Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple

quadratic complexity vulnerabilities of os.path.expandvars()
  (CVE-2025-6075, bsc#1252974).
Skip test_curses on ppc64le (gh#python/cpython#141534)
      avoid simple quadratic complexity vulnerabilities of
      (CVE-2025-6075, bsc#1252974). os.path.expandvars() the
      --verbose option anymore. Patch by Victor Stinner.
    - gh-95953: A CSS class, diff_changed, was added to th      e
      Patch by Katie Gardner                                    .
    - gh-138804: Raise TypeError instead of AttributeError whe  n
      an argument of incorrect type is passed to shlex.quote()  .
      This restores the behavior of the function prior to 3.14  .
    - gh-138514: Raise ValueError when a multi-character strin  g
      is passed to the echo_char parameter of getpass.getpass() .
      Patch by Benjamin Johnson                                 .
    - gh-116946: The _random.Random C type is now immutable     .
      Patch by Bénédikt Tran                                    .
    - gh-136028: Fix parsing month names containing “İ” (U+0130 ,
      LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime() .
      This affects locales az_AZ, ber_DZ, ber_MA and crh_UA     .
      whether the sign bit of a floating-point value is set     .
      Patch by Bénédikt Tran                                    .
    - gh-125996: Fix thread safety of collections.OrderedDict   .
      Patch by Kumar Aditya                                     .
    - gh-133551: Support t-strings (PEP 750) in annotationlib   .
      Patch by Jelle Zijlstra                                   .
    - gh-87790: Support underscore and comma as thousand        s
      Patch by Sergey B Kirpichev                               .
      macro is responsible for raising a curses.error exceptio n.
      Patch by Bénédikt Tra                                    n.
    - gh-138378: Move the globals-to-const     JIT optimizer pass
      into to the main                         JIT optimizer pass
    - gh-138372: Fix SyntaxWarning emitted for erroneou         s
      subscript expressions involving template string literals  .
      Patch by Brian Schubert                                   .
    - gh-138004: On Solaris/Illumos platforms, thread names     e
      ar now encoded as ASCII to avoid errors on systems (e.g   .
      OpenIndiana) that don’t support non-ASCII names           .
      Patch by Pablo Galindo                                    .
    - gh-137728: Fix the JIT’s handling of many local variables .
      This previously caused a segfault                         .
    - gh-137576: Fix for incorrect source code being shown i    n
      Patch by Adam Hartz                                       .
         PyBytesWriter_Create PyBytesWriter_Discard            ()
         PyBytesWriter_FinishWithPointer                       ()
         PyBytesWriter_FinishWithSize                          ()
         PyBytesWriter_Finish PyBytesWriter_Format             ()
         PyBytesWriter_GetData PyBytesWriter_GetSize           ()
         PyBytesWriter_GrowAndUpdatePointer PyBytesWriter_Grow ()
         PyBytesWriter_Resize PyBytesWriter_WriteBytes         ()
    - gh-133644: Remove deprecated alia                         s
      PyImport_ImportModuleNoBlock() of PyImport_ImportModule() .
      Patch by Bénédikt Tran                                    .
This commit is contained in:
2025-11-13 22:40:01 +01:00
parent b563206f1a
commit 2c3a121115
4 changed files with 433 additions and 55 deletions

View File

@@ -1,3 +1,11 @@
-------------------------------------------------------------------
Thu Nov 13 17:13:03 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
quadratic complexity vulnerabilities of os.path.expandvars()
(CVE-2025-6075, bsc#1252974).
- Skip test_curses on ppc64le (gh#python/cpython#141534)
-------------------------------------------------------------------
Mon Nov 10 10:01:37 UTC 2025 - Andreas Schwab <schwab@suse.de>
@@ -44,7 +52,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
modules when explicitly specified.
- Tests
- gh-139208: Fix regrtest --fast-ci --verbose: dont ignore
the --verbose option anymore. Patch by Victor Stinner.
avoid simple quadratic complexity vulnerabilities of
(CVE-2025-6075, bsc#1252974). os.path.expandvars() the
--verbose option anymore. Patch by Victor Stinner.
- gh-138313: Restore skipped test and add janky workaround
to prevent select buildbots from failing with a
ResourceWarning.
@@ -193,9 +203,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
arguments now accept any real numbers (such as Decimal and
Fraction), not only integers or floats, although this does
not improve precision.
- gh-95953: A CSS class, diff_changed, was added to the
- gh-95953: A CSS class, diff_changed, was added to th e
changed lines in the make_table output of difflib.HtmlDiff.
Patch by Katie Gardner.
Patch by Katie Gardner .
- gh-139210: Fix use-after-free when reporting unknown event
in xml.etree.ElementTree.iterparse(). Patch by Ken Jin.
- gh-138860: Lazy import rlcompleter in pdb to avoid deadlock
@@ -248,9 +258,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-138899: Executing quit command in pdb will raise
bdb.BdbQuit when pdb is started from an asyncio console
using breakpoint() or pdb.set_trace().
- gh-138804: Raise TypeError instead of AttributeError when
an argument of incorrect type is passed to shlex.quote().
This restores the behavior of the function prior to 3.14.
- gh-138804: Raise TypeError instead of AttributeError whe n
an argument of incorrect type is passed to shlex.quote() .
This restores the behavior of the function prior to 3.14 .
- gh-138779: Support device numbers larger than 2**63-1 for
the st_rdev field of the os.stat_result structure.
- gh-138682: Added symmetric difference support to
@@ -281,9 +291,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
calling createtimerhandler() on a Tk application) and
_tkinter.tkapp (the runtime type of Tk applications) are
now immutable. Patch by Bénédikt Tran.
- gh-138514: Raise ValueError when a multi-character string
is passed to the echo_char parameter of getpass.getpass().
Patch by Benjamin Johnson.
- gh-138514: Raise ValueError when a multi-character strin g
is passed to the echo_char parameter of getpass.getpass() .
Patch by Benjamin Johnson .
- gh-137706: Fix the partial evaluation of annotations that
use typing.Annotated[T, x] where T is a forward reference.
- gh-88375: Fix normalization of the robots.txt rules and
@@ -307,8 +317,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
copy.deepcopy() in the free-threading build.
- gh-116946: The types of select.poll() and select.epoll()
objects are now immutable. Patch by Bénédikt Tran.
- gh-116946: The _random.Random C type is now immutable.
Patch by Bénédikt Tran.
- gh-116946: The _random.Random C type is now immutable .
Patch by Bénédikt Tran .
- gh-57911: When extracting tar files on Windows, slashes in
symlink targets will be replaced by backslashes to prevent
corrupted links.
@@ -597,9 +607,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-134759: Fix UnboundLocalError in
email.message.Message.get_payload() when the payload to
decode is a bytes object. Patch by Kliment Lamonov.
- gh-136028: Fix parsing month names containing “İ” (U+0130,
LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime().
This affects locales az_AZ, ber_DZ, ber_MA and crh_UA.
- gh-136028: Fix parsing month names containing “İ” (U+0130 ,
LATIN CAPITAL LETTER I WITH DOT ABOVE) in time.strptime() .
This affects locales az_AZ, ber_DZ, ber_MA and crh_UA .
- gh-87135: Acquiring a threading.Lock or threading.RLock at
interpreter shutdown will raise PythonFinalizationError if
Python can determine that it would otherwise deadlock.
@@ -621,8 +631,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
non-OSError exception is raised during connection and
sockets close() raises OSError.
- gh-135853: math: expose C99 signbit() function to determine
whether the sign bit of a floating-point value is set.
Patch by Bénédikt Tran.
whether the sign bit of a floating-point value is set .
Patch by Bénédikt Tran .
- gh-134531: hmac: use the EVP_MAC(3ssl) interface for HMAC
when Python is built with OpenSSL 3.0 and later instead of
the deprecated HMAC_CTX(3ssl) interface. Patch by Bénédikt
@@ -917,8 +927,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
and TD = TypedDict("TD", None) calls for constructing
typing.TypedDict objects with zero field. Patch by Bénédikt
Tran.
- gh-125996: Fix thread safety of collections.OrderedDict.
Patch by Kumar Aditya.
- gh-125996: Fix thread safety of collections.OrderedDict .
Patch by Kumar Aditya .
- gh-133817: Remove support for creating NamedTuple classes
via the undocumented keyword argument syntax. Patch by
Bénédikt Tran.
@@ -973,8 +983,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
logging.basicConfig().
- gh-92897: Removed the check_home parameter from
sysconfig.is_python_build(), deprecated since Python 3.12.
- gh-133551: Support t-strings (PEP 750) in annotationlib.
Patch by Jelle Zijlstra.
- gh-133551: Support t-strings (PEP 750) in annotationlib .
Patch by Jelle Zijlstra .
- gh-133517: Remove os.listdrives(), os.listvolumes() and
os.listmounts() in non Windows desktop builds since the
underlying functionality is missing.
@@ -1035,9 +1045,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-87790: Support underscore and comma as thousands
separators in the fractional part for Fractions
formatting. Patch by Sergey B Kirpichev.
- gh-87790: Support underscore and comma as thousands
- gh-87790: Support underscore and comma as thousand s
separators in the fractional part for Decimals formatting.
Patch by Sergey B Kirpichev.
Patch by Sergey B Kirpichev .
- gh-131884: Fix formatting issues in json.dump() when both
indent and skipkeys are used.
- gh-131788: Make ResourceTracker.send from multiprocessing
@@ -1072,8 +1082,8 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-125028: functools.Placeholder cannot be passed to
functools.partial() as a keyword argument.
- gh-125843: If possible, indicate which curses C function or
macro is responsible for raising a curses.error exception.
Patch by Bénédikt Tran.
macro is responsible for raising a curses.error exceptio n.
Patch by Bénédikt Tra n.
- gh-119109: functools.partial() calls are now faster when
keyword arguments are used.
- gh-124033: SimplePath is now presented in
@@ -1198,13 +1208,13 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
__typing_subst__ returns an object that isnt a tuple.
- gh-138431: Fix a bug in the JIT optimizer when
round-tripping strings and tuples.
- gh-138378: Move the globals-to-const JIT optimizer pass
into to the main JIT optimizer pass
- gh-138378: Move the globals-to-const JIT optimizer pass
into to the main JIT optimizer pass
- gh-138401: Add missing validation of argument count in
os.sendfile() to be non-negative.
- gh-138372: Fix SyntaxWarning emitted for erroneous
subscript expressions involving template string literals.
Patch by Brian Schubert.
- gh-138372: Fix SyntaxWarning emitted for erroneou s
subscript expressions involving template string literals .
Patch by Brian Schubert .
- gh-138302: BINARY_OP now specializes to BINARY_OP_ADD_INT,
BINARY_OP_SUBTRACT_INT or BINARY_OP_MULTIPLY_INT if
operands are compact ints.
@@ -1229,9 +1239,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
and does not contain double quotes.
- gh-137384: Fix a crash when using the warnings module in a
finalizer at shutdown. Patch by Kumar Aditya.
- gh-138004: On Solaris/Illumos platforms, thread names are
now encoded as ASCII to avoid errors on systems (e.g.
OpenIndiana) that dont support non-ASCII names.
- gh-138004: On Solaris/Illumos platforms, thread names e
ar now encoded as ASCII to avoid errors on systems (e.g .
OpenIndiana) that dont support non-ASCII names .
- gh-137976: Removed localtime from the list of reported
system timezones.
- gh-137992: Ensure that PyRefTracer_SetTracer() sync with
@@ -1244,18 +1254,18 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-137883: Fix runaway recursion when calling a function
with keyword arguments.
- gh-137079: Fix keyword typo recognition when parsing files.
Patch by Pablo Galindo.
- gh-137728: Fix the JITs handling of many local variables.
This previously caused a segfault.
Patch by Pablo Galindo .
- gh-137728: Fix the JITs handling of many local variables .
This previously caused a segfault .
- gh-137716: Fix double period in AttributeError message for
invalid mock assertions
- gh-137433: Fix a potential deadlock in the free threading
build when daemon threads enable or disable profiling
or tracing while the main thread is shutting down the
interpreter.
- gh-137576: Fix for incorrect source code being shown in
- gh-137576: Fix for incorrect source code being shown i n
tracebacks from the Basic REPL when PYTHONSTARTUP is given.
Patch by Adam Hartz.
Patch by Adam Hartz .
- gh-37817: Allow assignment to __bases__ of direct
subclasses of builtin classes.
- gh-132732: Optimize _COMPARE_OP, _CONTAINS_OP,
@@ -1598,18 +1608,13 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
function.
- gh-129813: Implement PEP 782, the PyBytesWriter API. Add
functions:
PyBytesWriter_Create()
PyBytesWriter_Discard()
PyBytesWriter_FinishWithPointer()
PyBytesWriter_FinishWithSize()
PyBytesWriter_Finish()
PyBytesWriter_Format()
PyBytesWriter_GetData()
PyBytesWriter_GetSize()
PyBytesWriter_GrowAndUpdatePointer()
PyBytesWriter_Grow()
PyBytesWriter_Resize()
PyBytesWriter_WriteBytes()
PyBytesWriter_Create PyBytesWriter_Discard ()
PyBytesWriter_FinishWithPointer ()
PyBytesWriter_FinishWithSize ()
PyBytesWriter_Finish PyBytesWriter_Format ()
PyBytesWriter_GetData PyBytesWriter_GetSize ()
PyBytesWriter_GrowAndUpdatePointer PyBytesWriter_Grow ()
PyBytesWriter_Resize PyBytesWriter_WriteBytes ()
- Patch by Victor Stinner.
- gh-137956: Display and raise an exception if an extension
compiled for non-free-threaded Python is loaded in a
@@ -1669,9 +1674,9 @@ Fri Oct 24 21:45:47 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-133644: Remove deprecated function PyWeakref_GetObject()
and macro PyWeakref_GET_OBJECT. Use PyWeakref_GetRef()
instead. Patch by Bénédikt Tran.
- gh-133644: Remove deprecated alias
PyImport_ImportModuleNoBlock() of PyImport_ImportModule().
Patch by Bénédikt Tran.
- gh-133644: Remove deprecated alia s
PyImport_ImportModuleNoBlock() of PyImport_ImportModule() .
Patch by Bénédikt Tran .
- gh-133610: Remove deprecated functions
PyUnicode_AsDecodedObject(), PyUnicode_AsDecodedUnicode(),
PyUnicode_AsEncodedObject(), and