forked from pool/python315
Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
quadratic complexity vulnerabilities of os.path.expandvars()
(CVE-2025-6075, bsc#1252974).
Skip test_curses on ppc64le (gh#python/cpython#141534)
avoid simple quadratic complexity vulnerabilities of
(CVE-2025-6075, bsc#1252974). os.path.expandvars() the
--verbose option anymore. Patch by Victor Stinner.
- gh-95953: A CSS class, diff_changed, was added to th e
Patch by Katie Gardner .
- gh-138804: Raise TypeError instead of AttributeError whe n
an argument of incorrect type is passed to shlex.quote() .
This restores the behavior of the function prior to 3.14 .
- gh-138514: Raise ValueError when a multi-character strin g
is passed to the echo_char parameter of getpass.getpass() .
Patch by Benjamin Johnson .
- gh-116946: The _random.Random C type is now immutable .
Patch by Bénédikt Tran .
- gh-136028: Fix parsing month names containing “İ” (U+0130 ,
LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime() .
This affects locales az_AZ, ber_DZ, ber_MA and crh_UA .
whether the sign bit of a floating-point value is set .
Patch by Bénédikt Tran .
- gh-125996: Fix thread safety of collections.OrderedDict .
Patch by Kumar Aditya .
- gh-133551: Support t-strings (PEP 750) in annotationlib .
Patch by Jelle Zijlstra .
- gh-87790: Support underscore and comma as thousand s
Patch by Sergey B Kirpichev .
macro is responsible for raising a curses.error exceptio n.
Patch by Bénédikt Tra n.
- gh-138378: Move the globals-to-const JIT optimizer pass
into to the main JIT optimizer pass
- gh-138372: Fix SyntaxWarning emitted for erroneou s
subscript expressions involving template string literals .
Patch by Brian Schubert .
- gh-138004: On Solaris/Illumos platforms, thread names e
ar now encoded as ASCII to avoid errors on systems (e.g .
OpenIndiana) that don’t support non-ASCII names .
Patch by Pablo Galindo .
- gh-137728: Fix the JIT’s handling of many local variables .
This previously caused a segfault .
- gh-137576: Fix for incorrect source code being shown i n
Patch by Adam Hartz .
PyBytesWriter_Create PyBytesWriter_Discard ()
PyBytesWriter_FinishWithPointer ()
PyBytesWriter_FinishWithSize ()
PyBytesWriter_Finish PyBytesWriter_Format ()
PyBytesWriter_GetData PyBytesWriter_GetSize ()
PyBytesWriter_GrowAndUpdatePointer PyBytesWriter_Grow ()
PyBytesWriter_Resize PyBytesWriter_WriteBytes ()
- gh-133644: Remove deprecated alia s
PyImport_ImportModuleNoBlock() of PyImport_ImportModule() .
Patch by Bénédikt Tran .
This commit is contained in:
@@ -1,3 +1,11 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Nov 13 17:13:03 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
|
||||
quadratic complexity vulnerabilities of os.path.expandvars()
|
||||
(CVE-2025-6075, bsc#1252974).
|
||||
- Skip test_curses on ppc64le (gh#python/cpython#141534)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Nov 10 10:01:37 UTC 2025 - Andreas Schwab <schwab@suse.de>
|
||||
|
||||
@@ -44,7 +52,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
modules when explicitly specified.
|
||||
- Tests
|
||||
- gh-139208: Fix regrtest --fast-ci --verbose: don’t ignore
|
||||
the --verbose option anymore. Patch by Victor Stinner.
|
||||
avoid simple quadratic complexity vulnerabilities of
|
||||
(CVE-2025-6075, bsc#1252974). os.path.expandvars() the
|
||||
--verbose option anymore. Patch by Victor Stinner.
|
||||
- gh-138313: Restore skipped test and add janky workaround
|
||||
to prevent select buildbots from failing with a
|
||||
ResourceWarning.
|
||||
@@ -193,9 +203,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
arguments now accept any real numbers (such as Decimal and
|
||||
Fraction), not only integers or floats, although this does
|
||||
not improve precision.
|
||||
- gh-95953: A CSS class, diff_changed, was added to the
|
||||
- gh-95953: A CSS class, diff_changed, was added to th e
|
||||
changed lines in the make_table output of difflib.HtmlDiff.
|
||||
Patch by Katie Gardner.
|
||||
Patch by Katie Gardner .
|
||||
- gh-139210: Fix use-after-free when reporting unknown event
|
||||
in xml.etree.ElementTree.iterparse(). Patch by Ken Jin.
|
||||
- gh-138860: Lazy import rlcompleter in pdb to avoid deadlock
|
||||
@@ -248,9 +258,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
- gh-138899: Executing quit command in pdb will raise
|
||||
bdb.BdbQuit when pdb is started from an asyncio console
|
||||
using breakpoint() or pdb.set_trace().
|
||||
- gh-138804: Raise TypeError instead of AttributeError when
|
||||
an argument of incorrect type is passed to shlex.quote().
|
||||
This restores the behavior of the function prior to 3.14.
|
||||
- gh-138804: Raise TypeError instead of AttributeError whe n
|
||||
an argument of incorrect type is passed to shlex.quote() .
|
||||
This restores the behavior of the function prior to 3.14 .
|
||||
- gh-138779: Support device numbers larger than 2**63-1 for
|
||||
the st_rdev field of the os.stat_result structure.
|
||||
- gh-138682: Added symmetric difference support to
|
||||
@@ -281,9 +291,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
calling createtimerhandler() on a Tk application) and
|
||||
_tkinter.tkapp (the runtime type of Tk applications) are
|
||||
now immutable. Patch by Bénédikt Tran.
|
||||
- gh-138514: Raise ValueError when a multi-character string
|
||||
is passed to the echo_char parameter of getpass.getpass().
|
||||
Patch by Benjamin Johnson.
|
||||
- gh-138514: Raise ValueError when a multi-character strin g
|
||||
is passed to the echo_char parameter of getpass.getpass() .
|
||||
Patch by Benjamin Johnson .
|
||||
- gh-137706: Fix the partial evaluation of annotations that
|
||||
use typing.Annotated[T, x] where T is a forward reference.
|
||||
- gh-88375: Fix normalization of the robots.txt rules and
|
||||
@@ -307,8 +317,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
copy.deepcopy() in the free-threading build.
|
||||
- gh-116946: The types of select.poll() and select.epoll()
|
||||
objects are now immutable. Patch by Bénédikt Tran.
|
||||
- gh-116946: The _random.Random C type is now immutable.
|
||||
Patch by Bénédikt Tran.
|
||||
- gh-116946: The _random.Random C type is now immutable .
|
||||
Patch by Bénédikt Tran .
|
||||
- gh-57911: When extracting tar files on Windows, slashes in
|
||||
symlink targets will be replaced by backslashes to prevent
|
||||
corrupted links.
|
||||
@@ -597,9 +607,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
- gh-134759: Fix UnboundLocalError in
|
||||
email.message.Message.get_payload() when the payload to
|
||||
decode is a bytes object. Patch by Kliment Lamonov.
|
||||
- gh-136028: Fix parsing month names containing “İ” (U+0130,
|
||||
LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime().
|
||||
This affects locales az_AZ, ber_DZ, ber_MA and crh_UA.
|
||||
- gh-136028: Fix parsing month names containing “İ” (U+0130 ,
|
||||
LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime() .
|
||||
This affects locales az_AZ, ber_DZ, ber_MA and crh_UA .
|
||||
- gh-87135: Acquiring a threading.Lock or threading.RLock at
|
||||
interpreter shutdown will raise PythonFinalizationError if
|
||||
Python can determine that it would otherwise deadlock.
|
||||
@@ -621,8 +631,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
non-OSError exception is raised during connection and
|
||||
socket’s close() raises OSError.
|
||||
- gh-135853: math: expose C99 signbit() function to determine
|
||||
whether the sign bit of a floating-point value is set.
|
||||
Patch by Bénédikt Tran.
|
||||
whether the sign bit of a floating-point value is set .
|
||||
Patch by Bénédikt Tran .
|
||||
- gh-134531: hmac: use the EVP_MAC(3ssl) interface for HMAC
|
||||
when Python is built with OpenSSL 3.0 and later instead of
|
||||
the deprecated HMAC_CTX(3ssl) interface. Patch by Bénédikt
|
||||
@@ -917,8 +927,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
and TD = TypedDict("TD", None) calls for constructing
|
||||
typing.TypedDict objects with zero field. Patch by Bénédikt
|
||||
Tran.
|
||||
- gh-125996: Fix thread safety of collections.OrderedDict.
|
||||
Patch by Kumar Aditya.
|
||||
- gh-125996: Fix thread safety of collections.OrderedDict .
|
||||
Patch by Kumar Aditya .
|
||||
- gh-133817: Remove support for creating NamedTuple classes
|
||||
via the undocumented keyword argument syntax. Patch by
|
||||
Bénédikt Tran.
|
||||
@@ -973,8 +983,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
logging.basicConfig().
|
||||
- gh-92897: Removed the check_home parameter from
|
||||
sysconfig.is_python_build(), deprecated since Python 3.12.
|
||||
- gh-133551: Support t-strings (PEP 750) in annotationlib.
|
||||
Patch by Jelle Zijlstra.
|
||||
- gh-133551: Support t-strings (PEP 750) in annotationlib .
|
||||
Patch by Jelle Zijlstra .
|
||||
- gh-133517: Remove os.listdrives(), os.listvolumes() and
|
||||
os.listmounts() in non Windows desktop builds since the
|
||||
underlying functionality is missing.
|
||||
@@ -1035,9 +1045,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
- gh-87790: Support underscore and comma as thousands
|
||||
separators in the fractional part for Fraction’s
|
||||
formatting. Patch by Sergey B Kirpichev.
|
||||
- gh-87790: Support underscore and comma as thousands
|
||||
- gh-87790: Support underscore and comma as thousand s
|
||||
separators in the fractional part for Decimal’s formatting.
|
||||
Patch by Sergey B Kirpichev.
|
||||
Patch by Sergey B Kirpichev .
|
||||
- gh-131884: Fix formatting issues in json.dump() when both
|
||||
indent and skipkeys are used.
|
||||
- gh-131788: Make ResourceTracker.send from multiprocessing
|
||||
@@ -1072,8 +1082,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
- gh-125028: functools.Placeholder cannot be passed to
|
||||
functools.partial() as a keyword argument.
|
||||
- gh-125843: If possible, indicate which curses C function or
|
||||
macro is responsible for raising a curses.error exception.
|
||||
Patch by Bénédikt Tran.
|
||||
macro is responsible for raising a curses.error exceptio n.
|
||||
Patch by Bénédikt Tra n.
|
||||
- gh-119109: functools.partial() calls are now faster when
|
||||
keyword arguments are used.
|
||||
- gh-124033: SimplePath is now presented in
|
||||
@@ -1198,13 +1208,13 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
__typing_subst__ returns an object that isn’t a tuple.
|
||||
- gh-138431: Fix a bug in the JIT optimizer when
|
||||
round-tripping strings and tuples.
|
||||
- gh-138378: Move the globals-to-const JIT optimizer pass
|
||||
into to the main JIT optimizer pass
|
||||
- gh-138378: Move the globals-to-const JIT optimizer pass
|
||||
into to the main JIT optimizer pass
|
||||
- gh-138401: Add missing validation of argument count in
|
||||
os.sendfile() to be non-negative.
|
||||
- gh-138372: Fix SyntaxWarning emitted for erroneous
|
||||
subscript expressions involving template string literals.
|
||||
Patch by Brian Schubert.
|
||||
- gh-138372: Fix SyntaxWarning emitted for erroneou s
|
||||
subscript expressions involving template string literals .
|
||||
Patch by Brian Schubert .
|
||||
- gh-138302: BINARY_OP now specializes to BINARY_OP_ADD_INT,
|
||||
BINARY_OP_SUBTRACT_INT or BINARY_OP_MULTIPLY_INT if
|
||||
operands are compact ints.
|
||||
@@ -1229,9 +1239,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
and does not contain double quotes.
|
||||
- gh-137384: Fix a crash when using the warnings module in a
|
||||
finalizer at shutdown. Patch by Kumar Aditya.
|
||||
- gh-138004: On Solaris/Illumos platforms, thread names are
|
||||
now encoded as ASCII to avoid errors on systems (e.g.
|
||||
OpenIndiana) that don’t support non-ASCII names.
|
||||
- gh-138004: On Solaris/Illumos platforms, thread names e
|
||||
ar now encoded as ASCII to avoid errors on systems (e.g .
|
||||
OpenIndiana) that don’t support non-ASCII names .
|
||||
- gh-137976: Removed localtime from the list of reported
|
||||
system timezones.
|
||||
- gh-137992: Ensure that PyRefTracer_SetTracer() sync with
|
||||
@@ -1244,18 +1254,18 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
- gh-137883: Fix runaway recursion when calling a function
|
||||
with keyword arguments.
|
||||
- gh-137079: Fix keyword typo recognition when parsing files.
|
||||
Patch by Pablo Galindo.
|
||||
- gh-137728: Fix the JIT’s handling of many local variables.
|
||||
This previously caused a segfault.
|
||||
Patch by Pablo Galindo .
|
||||
- gh-137728: Fix the JIT’s handling of many local variables .
|
||||
This previously caused a segfault .
|
||||
- gh-137716: Fix double period in AttributeError message for
|
||||
invalid mock assertions
|
||||
- gh-137433: Fix a potential deadlock in the free threading
|
||||
build when daemon threads enable or disable profiling
|
||||
or tracing while the main thread is shutting down the
|
||||
interpreter.
|
||||
- gh-137576: Fix for incorrect source code being shown in
|
||||
- gh-137576: Fix for incorrect source code being shown i n
|
||||
tracebacks from the Basic REPL when PYTHONSTARTUP is given.
|
||||
Patch by Adam Hartz.
|
||||
Patch by Adam Hartz .
|
||||
- gh-37817: Allow assignment to __bases__ of direct
|
||||
subclasses of builtin classes.
|
||||
- gh-132732: Optimize _COMPARE_OP, _CONTAINS_OP,
|
||||
@@ -1598,18 +1608,13 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
function.
|
||||
- gh-129813: Implement PEP 782, the PyBytesWriter API. Add
|
||||
functions:
|
||||
PyBytesWriter_Create()
|
||||
PyBytesWriter_Discard()
|
||||
PyBytesWriter_FinishWithPointer()
|
||||
PyBytesWriter_FinishWithSize()
|
||||
PyBytesWriter_Finish()
|
||||
PyBytesWriter_Format()
|
||||
PyBytesWriter_GetData()
|
||||
PyBytesWriter_GetSize()
|
||||
PyBytesWriter_GrowAndUpdatePointer()
|
||||
PyBytesWriter_Grow()
|
||||
PyBytesWriter_Resize()
|
||||
PyBytesWriter_WriteBytes()
|
||||
PyBytesWriter_Create PyBytesWriter_Discard ()
|
||||
PyBytesWriter_FinishWithPointer ()
|
||||
PyBytesWriter_FinishWithSize ()
|
||||
PyBytesWriter_Finish PyBytesWriter_Format ()
|
||||
PyBytesWriter_GetData PyBytesWriter_GetSize ()
|
||||
PyBytesWriter_GrowAndUpdatePointer PyBytesWriter_Grow ()
|
||||
PyBytesWriter_Resize PyBytesWriter_WriteBytes ()
|
||||
- Patch by Victor Stinner.
|
||||
- gh-137956: Display and raise an exception if an extension
|
||||
compiled for non-free-threaded Python is loaded in a
|
||||
@@ -1669,9 +1674,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
|
||||
- gh-133644: Remove deprecated function PyWeakref_GetObject()
|
||||
and macro PyWeakref_GET_OBJECT. Use PyWeakref_GetRef()
|
||||
instead. Patch by Bénédikt Tran.
|
||||
- gh-133644: Remove deprecated alias
|
||||
PyImport_ImportModuleNoBlock() of PyImport_ImportModule().
|
||||
Patch by Bénédikt Tran.
|
||||
- gh-133644: Remove deprecated alia s
|
||||
PyImport_ImportModuleNoBlock() of PyImport_ImportModule() .
|
||||
Patch by Bénédikt Tran .
|
||||
- gh-133610: Remove deprecated functions
|
||||
PyUnicode_AsDecodedObject(), PyUnicode_AsDecodedUnicode(),
|
||||
PyUnicode_AsEncodedObject(), and
|
||||
|
||||
Reference in New Issue
Block a user