forked from pool/python315
Update to 3.15.0a6:
- Tests
- gh-144415: The Android testbed now distinguishes between
stdout/stderr messages which were triggered by a newline,
and those triggered by a manual call to flush. This fixes
logging of progress indicators and similar content.
- gh-65784: Add support for parametrized resource wantobjects
in regrtests, which allows to run Tkinter tests with the
specified value of tkinter.wantobjects, for example -u
wantobjects=0.
- Security
- CVE-2024-6923: BytesGenerator will now refuse to serialize
(write) headers that are unsafely folded or delimited; see
verify_generated_headers. (Contributed by Bas Bloemsaat and
Petr Viktorin in gh-121650). (bsc#1228780, gh-144125)
- CVE-2025-11468: Fixed a bug in the folding of comments when
flattening an email message using a modern email policy.
Comments consisting of a very long sequence of non-foldable
characters could trigger a forced line wrap that omitted
the required leading space on the continuation line,
causing the remainder of the comment to be interpreted as
a new header field. This enabled header injection with
carefully crafted inputs. (bsc#1257029, gh-143935)
- CVE-2025-15282: Reject control characters in data: URL
media types. (bsc#1257046, gh-143925)
- CVE-2025-15367: Reject control characters in POP3 commands.
(bsc#1257041, gh-143923)
- CVE-2025-15366: Reject control characters in IMAP commands.
(bsc#1257044, gh-143921)
- CVE-2026-0672: Reject control characters in
http.cookies.Morsel fields and values. (bsc#1257031,
gh-143919)
- CVE-2026-0865: Reject C0 control characters within
wsgiref.headers.Headers fields, values, and parameters.
(bsc#1257042, gh-143916)
- Library
- gh-144538: Bump the version of pip bundled in ensurepip to
version 26.0.1
- gh-144493: Improve an exception error message in
_overlapped.BindLocal() that is raised when
asyncio.loop.sock_connect() is called on
a asyncio.ProactorEventLoop with a socket that has an
invalid address family.
- gh-144386: Add support for arbitrary descriptors
__enter__(), __exit__(), __aenter__(), and __aexit__() in
contextlib.ExitStack and contextlib.AsyncExitStack, for
consistency with the with and async with statements.
- gh-123471: Make concurrent iteration over
itertools.combinations_with_replacement and
itertools.permutations safe under free-threading.
- gh-74453: Deprecate os.path.commonprefix() in favor of
os.path.commonpath() for path segment prefixes.
- The os.path.commonprefix() function is being deprecated due
to having a misleading name and module. The function is not
safe to use for path prefixes despite being included in
a module about path manipulation, meaning it is easy to
accidentally introduce path traversal vulnerabilities into
Python programs by using this function.
- gh-144380: Improve performance of io.BufferedReader line
iteration by ~49%.
- gh-144363: Update bundled libexpat to 2.7.4
- gh-140824: When faulthandler dumps the list of third-party
extension modules, ignore sub-modules of stdlib packages.
Patch by Victor Stinner.
- gh-144206: Improve error messages for buffer overflow in
fcntl.fcntl() and fcntl.ioctl().
- gh-144264: Speed up Base64 decoding of data containing
ignored characters (both in non-strict mode and with an
explicit ignorechars argument). It is now up to 2 times
faster for multiline Base64 data.
- gh-144249: Add filename context to OSError exceptions
raised by ssl.SSLContext.load_cert_chain(), allowing users
to have more context.
- gh-132888: Fix incorrect use of ctypes.GetLastError() and
add missing error checks for Windows API calls in
_pyrepl.windows_console.
- gh-142956: Updated tomllib to parse TOML 1.1.0.
- gh-144217: mimetypes: Add support for DICOM files (for
medical imaging) with the official MIME type
application/dicom. Patch by Benedikt Johannes.
- gh-144212: Mime type image/jxl is now supported by
mimetypes.
- gh-143594: Add symtable.Function.get_cells() and
symtable.Symbol.is_cell() methods.
- gh-144169: Fix three crashes when non-string keyword
arguments are supplied to objects in the ast module.
- gh-144128: Fix a crash in array.array.fromlist() when an
element’s __index__() method mutates the input list during
conversion.
- gh-144100: Fixed a crash in ctypes when using a deprecated
POINTER(str) type in argtypes. Instead of aborting, ctypes
now raises a proper Python exception when the pointer
target type is unresolved.
- gh-143658: importlib.metadata: Use str.lower() and
str.replace() to further improve performance of
importlib.metadata.Prepared.normalize(). Patch by Hugo van
Kemenade and Henry Schreiner.
- gh-144050: Fix stat.filemode() in the pure-Python
implementation to avoid misclassifying invalid mode values
as block devices.
- gh-83069: subprocess.Popen.wait(): when timeout is not
None, an efficient event-driven mechanism now waits for
process termination, if available. Linux >= 5.3 uses
os.pidfd_open() + select.poll(). macOS and other BSD
variants use select.kqueue() + KQ_FILTER_PROC
+ KQ_NOTE_EXIT. Windows keeps using WaitForSingleObject
(unchanged). If none of these mechanisms are available, the
function falls back to the traditional busy loop
(non-blocking call and short sleeps). Patch by Giampaolo
Rodola.
- gh-144030: The Python implementation of
functools.lru_cache() differed from the default
C implementation in that it did not check that its argument
is callable. This discrepancy is now fixed and both raise
a TypeError.
- gh-144001: Added the ignorechars parameter in
binascii.a2b_base64() and base64.b64decode().
- gh-144023: Fixed validation of file descriptor 0 in posix
functions when used with follow_symlinks parameter.
- gh-143999: Fix an issue where inspect.getgeneratorstate()
and inspect.getcoroutinestate() could fail for generators
wrapped by types.coroutine() in the suspended state.
- gh-143952: Fixed asyncio debugging tools to work with new
remote debugging API. Patch by Bartosz Sławecki.
- gh-143904: struct.pack_into() now raises OverflowError
instead of IndexError for too large offset argument.
- gh-143897: Remove the isxidstart() and isxidcontinue()
methods of unicodedata.ucd_3_2_0. They are now only exposed
as unicodedata.isxidstart() and
unicodedata.isxidcontinue().
- gh-143831: annotationlib.ForwardRef objects are now
hashable when created from annotation scopes with closures.
Previously, hashing such objects would throw an exception.
Patch by Bartosz Sławecki.
- gh-143874: Fixed a bug in pdb where expression results were
not sent back to remote client.
- gh-143754: Add new tkinter widget methods pack_content(),
place_content() and grid_content() which are alternative
spelling of old *_slaves() methods.
- gh-143756: Fix potential thread safety issues in ssl
module.
- gh-132604: Previously, Protocol classes that were not
decorated with @~typing.runtime_checkable, but that
inherited from another Protocol class that did have this
decorator, could be used in isinstance() and issubclass()
checks. This behavior is now deprecated and such checks
will throw a TypeError in Python 3.20. Patch by Bartosz
Sławecki.
- gh-143543: Fix a crash in itertools.groupby that could
occur when a user-defined __eq__() method re-enters the
iterator during key comparison.
- gh-143689: Fix io.BufferedReader.read1() state cleanup on
buffer allocation failure.
- gh-143602: Fix a inconsistency issue in write() that leads
to unexpected buffer overwrite by deduplicating the buffer
exports.
- gh-142434: Use ppoll() if available in select.poll() to
have a timeout resolution of 1 nanosecond, instead of
a resolution of 1 ms. Patch by Victor Stinner.
- gh-140557: array.array buffers now have the same alignment
when empty as when allocated. Unaligned buffers can still
be created by slicing.
- gh-143423: Fix free-threaded build detection in the
sampling profiler when Py_GIL_DISABLED is set to 0.
- gh-101178: Add Ascii85, Base85, and Z85 support to binascii
and improve the performance of the base-85 converters in
base64.
- gh-142966: Fix ctypes.POINTER.set_type() not updating the
format string to match the type.
- gh-142555: array: fix a crash in a[i] = v when converting
i to an index via i.__index__ or i.__float__ mutates the
array.
- gh-142438: Fix _decimal builds configured with
EXTRA_FUNCTIONALITY by correcting the Context.apply wrapper
to pass the right argument.
- gh-141860: Add an on_error keyword-only parameter to
multiprocessing.set_forkserver_preload() to control how
import failures during module preloading are handled.
Accepts 'ignore' (default, silent), 'warn' (emit
ImportWarning), or 'fail' (raise exception). Contributed by
Nick Neumann and Gregory P. Smith.
- CVE-2025-12781: Accepting + and / characters with an
alternative alphabet in base64.b64decode() and
base64.urlsafe_b64decode() is now deprecated. In future
Python versions they will be errors in the strict mode and
discarded in the non-strict mode. (bsc#1257108, gh-125346)
- gh-140715: Add '%F' support to strptime().
- gh-67041: Add the missing_as_none parameter to urlparse(),
urlsplit() and urldefrag() functions. Add the keep_empty
parameter to urlunparse() and urlunsplit() functions. This
allows to distinguish between empty and not defined URI
components and preserve empty components.
- gh-77188: The pickle module now properly handles
name-mangled private methods.
- IDLE
- gh-143774: Better explain the operation of Format / Format
Paragraph.
- Core and Builtins
- gh-134584: Optimize and eliminate ref-counting in
_BINARY_OP_SUBSCR_LIST_SLICE
- gh-144563: Fix interaction of the Tachyon profiler and
ctypes and other modules that load the Python shared
library (if present) in an independent map as this was
causing the mechanism that loads the binary information to
be confused. Patch by Pablo Galindo
- gh-144601: Fix crash when importing a module whose PyInit
function raises an exception from a subinterpreter.
- gh-144549: Fix building the tail calling interpreter on
Visual Studio 2026 with free-threading.
- gh-144513: Fix potential deadlock when using critical
sections during stop-the-world pauses in the free-threaded
build.
- gh-131798: Optimise _GUARD_TOS_SLICE in the JIT.
- gh-144330: Move classmethod and staticmethod initialization
from __init__() to __new__(). Patch by Victor Stinner.
- gh-144446: Fix data races in the free-threaded build when
reading frame object attributes while another thread is
executing the frame.
- gh-120321: Add gi_state, cr_state, and ag_state attributes
to generators, coroutines, and async generators that return
the current state as a string (e.g., GEN_RUNNING). The
inspect module functions getgeneratorstate(),
getcoroutinestate(), and getasyncgenstate() now return
these attributes directly.
- gh-141563: Fix thread safety of PyDateTime_IMPORT.
- gh-144280: Fix a bug in JIT where the predicate symbol had
no truthiness
- gh-140550: In PyModuleDef.m_slots, allow slots that repeat
information present in PyModuleDef.
- gh-139103: Improve scaling of namedtuple() instantiation in
the free-threaded build.
- gh-144307: Prevent a reference leak in module teardown at
interpreter finalization.
- gh-144319: Add huge pages support for the pymalloc
allocator. Patch by Pablo Galindo
- gh-120321: Made gi_yieldfrom thread-safe in the
free-threading build by using a lightweight lock on the
frame state.
- gh-144194: Fix error handling in perf jitdump
initialization on memory allocation failure.
- gh-143962: Name suggestion for not normalized name suggests
now the normalized name or the closest name to the
normalized name. If the suggested name is not ASCII,
include also its ASCII representation.
- gh-144157: bytes.translate() now allows the compiler to
unroll its loop more usefully for a 2x speedup in the
common no-deletions specified case.
- gh-144068: Fix JIT tracer memory leak, ensure the JIT
tracer state is freed when daemon threads are cleaned up
during interpreter shutdown.
- gh-144012: Check if the result is NULL in BINARY_OP_EXTENT
opcode.
- gh-144007: Eliminate redundant refcounting in the JIT for
BINARY_OP.
- gh-144005: Eliminate redundant refcounting from
BINARY_OP_EXTEND.
- gh-143939: Fix erroneous “cannot reuse already awaited
coroutine” error that could occur when a generator was run
during the process of clearing a coroutine’s frame.
- gh-141805: Fix crash in set when objects with the same hash
are concurrently added to the set after removing an element
with the same hash while the set still contains elements
with the same hash.
- gh-143670: Fixes a crash in ga_repr_items_list function.
- gh-143650: Fix race condition in importlib where a thread
could receive a stale module reference when another
thread’s import fails.
- gh-143569: Generator expressions in 3.15 now conform to the
documented behavior when the iterable does not support
iteration. This matches the behavior in 3.14 and earlier
- gh-143192: Improve performance of bitwise operations on
multi-digit ints.
- gh-132657: If we are specializing to LOAD_GLOBAL_MODULE or
LOAD_ATTR_MODULE, try to enable deferred reference counting
for the value, if the object is owned by a different
thread. This applies to the free-threaded build only and
should improve scaling of multi-threaded programs. Note
that when deferred reference counting is enabled, the
object will be deallocated by the GC, rather than by
Py_DECREF().
- gh-143055: Implement PEP 798 (Unpacking in Comprehensions).
Patch by Adam Hartz.
- gh-142037: Improve error messages for printf-style
formatting. For errors in the format string, always include
the position of the start of the format unit. For errors
related to the formatted arguments, always include the
number or the name of the argument. Raise more specific
errors and include more information (type and number of
arguments, most probable causes of error).
- gh-140557: bytearray buffers now have the same alignment
when empty as when allocated. Unaligned buffers can still
be created by slicing.
- gh-140232: Frozenset objects with immutable elements are no
longer tracked by the garbage collector.
- gh-115231: Setup __module__ attribute for built-in static
methods. Patch by Sergey B Kirpichev.
- C API
- gh-143869: Added PyLong_GetNativeLayout(), PyLongLayout,
PyLongExport, PyLong_Export(), PyLong_FreeExport(),
PyLongWriter, PyLongWriter_Create(), PyLongWriter_Finish()
and PyLongWriter_Discard() to the limited API.
- gh-141070: Renamed PyUnstable_Object_Dump() to
PyObject_Dump().
- Build
- gh-140421: Disable the perf trampoline on older macOS
versions where it cannot be built.
- gh-144309: Build Python with POSIX 2024, instead of POSIX
2008. Patch by Victor Stinner.
- gh-144278: Enables defining the _PY_IMPL_NAME and
_PY_IMPL_CACHE_TAG preprocessor definitions to override
sys.implementation at build time. Definitions need to
include quotes when setting to a string literal. Setting
the cache tag to NULL has the effect of completely
disabling automatic creation and use of .pyc files.
- gh-143960: Add support for OpenSSL 3.6, drop EOL 3.2. Patch
by Hugo van Kemenade.
- gh-143941: Move WASI-related files to Platforms/WASI. Along
the way, leave a deprecated Tools/wasm/wasi/__main__.py
behind for backwards-compatibility.
- gh-143842: Prevent static builds from clashing with curses
by making the optimizer COLORS table static.
Remove upstreamed patches:
- CVE-2024-6923-follow-up-EOL-email-headers.patch
- CVE-2025-11468-email-hdr-fold-comment.patch
- CVE-2025-12781-b64decode-alt-chars.patch
- CVE-2025-15282-urllib-ctrl-chars.patch
- CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2025-15367-poplib-ctrl-chars.patch
- CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
- CVE-2026-0865-wsgiref-ctrl-chars.patch
This commit is contained in:
@@ -1,3 +1,337 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Feb 11 20:26:47 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
- Update to 3.15.0a6:
|
||||
- Tests
|
||||
- gh-144415: The Android testbed now distinguishes between
|
||||
stdout/stderr messages which were triggered by a newline,
|
||||
and those triggered by a manual call to flush. This fixes
|
||||
logging of progress indicators and similar content.
|
||||
- gh-65784: Add support for parametrized resource wantobjects
|
||||
in regrtests, which allows to run Tkinter tests with the
|
||||
specified value of tkinter.wantobjects, for example -u
|
||||
wantobjects=0.
|
||||
- Security
|
||||
- CVE-2024-6923: BytesGenerator will now refuse to serialize
|
||||
(write) headers that are unsafely folded or delimited; see
|
||||
verify_generated_headers. (Contributed by Bas Bloemsaat and
|
||||
Petr Viktorin in gh-121650). (bsc#1228780, gh-144125)
|
||||
- CVE-2025-11468: Fixed a bug in the folding of comments when
|
||||
flattening an email message using a modern email policy.
|
||||
Comments consisting of a very long sequence of non-foldable
|
||||
characters could trigger a forced line wrap that omitted
|
||||
the required leading space on the continuation line,
|
||||
causing the remainder of the comment to be interpreted as
|
||||
a new header field. This enabled header injection with
|
||||
carefully crafted inputs. (bsc#1257029, gh-143935)
|
||||
- CVE-2025-15282: Reject control characters in data: URL
|
||||
media types. (bsc#1257046, gh-143925)
|
||||
- CVE-2025-15367: Reject control characters in POP3 commands.
|
||||
(bsc#1257041, gh-143923)
|
||||
- CVE-2025-15366: Reject control characters in IMAP commands.
|
||||
(bsc#1257044, gh-143921)
|
||||
- CVE-2026-0672: Reject control characters in
|
||||
http.cookies.Morsel fields and values. (bsc#1257031,
|
||||
gh-143919)
|
||||
- CVE-2026-0865: Reject C0 control characters within
|
||||
wsgiref.headers.Headers fields, values, and parameters.
|
||||
(bsc#1257042, gh-143916)
|
||||
- Library
|
||||
- gh-144538: Bump the version of pip bundled in ensurepip to
|
||||
version 26.0.1
|
||||
- gh-144493: Improve an exception error message in
|
||||
_overlapped.BindLocal() that is raised when
|
||||
asyncio.loop.sock_connect() is called on
|
||||
a asyncio.ProactorEventLoop with a socket that has an
|
||||
invalid address family.
|
||||
- gh-144386: Add support for arbitrary descriptors
|
||||
__enter__(), __exit__(), __aenter__(), and __aexit__() in
|
||||
contextlib.ExitStack and contextlib.AsyncExitStack, for
|
||||
consistency with the with and async with statements.
|
||||
- gh-123471: Make concurrent iteration over
|
||||
itertools.combinations_with_replacement and
|
||||
itertools.permutations safe under free-threading.
|
||||
- gh-74453: Deprecate os.path.commonprefix() in favor of
|
||||
os.path.commonpath() for path segment prefixes.
|
||||
- The os.path.commonprefix() function is being deprecated due
|
||||
to having a misleading name and module. The function is not
|
||||
safe to use for path prefixes despite being included in
|
||||
a module about path manipulation, meaning it is easy to
|
||||
accidentally introduce path traversal vulnerabilities into
|
||||
Python programs by using this function.
|
||||
- gh-144380: Improve performance of io.BufferedReader line
|
||||
iteration by ~49%.
|
||||
- gh-144363: Update bundled libexpat to 2.7.4
|
||||
- gh-140824: When faulthandler dumps the list of third-party
|
||||
extension modules, ignore sub-modules of stdlib packages.
|
||||
Patch by Victor Stinner.
|
||||
- gh-144206: Improve error messages for buffer overflow in
|
||||
fcntl.fcntl() and fcntl.ioctl().
|
||||
- gh-144264: Speed up Base64 decoding of data containing
|
||||
ignored characters (both in non-strict mode and with an
|
||||
explicit ignorechars argument). It is now up to 2 times
|
||||
faster for multiline Base64 data.
|
||||
- gh-144249: Add filename context to OSError exceptions
|
||||
raised by ssl.SSLContext.load_cert_chain(), allowing users
|
||||
to have more context.
|
||||
- gh-132888: Fix incorrect use of ctypes.GetLastError() and
|
||||
add missing error checks for Windows API calls in
|
||||
_pyrepl.windows_console.
|
||||
- gh-142956: Updated tomllib to parse TOML 1.1.0.
|
||||
- gh-144217: mimetypes: Add support for DICOM files (for
|
||||
medical imaging) with the official MIME type
|
||||
application/dicom. Patch by Benedikt Johannes.
|
||||
- gh-144212: Mime type image/jxl is now supported by
|
||||
mimetypes.
|
||||
- gh-143594: Add symtable.Function.get_cells() and
|
||||
symtable.Symbol.is_cell() methods.
|
||||
- gh-144169: Fix three crashes when non-string keyword
|
||||
arguments are supplied to objects in the ast module.
|
||||
- gh-144128: Fix a crash in array.array.fromlist() when an
|
||||
element’s __index__() method mutates the input list during
|
||||
conversion.
|
||||
- gh-144100: Fixed a crash in ctypes when using a deprecated
|
||||
POINTER(str) type in argtypes. Instead of aborting, ctypes
|
||||
now raises a proper Python exception when the pointer
|
||||
target type is unresolved.
|
||||
- gh-143658: importlib.metadata: Use str.lower() and
|
||||
str.replace() to further improve performance of
|
||||
importlib.metadata.Prepared.normalize(). Patch by Hugo van
|
||||
Kemenade and Henry Schreiner.
|
||||
- gh-144050: Fix stat.filemode() in the pure-Python
|
||||
implementation to avoid misclassifying invalid mode values
|
||||
as block devices.
|
||||
- gh-83069: subprocess.Popen.wait(): when timeout is not
|
||||
None, an efficient event-driven mechanism now waits for
|
||||
process termination, if available. Linux >= 5.3 uses
|
||||
os.pidfd_open() + select.poll(). macOS and other BSD
|
||||
variants use select.kqueue() + KQ_FILTER_PROC
|
||||
+ KQ_NOTE_EXIT. Windows keeps using WaitForSingleObject
|
||||
(unchanged). If none of these mechanisms are available, the
|
||||
function falls back to the traditional busy loop
|
||||
(non-blocking call and short sleeps). Patch by Giampaolo
|
||||
Rodola.
|
||||
- gh-144030: The Python implementation of
|
||||
functools.lru_cache() differed from the default
|
||||
C implementation in that it did not check that its argument
|
||||
is callable. This discrepancy is now fixed and both raise
|
||||
a TypeError.
|
||||
- gh-144001: Added the ignorechars parameter in
|
||||
binascii.a2b_base64() and base64.b64decode().
|
||||
- gh-144023: Fixed validation of file descriptor 0 in posix
|
||||
functions when used with follow_symlinks parameter.
|
||||
- gh-143999: Fix an issue where inspect.getgeneratorstate()
|
||||
and inspect.getcoroutinestate() could fail for generators
|
||||
wrapped by types.coroutine() in the suspended state.
|
||||
- gh-143952: Fixed asyncio debugging tools to work with new
|
||||
remote debugging API. Patch by Bartosz Sławecki.
|
||||
- gh-143904: struct.pack_into() now raises OverflowError
|
||||
instead of IndexError for too large offset argument.
|
||||
- gh-143897: Remove the isxidstart() and isxidcontinue()
|
||||
methods of unicodedata.ucd_3_2_0. They are now only exposed
|
||||
as unicodedata.isxidstart() and
|
||||
unicodedata.isxidcontinue().
|
||||
- gh-143831: annotationlib.ForwardRef objects are now
|
||||
hashable when created from annotation scopes with closures.
|
||||
Previously, hashing such objects would throw an exception.
|
||||
Patch by Bartosz Sławecki.
|
||||
- gh-143874: Fixed a bug in pdb where expression results were
|
||||
not sent back to remote client.
|
||||
- gh-143754: Add new tkinter widget methods pack_content(),
|
||||
place_content() and grid_content() which are alternative
|
||||
spelling of old *_slaves() methods.
|
||||
- gh-143756: Fix potential thread safety issues in ssl
|
||||
module.
|
||||
- gh-132604: Previously, Protocol classes that were not
|
||||
decorated with @~typing.runtime_checkable, but that
|
||||
inherited from another Protocol class that did have this
|
||||
decorator, could be used in isinstance() and issubclass()
|
||||
checks. This behavior is now deprecated and such checks
|
||||
will throw a TypeError in Python 3.20. Patch by Bartosz
|
||||
Sławecki.
|
||||
- gh-143543: Fix a crash in itertools.groupby that could
|
||||
occur when a user-defined __eq__() method re-enters the
|
||||
iterator during key comparison.
|
||||
- gh-143689: Fix io.BufferedReader.read1() state cleanup on
|
||||
buffer allocation failure.
|
||||
- gh-143602: Fix a inconsistency issue in write() that leads
|
||||
to unexpected buffer overwrite by deduplicating the buffer
|
||||
exports.
|
||||
- gh-142434: Use ppoll() if available in select.poll() to
|
||||
have a timeout resolution of 1 nanosecond, instead of
|
||||
a resolution of 1 ms. Patch by Victor Stinner.
|
||||
- gh-140557: array.array buffers now have the same alignment
|
||||
when empty as when allocated. Unaligned buffers can still
|
||||
be created by slicing.
|
||||
- gh-143423: Fix free-threaded build detection in the
|
||||
sampling profiler when Py_GIL_DISABLED is set to 0.
|
||||
- gh-101178: Add Ascii85, Base85, and Z85 support to binascii
|
||||
and improve the performance of the base-85 converters in
|
||||
base64.
|
||||
- gh-142966: Fix ctypes.POINTER.set_type() not updating the
|
||||
format string to match the type.
|
||||
- gh-142555: array: fix a crash in a[i] = v when converting
|
||||
i to an index via i.__index__ or i.__float__ mutates the
|
||||
array.
|
||||
- gh-142438: Fix _decimal builds configured with
|
||||
EXTRA_FUNCTIONALITY by correcting the Context.apply wrapper
|
||||
to pass the right argument.
|
||||
- gh-141860: Add an on_error keyword-only parameter to
|
||||
multiprocessing.set_forkserver_preload() to control how
|
||||
import failures during module preloading are handled.
|
||||
Accepts 'ignore' (default, silent), 'warn' (emit
|
||||
ImportWarning), or 'fail' (raise exception). Contributed by
|
||||
Nick Neumann and Gregory P. Smith.
|
||||
- CVE-2025-12781: Accepting + and / characters with an
|
||||
alternative alphabet in base64.b64decode() and
|
||||
base64.urlsafe_b64decode() is now deprecated. In future
|
||||
Python versions they will be errors in the strict mode and
|
||||
discarded in the non-strict mode. (bsc#1257108, gh-125346)
|
||||
- gh-140715: Add '%F' support to strptime().
|
||||
- gh-67041: Add the missing_as_none parameter to urlparse(),
|
||||
urlsplit() and urldefrag() functions. Add the keep_empty
|
||||
parameter to urlunparse() and urlunsplit() functions. This
|
||||
allows to distinguish between empty and not defined URI
|
||||
components and preserve empty components.
|
||||
- gh-77188: The pickle module now properly handles
|
||||
name-mangled private methods.
|
||||
- IDLE
|
||||
- gh-143774: Better explain the operation of Format / Format
|
||||
Paragraph.
|
||||
- Core and Builtins
|
||||
- gh-134584: Optimize and eliminate ref-counting in
|
||||
_BINARY_OP_SUBSCR_LIST_SLICE
|
||||
- gh-144563: Fix interaction of the Tachyon profiler and
|
||||
ctypes and other modules that load the Python shared
|
||||
library (if present) in an independent map as this was
|
||||
causing the mechanism that loads the binary information to
|
||||
be confused. Patch by Pablo Galindo
|
||||
- gh-144601: Fix crash when importing a module whose PyInit
|
||||
function raises an exception from a subinterpreter.
|
||||
- gh-144549: Fix building the tail calling interpreter on
|
||||
Visual Studio 2026 with free-threading.
|
||||
- gh-144513: Fix potential deadlock when using critical
|
||||
sections during stop-the-world pauses in the free-threaded
|
||||
build.
|
||||
- gh-131798: Optimise _GUARD_TOS_SLICE in the JIT.
|
||||
- gh-144330: Move classmethod and staticmethod initialization
|
||||
from __init__() to __new__(). Patch by Victor Stinner.
|
||||
- gh-144446: Fix data races in the free-threaded build when
|
||||
reading frame object attributes while another thread is
|
||||
executing the frame.
|
||||
- gh-120321: Add gi_state, cr_state, and ag_state attributes
|
||||
to generators, coroutines, and async generators that return
|
||||
the current state as a string (e.g., GEN_RUNNING). The
|
||||
inspect module functions getgeneratorstate(),
|
||||
getcoroutinestate(), and getasyncgenstate() now return
|
||||
these attributes directly.
|
||||
- gh-141563: Fix thread safety of PyDateTime_IMPORT.
|
||||
- gh-144280: Fix a bug in JIT where the predicate symbol had
|
||||
no truthiness
|
||||
- gh-140550: In PyModuleDef.m_slots, allow slots that repeat
|
||||
information present in PyModuleDef.
|
||||
- gh-139103: Improve scaling of namedtuple() instantiation in
|
||||
the free-threaded build.
|
||||
- gh-144307: Prevent a reference leak in module teardown at
|
||||
interpreter finalization.
|
||||
- gh-144319: Add huge pages support for the pymalloc
|
||||
allocator. Patch by Pablo Galindo
|
||||
- gh-120321: Made gi_yieldfrom thread-safe in the
|
||||
free-threading build by using a lightweight lock on the
|
||||
frame state.
|
||||
- gh-144194: Fix error handling in perf jitdump
|
||||
initialization on memory allocation failure.
|
||||
- gh-143962: Name suggestion for not normalized name suggests
|
||||
now the normalized name or the closest name to the
|
||||
normalized name. If the suggested name is not ASCII,
|
||||
include also its ASCII representation.
|
||||
- gh-144157: bytes.translate() now allows the compiler to
|
||||
unroll its loop more usefully for a 2x speedup in the
|
||||
common no-deletions specified case.
|
||||
- gh-144068: Fix JIT tracer memory leak, ensure the JIT
|
||||
tracer state is freed when daemon threads are cleaned up
|
||||
during interpreter shutdown.
|
||||
- gh-144012: Check if the result is NULL in BINARY_OP_EXTENT
|
||||
opcode.
|
||||
- gh-144007: Eliminate redundant refcounting in the JIT for
|
||||
BINARY_OP.
|
||||
- gh-144005: Eliminate redundant refcounting from
|
||||
BINARY_OP_EXTEND.
|
||||
- gh-143939: Fix erroneous “cannot reuse already awaited
|
||||
coroutine” error that could occur when a generator was run
|
||||
during the process of clearing a coroutine’s frame.
|
||||
- gh-141805: Fix crash in set when objects with the same hash
|
||||
are concurrently added to the set after removing an element
|
||||
with the same hash while the set still contains elements
|
||||
with the same hash.
|
||||
- gh-143670: Fixes a crash in ga_repr_items_list function.
|
||||
- gh-143650: Fix race condition in importlib where a thread
|
||||
could receive a stale module reference when another
|
||||
thread’s import fails.
|
||||
- gh-143569: Generator expressions in 3.15 now conform to the
|
||||
documented behavior when the iterable does not support
|
||||
iteration. This matches the behavior in 3.14 and earlier
|
||||
- gh-143192: Improve performance of bitwise operations on
|
||||
multi-digit ints.
|
||||
- gh-132657: If we are specializing to LOAD_GLOBAL_MODULE or
|
||||
LOAD_ATTR_MODULE, try to enable deferred reference counting
|
||||
for the value, if the object is owned by a different
|
||||
thread. This applies to the free-threaded build only and
|
||||
should improve scaling of multi-threaded programs. Note
|
||||
that when deferred reference counting is enabled, the
|
||||
object will be deallocated by the GC, rather than by
|
||||
Py_DECREF().
|
||||
- gh-143055: Implement PEP 798 (Unpacking in Comprehensions).
|
||||
Patch by Adam Hartz.
|
||||
- gh-142037: Improve error messages for printf-style
|
||||
formatting. For errors in the format string, always include
|
||||
the position of the start of the format unit. For errors
|
||||
related to the formatted arguments, always include the
|
||||
number or the name of the argument. Raise more specific
|
||||
errors and include more information (type and number of
|
||||
arguments, most probable causes of error).
|
||||
- gh-140557: bytearray buffers now have the same alignment
|
||||
when empty as when allocated. Unaligned buffers can still
|
||||
be created by slicing.
|
||||
- gh-140232: Frozenset objects with immutable elements are no
|
||||
longer tracked by the garbage collector.
|
||||
- gh-115231: Setup __module__ attribute for built-in static
|
||||
methods. Patch by Sergey B Kirpichev.
|
||||
- C API
|
||||
- gh-143869: Added PyLong_GetNativeLayout(), PyLongLayout,
|
||||
PyLongExport, PyLong_Export(), PyLong_FreeExport(),
|
||||
PyLongWriter, PyLongWriter_Create(), PyLongWriter_Finish()
|
||||
and PyLongWriter_Discard() to the limited API.
|
||||
- gh-141070: Renamed PyUnstable_Object_Dump() to
|
||||
PyObject_Dump().
|
||||
- Build
|
||||
- gh-140421: Disable the perf trampoline on older macOS
|
||||
versions where it cannot be built.
|
||||
- gh-144309: Build Python with POSIX 2024, instead of POSIX
|
||||
2008. Patch by Victor Stinner.
|
||||
- gh-144278: Enables defining the _PY_IMPL_NAME and
|
||||
_PY_IMPL_CACHE_TAG preprocessor definitions to override
|
||||
sys.implementation at build time. Definitions need to
|
||||
include quotes when setting to a string literal. Setting
|
||||
the cache tag to NULL has the effect of completely
|
||||
disabling automatic creation and use of .pyc files.
|
||||
- gh-143960: Add support for OpenSSL 3.6, drop EOL 3.2. Patch
|
||||
by Hugo van Kemenade.
|
||||
- gh-143941: Move WASI-related files to Platforms/WASI. Along
|
||||
the way, leave a deprecated Tools/wasm/wasi/__main__.py
|
||||
behind for backwards-compatibility.
|
||||
- gh-143842: Prevent static builds from clashing with curses
|
||||
by making the optimizer COLORS table static.
|
||||
- Remove upstreamed patches:
|
||||
- CVE-2024-6923-follow-up-EOL-email-headers.patch
|
||||
- CVE-2025-11468-email-hdr-fold-comment.patch
|
||||
- CVE-2025-12781-b64decode-alt-chars.patch
|
||||
- CVE-2025-15282-urllib-ctrl-chars.patch
|
||||
- CVE-2025-15366-imap-ctrl-chars.patch
|
||||
- CVE-2025-15367-poplib-ctrl-chars.patch
|
||||
- CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
|
||||
- CVE-2026-0865-wsgiref-ctrl-chars.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sun Feb 8 13:34:32 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user