colorize()). This can occur when sys.stdout is redirected. - gh-141679: Add colour to defaults in argparse help. Patch by Hugo van Kemenade. - gh-141686: Break reference cycles created by each call to json.dump() or json.JSONEncoder.iterencode(). - gh-141659: Fix bad file descriptor errors from _posixsubprocess on AIX. - gh-141645: Add a new --live mode to the tachyon profiler in profiling.sampling module. This mode consist of a live TUI that displays real-time profiling statistics as the target application runs, similar to top. Patch by Pablo Galindo - gh-141615: Check stdin instead of stdout for use_rawinput in pdb. - gh-69113: Fix doctest to correctly report line numbers for doctests in __test__ dictionary when formatted as triple-quoted strings by finding unique lines in the string and matching them in the source file. - gh-141600: Fix musl version detection on Void Linux. - gh-48752: Add readline.get_pre_input_hook() function to retrieve the current pre-input hook. This allows applications to save and restore the hook without overwriting user settings. Patch by Sanyam Khurana. - gh-141565: Add async-aware profiling to the Tachyon sampling profiler. The profiler now reconstructs and displays async task hierarchies in flamegraphs, making the output more actionable for users. Patch by Savannah Ostrowski and Pablo Galindo Salgado. - gh-60107: Remove a copy from io.RawIOBase.read(). If the underlying I/O class keeps a reference to the mutable memory, raise a BufferError. - gh-116738: Make csv module thread-safe on the free threaded build. - gh-140911: collections: Ensure that the methods UserString.rindex() and UserString.index() accept collections.UserString instances as the sub argument. - gh-140875: Fix handling of unclosed character references (named and numerical) followed by the end of file in html.parser.HTMLParser with convert_charrefs=False. - gh-140677: Add heatmap visualization mode to the Tachyon sampling profiler. The new --heatmap output format provides a line-by-line view showing execution intensity with color-coded samples, inline statistics, and interactive call graph navigation between callers and callees. - gh-139946: Distinguish stdout and stderr when colorizing output in argparse module. - gh-76007: pydoc: Fix DeprecationWarning being raised when generating doc for stdlib modules. - gh-139686: Make importlib.reload no-op for lazy modules. - gh-138697: Fix inferring dest from a single-dash long option in argparse. If a short option and a single-dash long option are passed to add_argument(), dest is now inferred from the single-dash long option. - gh-138525: Add support for single-dash long options and alternate prefix characters in argparse.BooleanOptionalAction. - gh-79986: Add parsing for References and In-Reply-To headers to the email library that parses the header content as lists of message id tokens. This prevents them from being folded incorrectly. - gh-135559: Flag: a dir() on a Flag enumeration now shows non-canonical members. (i.e. aliases). - gh-134453: Fixed subprocess.Popen.communicate() input= handling of memoryview instances that were non-byte shaped on POSIX platforms. Those are now properly cast to a byte shaped view instead of truncating the input. Windows platforms did not have this bug. - gh-127930: Add __all__ to tkinter.simpledialog. - gh-115952: Fix a potential memory denial of service in the pickle module. When reading a pickled data received from untrusted source, it could cause an arbitrary amount of memory to be allocated, even if the code that is allowed to execute is restricted by overriding the find_class() method. This could have led to symptoms including a MemoryError, swapping, out of memory (OOM) killed processes or containers, or even system crashes. bpo-40350: Fix support for namespace packages in modulefinder. Documentation - gh-141994: xml.sax.handler: Make Documentation of xml.sax.handler.feature_external_ges warn of opening up to external entity attacks. Patch by Sebastian Pipping. Core and Builtins - gh-134584: Eliminate redundant refcounting from _STORE_ATTR_INSTANCE_VALUE. - gh-142718: JIT: Fix segfault caused by not flushing the stack to memory at side exits. - gh-142737: Tracebacks will be displayed in fallback mode even if io.open() is lost. Previously, this would crash the interpreter. Patch by Bartosz Sławecki. - gh-116738: Make the attributes in bz2 thread-safe on the free threaded build. - gh-134584: Eliminate redundant refcounting from _CALL_LIST_APPEND. - gh-142554: Fix a crash in divmod() when _pylong.int_divmod() does not return a tuple of length two exactly. Patch by Bénédikt Tran. - gh-142531: Fix a free-threaded GC performance regression. If there are many untracked tuples, the GC will run too often, resulting in poor performance. The fix is to include untracked tuples in the “long lived” object count. The number of frozen objects is also now included since the free-threaded GC must scan those too. - gh-142402: Fix reference counting when adjacent literal parts are merged while constructing string.templatelib.Template, preventing the displaced string object from leaking. - gh-116738: Make the attributes in zlib thread-safe on the free threaded build. - gh-142343: Fix SIGILL crash on m68k due to incorrect assembly constraint. - gh-142236: Improve the “Perhaps you forgot a comma?” syntax error for multi-line string concatenations to point to the last string instead of the first, making it easier to locate where the comma is missing. Patch by Pablo Galindo. - gh-142236: Fix incorrect keyword suggestions for syntax errors in traceback. The keyword typo suggestion mechanism would incorrectly suggest replacements when the extracted source code was incomplete rather than containing an actual typo. Patch by Pablo Galindo. - gh-142305: Decrease the size of the generated stencils and the runtime JIT code. Patch by Diego Russo. - gh-135379: Implement a limited form of register allocation known as “top of stack caching” in the JIT. It works by keeping 0-3 of the top items in the stack in registers. The code generator generates multiple versions of those uops that do not escape and are relatively small. During JIT compilation, the copy that produces the least memory traffic is selected, spilling or reloading values when needed. - gh-142276: Fix missing type watcher when promoting attribute loads to constants in the JIT. Patch by Ken Jin. Reproducer by Yuancheng Jiang. - gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key. - gh-141976: Check against abstract stack overflow in the JIT optimizer. - gh-97850: Remove all *.load_module() usage and definitions from the import system and importlib. The method has been deprecated in favor of importlib.abc.Loader.exec_module() since Python 3.4. - gh-142048: Fix quadratically increasing garbage collection delays in free-threaded build. - gh-65961: Stop setting __cached__ on modules. - gh-141770: Annotate anonymous mmap usage only when supported by the Linux kernel and if -X dev is used or Python is built in debug mode. Patch by Donghee Na. - gh-142029: Raise ModuleNotFoundError instead of crashing when a nonexistent module is used as a name in _imp.create_builtin(). - gh-142029: Raise ValueError instead of crashing when empty string is used as a name in _imp.create_builtin(). - gh-141976: Protect against specialization failures in the tracing JIT compiler for performance reasons. - gh-141861: Fix invalid memory read in the ENTER_EXECUTOR instruction. - gh-141930: When importing a module, use Python’s regular file object to ensure that writes to .pyc files are complete or an appropriate error is raised. - gh-138122: Add incomplete sample detection to prevent corrupted profiling data. Each thread state now contains an embedded base frame (sentinel at the bottom of the frame stack) with owner type FRAME_OWNED_BY_INTERPRETER. The profiler validates that stack unwinding terminates at this sentinel frame. Samples that fail to reach the base frame (due to race conditions, memory corruption, or other errors) are now rejected rather than being included as spurious data. - gh-120158: Fix inconsistent state when enabling or disabling monitoring events too many times. - gh-140638: Expose a "candidates" stat in gc.get_stats() and gc.callbacks. - gh-141780: Fix Py_mod_gil with API added in PEP 793: PyModule_FromSlotsAndSpec() and PyModExport hooks - gh-141732: Ensure the __repr__() for ExceptionGroup and BaseExceptionGroup does not change when the exception sequence that was original passed in to its constructor is subsequently mutated. - gh-140638: Expose a "duration" stat in gc.get_stats() and gc.callbacks. - gh-139653: Only raise a RecursionError or trigger a fatal error if the stack pointer is both below the limit pointer and above the stack base. If outside of these bounds assume that it is OK. This prevents false positives when user-space threads swap stacks. - gh-41779: Allowed defining the __dict__ and __weakref__ __slots__ for any class. - gh-139103: Improve multithreaded scaling of dataclasses on the free-threaded build. - gh-141589: Change backoff counter to use prime numbers instead of powers of 2. Use only 3 bits for counter and 13 bits for value. This allows to support values up to 8191. Patch by Mikhail Efimov. - gh-137007: Fix a bug during JIT compilation failure which caused garbage collection debug assertions to fail. - gh-132657: For the free-threaded build, avoid locking the set object for the __contains__ method. - gh-134584: Eliminate redundant refcounting from _CALL_STR_1. - gh-134584: Eliminate redundant refcounting from _CALL_BUILTIN_O. - gh-134584: Eliminate redundant refcounting from _CALL_TUPLE_1. Patch by Noam Cohen C API - gh-142589: Fix PyUnstable_Object_IsUniqueReferencedTemporary() handling of tagged ints on the interpreter stack. - gh-142571: PyUnstable_CopyPerfMapFile() now checks that opening the file succeeded before flushing. - gh-142225: Fixed the PyABIInfo_VAR macro. - gh-141049: _PyObject_CallMethodId(), _PyObject_GetAttrId() and _PyUnicode_FromId() are deprecated since 3.15 and will be removed in 3.20. Instead, use PyUnicode_InternFromString() and cache the result in the module state, then call PyObject_CallMethod() or PyObject_GetAttr(). Patch by Victor Stinner. - gh-142163: Fix the HAVE_THREAD_LOCAL macro being defined without the Py_BUILD_CORE macro set after including Python.h. - gh-137422: Fix free threading race condition in PyImport_AddModuleRef(). It was previously possible for two calls to the function return two different objects, only one of which was stored in sys.modules. - gh-141726: Add PyDict_SetDefaultRef() to the Stable ABI. - gh-140042: Removed the sqlite3_shutdown call that could cause closing connections for sqlite when used with multiple sub interpreters. - gh-141070: Add PyUnstable_Object_Dump() to dump an object to stderr. It should only be used for debugging. Patch by Victor Stinner. - gh-139165: Expose the functions Py_SIZE(), Py_IS_TYPE() and Py_SET_SIZE() in the Stable ABI. Build - gh-131372: Add LDVERSION and EXE to the base_interpreter value of build-details.json. - gh-142454: When calculating the digest of the JIT stencils input, sort the hashed files by filenames before adding their content to the hasher. This ensures deterministic hash input and hence deterministic hash, independent on filesystem order. - gh-131372: build-details.py will only be installed as part of the main install (make install). make altinstall will no longer include it. - gh-142234: Allow --enable-wasm-dynamic-linking for WASI. While CPython doesn’t directly support it so external/downstream users do not have to patch in support for the flag. - gh-142050: Fixed a bug where JIT stencils produced on Windows contained debug data. Patch by Chris Eibl. - gh-141808: Do not generate the jit stencils twice in case of PGO builds on Windows. - gh-141926: RUNSHARED is no longer cleared when cross-compiling. Previously, RUNSHARED was cleared when cross-compiling, which breaks PGO when using --enabled-shared on systems where the cross-compiled CPython is otherwise executable (e.g., via transparent emulation). - gh-141808: When running make clean-retain-profile, keep the generated JIT stencils. That way, the stencils are not generated twice when Profile-guided optimization (PGO) is used. It also allows distributors to supply their own pre-built JIT stencils. - gh-141784: Fix _remote_debugging_module.c compilation on 32-bit Linux. Include Python.h before system headers to make sure that _remote_debugging_module.c uses the same types (ABI) than Python. Patch by Victor Stinner. - gh-141172: Update to WASI SDK 29. - gh-139707: Add configure option --with-missing-stdlib-config=FILE allows which distributors to pass a JSON configuration file containing custom error messages for missing standard library modules. - gh-108819: Honor --with-platlibdir in the pure-Python standard library installation path, if PLATLIBDIR doesn’t match the value used in LIBDIR. Tests - gh-140381: Fix flaky test_profiling tests on i686 and s390x architectures by increasing slow_fibonacci call frequency from every 5th iteration to every 2nd iteration. - gh-140210: Make test_sysconfig.test_parse_makefile_renamed_vars less fragile by clearing the environment variables before parsing the Makefile. 2025-12-19 17:49:47 +01:00			`version https://git-lfs.github.com/spec/v1`
			`oid sha256:6ab02cdac24505779877bb1d9189432d67e90ddf2a9b8b7b373ead54ac07b607`
			`size 34723712`