- Update patch fix_configure_rst.patch
- Update to 3.11.7:
- Core and Builtins
- gh-112625: Fixes a bug where a bytearray object could be cleared
while iterating over an argument in the bytearray.join() method
that could result in reading memory after it was freed.
- gh-112388: Fix an error that was causing the parser to try to
overwrite tokenizer errors. Patch by pablo Galindo
- gh-112387: Fix error positions for decoded strings with
backwards tokenize errors. Patch by Pablo Galindo
- gh-112266: Change docstrings of __dict__ and __weakref__.
- gh-109181: Speed up Traceback object creation by lazily compute
the line number. Patch by Pablo Galindo
- gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004
codecs read out of bounds
- gh-111366: Fix an issue in the codeop that was causing
SyntaxError exceptions raised in the presence of invalid syntax
to not contain precise error messages. Patch by Pablo Galindo
- gh-111380: Fix a bug that was causing SyntaxWarning to appear
twice when parsing if invalid syntax is encountered later. Patch
by Pablo galindo
- gh-88116: Traceback location ranges involving wide unicode
characters (like emoji and asian characters) now are properly
highlighted. Patch by Batuhan Taskaya and Pablo Galindo.
- gh-94438: Fix a regression that prevented jumping across is None
and is not None when debugging. Patch by Savannah Ostrowski.
- gh-110696: Fix incorrect error message for invalid argument
unpacking. Patch by Pablo Galindo
- gh-110237: Fix missing error checks for calls to PyList_Append
in _PyEval_MatchClass.
- gh-109216: Fix possible memory leak in BUILD_MAP.
- Library
- gh-112618: Fix a caching bug relating to typing.Annotated.
Annotated[str, True] is no longer identical to Annotated[str,
1].
- gh-112509: Fix edge cases that could cause a key to be present
in both the __required_keys__ and __optional_keys__ attributes
of a typing.TypedDict. Patch by Jelle Zijlstra.
- gh-94722: Fix bug where comparison between instances of DocTest
fails if one of them has None as its lineno.
- gh-112105: Make readline.set_completer_delims() work with
libedit
- gh-111942: Fix SystemError in the TextIOWrapper constructor with
non-encodable “errors” argument in non-debug mode.
- gh-109538: Issue warning message instead of having RuntimeError
be displayed when event loop has already been closed at
StreamWriter.__del__().
- gh-111942: Fix crashes in io.TextIOWrapper.reconfigure() when
pass invalid arguments, e.g. non-string encoding.
- gh-111804: Remove posix.fallocate() under WASI as the underlying
posix_fallocate() is not available in WASI preview2.
- gh-111841: Fix truncating arguments on an embedded null
character in os.putenv() and os.unsetenv() on Windows.
- gh-111541: Fix doctest for SyntaxError not-builtin subclasses.
- gh-110894: Call loop exception handler for exceptions in
client_connected_cb of asyncio.start_server() so that
applications can handle it. Patch by Kumar Aditya.
- gh-111531: Fix reference leaks in bind_class() and bind_all()
methods of tkinter widgets.
- gh-111356: Added io.text_encoding(), io.DEFAULT_BUFFER_SIZE, and
io.IncrementalNewlineDecoder to io.__all__.
- gh-68166: Remove mention of not supported “vsapi” element type
in tkinter.ttk.Style.element_create(). Add tests for
element_create() and other ttk.Style methods. Add examples for
element_create() in the documentation.
- gh-111251: Fix _blake2 not checking for errors when
initializing.
- gh-111174: Fix crash in io.BytesIO.getbuffer() called repeatedly
for empty BytesIO.
- gh-111187: Postpone removal version for
locale.getdefaultlocale() to Python 3.15.
- gh-111159: Fix doctest output comparison for exceptions with
notes.
- gh-110910: Fix invalid state handling in asyncio.TaskGroup and
asyncio.Timeout. They now raise proper RuntimeError if they are
improperly used and are left in consistent state after this.
- gh-111092: Make turtledemo run without default root enabled.
- gh-110590: Fix a bug in _sre.compile() where TypeError would be
overwritten by OverflowError when the code argument was a list
of non-ints.
- gh-65052: Prevent pdb from crashing when trying to display
undisplayable objects
- gh-110519: Deprecation warning about non-integer number in
gettext now alwais refers to the line in the user code where
gettext function or method is used. Previously it could refer to
a line in gettext code.
- gh-110378: contextmanager() and asynccontextmanager() context
managers now close an invalid underlying generator object that
yields more then one value.
- gh-110365: Fix termios.tcsetattr() bug that was overwritting
existing errors during parsing integers from term list.
- gh-110196: Add __reduce__ method to IPv6Address in order to keep
scope_id
- gh-109747: Improve errors for unsupported look-behind patterns.
Now re.error is raised instead of OverflowError or RuntimeError
for too large width of look-behind pattern.
- gh-109786: Fix possible reference leaks and crash when re-enter
the __next__() method of itertools.pairwise.
- gh-108791: Improved error handling in pdb command line
interface, making it produce more concise error messages.
- gh-73561: Omit the interface scope from an IPv6 address when
used as Host header by http.client.
- gh-86826: zipinfo now supports the full range of values in the
TZ string determined by RFC 8536 and detects all invalid
formats. Both Python and C implementations now raise exceptions
of the same type on invalid data.
- bpo-41422: Fixed memory leaks of pickle.Pickler and
pickle.Unpickler involving cyclic references via the internal
memo mapping.
- bpo-40262: The ssl.SSLSocket.recv_into() method no longer
requires the buffer argument to implement __len__ and supports
buffers with arbitrary item size.
- bpo-35191: Fix unexpected integer truncation in
socket.setblocking() which caused it to interpret multiples of
2**32 as False.
- Documentation
- gh-108826: dis module command-line interface is now mentioned in
documentation.
- Tests
- gh-110367: Make regrtest --verbose3 option compatible with
--huntrleaks -jN options. The ./python -m test -j1 -R 3:3
--verbose3 command now works as expected. Patch by Victor
Stinner.
- gh-111309: distutils tests can now be run via unittest.
- gh-111165: Remove no longer used functions run_unittest() and
run_doctest() and class BasicTestRunner from the test.support
module.
- gh-110932: Fix regrtest if the SOURCE_DATE_EPOCH environment
variable is defined: use the variable value as the random seed.
Patch by Victor Stinner.
- gh-110995: test_gdb: Fix detection of gdb built without Python
scripting support. Patch by Victor Stinner.
- gh-110918: Test case matching patterns specified by options
--match, --ignore, --matchfile and --ignorefile are now tested
in the order of specification, and the last match determines
whether the test case be run or ignored.
- gh-110647: Fix test_stress_modifying_handlers() of test_signal.
Patch by Victor Stinner.
- gh-103053: Fix test_tools.test_freeze on FreeBSD: run “make
distclean” instead of “make clean” in the copied source
directory to remove also the “python” program. Patch by Victor
Stinner.
- gh-110167: Fix a deadlock in test_socket when server fails with
a timeout but the client is still running in its thread. Don’t
hold a lock to call cleanup functions in doCleanups(). One of
the cleanup function waits until the client completes, whereas
the client could deadlock if it called addCleanup() in such
situation. Patch by Victor Stinner.
- gh-110388: Add tests for tty.
- gh-81002: Add tests for termios.
- gh-110267: Add tests for pickling and copying PyStructSequence
objects. Patched by Xuehai Pan.
- gh-109974: Fix race conditions in test_threading lock tests.
Wait until a condition is met rather than using time.sleep()
with a hardcoded number of seconds. Patch by Victor Stinner.
- gh-109972: Split test_gdb.py file into a test_gdb package made
of multiple tests, so tests can now be run in parallel. Patch by
Victor Stinner.
- gh-104736: Fix test_gdb on Python built with LLVM clang 16 on
Linux ppc64le (ex: Fedora 38). Search patterns in gdb “bt”
command output to detect when gdb fails to retrieve the
traceback. For example, skip a test if Backtrace stopped: frame
did not save the PC is found. Patch by Victor Stinner.
- gh-108927: Fixed order dependence in running tests in the same
process when a test that has submodules (e.g. test_importlib)
follows a test that imports its submodule (e.g.
test_importlib.util) and precedes a test (e.g. test_unittest or
test_compileall) that uses that submodule.
- Build
- gh-103053: “make check-clean-src” now also checks if the
“python” program is found in the source directory: fail with an
error if it does exist. Patch by Victor Stinner.
- gh-109191: Fix compile error when building with recent versions
of libedit.
- IDLE
- bpo-35668: Add docstrings to the IDLE debugger module. Fix two
bugs: initialize Idb.botframe (should be in Bdb); in
Idb.in_rpc_code, check whether prev_frame is None before trying
to use it. Greatly expand test_debugger.
- C API
- gh-112438: Fix support of format units “es”, “et”, “es#”, and
“et#” in nested tuples in PyArg_ParseTuple()-like functions.
- gh-109521: PyImport_GetImporter() now sets RuntimeError if it
fails to get sys.path_hooks or sys.path_importer_cache or they
are not list and dict correspondingly. Previously it could
return NULL without setting error in obscure cases, crash or
raise SystemError if these attributes have wrong type.
OBS-URL: https://build.opensuse.org/request/show/1133399
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=89
- Remove not needed patch 103213-fetch-CONFIG_ARGS.patch
- Refresh patches:
- bpo-31046_ensurepip_honours_prefix.patch
- fix_configure_rst.patch
- Update to 3.11.6:
- Core and Builtins
- gh-109351: Fix crash when compiling an invalid AST involving a
named (walrus) expression.
- gh-109207: Fix a SystemError in __repr__ of symtable entry
object.
- gh-109179: Fix bug where the C traceback display drops notes
from SyntaxError.
- gh-88943: Improve syntax error for non-ASCII character that
follows a numerical literal. It now points on the invalid
non-ASCII character, not on the valid numerical literal.
- gh-108959: Fix caret placement for error locations for subscript
and binary operations that involve non-semantic parentheses and
spaces. Patch by Pablo Galindo
- gh-108520: Fix
multiprocessing.synchronize.SemLock.__setstate__() to properly
initialize multiprocessing.synchronize.SemLock._is_fork_ctx.
This fixes a regression when passing a SemLock accross nested
processes.
- Rename multiprocessing.synchronize.SemLock.is_fork_ctx to
multiprocessing.synchronize.SemLock._is_fork_ctx to avoid
exposing it as public API.
- Library
- gh-110036: On Windows, multiprocessing Popen.terminate() now
catchs PermissionError and get the process exit code. If the
process is still running, raise again the PermissionError.
OBS-URL: https://build.opensuse.org/request/show/1126597
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=87
- Update to 3.11.5 (bsc#1214692):
- Security
- gh-108310: Fixed an issue where instances of ssl.SSLSocket were
vulnerable to a bypass of the TLS handshake and included
protections (like certificate verification) and treating sent
unencrypted data as if it were post-handshake TLS encrypted data.
Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by
Gregory P. Smith.
- Core and Builtins
- gh-104432: Fix potential unaligned memory access on C APIs
involving returned sequences of char * pointers within the grp
and socket modules. These were revealed using a
-fsaniziter=alignment build on ARM macOS. Patch by Christopher
Chavez.
- gh-77377: Ensure that multiprocessing synchronization objects
created in a fork context are not sent to a different process
created in a spawn context. This changes a segfault into an
actionable RuntimeError in the parent process.
- gh-106092: Fix a segmentation fault caused by a use-after-free
bug in frame_dealloc when the trashcan delays the deallocation
of a PyFrameObject.
- gh-106719: No longer suppress arbitrary errors in the
__annotations__ getter and setter in the type and module types.
- gh-106723: Propagate frozen_modules to multiprocessing spawned
process interpreters.
- gh-105979: Fix crash in _imp.get_frozen_object() due to improper
exception handling.
- gh-105840: Fix possible crashes when specializing function calls
with too many __defaults__.
- gh-105588: Fix an issue that could result in crashes when
compiling malformed ast nodes.
- gh-105375: Fix bugs in the builtins module where exceptions
could end up being overwritten.
- gh-105375: Fix bug in the compiler where an exception could end
up being overwritten.
- gh-105375: Improve error handling in
PyUnicode_BuildEncodingMap() where an exception could end up
being overwritten.
- gh-105235: Prevent out-of-bounds memory access during
mmap.find() calls.
- gh-101006: Improve error handling when read marshal data.
- Library
- gh-105736: Harmonized the pure Python version of OrderedDict
with the C version. Now, both versions set up their internal
state in __new__. Formerly, the pure Python version did the set
up in __init__.
- gh-107963: Fix multiprocessing.set_forkserver_preload() to check
the given list of modules names. Patch by Dong-hee Na.
- gh-106242: Fixes os.path.normpath() to handle embedded null
characters without truncating the path.
- gh-107845: tarfile.data_filter() now takes the location of
symlinks into account when determining their target, so it will
no longer reject some valid tarballs with
LinkOutsideDestinationError.
- gh-107715: Fix doctest.DocTestFinder.find() in presence of class
names with special characters. Patch by Gertjan van Zwieten.
- gh-100814: Passing a callable object as an option value to a
Tkinter image now raises the expected TclError instead of an
AttributeError.
- gh-106684: Close asyncio.StreamWriter when it is not closed by
application leading to memory leaks. Patch by Kumar Aditya.
- gh-107077: Seems that in some conditions, OpenSSL will return
SSL_ERROR_SYSCALL instead of SSL_ERROR_SSL when a certification
verification has failed, but the error parameters will still
contain ERR_LIB_SSL and SSL_R_CERTIFICATE_VERIFY_FAILED. We are
now detecting this situation and raising the appropiate
ssl.SSLCertVerificationError. Patch by Pablo Galindo
- gh-107396: tarfiles; Fixed use before assignment of
self.exception for gzip decompression
- gh-62519: Make gettext.pgettext() search plural definitions when
translation is not found.
- gh-83006: Document behavior of shutil.disk_usage() for
non-mounted filesystems on Unix.
- gh-106186: Do not report MultipartInvariantViolationDefect
defect when the email.parser.Parser class is used to parse
emails with headersonly=True.
- gh-106831: Fix potential missing NULL check of d2i_SSL_SESSION
result in _ssl.c.
- gh-106774: Update the bundled copy of pip to version 23.2.1.
- gh-106752: Fixed several bug in zipfile.Path in
name/suffix/suffixes/stem operations when no filename is present
and the Path is not at the root of the zipfile.
- gh-106602: Add __copy__ and __deepcopy__ in enum
- gh-106530: Revert a change to colorsys.rgb_to_hls() that caused
division by zero for certain almost-white inputs. Patch by Terry
Jan Reedy.
- gh-106052: re module: fix the matching of possessive quantifiers
in the case of a subpattern containing backtracking.
- gh-106510: Improve debug output for atomic groups in regular
expressions.
- gh-105497: Fix flag mask inversion when unnamed flags exist.
- gh-90876: Prevent multiprocessing.spawn from failing to import
in environments where sys.executable is None. This regressed in
3.11 with the addition of support for path-like objects in
multiprocessing.
- gh-106350: Detect possible memory allocation failure in the
libtommath function mp_init() used by the _tkinter module.
- gh-102541: Make pydoc.doc catch bad module ImportError when
output stream is not None.
- gh-106263: Fix crash when calling repr with a manually
constructed SignalDict object. Patch by Charlie Zhao.
- gh-105375: Fix a bug in _Unpickler_SetInputStream() where an
exception could end up being overwritten in case of failure.
- gh-105375: Fix bugs in sys where exceptions could end up being
overwritten because of deferred error handling.
- gh-105605: Harden pyexpat error handling during module
initialisation to prevent exceptions from possibly being
overwritten, and objects from being dereferenced twice.
- gh-105375: Fix bug in decimal where an exception could end up
being overwritten.
- gh-105375: Fix bugs in _datetime where exceptions could be
overwritten in case of module initialisation failure.
- gh-105375: Fix bugs in _ssl initialisation which could lead to
leaked references and overwritten exceptions.
- gh-105375: Fix a bug in array.array where an exception could end
up being overwritten.
- gh-105375: Fix bugs in _ctypes where exceptions could end up
being overwritten.
- gh-105375: Fix a bug in the posix module where an exception
could be overwritten.
- gh-105375: Fix bugs in _elementtree where exceptions could be
overwritten.
- gh-105375: Fix bugs in zoneinfo where exceptions could be
overwritten.
- gh-105375: Fix bugs in pickle where exceptions could be
overwritten.
- gh-105497: Fix flag inversion when alias/mask members exist.
- gh-105375: Fix bugs in pickle where exceptions could be
overwritten.
- gh-103171: Revert undocumented behaviour change with
runtime-checkable protocols decorated with typing.final() in
Python 3.11. The behaviour change had meant that objects would
not be considered instances of these protocols at runtime unless
they had a __final__ attribute. Patch by Alex Waygood.
- gh-105375: Fix a bug in sqlite3 where an exception could be
overwritten in the collation callback.
- gh-105332: Revert pickling method from by-name back to by-value.
- gh-104554: Add RTSPS scheme support in urllib.parse
- gh-100061: Fix a bug that causes wrong matches for regular
expressions with possessive qualifier.
- gh-102541: Hide traceback in help() prompt, when import failed.
- gh-99203: Restore following CPython <= 3.10.5 behavior of
shutil.make_archive(): do not create an empty archive if
root_dir is not a directory, and, in that case, raise
FileNotFoundError or NotADirectoryError regardless of format
choice. Beyond the brought-back behavior, the function may now
also raise these exceptions in dry_run mode.
- gh-94777: Fix hanging multiprocessing ProcessPoolExecutor when a
child process crashes while data is being written in the call
queue.
- bpo-18319: Ensure gettext(msg) retrieve translations even if a
plural form exists. In other words: gettext(msg) ==
ngettext(msg, '', 1).
- Documentation
- gh-107008: Document the curses module variables LINES and COLS.
- gh-106948: Add a number of standard external names to
nitpick_ignore.
- gh-54738: Add documentation on how to localize the argparse
module.
- Tests
- gh-105776: Fix test_cppext when the C compiler command -std=c11
option: remove -std= options from the compiler command. Patch by
Victor Stinner.
- gh-107237: test_logging: Fix test_udp_reconnection() by
increasing the timeout from 100 ms to 5 minutes (LONG_TIMEOUT).
Patch by Victor Stinner.
- gh-101634: When running the Python test suite with -jN option,
if a worker stdout cannot be decoded from the locale encoding
report a failed testn so the exitcode is non-zero. Patch by
Victor Stinner.
- Build
- gh-107814: When calling find_python.bat with -q it did not
properly silence the output of nuget. That is now fixed.
- gh-106881: Check for linux/limits.h before including it in
Modules/posixmodule.c.
- gh-104692: Include commoninstall as a prerequisite for
bininstall
- This ensures that commoninstall is completed before bininstall
is started when parallel builds are used (make -j install), and
so the python3 symlink is only installed after all standard
library modules are installed.
- gh-100340: Allows -Wno-int-conversion for wasm-sdk 17 and
onwards, thus enables building WASI builds once against the
latest sdk.
- Windows
- gh-106242: Fixes realpath() to behave consistently when passed a
path containing an embedded null character on Windows. In strict
mode, it now raises OSError instead of the unexpected
ValueError, and in non-strict mode will make the path absolute.
- gh-106844: Fix integer overflow in _winapi.LCMapStringEx() which
affects ntpath.normcase().
- gh-99079: Update Windows build to use OpenSSL 3.0.9
- gh-105436: Ensure that an empty environment block is terminated
by two null characters, as is required by Windows.
- macOS
- gh-107565: Update macOS installer to use OpenSSL 3.0.10.
- gh-99079: Update macOS installer to use OpenSSL 3.0.9.
- Tools/Demos
- gh-107565: Update multissltests and GitHub CI workflows to use
OpenSSL 1.1.1v, 3.0.10, and 3.1.2.
- gh-95065: Argument Clinic now supports overriding automatically
generated signature by using directive @text_signature. See How
to override the generated signature.
- gh-106970: Fix bugs in the Argument Clinic destination <name>
clear command; the destination buffers would never be cleared,
and the destination directive parser would simply continue to
the fault handler after processing the command. Patch by Erlend
E. Aasland.
- C API
- gh-107916: C API functions PyErr_SetFromErrnoWithFilename(),
PyErr_SetExcFromWindowsErrWithFilename() and
PyErr_SetFromWindowsErrWithFilename() save now the error code
before calling PyUnicode_DecodeFSDefault().
- gh-107915: Such C API functions as PyErr_SetString(),
PyErr_Format(), PyErr_SetFromErrnoWithFilename() and many others
no longer crash or ignore errors if it failed to format the
error message or decode the filename. Instead, they keep a
corresponding error.
- gh-107226: PyModule_AddObjectRef() is now only available in the
limited API version 3.10 or later.
- gh-105375: Fix a bug in PyErr_WarnExplicit() where an exception
could end up being overwritten if the API failed internally.
- gh-99612: Fix PyUnicode_DecodeUTF8Stateful() for ASCII-only
data: *consumed was not set.
OBS-URL: https://build.opensuse.org/request/show/1109225
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=23
- Security
- gh-108310: Fixed an issue where instances of ssl.SSLSocket were
vulnerable to a bypass of the TLS handshake and included
protections (like certificate verification) and treating sent
unencrypted data as if it were post-handshake TLS encrypted data.
Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by
Gregory P. Smith.
- Core and Builtins
- gh-104432: Fix potential unaligned memory access on C APIs
involving returned sequences of char * pointers within the grp
and socket modules. These were revealed using a
-fsaniziter=alignment build on ARM macOS. Patch by Christopher
Chavez.
- gh-77377: Ensure that multiprocessing synchronization objects
created in a fork context are not sent to a different process
created in a spawn context. This changes a segfault into an
actionable RuntimeError in the parent process.
- gh-106092: Fix a segmentation fault caused by a use-after-free
bug in frame_dealloc when the trashcan delays the deallocation
of a PyFrameObject.
- gh-106719: No longer suppress arbitrary errors in the
__annotations__ getter and setter in the type and module types.
- gh-106723: Propagate frozen_modules to multiprocessing spawned
process interpreters.
- gh-105979: Fix crash in _imp.get_frozen_object() due to improper
exception handling.
- gh-105840: Fix possible crashes when specializing function calls
with too many __defaults__.
- gh-105588: Fix an issue that could result in crashes when
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=83
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API). (The patch is faulty,
gh#python/cpython#106669, but upstream decided not to just
revert it).
OBS-URL: https://build.opensuse.org/request/show/1102237
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=21
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API). (The patch is faulty,
gh#python/cpython#106669, but upstream decided not to just
revert it).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=77
- Update to Python 3.11.4:
- gh-103142: The version of OpenSSL used in Windows and
Mac installers has been upgraded to 1.1.1u to address
CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464,
as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303
fixed previously in 1.1.1t (gh-101727).
- gh-102153: urllib.parse.urlsplit() now strips leading C0
control and space characters following the specification for
URLs defined by WHATWG in response to CVE-2023-24329
(bsc#1208471).
- gh-99889: Fixed a security in flaw in uu.decode() that could
allow for directory traversal based on the input if no
out_file was specified.
- gh-104049: Do not expose the local on-disk
location in directory indexes produced by
http.client.SimpleHTTPRequestHandler.
- gh-103935: trace.__main__ now uses io.open_code() for files
to be executed instead of raw open().
- gh-102953: The extraction methods in tarfile, and
shutil.unpack_archive(), have a new filter argument that
allows limiting tar features than may be surprising or
dangerous, such as creating files outside the destination
directory. See Extraction filters for details (fixing
CVE-2007-4559, bsc#1203750).
- Remove upstreamed patches:
- CVE-2007-4559-filter-tarfile_extractall.patch
OBS-URL: https://build.opensuse.org/request/show/1096536
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=20
- gh-103142: The version of OpenSSL used in Windows and
Mac installers has been upgraded to 1.1.1u to address
CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464,
as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303
fixed previously in 1.1.1t (gh-101727).
- gh-102153: urllib.parse.urlsplit() now strips leading C0
control and space characters following the specification for
URLs defined by WHATWG in response to CVE-2023-24329
(bsc#1208471).
- gh-99889: Fixed a security in flaw in uu.decode() that could
allow for directory traversal based on the input if no
out_file was specified.
- gh-104049: Do not expose the local on-disk
location in directory indexes produced by
http.client.SimpleHTTPRequestHandler.
- gh-103935: trace.__main__ now uses io.open_code() for files
to be executed instead of raw open().
- gh-102953: The extraction methods in tarfile, and
shutil.unpack_archive(), have a new filter argument that
allows limiting tar features than may be surprising or
dangerous, such as creating files outside the destination
directory. See Extraction filters for details (fixing
CVE-2007-4559, bsc#1203750).
- Remove upstreamed patches:
- CVE-2007-4559-filter-tarfile_extractall.patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=71
- Why in the world we download from HTTP?
- Add 103213-fetch-CONFIG_ARGS.patch (gh#python/cpython#103053).
- Add skip_if_buildbot-extend.patch to avoid the bug altogether
(extending what skip_if_buildbot covers).
- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
bsc#1203750 (CVE-2007-4559) and implementing "PEP 706 – Filter
for tarfile.extractall".
- Update to 3.11.3:
- Security
- gh-101727: Updated the OpenSSL version used in Windows
and macOS binary release builds to 1.1.1t to address
CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the
OpenSSL 2023-02-07 security advisory.
- Core and Builtins
- gh-101975: Fixed stacktop value on tracing entries to avoid
corruption on garbage collection.
- gh-102701: Fix overflow when creating very large dict.
- gh-102416: Do not memoize incorrectly automatically
generated loop rules in the parser. Patch by Pablo Galindo.
- gh-102356: Fix a bug that caused a crash when deallocating
deeply nested filter objects. Patch by Marta Gómez Macías.
- gh-102397: Fix segfault from race condition in signal
handling during garbage collection. Patch by Kumar Aditya.
- gh-102281: Fix potential nullptr dereference and use of
uninitialized memory in fileutils. Patch by Max Bachmann.
- gh-102126: Fix deadlock at shutdown when clearing thread
states if any finalizer tries to acquire the runtime head
lock. Patch by Kumar Aditya.
- gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
module. Patch by Max Bachmann.
- gh-101967: Fix possible segfault in
positional_only_passed_as_keyword function, when new list
created.
- gh-101765: Fix SystemError / segmentation fault in iter
__reduce__ when internal access of builtins.__dict__ keys
mutates the iter object.
- gh-101696: Invalidate type version tag in
_PyStaticType_Dealloc for static types, avoiding bug where
a false cache hit could crash the interpreter. Patch by
Kumar Aditya.
- Library
- gh-102549: Don’t ignore exceptions in member type creation.
- gh-102947: Improve traceback when dataclasses.fields() is
called on a non-dataclass. Patch by Alex Waygood
- gh-102780: The asyncio.Timeout context manager now
works reliably even when performing cleanup due to task
cancellation. Previously it could raise a CancelledError
instead of an TimeoutError in such cases.
- gh-88965: typing: Fix a bug relating to substitution in .
Pacustom classes generic over a ParamSpec. Previously, if .
Pathe ParamSpec was substituted with a parameters list that .
Paitself contained a TypeVar, the TypeVar in the parameters .
Palist could not be subsequently substituted. This is now .
Pafixed tch by Nikita Sobolev .
- gh-101979: Fix a bug where parentheses in the metavar
argument to argparse.ArgumentParser.add_argument() were
dropped. Patch by Yeojin Kim.
- gh-102179: Fix os.dup2() error message for negative fds.
- gh-101961: For the binary mode, fileinput.hookcompressed()
doesn’t set the encoding value even if the value is
None. Patch by Gihwan Kim.
- gh-101936: The default value of fp becomes io.BytesIO
if HTTPError is initialized without a designated fp
parameter. Patch by Long Vo.
- gh-102069: Fix __weakref__ descriptor generation for custom
dataclasses.
- gh-101566: In zipfile, apply fix for extractall on the
underlying zipfile after being wrapped in Path.
- gh-101892: Callable iterators no longer raise SystemError
when the callable object exhausts the iterator but forgets
to either return a sentinel value or raise StopIteration.
- gh-97786: Fix potential undefined behaviour in corner cases
of floating-point-to-time conversions.
- gh-101517: Fixed bug where bdb looks up the source line
with linecache with a lineno=None, which causes it to fail
with an unhandled exception.
- gh-101673: Fix a pdb bug where ll clears the changes to
local variables.
- gh-96931: Fix incorrect results from
ssl.SSLSocket.shared_ciphers()
- gh-88233: Correctly preserve “extra” fields in zipfile
regardless of their ordering relative to a zip64 “extra.”
- gh-96127: inspect.signature was raising TypeError on
call with mock objects. Now it correctly returns (*args,
**kwargs) as infered signature.
- gh-95495: When built against OpenSSL 3.0, the ssl module
had a bug where it reported unauthenticated EOFs (i.e.
without close_notify) as a clean TLS-level EOF. It now
raises SSLEOFError, matching the behavior in previous
versions of OpenSSL. The options attribute on SSLContext
also no longer includes OP_IGNORE_UNEXPECTED_EOF by
default. This option may be set to specify the previous
OpenSSL 3.0 behavior.
- gh-94440: Fix a concurrent.futures.process bug where
ProcessPoolExecutor shutdown could hang after a future has
been quickly submitted and canceled.
- Documentation
- gh-103112: Add docstring to http.client.HTTPResponse.read()
to fix pydoc output.
- gh-85417: Update cmath documentation to clarify behaviour
on branch cuts.
- gh-97725: Fix asyncio.Task.print_stack() description for
file=None. Patch by Oleg Iarygin.
- Tests
- gh-102980: Improve test coverage on pdb.
- gh-102537: Adjust the error handling strategy in
test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
Paul Ganssle.
- gh-89792: test_tools now copies up to 10x less source data
to a temporary directory during the freeze test by ignoring
git metadata and other artifacts. It also limits its python
build parallelism based on os.cpu_count instead of hard
coding it as 8 cores.
- gh-101377: Improved test_locale_calendar_formatweekday of
calendar.
- Build
- gh-102711: Fix -Wstrict-prototypes compiler warnings.
OBS-URL: https://build.opensuse.org/request/show/1084262
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=17
- Security
- gh-101727: Updated the OpenSSL version used in Windows
and macOS binary release builds to 1.1.1t to address
CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the
OpenSSL 2023-02-07 security advisory.
- gh-101283: subprocess.Popen now uses a safer approach to
find cmd.exe when launching with shell=True. Patch by Eryk
Sun, based on a patch by Oleg Iarygin.
- Core and Builtins
- gh-101975: Fixed stacktop value on tracing entries to avoid
corruption on garbage collection.
- gh-102701: Fix overflow when creating very large dict.
- gh-102416: Do not memoize incorrectly automatically
generated loop rules in the parser. Patch by Pablo Galindo.
- gh-102356: Fix a bug that caused a crash when deallocating
deeply nested filter objects. Patch by Marta Gómez Macías.
- gh-102397: Fix segfault from race condition in signal
handling during garbage collection. Patch by Kumar Aditya.
- gh-102281: Fix potential nullptr dereference and use of
uninitialized memory in fileutils. Patch by Max Bachmann.
- gh-102126: Fix deadlock at shutdown when clearing thread
states if any finalizer tries to acquire the runtime head
lock. Patch by Kumar Aditya.
- gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
module. Patch by Max Bachmann.
- gh-101967: Fix possible segfault in
positional_only_passed_as_keyword function, when new list
created.
- gh-101765: Fix SystemError / segmentation fault in iter
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=57
