- Update CVE-2023-52425-libexpat-2.6.0-backport.patch
so that it uses features sniffing, not just
comparing version number. Include also
support-expat-CVE-2022-25236-patched.patch.
- Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping
failing tests.
- Refresh patches:
- CVE-2023-27043-email-parsing-errors.patch
- fix_configure_rst.patch
- skip_if_buildbot-extend.patch
- Remove included patch:
- support-expat-CVE-2022-25236-patched.patch
OBS-URL: https://build.opensuse.org/request/show/1171202
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=34
uses features sniffing, not just comparing version
number. Include also support-expat-CVE-2022-25236-patched.patch.
- Refresh patches:
- CVE-2023-27043-email-parsing-errors.patch
- fix_configure_rst.patch
- skip_if_buildbot-extend.patch
- Remove included patch:
- support-expat-CVE-2022-25236-patched.patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=123
- Remove not needed upstream patches:
* libexpat260.patch
* CVE-2023-6597-TempDir-cleaning-symlink.patch, bsc#1219666
- Update to 3.11.9:
* Security
- gh-115398: Allow controlling Expat >=2.6.0 reparse deferral
(CVE-2023-52425, bsc#1219559) by adding five new methods:
xml.etree.ElementTree.XMLParser.flush()
xml.etree.ElementTree.XMLPullParser.flush()
xml.parsers.expat.xmlparser.GetReparseDeferralEnabled()
xml.parsers.expat.xmlparser.SetReparseDeferralEnabled()
xml.sax.expatreader.ExpatParser.flush()
- gh-115399: Update bundled libexpat to 2.6.0
- gh-115243: Fix possible crashes in collections.deque.index()
when the deque is concurrently modified.
- gh-114572: ssl.SSLContext.cert_store_stats() and
ssl.SSLContext.get_ca_certs() now correctly lock access to the
certificate store, when the ssl.SSLContext is shared across
multiple threads.
* Core and Builtins
- gh-116296: Fix possible refleak in object.__reduce__() internal
error handling.
- gh-116034: Fix location of the error on a failed assertion.
- gh-115823: Properly calculate error ranges in the parser when
raising SyntaxError exceptions caused by invalid byte sequences.
Patch by Pablo Galindo
- gh-112087: For an empty reverse iterator for list will be
reduced to reversed(). Patch by Donghee Na.
- gh-115011: Setters for members with an unsigned integer type now
support the same range of valid values for objects that has a
OBS-URL: https://build.opensuse.org/request/show/1166573
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=119
- Rewrite %prep to use %autosetup et al. for compatibility with
rpm 4.20.
- bsc#1221260 add bsc1221260-test_asyncio-ResourceWarning.patch
to eliminate ResourceWarning which broke the test suite in
test_asyncio.
- Use the system-wide crypto-policies [bsc#1211301]
* Use the system default cipher list instead of hardcoded values
* Add the --with-ssl-default-suites=openssl configure option
OBS-URL: https://build.opensuse.org/request/show/1157149
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=31
CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from
gh#python/cpython!99930) fixing symlink bug in cleanup of
tempfile.TemporaryDirectory.
- Repurpose skip-failing-tests.patch to increase timeout for
test.test_asyncio.test_tasks.TimeoutTests.test_timeout_time,
which fails on slow machines in IBS (s390x).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=104
- Update to 3.11.8:
- Security
- gh-113659: Skip .pth files with names starting with a dot or
hidden file attribute.
- Core and Builtins
- gh-114887: Changed socket type validation in
create_datagram_endpoint() to accept all non-stream sockets.
This fixes a regression in compatibility with raw sockets.
- gh-114388: Fix a RuntimeWarning emitted when assign an
integer-like value that is not an instance of int to an
attribute that corresponds to a C struct member of type T_UINT
and T_ULONG. Fix a double RuntimeWarning emitted when assign a
negative integer value to an attribute that corresponds to a C
struct member of type T_UINT.
- gh-89811: Check for a valid tp_version_tag before performing
bytecode specializations that rely on this value being usable.
- gh-113602: Fix an error that was causing the parser to try to
overwrite existing errors and crashing in the process. Patch by
Pablo Galindo
- gh-113566: Fix a 3.11-specific crash when the repr of a Future
is requested after the module has already been
garbage-collected.
- gh-106905: Use per AST-parser state rather than global state to
track recursion depth within the AST parser to prevent potential
race condition due to simultaneous parsing.
- The issue primarily showed up in 3.11 by multithreaded users of
ast.parse(). In 3.12 a change to when garbage collection can be
triggered prevented the race condition from occurring.
- gh-112716: Fix SystemError in the import statement and in
__reduce__() methods of builtin types when __builtins__ is not a
dict.
- gh-105967: Workaround a bug in Apple’s macOS platform zlib
library where zlib.crc32() and binascii.crc32() could produce
incorrect results on multi-gigabyte inputs. Including when using
zipfile on zips containing large data.
- gh-94606: Fix UnicodeEncodeError when
email.message.get_payload() reads a message with a Unicode
surrogate character and the message content is not well-formed
for surrogateescape encoding. Patch by Sidney Markowitz.
- Library
- gh-114965: Update bundled pip to 24.0
- gh-114959: tarfile no longer ignores errors when trying to
extract a directory on top of a file.
- gh-109475: Fix support of explicit option value “–” in argparse
(e.g. --option=--).
- gh-110190: Fix ctypes structs with array on Windows ARM64
platform by setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by
Diego Russo
- gh-113280: Fix a leak of open socket in rare cases when error
occurred in ssl.SSLSocket creation.
- gh-77749: email.policy.EmailPolicy.fold() now always encodes
non-ASCII characters in headers if utf8 is false.
- gh-114492: Make the result of termios.tcgetattr() reproducible
on Alpine Linux. Previously it could leave a random garbage in
some fields.
- gh-75128: Ignore an OSError in
asyncio.BaseEventLoop.create_server() when IPv6 is available but
the interface cannot actually support it.
- gh-114257: Dismiss the FileNotFound error in
ctypes.util.find_library() and just return None on Linux.
- gh-101438: Avoid reference cycle in ElementTree.iterparse. The
iterator returned by ElementTree.iterparse may hold on to a file
descriptor. The reference cycle prevented prompt clean-up of the
file descriptor if the returned iterator was not exhausted.
- gh-104522: OSError raised when run a subprocess now only has
filename attribute set to cwd if the error was caused by a
failed attempt to change the current directory.
- gh-109534: Fix a reference leak in
asyncio.selector_events.BaseSelectorEventLoop when SSL
handshakes fail. Patch contributed by Jamie Phan.
- gh-114077: Fix possible OverflowError in
socket.socket.sendfile() when pass count larger than 2 GiB on
32-bit platform.
- gh-114014: Fixed a bug in fractions.Fraction where an invalid
string using d in the decimals part creates a different error
compared to other invalid letters/characters. Patch by Jeremiah
Gabriel Pascual.
- gh-113951: Fix the behavior of tag_unbind() methods of
tkinter.Text and tkinter.Canvas classes with three arguments.
Previously, widget.tag_unbind(tag, sequence, funcid) destroyed
the current binding for sequence, leaving sequence unbound, and
deleted the funcid command. Now it removes only funcid from the
binding for sequence, keeping other commands, and deletes the
funcid command. It leaves sequence unbound only if funcid was
the last bound command.
- gh-113877: Fix tkinter method winfo_pathname() on 64-bit
Windows.
- gh-113781: Silence unraisable AttributeError when warnings are
emitted during Python finalization.
- gh-113594: Fix UnicodeEncodeError in email when re-fold lines
that contain unknown-8bit encoded part followed by
non-unknown-8bit encoded part.
- gh-113538: In asyncio.StreamReaderProtocol.connection_made(),
there is callback that logs an error if the task wrapping the
“connected callback” fails. This callback would itself fail if
the task was cancelled. Prevent this by checking whether the
task was cancelled first. If so, close the transport but don’t
log an error.
- gh-85567: Fix resource warnings for unclosed files in pickle and
pickletools command line interfaces.
- gh-101225: Increase the backlog for
multiprocessing.connection.Listener objects created by
multiprocessing.manager and multiprocessing.resource_sharer to
significantly reduce the risk of getting a connection refused
error when creating a multiprocessing.connection.Connection to
them.
- gh-113543: Make sure that webbrowser.MacOSXOSAScript sends
webbrowser.open audit event.
- gh-113028: When a second reference to a string appears in the
input to pickle, and the Python implementation is in use, we are
guaranteed that a single copy gets pickled and a single object
is shared when reloaded. Previously, in protocol 0, when a
string contained certain characters (e.g. newline) it resulted
in duplicate objects.
- gh-113421: Fix multiprocessing logger for %(filename)s.
- gh-113358: Fix rendering tracebacks for exceptions with a broken
__getattr__.
- gh-113214: Fix an AttributeError during asyncio SSL protocol
aborts in SSL-over-SSL scenarios.
- gh-113246: Update bundled pip to 23.3.2.
- gh-113199: Make http.client.HTTPResponse.read1 and
http.client.HTTPResponse.readline close IO after reading all
data when content length is known. Patch by Illia Volochii.
- gh-113188: Fix shutil.copymode() and shutil.copystat() on
Windows. Previously they worked differenly if dst is a symbolic
link: they modified the permission bits of dst itself rather
than the file it points to if follow_symlinks is true or src is
not a symbolic link, and did not modify the permission bits if
follow_symlinks is false and src is a symbolic link.
- gh-61648: Detect line numbers of properties in doctests.
- gh-112559: signal.signal() and signal.getsignal() no longer call
repr on callable handlers. asyncio.run() and
asyncio.Runner.run() no longer call repr on the task results.
Patch by Yilei Yang.
- gh-110190: Fix ctypes structs with array on PPC64LE platform by
setting MAX_STRUCT_SIZE to 64 in stgdict. Patch by Diego Russo.
- gh-79429: Ignore FileNotFoundError when remove a temporary
directory in the multiprocessing finalizer.
- gh-79325: Fix an infinite recursion error in
tempfile.TemporaryDirectory() cleanup on Windows.
- gh-110190: Fix ctypes structs with array on Arm platform by
setting MAX_STRUCT_SIZE to 32 in stgdict. Patch by Diego Russo.
- gh-81194: Fix a crash in socket.if_indextoname() with specific
value (UINT_MAX). Fix an integer overflow in
socket.if_indextoname() on 64-bit non-Windows platforms.
- gh-75666: Fix the behavior of tkinter widget’s unbind() method
with two arguments. Previously, widget.unbind(sequence, funcid)
destroyed the current binding for sequence, leaving sequence
unbound, and deleted the funcid command. Now it removes only
funcid from the binding for sequence, keeping other commands,
and deletes the funcid command. It leaves sequence unbound only
if funcid was the last bound command.
- gh-110345: Show the Tcl/Tk patchlevel (rather than version) in
tkinter._test().
- gh-109858: Protect zipfile from “quoted-overlap” zipbomb. It now
raises BadZipFile when try to read an entry that overlaps with
other entry or central directory.
- gh-38807: Fix race condition in trace. Instead of checking if a
directory exists and creating it, directly call os.makedirs()
with the kwarg exist_ok=True.
- gh-75705: Set unixfrom envelope in mailbox.mbox and
mailbox.MMDF.
- gh-105102: Allow ctypes.Union to be nested in ctypes.Structure
when the system endianness is the opposite of the classes.
- gh-104282: Fix null pointer dereference in
lzma._decode_filter_properties() due to improper handling of BCJ
filters with properties of zero length. Patch by Radislav
Chugunov.
- gh-102512: When os.fork() is called from a foreign thread (aka
_DummyThread), the type of the thread in a child process is
changed to _MainThread. Also changed its name and daemonic
status, it can be now joined.
- gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup,
which now no longer dereferences symlinks when working around
file system permission errors.
- bpo-43153: On Windows, tempfile.TemporaryDirectory previously
masked a PermissionError with NotADirectoryError during
directory cleanup. It now correctly raises PermissionError if
errors are not ignored. Patch by Andrei Kulakov and Ken Jin.
- bpo-35332: The shutil.rmtree() function now ignores errors when
calling os.close() when ignore_errors is True, and os.close() no
longer retried after error.
- bpo-35928: io.TextIOWrapper now correctly handles the decoding
buffer after read() and write().
- bpo-26791: shutil.move() now moves a symlink into a directory
when that directory is the target of the symlink. This provides
the same behavior as the mv shell command. The previous behavior
raised an exception. Patch by Jeffrey Kintscher.
- bpo-36959: Fix some error messages for invalid ISO format string
combinations in strptime() that referred to directives not
contained in the format string. Patch by Gordon P. Hemsley.
- bpo-18060: Fixed a class inheritance issue that can cause
segfaults when deriving two or more levels of subclasses from a
base class of Structure or Union.
- Documentation
- gh-110746: Improved markup for valid options/values for methods
ttk.treeview.column and ttk.treeview.heading, and for Layouts.
- gh-95649: Document that the asyncio module contains code taken
from v0.16.0 of the uvloop project, as well as the required MIT
licensing information.
- Tests
- gh-109980: Fix test_tarfile_vs_tar in test_shutil for macOS,
where system tar can include more information in the archive
than shutil.make_archive.
- gh-112769: The tests now correctly compare zlib version when
zlib.ZLIB_RUNTIME_VERSION contains non-integer suffixes. For
example zlib-ng defines the version as 1.3.0.zlib-ng.
- gh-105089: Fix
test.test_zipfile.test_core.TestWithDirectory.test_create_directory_with_write
test in AIX by doing a bitwise AND of 0xFFFF on mode , so that
it will be in sync with zinfo.external_attr
- bpo-40648: Test modes that file can get with chmod() on Windows.
- Build
- gh-101778: Fix build error when there’s a dangling symlink in
the directory containing ffi.h.
- gh-112305: Fixed the check-clean-src step performed on out of
tree builds to detect errant $(srcdir)/Python/frozen_modules/*.h
files and recommend appropriate source tree cleanup steps to get
a working build again.
- bpo-11102: The os.major(), os.makedev(), and os.minor()
functions are now available on HP-UX v3.
- bpo-36351: Do not set ipv6type when cross-compiling.
- IDLE
- gh-96905: In idlelib code, stop redefining built-ins ‘dict’ and
‘object’.
- gh-72284: Improve the lists of features, editor key bindings,
and shell key bingings in the IDLE doc.
- gh-113903: Fix rare failure of test.test_idle, in
test_configdialog.
- gh-113729: Fix the “Help -> IDLE Doc” menu bug in 3.11.7 and
3.12.1.
- gh-113269: Fix test_editor hang on macOS Catalina.
- gh-112898: Fix processing unsaved files when quitting IDLE on
macOS.
- gh-103820: Revise IDLE bindings so that events from mouse button
4/5 on non-X11 windowing systems (i.e. Win32 and Aqua) are not
mistaken for scrolling.
- bpo-13586: Enter the selected text when opening the “Replace”
dialog.
- Tools/Demos
- gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.13 and
multissltests to use 1.1.1w, 3.0.13, 3.1.5, and 3.2.1.
- gh-115015: Fix a bug in Argument Clinic that generated incorrect
code for methods with no parameters that use the METH_METHOD |
METH_FASTCALL | METH_KEYWORDS calling convention. Only the
positional parameter count was checked; any keyword argument
passed would be silently accepted.
- Refresh all patches:
- CVE-2023-27043-email-parsing-errors.patch
- F00251-change-user-install-location.patch
- bpo-31046_ensurepip_honours_prefix.patch
- distutils-reproducible-compile.patch
- fix_configure_rst.patch
- python-3.3.0b1-fix_date_time_compiler.patch
- python-3.3.0b1-localpath.patch
- python-3.3.0b1-test-posix_fadvise.patch
- skip_if_buildbot-extend.patch
- subprocess-raise-timeout.patch
- support-expat-CVE-2022-25236-patched.patch
OBS-URL: https://build.opensuse.org/request/show/1145174
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=99
- Update patch fix_configure_rst.patch
- Update to 3.11.7:
- Core and Builtins
- gh-112625: Fixes a bug where a bytearray object could be cleared
while iterating over an argument in the bytearray.join() method
that could result in reading memory after it was freed.
- gh-112388: Fix an error that was causing the parser to try to
overwrite tokenizer errors. Patch by pablo Galindo
- gh-112387: Fix error positions for decoded strings with
backwards tokenize errors. Patch by Pablo Galindo
- gh-112266: Change docstrings of __dict__ and __weakref__.
- gh-109181: Speed up Traceback object creation by lazily compute
the line number. Patch by Pablo Galindo
- gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004
codecs read out of bounds
- gh-111366: Fix an issue in the codeop that was causing
SyntaxError exceptions raised in the presence of invalid syntax
to not contain precise error messages. Patch by Pablo Galindo
- gh-111380: Fix a bug that was causing SyntaxWarning to appear
twice when parsing if invalid syntax is encountered later. Patch
by Pablo galindo
- gh-88116: Traceback location ranges involving wide unicode
characters (like emoji and asian characters) now are properly
highlighted. Patch by Batuhan Taskaya and Pablo Galindo.
- gh-94438: Fix a regression that prevented jumping across is None
and is not None when debugging. Patch by Savannah Ostrowski.
- gh-110696: Fix incorrect error message for invalid argument
unpacking. Patch by Pablo Galindo
- gh-110237: Fix missing error checks for calls to PyList_Append
in _PyEval_MatchClass.
OBS-URL: https://build.opensuse.org/request/show/1134225
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=97
- Update patch fix_configure_rst.patch
- Update to 3.11.7:
- Core and Builtins
- gh-112625: Fixes a bug where a bytearray object could be cleared
while iterating over an argument in the bytearray.join() method
that could result in reading memory after it was freed.
- gh-112388: Fix an error that was causing the parser to try to
overwrite tokenizer errors. Patch by pablo Galindo
- gh-112387: Fix error positions for decoded strings with
backwards tokenize errors. Patch by Pablo Galindo
- gh-112266: Change docstrings of __dict__ and __weakref__.
- gh-109181: Speed up Traceback object creation by lazily compute
the line number. Patch by Pablo Galindo
- gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004
codecs read out of bounds
- gh-111366: Fix an issue in the codeop that was causing
SyntaxError exceptions raised in the presence of invalid syntax
to not contain precise error messages. Patch by Pablo Galindo
- gh-111380: Fix a bug that was causing SyntaxWarning to appear
twice when parsing if invalid syntax is encountered later. Patch
by Pablo galindo
- gh-88116: Traceback location ranges involving wide unicode
characters (like emoji and asian characters) now are properly
highlighted. Patch by Batuhan Taskaya and Pablo Galindo.
- gh-94438: Fix a regression that prevented jumping across is None
and is not None when debugging. Patch by Savannah Ostrowski.
- gh-110696: Fix incorrect error message for invalid argument
unpacking. Patch by Pablo Galindo
- gh-110237: Fix missing error checks for calls to PyList_Append
in _PyEval_MatchClass.
- gh-109216: Fix possible memory leak in BUILD_MAP.
- Library
- gh-112618: Fix a caching bug relating to typing.Annotated.
Annotated[str, True] is no longer identical to Annotated[str,
1].
- gh-112509: Fix edge cases that could cause a key to be present
in both the __required_keys__ and __optional_keys__ attributes
of a typing.TypedDict. Patch by Jelle Zijlstra.
- gh-94722: Fix bug where comparison between instances of DocTest
fails if one of them has None as its lineno.
- gh-112105: Make readline.set_completer_delims() work with
libedit
- gh-111942: Fix SystemError in the TextIOWrapper constructor with
non-encodable “errors” argument in non-debug mode.
- gh-109538: Issue warning message instead of having RuntimeError
be displayed when event loop has already been closed at
StreamWriter.__del__().
- gh-111942: Fix crashes in io.TextIOWrapper.reconfigure() when
pass invalid arguments, e.g. non-string encoding.
- gh-111804: Remove posix.fallocate() under WASI as the underlying
posix_fallocate() is not available in WASI preview2.
- gh-111841: Fix truncating arguments on an embedded null
character in os.putenv() and os.unsetenv() on Windows.
- gh-111541: Fix doctest for SyntaxError not-builtin subclasses.
- gh-110894: Call loop exception handler for exceptions in
client_connected_cb of asyncio.start_server() so that
applications can handle it. Patch by Kumar Aditya.
- gh-111531: Fix reference leaks in bind_class() and bind_all()
methods of tkinter widgets.
- gh-111356: Added io.text_encoding(), io.DEFAULT_BUFFER_SIZE, and
io.IncrementalNewlineDecoder to io.__all__.
- gh-68166: Remove mention of not supported “vsapi” element type
in tkinter.ttk.Style.element_create(). Add tests for
element_create() and other ttk.Style methods. Add examples for
element_create() in the documentation.
- gh-111251: Fix _blake2 not checking for errors when
initializing.
- gh-111174: Fix crash in io.BytesIO.getbuffer() called repeatedly
for empty BytesIO.
- gh-111187: Postpone removal version for
locale.getdefaultlocale() to Python 3.15.
- gh-111159: Fix doctest output comparison for exceptions with
notes.
- gh-110910: Fix invalid state handling in asyncio.TaskGroup and
asyncio.Timeout. They now raise proper RuntimeError if they are
improperly used and are left in consistent state after this.
- gh-111092: Make turtledemo run without default root enabled.
- gh-110590: Fix a bug in _sre.compile() where TypeError would be
overwritten by OverflowError when the code argument was a list
of non-ints.
- gh-65052: Prevent pdb from crashing when trying to display
undisplayable objects
- gh-110519: Deprecation warning about non-integer number in
gettext now alwais refers to the line in the user code where
gettext function or method is used. Previously it could refer to
a line in gettext code.
- gh-110378: contextmanager() and asynccontextmanager() context
managers now close an invalid underlying generator object that
yields more then one value.
- gh-110365: Fix termios.tcsetattr() bug that was overwritting
existing errors during parsing integers from term list.
- gh-110196: Add __reduce__ method to IPv6Address in order to keep
scope_id
- gh-109747: Improve errors for unsupported look-behind patterns.
Now re.error is raised instead of OverflowError or RuntimeError
for too large width of look-behind pattern.
- gh-109786: Fix possible reference leaks and crash when re-enter
the __next__() method of itertools.pairwise.
- gh-108791: Improved error handling in pdb command line
interface, making it produce more concise error messages.
- gh-73561: Omit the interface scope from an IPv6 address when
used as Host header by http.client.
- gh-86826: zipinfo now supports the full range of values in the
TZ string determined by RFC 8536 and detects all invalid
formats. Both Python and C implementations now raise exceptions
of the same type on invalid data.
- bpo-41422: Fixed memory leaks of pickle.Pickler and
pickle.Unpickler involving cyclic references via the internal
memo mapping.
- bpo-40262: The ssl.SSLSocket.recv_into() method no longer
requires the buffer argument to implement __len__ and supports
buffers with arbitrary item size.
- bpo-35191: Fix unexpected integer truncation in
socket.setblocking() which caused it to interpret multiples of
2**32 as False.
- Documentation
- gh-108826: dis module command-line interface is now mentioned in
documentation.
- Tests
- gh-110367: Make regrtest --verbose3 option compatible with
--huntrleaks -jN options. The ./python -m test -j1 -R 3:3
--verbose3 command now works as expected. Patch by Victor
Stinner.
- gh-111309: distutils tests can now be run via unittest.
- gh-111165: Remove no longer used functions run_unittest() and
run_doctest() and class BasicTestRunner from the test.support
module.
- gh-110932: Fix regrtest if the SOURCE_DATE_EPOCH environment
variable is defined: use the variable value as the random seed.
Patch by Victor Stinner.
- gh-110995: test_gdb: Fix detection of gdb built without Python
scripting support. Patch by Victor Stinner.
- gh-110918: Test case matching patterns specified by options
--match, --ignore, --matchfile and --ignorefile are now tested
in the order of specification, and the last match determines
whether the test case be run or ignored.
- gh-110647: Fix test_stress_modifying_handlers() of test_signal.
Patch by Victor Stinner.
- gh-103053: Fix test_tools.test_freeze on FreeBSD: run “make
distclean” instead of “make clean” in the copied source
directory to remove also the “python” program. Patch by Victor
Stinner.
- gh-110167: Fix a deadlock in test_socket when server fails with
a timeout but the client is still running in its thread. Don’t
hold a lock to call cleanup functions in doCleanups(). One of
the cleanup function waits until the client completes, whereas
the client could deadlock if it called addCleanup() in such
situation. Patch by Victor Stinner.
- gh-110388: Add tests for tty.
- gh-81002: Add tests for termios.
- gh-110267: Add tests for pickling and copying PyStructSequence
objects. Patched by Xuehai Pan.
- gh-109974: Fix race conditions in test_threading lock tests.
Wait until a condition is met rather than using time.sleep()
with a hardcoded number of seconds. Patch by Victor Stinner.
- gh-109972: Split test_gdb.py file into a test_gdb package made
of multiple tests, so tests can now be run in parallel. Patch by
Victor Stinner.
- gh-104736: Fix test_gdb on Python built with LLVM clang 16 on
Linux ppc64le (ex: Fedora 38). Search patterns in gdb “bt”
command output to detect when gdb fails to retrieve the
traceback. For example, skip a test if Backtrace stopped: frame
did not save the PC is found. Patch by Victor Stinner.
- gh-108927: Fixed order dependence in running tests in the same
process when a test that has submodules (e.g. test_importlib)
follows a test that imports its submodule (e.g.
test_importlib.util) and precedes a test (e.g. test_unittest or
test_compileall) that uses that submodule.
- Build
- gh-103053: “make check-clean-src” now also checks if the
“python” program is found in the source directory: fail with an
error if it does exist. Patch by Victor Stinner.
- gh-109191: Fix compile error when building with recent versions
of libedit.
- IDLE
- bpo-35668: Add docstrings to the IDLE debugger module. Fix two
bugs: initialize Idb.botframe (should be in Bdb); in
Idb.in_rpc_code, check whether prev_frame is None before trying
to use it. Greatly expand test_debugger.
- C API
- gh-112438: Fix support of format units “es”, “et”, “es#”, and
“et#” in nested tuples in PyArg_ParseTuple()-like functions.
- gh-109521: PyImport_GetImporter() now sets RuntimeError if it
fails to get sys.path_hooks or sys.path_importer_cache or they
are not list and dict correspondingly. Previously it could
return NULL without setting error in obscure cases, crash or
raise SystemError if these attributes have wrong type.
OBS-URL: https://build.opensuse.org/request/show/1133399
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=89
- Remove not needed patch 103213-fetch-CONFIG_ARGS.patch
- Refresh patches:
- bpo-31046_ensurepip_honours_prefix.patch
- fix_configure_rst.patch
- Update to 3.11.6:
- Core and Builtins
- gh-109351: Fix crash when compiling an invalid AST involving a
named (walrus) expression.
- gh-109207: Fix a SystemError in __repr__ of symtable entry
object.
- gh-109179: Fix bug where the C traceback display drops notes
from SyntaxError.
- gh-88943: Improve syntax error for non-ASCII character that
follows a numerical literal. It now points on the invalid
non-ASCII character, not on the valid numerical literal.
- gh-108959: Fix caret placement for error locations for subscript
and binary operations that involve non-semantic parentheses and
spaces. Patch by Pablo Galindo
- gh-108520: Fix
multiprocessing.synchronize.SemLock.__setstate__() to properly
initialize multiprocessing.synchronize.SemLock._is_fork_ctx.
This fixes a regression when passing a SemLock accross nested
processes.
- Rename multiprocessing.synchronize.SemLock.is_fork_ctx to
multiprocessing.synchronize.SemLock._is_fork_ctx to avoid
exposing it as public API.
- Library
- gh-110036: On Windows, multiprocessing Popen.terminate() now
catchs PermissionError and get the process exit code. If the
process is still running, raise again the PermissionError.
OBS-URL: https://build.opensuse.org/request/show/1126597
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=87
- Update to 3.11.5 (bsc#1214692):
- Security
- gh-108310: Fixed an issue where instances of ssl.SSLSocket were
vulnerable to a bypass of the TLS handshake and included
protections (like certificate verification) and treating sent
unencrypted data as if it were post-handshake TLS encrypted data.
Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by
Gregory P. Smith.
- Core and Builtins
- gh-104432: Fix potential unaligned memory access on C APIs
involving returned sequences of char * pointers within the grp
and socket modules. These were revealed using a
-fsaniziter=alignment build on ARM macOS. Patch by Christopher
Chavez.
- gh-77377: Ensure that multiprocessing synchronization objects
created in a fork context are not sent to a different process
created in a spawn context. This changes a segfault into an
actionable RuntimeError in the parent process.
- gh-106092: Fix a segmentation fault caused by a use-after-free
bug in frame_dealloc when the trashcan delays the deallocation
of a PyFrameObject.
- gh-106719: No longer suppress arbitrary errors in the
__annotations__ getter and setter in the type and module types.
- gh-106723: Propagate frozen_modules to multiprocessing spawned
process interpreters.
- gh-105979: Fix crash in _imp.get_frozen_object() due to improper
exception handling.
- gh-105840: Fix possible crashes when specializing function calls
with too many __defaults__.
- gh-105588: Fix an issue that could result in crashes when
compiling malformed ast nodes.
- gh-105375: Fix bugs in the builtins module where exceptions
could end up being overwritten.
- gh-105375: Fix bug in the compiler where an exception could end
up being overwritten.
- gh-105375: Improve error handling in
PyUnicode_BuildEncodingMap() where an exception could end up
being overwritten.
- gh-105235: Prevent out-of-bounds memory access during
mmap.find() calls.
- gh-101006: Improve error handling when read marshal data.
- Library
- gh-105736: Harmonized the pure Python version of OrderedDict
with the C version. Now, both versions set up their internal
state in __new__. Formerly, the pure Python version did the set
up in __init__.
- gh-107963: Fix multiprocessing.set_forkserver_preload() to check
the given list of modules names. Patch by Dong-hee Na.
- gh-106242: Fixes os.path.normpath() to handle embedded null
characters without truncating the path.
- gh-107845: tarfile.data_filter() now takes the location of
symlinks into account when determining their target, so it will
no longer reject some valid tarballs with
LinkOutsideDestinationError.
- gh-107715: Fix doctest.DocTestFinder.find() in presence of class
names with special characters. Patch by Gertjan van Zwieten.
- gh-100814: Passing a callable object as an option value to a
Tkinter image now raises the expected TclError instead of an
AttributeError.
- gh-106684: Close asyncio.StreamWriter when it is not closed by
application leading to memory leaks. Patch by Kumar Aditya.
- gh-107077: Seems that in some conditions, OpenSSL will return
SSL_ERROR_SYSCALL instead of SSL_ERROR_SSL when a certification
verification has failed, but the error parameters will still
contain ERR_LIB_SSL and SSL_R_CERTIFICATE_VERIFY_FAILED. We are
now detecting this situation and raising the appropiate
ssl.SSLCertVerificationError. Patch by Pablo Galindo
- gh-107396: tarfiles; Fixed use before assignment of
self.exception for gzip decompression
- gh-62519: Make gettext.pgettext() search plural definitions when
translation is not found.
- gh-83006: Document behavior of shutil.disk_usage() for
non-mounted filesystems on Unix.
- gh-106186: Do not report MultipartInvariantViolationDefect
defect when the email.parser.Parser class is used to parse
emails with headersonly=True.
- gh-106831: Fix potential missing NULL check of d2i_SSL_SESSION
result in _ssl.c.
- gh-106774: Update the bundled copy of pip to version 23.2.1.
- gh-106752: Fixed several bug in zipfile.Path in
name/suffix/suffixes/stem operations when no filename is present
and the Path is not at the root of the zipfile.
- gh-106602: Add __copy__ and __deepcopy__ in enum
- gh-106530: Revert a change to colorsys.rgb_to_hls() that caused
division by zero for certain almost-white inputs. Patch by Terry
Jan Reedy.
- gh-106052: re module: fix the matching of possessive quantifiers
in the case of a subpattern containing backtracking.
- gh-106510: Improve debug output for atomic groups in regular
expressions.
- gh-105497: Fix flag mask inversion when unnamed flags exist.
- gh-90876: Prevent multiprocessing.spawn from failing to import
in environments where sys.executable is None. This regressed in
3.11 with the addition of support for path-like objects in
multiprocessing.
- gh-106350: Detect possible memory allocation failure in the
libtommath function mp_init() used by the _tkinter module.
- gh-102541: Make pydoc.doc catch bad module ImportError when
output stream is not None.
- gh-106263: Fix crash when calling repr with a manually
constructed SignalDict object. Patch by Charlie Zhao.
- gh-105375: Fix a bug in _Unpickler_SetInputStream() where an
exception could end up being overwritten in case of failure.
- gh-105375: Fix bugs in sys where exceptions could end up being
overwritten because of deferred error handling.
- gh-105605: Harden pyexpat error handling during module
initialisation to prevent exceptions from possibly being
overwritten, and objects from being dereferenced twice.
- gh-105375: Fix bug in decimal where an exception could end up
being overwritten.
- gh-105375: Fix bugs in _datetime where exceptions could be
overwritten in case of module initialisation failure.
- gh-105375: Fix bugs in _ssl initialisation which could lead to
leaked references and overwritten exceptions.
- gh-105375: Fix a bug in array.array where an exception could end
up being overwritten.
- gh-105375: Fix bugs in _ctypes where exceptions could end up
being overwritten.
- gh-105375: Fix a bug in the posix module where an exception
could be overwritten.
- gh-105375: Fix bugs in _elementtree where exceptions could be
overwritten.
- gh-105375: Fix bugs in zoneinfo where exceptions could be
overwritten.
- gh-105375: Fix bugs in pickle where exceptions could be
overwritten.
- gh-105497: Fix flag inversion when alias/mask members exist.
- gh-105375: Fix bugs in pickle where exceptions could be
overwritten.
- gh-103171: Revert undocumented behaviour change with
runtime-checkable protocols decorated with typing.final() in
Python 3.11. The behaviour change had meant that objects would
not be considered instances of these protocols at runtime unless
they had a __final__ attribute. Patch by Alex Waygood.
- gh-105375: Fix a bug in sqlite3 where an exception could be
overwritten in the collation callback.
- gh-105332: Revert pickling method from by-name back to by-value.
- gh-104554: Add RTSPS scheme support in urllib.parse
- gh-100061: Fix a bug that causes wrong matches for regular
expressions with possessive qualifier.
- gh-102541: Hide traceback in help() prompt, when import failed.
- gh-99203: Restore following CPython <= 3.10.5 behavior of
shutil.make_archive(): do not create an empty archive if
root_dir is not a directory, and, in that case, raise
FileNotFoundError or NotADirectoryError regardless of format
choice. Beyond the brought-back behavior, the function may now
also raise these exceptions in dry_run mode.
- gh-94777: Fix hanging multiprocessing ProcessPoolExecutor when a
child process crashes while data is being written in the call
queue.
- bpo-18319: Ensure gettext(msg) retrieve translations even if a
plural form exists. In other words: gettext(msg) ==
ngettext(msg, '', 1).
- Documentation
- gh-107008: Document the curses module variables LINES and COLS.
- gh-106948: Add a number of standard external names to
nitpick_ignore.
- gh-54738: Add documentation on how to localize the argparse
module.
- Tests
- gh-105776: Fix test_cppext when the C compiler command -std=c11
option: remove -std= options from the compiler command. Patch by
Victor Stinner.
- gh-107237: test_logging: Fix test_udp_reconnection() by
increasing the timeout from 100 ms to 5 minutes (LONG_TIMEOUT).
Patch by Victor Stinner.
- gh-101634: When running the Python test suite with -jN option,
if a worker stdout cannot be decoded from the locale encoding
report a failed testn so the exitcode is non-zero. Patch by
Victor Stinner.
- Build
- gh-107814: When calling find_python.bat with -q it did not
properly silence the output of nuget. That is now fixed.
- gh-106881: Check for linux/limits.h before including it in
Modules/posixmodule.c.
- gh-104692: Include commoninstall as a prerequisite for
bininstall
- This ensures that commoninstall is completed before bininstall
is started when parallel builds are used (make -j install), and
so the python3 symlink is only installed after all standard
library modules are installed.
- gh-100340: Allows -Wno-int-conversion for wasm-sdk 17 and
onwards, thus enables building WASI builds once against the
latest sdk.
- Windows
- gh-106242: Fixes realpath() to behave consistently when passed a
path containing an embedded null character on Windows. In strict
mode, it now raises OSError instead of the unexpected
ValueError, and in non-strict mode will make the path absolute.
- gh-106844: Fix integer overflow in _winapi.LCMapStringEx() which
affects ntpath.normcase().
- gh-99079: Update Windows build to use OpenSSL 3.0.9
- gh-105436: Ensure that an empty environment block is terminated
by two null characters, as is required by Windows.
- macOS
- gh-107565: Update macOS installer to use OpenSSL 3.0.10.
- gh-99079: Update macOS installer to use OpenSSL 3.0.9.
- Tools/Demos
- gh-107565: Update multissltests and GitHub CI workflows to use
OpenSSL 1.1.1v, 3.0.10, and 3.1.2.
- gh-95065: Argument Clinic now supports overriding automatically
generated signature by using directive @text_signature. See How
to override the generated signature.
- gh-106970: Fix bugs in the Argument Clinic destination <name>
clear command; the destination buffers would never be cleared,
and the destination directive parser would simply continue to
the fault handler after processing the command. Patch by Erlend
E. Aasland.
- C API
- gh-107916: C API functions PyErr_SetFromErrnoWithFilename(),
PyErr_SetExcFromWindowsErrWithFilename() and
PyErr_SetFromWindowsErrWithFilename() save now the error code
before calling PyUnicode_DecodeFSDefault().
- gh-107915: Such C API functions as PyErr_SetString(),
PyErr_Format(), PyErr_SetFromErrnoWithFilename() and many others
no longer crash or ignore errors if it failed to format the
error message or decode the filename. Instead, they keep a
corresponding error.
- gh-107226: PyModule_AddObjectRef() is now only available in the
limited API version 3.10 or later.
- gh-105375: Fix a bug in PyErr_WarnExplicit() where an exception
could end up being overwritten if the API failed internally.
- gh-99612: Fix PyUnicode_DecodeUTF8Stateful() for ASCII-only
data: *consumed was not set.
OBS-URL: https://build.opensuse.org/request/show/1109225
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=23
- Security
- gh-108310: Fixed an issue where instances of ssl.SSLSocket were
vulnerable to a bypass of the TLS handshake and included
protections (like certificate verification) and treating sent
unencrypted data as if it were post-handshake TLS encrypted data.
Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by
Gregory P. Smith.
- Core and Builtins
- gh-104432: Fix potential unaligned memory access on C APIs
involving returned sequences of char * pointers within the grp
and socket modules. These were revealed using a
-fsaniziter=alignment build on ARM macOS. Patch by Christopher
Chavez.
- gh-77377: Ensure that multiprocessing synchronization objects
created in a fork context are not sent to a different process
created in a spawn context. This changes a segfault into an
actionable RuntimeError in the parent process.
- gh-106092: Fix a segmentation fault caused by a use-after-free
bug in frame_dealloc when the trashcan delays the deallocation
of a PyFrameObject.
- gh-106719: No longer suppress arbitrary errors in the
__annotations__ getter and setter in the type and module types.
- gh-106723: Propagate frozen_modules to multiprocessing spawned
process interpreters.
- gh-105979: Fix crash in _imp.get_frozen_object() due to improper
exception handling.
- gh-105840: Fix possible crashes when specializing function calls
with too many __defaults__.
- gh-105588: Fix an issue that could result in crashes when
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=83
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API). (The patch is faulty,
gh#python/cpython#106669, but upstream decided not to just
revert it).
OBS-URL: https://build.opensuse.org/request/show/1102237
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=21
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API). (The patch is faulty,
gh#python/cpython#106669, but upstream decided not to just
revert it).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=77
- Update to Python 3.11.4:
- gh-103142: The version of OpenSSL used in Windows and
Mac installers has been upgraded to 1.1.1u to address
CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464,
as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303
fixed previously in 1.1.1t (gh-101727).
- gh-102153: urllib.parse.urlsplit() now strips leading C0
control and space characters following the specification for
URLs defined by WHATWG in response to CVE-2023-24329
(bsc#1208471).
- gh-99889: Fixed a security in flaw in uu.decode() that could
allow for directory traversal based on the input if no
out_file was specified.
- gh-104049: Do not expose the local on-disk
location in directory indexes produced by
http.client.SimpleHTTPRequestHandler.
- gh-103935: trace.__main__ now uses io.open_code() for files
to be executed instead of raw open().
- gh-102953: The extraction methods in tarfile, and
shutil.unpack_archive(), have a new filter argument that
allows limiting tar features than may be surprising or
dangerous, such as creating files outside the destination
directory. See Extraction filters for details (fixing
CVE-2007-4559, bsc#1203750).
- Remove upstreamed patches:
- CVE-2007-4559-filter-tarfile_extractall.patch
OBS-URL: https://build.opensuse.org/request/show/1096536
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=20
- gh-103142: The version of OpenSSL used in Windows and
Mac installers has been upgraded to 1.1.1u to address
CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464,
as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303
fixed previously in 1.1.1t (gh-101727).
- gh-102153: urllib.parse.urlsplit() now strips leading C0
control and space characters following the specification for
URLs defined by WHATWG in response to CVE-2023-24329
(bsc#1208471).
- gh-99889: Fixed a security in flaw in uu.decode() that could
allow for directory traversal based on the input if no
out_file was specified.
- gh-104049: Do not expose the local on-disk
location in directory indexes produced by
http.client.SimpleHTTPRequestHandler.
- gh-103935: trace.__main__ now uses io.open_code() for files
to be executed instead of raw open().
- gh-102953: The extraction methods in tarfile, and
shutil.unpack_archive(), have a new filter argument that
allows limiting tar features than may be surprising or
dangerous, such as creating files outside the destination
directory. See Extraction filters for details (fixing
CVE-2007-4559, bsc#1203750).
- Remove upstreamed patches:
- CVE-2007-4559-filter-tarfile_extractall.patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=71
- Why in the world we download from HTTP?
- Add 103213-fetch-CONFIG_ARGS.patch (gh#python/cpython#103053).
- Add skip_if_buildbot-extend.patch to avoid the bug altogether
(extending what skip_if_buildbot covers).
- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
bsc#1203750 (CVE-2007-4559) and implementing "PEP 706 – Filter
for tarfile.extractall".
- Update to 3.11.3:
- Security
- gh-101727: Updated the OpenSSL version used in Windows
and macOS binary release builds to 1.1.1t to address
CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the
OpenSSL 2023-02-07 security advisory.
- Core and Builtins
- gh-101975: Fixed stacktop value on tracing entries to avoid
corruption on garbage collection.
- gh-102701: Fix overflow when creating very large dict.
- gh-102416: Do not memoize incorrectly automatically
generated loop rules in the parser. Patch by Pablo Galindo.
- gh-102356: Fix a bug that caused a crash when deallocating
deeply nested filter objects. Patch by Marta Gómez Macías.
- gh-102397: Fix segfault from race condition in signal
handling during garbage collection. Patch by Kumar Aditya.
- gh-102281: Fix potential nullptr dereference and use of
uninitialized memory in fileutils. Patch by Max Bachmann.
- gh-102126: Fix deadlock at shutdown when clearing thread
states if any finalizer tries to acquire the runtime head
lock. Patch by Kumar Aditya.
- gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
module. Patch by Max Bachmann.
- gh-101967: Fix possible segfault in
positional_only_passed_as_keyword function, when new list
created.
- gh-101765: Fix SystemError / segmentation fault in iter
__reduce__ when internal access of builtins.__dict__ keys
mutates the iter object.
- gh-101696: Invalidate type version tag in
_PyStaticType_Dealloc for static types, avoiding bug where
a false cache hit could crash the interpreter. Patch by
Kumar Aditya.
- Library
- gh-102549: Don’t ignore exceptions in member type creation.
- gh-102947: Improve traceback when dataclasses.fields() is
called on a non-dataclass. Patch by Alex Waygood
- gh-102780: The asyncio.Timeout context manager now
works reliably even when performing cleanup due to task
cancellation. Previously it could raise a CancelledError
instead of an TimeoutError in such cases.
- gh-88965: typing: Fix a bug relating to substitution in .
Pacustom classes generic over a ParamSpec. Previously, if .
Pathe ParamSpec was substituted with a parameters list that .
Paitself contained a TypeVar, the TypeVar in the parameters .
Palist could not be subsequently substituted. This is now .
Pafixed tch by Nikita Sobolev .
- gh-101979: Fix a bug where parentheses in the metavar
argument to argparse.ArgumentParser.add_argument() were
dropped. Patch by Yeojin Kim.
- gh-102179: Fix os.dup2() error message for negative fds.
- gh-101961: For the binary mode, fileinput.hookcompressed()
doesn’t set the encoding value even if the value is
None. Patch by Gihwan Kim.
- gh-101936: The default value of fp becomes io.BytesIO
if HTTPError is initialized without a designated fp
parameter. Patch by Long Vo.
- gh-102069: Fix __weakref__ descriptor generation for custom
dataclasses.
- gh-101566: In zipfile, apply fix for extractall on the
underlying zipfile after being wrapped in Path.
- gh-101892: Callable iterators no longer raise SystemError
when the callable object exhausts the iterator but forgets
to either return a sentinel value or raise StopIteration.
- gh-97786: Fix potential undefined behaviour in corner cases
of floating-point-to-time conversions.
- gh-101517: Fixed bug where bdb looks up the source line
with linecache with a lineno=None, which causes it to fail
with an unhandled exception.
- gh-101673: Fix a pdb bug where ll clears the changes to
local variables.
- gh-96931: Fix incorrect results from
ssl.SSLSocket.shared_ciphers()
- gh-88233: Correctly preserve “extra” fields in zipfile
regardless of their ordering relative to a zip64 “extra.”
- gh-96127: inspect.signature was raising TypeError on
call with mock objects. Now it correctly returns (*args,
**kwargs) as infered signature.
- gh-95495: When built against OpenSSL 3.0, the ssl module
had a bug where it reported unauthenticated EOFs (i.e.
without close_notify) as a clean TLS-level EOF. It now
raises SSLEOFError, matching the behavior in previous
versions of OpenSSL. The options attribute on SSLContext
also no longer includes OP_IGNORE_UNEXPECTED_EOF by
default. This option may be set to specify the previous
OpenSSL 3.0 behavior.
- gh-94440: Fix a concurrent.futures.process bug where
ProcessPoolExecutor shutdown could hang after a future has
been quickly submitted and canceled.
- Documentation
- gh-103112: Add docstring to http.client.HTTPResponse.read()
to fix pydoc output.
- gh-85417: Update cmath documentation to clarify behaviour
on branch cuts.
- gh-97725: Fix asyncio.Task.print_stack() description for
file=None. Patch by Oleg Iarygin.
- Tests
- gh-102980: Improve test coverage on pdb.
- gh-102537: Adjust the error handling strategy in
test_zoneinfo.TzPathTest.python_tzpath_context. Patch by
Paul Ganssle.
- gh-89792: test_tools now copies up to 10x less source data
to a temporary directory during the freeze test by ignoring
git metadata and other artifacts. It also limits its python
build parallelism based on os.cpu_count instead of hard
coding it as 8 cores.
- gh-101377: Improved test_locale_calendar_formatweekday of
calendar.
- Build
- gh-102711: Fix -Wstrict-prototypes compiler warnings.
OBS-URL: https://build.opensuse.org/request/show/1084262
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=17
- Security
- gh-101727: Updated the OpenSSL version used in Windows
and macOS binary release builds to 1.1.1t to address
CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 per the
OpenSSL 2023-02-07 security advisory.
- gh-101283: subprocess.Popen now uses a safer approach to
find cmd.exe when launching with shell=True. Patch by Eryk
Sun, based on a patch by Oleg Iarygin.
- Core and Builtins
- gh-101975: Fixed stacktop value on tracing entries to avoid
corruption on garbage collection.
- gh-102701: Fix overflow when creating very large dict.
- gh-102416: Do not memoize incorrectly automatically
generated loop rules in the parser. Patch by Pablo Galindo.
- gh-102356: Fix a bug that caused a crash when deallocating
deeply nested filter objects. Patch by Marta Gómez Macías.
- gh-102397: Fix segfault from race condition in signal
handling during garbage collection. Patch by Kumar Aditya.
- gh-102281: Fix potential nullptr dereference and use of
uninitialized memory in fileutils. Patch by Max Bachmann.
- gh-102126: Fix deadlock at shutdown when clearing thread
states if any finalizer tries to acquire the runtime head
lock. Patch by Kumar Aditya.
- gh-102027: Fix SSE2 and SSE3 detection in _blake2 internal
module. Patch by Max Bachmann.
- gh-101967: Fix possible segfault in
positional_only_passed_as_keyword function, when new list
created.
- gh-101765: Fix SystemError / segmentation fault in iter
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=57
- Update to 3.11.1:
- python -m http.server no longer allows terminal control
characters sent within a garbage request to be printed
to the stderr server lo This is done by changing the
http.server BaseHTTPRequestHandler .log_message method to
replace control characters with a \xHH hex escape before
printin
- Avoid publishing list of active per-interpreter audit hooks
via the gc module
- The IDNA codec decoder used on DNS hostnames by socket or
asyncio related name resolution functions no longer involves
a quadratic algorithm. This prevents a potential CPU denial
of service if an out-of-spec excessive length hostname
involving bidirectional characters were decoded. Some
protocols such as urllib http 3xx redirects potentially allow
for an attacker to supply such a name (CVE-2022-45061).
- Update bundled libexpat to 2.5.0
- Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no
longer uses a shell to run openssl commands. Issue reported
and initial fix by Caleb Shortt. Patch by Victor Stinner.
- Fix a crash when an object which does not have a dictionary
frees its instance values.
- Fix a bug in the tokenizer that could cause infinite
recursion when showing syntax warnings that happen in the
first line of the source. Patch by Pablo Galindo
- Fix an issue that could cause frames to be visible to Python
code as they are being torn down, possibly leading to memory
corruption or hard crashes of the interpreter.
- Fix a reference bug in _imp.create_builtin() after the
creation of the first sub-interpreter for modules builtins
and sys. Patch by Victor Stinner.
- Fixed a bug that was causing a buffer overflow if the
tokenizer copies a line missing the newline caracter from a
file that is as long as the available tokenizer buffer. Patch
by Pablo galindo
- Fix bug where an ExceptionGroup subclass can wrap a
BaseException.
- Fix zip path for venv created from a non-installed python on
POSIX platforms.
- Fix an issue that could potentially cause incorrect error
handling for some bytecode instructions.
- Fix an issue that prevented PyThreadState and
PyInterpreterState memory from being freed properly.
- Fix failure in except* with unhashable exceptions.
- Fix calculation of sys._base_executable when inside a POSIX
virtual environment using copies of the python binary when
the base installation does not provide the executable name
used by the venv. Calculation will fall back to alternative
names (“python<MAJOR>”, “python<MAJOR>.<MINOR>”).
- Update faulthandler to emit an error message with the proper
unexpected signal number. Patch by Dong-hee Na.
- Fix location of SyntaxError for a try block with both except
and except*.
- Fix the error reporting positions of specialized traceback
anchors when the source line contains Unicode characters.
- Fix subscription of type aliases containing bare generic
types or types like TypeVar: for example tuple[A, T][int] and
tuple[TypeVar, T][int], where A is a generic type, and T is a
type variable.
- Lower the recursion depth for marshal on WASI to support
wasmtime 2.0/main.
- Fix multiple crashes in debug mode when str subclasses are
used instead of str itself.
- Fix an issue where member descriptors (such as those for
__slots__) could behave incorrectly or crash instead of
raising a TypeError when accessed via an instance of an
invalid type.
- Suppress ImportError for invalid query for help()
command. Patch by Dong-hee Na.
- Fix detection of MAC addresses for uuid on certain OSs. Patch
by Chaim Sanders
- Print exception class name instead of its string
representation when raising errors from ctypes calls.
- os.sched_yield() now release the GIL while calling
sched_yield(2). Patch by Dong-hee Na.
- Fix an issue that could delay the specialization of PRECALL
instructions.
- Bugfix: PyFunction_GetAnnotations() should return a borrowed
reference. It was returning a new reference.
- Ensure that all Python frame objects are backed by “complete”
frames.
- Fixed a missing incref/decref pair in
Exception.__setstate__(). Patch by Ofey Chan.
- Fix the Python path configuration used to initialized
sys.path at Python startup. Paths are no longer encoded
to UTF-8/strict to avoid encoding errors if it contains
surrogate characters (bytes paths are decoded with the
surrogateescape error handler). Patch by Victor Stinner.
- Fix overly-broad source position information for chained
comparisons used as branching conditions.
- At Python exit, sometimes a thread holding the GIL can
wait forever for a thread (usually a daemon thread) which
requested to drop the GIL, whereas the thread already
exited. To fix the race condition, the thread which requested
the GIL drop now resets its request before exiting. Issue
discovered and analyzed by Mingliang ZHAO. Patch by Victor
Stinner.
- Fix a possible assertion failure, fatal error, or SystemError
if a line tracing event raises an exception while opcode
tracing is enabled.
- Fix undefined behaviour in C code of null pointer arithmetic.
- Make sure that all frame objects created are created from
valid interpreter frames. Prevents the possibility of invalid
frames in backtraces and signal handlers.
- Disable incorrect pickling of the C implemented classmethod
descriptors.
- On WASI ENOTCAPABLE is now mapped to PermissionError. The
errno modules exposes the new error number. getpath.py now
ignores PermissionError when it cannot open landmark files
pybuilddir.txt and pyenv.cfg.
- Allow pdb to locate source for frozen modules in the standard
library.
- Raise ValueError instead of SystemError when methods of
uninitialized io.IncrementalNewlineDecoder objects are
called. Patch by Oren Milman.
- Fix a possible assertion failure in io.FileIO when the opener
returns an invalid file descriptor.
- Also escape s in the http.server
BaseHTTPRequestHandler.log_message so that it is technically
possible to parse the line and reconstruct what the original
data was. Without this a xHH is ambiguious as to if it is a
hex replacement we put in or the characters r”x” came through
in the original request line.
- asyncio.get_event_loop() now only emits a deprecation warning
when a new event loop was created implicitly. It no longer
emits a deprecation warning if the current event loop was
set.
- Fix bug when calling trace.CoverageResults with valid infile.
- Fix a bug in handling class cleanups in
unittest.TestCase. Now addClassCleanup() uses separate lists
for different TestCase subclasses, and doClassCleanups() only
cleans up the particular class.
- Release the GIL when calling termios APIs to avoid blocking
threads.
- Fix ast.increment_lineno() to also cover ast.TypeIgnore when
changing line numbers.
- Fix bug in urllib.parse.urlparse() that causes URL schemes
that begin with a digit, a plus sign, or a minus sign to be
parsed incorrectly.
- Check the number of arguments in substitution in user
generics containing a TypeVarTuple and one or more TypeVar.
- Fix substitution of ParamSpec followed by TypeVarTuple in
generic aliases.
- Fix substitution of TypeVarTuple and ParamSpec together in
user generics.
- Fixed bug where inspect.signature() reported incorrect
arguments for decorated methods.
- Fix SystemError in ctypes when exception was not set during
__initsubclass__.
- Remove older version of
_SSLProtocolTransport.get_write_buffer_limits in
asyncio.sslproto
- fix negative numbers failing in verify()
- Fix statistics.NormalDist pickle with 0 and 1 protocols.
- enum.auto() is now correctly activated when combined with
other assignment values. E.g. ONE = auto(), 'some text' will
now evaluate as (1, 'some text').
- Update the bundled copy of pip to version 22.3.1.
- Clean up refleak on failed module initialisation in _zoneinfo
- Clean up refleaks on failed module initialisation in in
_pickle
- Clean up refleak on failed module initialisation in _io.
- Fix memory leak in math.dist() when both points don’t have
the same dimension. Patch by Kumar Aditya.
- [3.11] Applied changes from importlib_metadata 4.11.4
through 4.13, including compatibility and robustness
fixes for Distribution objects without _normalized_name,
disallowing invalid inputs to Distribution.from_name, and
refined behaviors in PathDistribution._name_from_stem and
PathDistribution._normalized_name.
- Fix argument typechecks in _overlapped.WSAConnect() and
_overlapped.Overlapped.WSASendTo() functions.
- Prevent crashing in traceback when retrieving the byte-offset
for some source files that contain certain unicode
characters.
- Fix internal error in the re module which in very rare
circumstances prevented compilation of a regular expression
containing a conditional expression without the “else”
branch.
- Fix asyncio.StreamWriter.drain() to call
protocol.connection_lost callback only once on Windows.
- Add a mutex to unittest.mock.NonCallableMock to protect
concurrent access to mock attributes.
- Fix hang on Windows in subprocess.wait_closed() in asyncio
with ProactorEventLoop. Patch by Kumar Aditya.
- Fix infinite loop in unittest when a self-referencing chained
exception is raised
- tkinter.Text.count() raises now an exception for options
starting with “-” instead of silently ignoring them.
- On uname_result, restored expectation that _fields and
_asdict would include all six properties including processor.
- A createSocket() method was added to SysLogHandler.
- Fix bug in urllib.parse.urlparse() that causes certain port
numbers containing whitespace, underscores, plus and minus
signs, or non-ASCII digits to be incorrectly accepted.
- Allow venv to pass along PYTHON* variables to ensurepip and
pip when they do not impact path resolution
- On macOS, fix a crash in syslog.syslog() in multi-threaded
applications. On macOS, the libc syslog() function is not
thread-safe, so syslog.syslog() no longer releases the GIL to
call it. Patch by Victor Stinner.
- Allow BUILTINS to be a valid field name for frozen
dataclasses.
- Wrap network errors consistently in urllib FTP support, so
the test suite doesn’t fail when a network is available but
the public internet is not reachable.
- Make sure patch.dict() can be applied on async functions.
- Earlier in 3.11 we deprecated
asyncio.Task.cancel("message"). We realized we were too
harsh, and have undeprecated it.
- Change deprecate warning message in unittest from It is
deprecated to return a value!=None to It is deprecated to
return a value that is not None from a test case
- Fixes AttributeError when subprocess.check_output() is used
with argument input=None and either of the arguments encoding
or errors are used.
- Fix is_private properties in the ipaddress module. Previously
non-private networks (0.0.0.0/0) would return True from this
method; now they correctly return False.
- Avoid spurious tracebacks from asyncio when default executor
cleanup is delayed until after the event loop is closed (e.g.
as the result of a keyboard interrupt).
- Avoid a crash in the C version of
asyncio.Future.remove_done_callback() when an evil argument
is passed.
- Remove tokenize.NL check from tabnanny.
- Fix generation of the default name of
tkinter.Checkbutton. Previously, checkbuttons in different
parent widgets could have the same short name and share
the same state if arguments “name” and “variable” are not
specified. Now they are globally unique.
- Update bundled libexpat to 2.4.9
- Fix race condition in asyncio where process_exited() called
before the pipe_data_received() leading to inconsistent
output. Patch by Kumar Aditya.
- Fixed check in multiprocessing.resource_tracker that
guarantees that the length of a write to a pipe is not
greater than PIPE_BUF.
- Corrected type annotation for dataclass attribute
pstats.FunctionProfile.ncalls to be str.
- Fix repr of Any subclasses.
- Work around missing socket functions in socket’s __repr__.
- In inspect, fix overeager replacement of “typing.” in
formatting annotations.
- Fix handling of bytes path-like objects in os.ismount().
- Fix handling compiler warnings (SyntaxWarning and
DeprecationWarning) in codeop.compile_command() when checking
for incomplete input. Previously it emitted warnings and
raised a SyntaxError. Now it always returns None for
incomplete input without emitting any warnings.
- To avoid apparent memory leaks when asyncio.open_connection()
raises, break reference cycles generated by local exception
and future instances (which has exception instance as its
member var). Patch by Dong Uk, Kang.
- Fixed flickering of the turtle window when the tracer is
turned off. Patch by Shin-myoung-serp.
- Fix asyncio subprocess transport to kill process cleanly
when process is blocked and avoid RuntimeError when loop is
closed. Patch by Kumar Aditya.
- Prevent error when activating venv in nested fish instances.
- TarFile.next() now returns None when called on an empty
tarfile.
- Document the optional callback parameter of WeakMethod. Patch
by Géry Ogam.
- Restrict use of sockets instead of pipes for stdin of
subprocesses created by asyncio to AIX platform only.
- shutil.copytree() now applies the ignore_dangling_symlinks
argument recursively.
- Fix IndexError in argparse.ArgumentParser when a store_true
action is given an explicit argument.
- Document that calling variadic functions with ctypes requires
special care on macOS/arm64 (and possibly other platforms).
- Remove extra row
- Clarified the conflicting advice given in the ast
documentation about ast.literal_eval() being “safe” for use
on untrusted input while at the same time warning that it
can crash the process. The latter statement is true and is
deemed unfixable without a large amount of work unsuitable
for a bugfix. So we keep the warning and no longer claim that
literal_eval is safe.
- Restructured the documentation for the os.wait* family of
functions, and improved the docs for os.waitid() with more
explanation of the possible argument constants.
- Skip test_normalization() of test_unicodedata if it
fails to download NormalizationTest.txt file from
pythontest.net. Patch by Victor Stinner.
- Correct test_marsh on (32 bit) x86: test_deterministic sets
was failing.
- Optional big memory tests in test_sqlite3 now catch the
correct sqlite.DataError exception type in case of too large
strings and/or blobs passed.
- Fix a bug in the typing tests where a test relying
on CPython-specific implementation details was not
decorated with @cpython_only and was not skipped on other
implementations.
- Add tests for star-unpacking with PEP 646, and some other
miscellaneous PEP 646 tests.
- Added explicit coverage of Py_Initialize (and hence
Py_InitializeEx) back to the embedding tests (all other
embedding tests migrated to Py_InitializeFromConfig in Python
3.11)
- Some C API tests were moved into the new Lib/test/test_capi/
directory.
- Fix -Wimplicit-int, -Wstrict-prototypes, and
-Wimplicit-function-declaration compiler warnings in
configure checks.
- Fix a compilation issue with GCC 12 on macOS.
- Fix -Wimplicit-int compiler warning in configure check for
PTHREAD_SCOPE_SYSTEM.
- Fix a possible fd leak in Programs/_freeze_module.c
introduced in Python 3.11.
- Fix build with PYTHON_FOR_REGEN=python3.8.
- Specify the full path to the source location for make
docclean (needed for cross-builds).
- Don’t use vendored libmpdec headers if --with-system-libmpdec
is passed to configure. Don’t use vendored libexpat headers
if --with-system-expat is passed to !configure.
- Fix the build process of clang compiler for _bootstrap_python
if LTO optimization is applied. Patch by Matthias Görgens and
Dong-hee Na.
- wasm32-emscripten builds for browsers now include
concurrent.futures for asyncio and unittest.mock.
- wasm32-emscripten platform no longer builds resource module,
getresuid(), getresgid(), and their setters. The APIs are
stubs and not functional.
- Updated pegen regeneration script on Windows to find and
use Python 3.9 or higher. Prior to this, pegen regeneration
already required 3.9 or higher, but the script may have used
lower versions of Python.
- Fix a bug in the previous bugfix that caused IDLE to
not start when run with 3.10.8, 3.12.0a1, and at least
Microsoft Python 3.10.2288.0 installed without the Lib/test
package. 3.11.0 was never affected.
- The wasm_build.py script now pre-builds Emscripten ports,
checks for broken EMSDK versions, and warns about pkg-config
env vars.
- The new tool Tools/wasm/wasm_builder.py automates configure,
compile, and test steps for building CPython on WebAssembly
platforms.
- Fix handling of module docstrings in Tools/i18n/pygettext.py.
- PyBUF_* constants were marked as part of Limited API
of Python 3.11+. These were available in 3.11.0 with
Py_LIMITED_API defined for 3.11, and are necessary to use the
buffer API.
- Fix use-after-free in Py_SetPythonHome(NULL),
Py_SetProgramName(NULL) and _Py_SetProgramFullPath(NULL)
function calls. Issue reported by Benedikt Reinartz. Patch by
Victor Stinner.
- Py_InitializeEx now correctly calls PyConfig_Clear after
initializing the interpreter (the omission didn’t cause a
memory leak only because none of the dynamically allocated
config fields are populated by the wrapper function)
- Removed upstreamed patches:
- 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
- CVE-2022-45061-DoS-by-IDNA-decode.patch
OBS-URL: https://build.opensuse.org/request/show/1041729
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=11
- python -m http.server no longer allows terminal control
characters sent within a garbage request to be printed
to the stderr server lo This is done by changing the
http.server BaseHTTPRequestHandler .log_message method to
replace control characters with a \xHH hex escape before
printin
- Avoid publishing list of active per-interpreter audit hooks
via the gc module
- The IDNA codec decoder used on DNS hostnames by socket or
asyncio related name resolution functions no longer involves
a quadratic algorithm. This prevents a potential CPU denial
of service if an out-of-spec excessive length hostname
involving bidirectional characters were decoded. Some
protocols such as urllib http 3xx redirects potentially allow
for an attacker to supply such a name (CVE-2022-45061).
- Update bundled libexpat to 2.5.0
- Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no
longer uses a shell to run openssl commands. Issue reported
and initial fix by Caleb Shortt. Patch by Victor Stinner.
- Fix a crash when an object which does not have a dictionary
frees its instance values.
- Fix a bug in the tokenizer that could cause infinite
recursion when showing syntax warnings that happen in the
first line of the source. Patch by Pablo Galindo
- Fix an issue that could cause frames to be visible to Python
code as they are being torn down, possibly leading to memory
corruption or hard crashes of the interpreter.
- Fix a reference bug in _imp.create_builtin() after the
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=40
- Update to 3.11.0 (overall changes from 3.10.*):
- General changes
- PEP 657 -- Include Fine-Grained Error Locations in
Tracebacks
- PEP 654 -- Exception Groups and except*
- PEP 680 -- tomllib: Support for Parsing TOML in the
Standard Library
- gh-90908 -- Introduce task groups to asyncio
- gh-34627 -- Atomic grouping ((?>...)) and possessive
quantifiers (*+, ++, ?+, {m,n}+) are now supported in
regular expressions.
- The Faster CPython Project is already yielding some
exciting results. Python 3.11 is up to 10-60% faster than
Python 3.10. On average, we measured a 1.22x speedup on the
standard benchmark suite. See Faster CPython for details.
- Typing and typing language changes
- PEP 673 -- Self Type
- PEP 646 -- Variadic Generics
- PEP 675 -- Arbitrary Literal String Type
- PEP 655 -- Marking individual TypedDict items as required
or potentially-missing
- PEP 681 -- Data Class Transforms
- (just changes from 3.11.0rc2):
- Fix multiplying a list by an integer (list *= int): detect
the integer overflow when the new allocated length is close
to the maximum size. Issue reported by Jordan Limor. Patch by
Victor Stinner.
- On Linux the multiprocessing module returns to using
filesystem backed unix domain sockets for communication
with the forkserver process instead of the Linux abstract
OBS-URL: https://build.opensuse.org/request/show/1031401
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=34
- Update to 3.11.0rc2:
- Converting between int and str in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base
10 (decimal) now raises a ValueError if the number of digits
in string form is above a limit to avoid potential denial of
service attacks due to the algorithmic complexity. This is
a mitigation for CVE-2020-10735.
This new limit can be configured or disabled by environment
variable, command line flag, or sys APIs. See the integer
string conversion length limitation documentation. The
default limit is 4300 digits in string form.
- Fix case of undefined behavior in ceval.c
- Do not expose KeyWrapper in _functools.
- Ensure that tracing, sys.setrace(), is turned on
immediately. In pre-release versions of 3.11, some tracing
events might have been lost when turning on tracing in a
__del__ method or interrupt.
- Fix use after free in trace refs build mode. Patch by Kumar
Aditya.
- When loading a file with invalid UTF-8 inside a multi-line
string, a correct SyntaxError is emitted.
- Make sure that incomplete frames do not show up in
tracemalloc traces.
- Remove two cases of undefined behavior, by adding NULL
checks.
- Fix possible NULL pointer dereference in
_PyThread_CurrentFrames. Patch by Kumar Aditya.
- Fix AttributeError missing name and obj attributes in
object.__getattribute__(). Patch by Philip Georgi.
- Loading a file with invalid UTF-8 will now report the broken
character at the correct location.
- Fixed a bug that caused _PyCode_GetExtra to return garbage
for negative indexes. Patch by Pablo Galindo
- Fix a deadlock in PyGILState_Ensure() when allocating new
thread state. Patch by Kumar Aditya.
- PyType_Ready() now initializes ht_cached_keys and performs
additional checks to ensure that type objects are properly
configured. This avoids crashes in 3rd party packages that
don’t use regular API to create new types.
- Skip over incomplete frames in PyThreadState_GetFrame().
- Fix format string in _PyPegen_raise_error_known_location that
can lead to memory corruption on some 64bit systems. The
function was building a tuple with i (int) instead of n
(Py_ssize_t) for Py_ssize_t arguments.
- Fix misleading contents of error message when converting an
all-whitespace string to float.
- ast.parse() will no longer parse function definitions with
positional-only params when passed feature_version less than
(3, 8). Patch by Shantanu Jain.
- Fix incorrect error message in the io module.
- Fix the faulthandler implementation of
faulthandler.register(signal, chain=True) if the sigaction()
function is not available: don’t call the previous signal
handler if it’s NULL. Patch by Victor Stinner.
- Correct conversion of numbers.Rational’s to float.
- Fix TypeVarTuple.__typing_prepare_subst__. TypeError was not
raised when using more than one TypeVarTuple, like [*T, *V]
in type alias substitutions.
- Fix asyncio.streams.StreamReaderProtocol to keep a strong
reference to the created task, so that it’s not garbage
collected
- Fix a performance regression in logging
TimedRotatingFileHandler. Only check for special files when
the rollover time has passed.
- Fix unused localName parameter in the Attr class in
xml.dom.minidom.
- Fix incorrect condition that causes sys.thread_info.name to
be wrong on pthread platforms.
- Remove an incompatible change from bpo-28080 that caused a
regression that ignored the utf8 in ZipInfo.flag_bits. Patch
by Pablo Galindo.
- Fix asyncio.Runner to call asyncio.set_event_loop() only
once to avoid calling attach_loop() multiple times on child
watchers. Patch by Kumar Aditya.
- Fix unittest.IsolatedAsyncioTestCase to set event loop before
calling setup functions. Patch by Kumar Aditya.
- When a task catches asyncio.CancelledError and raises some
other error, the other error should generally not silently be
suppressed.
- Fail gracefully if EPERM or ENOSYS is raised when loading
crypt methods. This may happen when trying to load MD5 on a
Linux kernel with FIPS enabled.
- Allow asyncio.StreamWriter.drain() to be awaited concurrently
by multiple tasks. Patch by Kumar Aditya.
- Fix ast.unparse() when ImportFrom.level is None
- Improve discoverability of the higher level
concurrent.futures module by providing clearer links from the
lower level threading and multiprocessing modules.
- What’s New 3.11 now has instructions for how to provide
compiler and linker flags for Tcl/Tk and OpenSSL on RHEL 7
and CentOS 7.
- Mitigate the inherent race condition from using
find_unused_port() in testSockName() by trying to find an
unused port a few times before failing. Patch by Ross Burton.
- Build and test with OpenSSL 1.1.1q
- Use support-expat-CVE-2022-25236-patched.patch from the current
version of gh#python/cpython#93900 instead of the old
support-expat-245.patch.
- Reapply fix_configure_rst.patch.
OBS-URL: https://build.opensuse.org/request/show/1003848
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=8
- Converting between int and str in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base
10 (decimal) now raises a ValueError if the number of digits
in string form is above a limit to avoid potential denial of
service attacks due to the algorithmic complexity. This is
a mitigation for CVE-2020-10735.
This new limit can be configured or disabled by environment
variable, command line flag, or sys APIs. See the integer
string conversion length limitation documentation. The
default limit is 4300 digits in string form.
- Fix case of undefined behavior in ceval.c
- Do not expose KeyWrapper in _functools.
- Ensure that tracing, sys.setrace(), is turned on
immediately. In pre-release versions of 3.11, some tracing
events might have been lost when turning on tracing in a
__del__ method or interrupt.
- Fix use after free in trace refs build mode. Patch by Kumar
Aditya.
- When loading a file with invalid UTF-8 inside a multi-line
string, a correct SyntaxError is emitted.
- Make sure that incomplete frames do not show up in
tracemalloc traces.
- Remove two cases of undefined behavior, by adding NULL
checks.
- Fix possible NULL pointer dereference in
_PyThread_CurrentFrames. Patch by Kumar Aditya.
- Fix AttributeError missing name and obj attributes in
object.__getattribute__(). Patch by Philip Georgi.
- Loading a file with invalid UTF-8 will now report the broken
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=32
- Core and Builtins
- Update code object hashing and equality to consider all
debugging and exception handling tables. This fixes an
issue where certain non-identical code objects could be
“deduplicated” during compilation.
- _PyPegen_Parser_New now properly detects token memory
allocation errors. Patch by Honglin Zhu.
- Run Python code in tracer/profiler function at full
speed. Fixes slowdown in earlier versions of 3.11.
- Emit a warning in debug mode if an object does not call
PyObject_GC_UnTrack() before deallocation. Patch by Pablo
Galindo.
- Prevented crashes in the AST constructor when
compiling some absurdly long expressions like
"+0"*1000000. RecursionError is now raised instead. Patch
by Pablo Galindo
- ast.AST node positions are now validated when provided to
compile() and other related functions. If invalid positions
are detected, a ValueError will be raised.
- Fix error detection in some builtin functions when keyword
argument name is an instance of a str subclass with
overloaded __eq__ and __hash__. Previously it could cause
SystemError or other undesired behavior.
- Library
- Update bundled pip to 22.2.2.
- Fix asyncio.TaskGroup to propagate exception when
asyncio.CancelledError was replaced with another exception
by a context manger. Patch by Kumar Aditya and Guido van
Rossum.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=27
- Update to 3.11.0b5:
- Core and Builtins
- gh-93351: ast.AST node positions are now validated when
provided to compile() and other related functions. If
invalid positions are detected, a ValueError will be
raised.
- gh-94438: Fix an issue that caused extended opcode
arguments and some conditional pops to be ignored when
calculating valid jump targets for assignments to the
f_lineno attribute of frame objects. In some cases, this
could cause inconsistent internal state, resulting in a
hard crash of the interpreter.
- gh-95060: Undocumented PyCode_Addr2Location function now
properly returns when addrq argument is less than zero.
- gh-95113: Replace all EXTENDED_ARG_QUICK instructions
with basic EXTENDED_ARG instructions in unquickened
code. Consumers of non-adaptive bytecode should be able to
handle extended arguments the same way they were handled in
CPython 3.10 and older.
- gh-91409: Fix incorrect source location info caused by
certain optimizations in the bytecode compiler.
- gh-94036: Fix incorrect source location info for some
multi-line attribute accesses and method calls.
- gh-94739: Allow jumping within, out of, and across
exception handlers in the debugger.
- gh-94949: ast.parse() will no longer parse parenthesized
context managers when passed feature_version less than (3,
9). Patch by Shantanu Jain.
- gh-94947: ast.parse() will no longer parse assignment
expressions when passed feature_version less than (3,
8). Patch by Shantanu Jain.
- gh-91256: Ensures the program name is known for help text
during interpreter startup.
- gh-94869: Fix the column offsets for some expressions in
multi-line f-strings ast nodes. Patch by Pablo Galindo.
- gh-94822: Fix an issue where lookups of metaclass
descriptors may be ignored when an identically-named
attribute also exists on the class itself.
- gh-91153: Fix an issue where a bytearray item assignment
could crash if it’s resized by the new value’s __index__()
method.
- gh-90699: Fix reference counting bug in
bool.__repr__(). Patch by Kumar Aditya.
- Library
- gh-95087: Fix IndexError in parsing invalid date in the
email module.
- gh-95199: Upgrade bundled setuptools to 63.2.0.
- gh-95194: Upgrade bundled pip to 22.2.
- gh-95132: Fix a sqlite3 regression where *args and **kwds
were incorrectly relayed from connect() to the Connection
factory. The regression was introduced in 3.11a1 with PR
24421 (gh-85128). Patch by Erlend E. Aasland.`
- gh-93157: Fix fileinput module didn’t support errors option
when inplace is true.
- gh-95105: wsgiref.types.InputStream.__iter__() should
return Iterator[bytes], not Iterable[bytes]. Patch by
Shantanu Jain.
- gh-94857: Fix refleak in
_io.TextIOWrapper.reconfigure. Patch by Kumar Aditya.
- gh-94821: Fix binding of unix socket to empty address
on Linux to use an available address from the abstract
namespace, instead of “0”.
- gh-89988: Fix memory leak in pickle.Pickler when looking up
dispatch_table. Patch by Kumar Aditya.
- bpo-47025: Drop support for bytes on sys.path.
- Tests
- gh-95212: Make multiprocessing test case
test_shared_memory_recreate parallel-safe.
- Build
- gh-94847: Fixed _decimal module build issue on GCC when
compiling with LTO and pydebug. Debug builds no longer
force inlining of functions.
- gh-94841: Fix the possible performance regression of
PyObject_Free() compiled with MSVC version 1932.
- gh-94801: configure now uses custom flags like ZLIB_CFLAGS
and ZLIB_LIBS when searching for headers and libraries.
- gh-94773: deepfreeze.py now supports code object with
frozensets that contain incompatible, unsortable types.
- C API
- gh-94930: Fix SystemError raised when
PyArg_ParseTupleAndKeywords() is used with # in (...) but
without PY_SSIZE_T_CLEAN defined.
- gh-94864: Fix PyArg_Parse* with deprecated format units “u”
and “Z”. It returned 1 (success) when warnings are turned
into exceptions.
- gh-94731: Python again uses C-style casts for
most casting operations when compiled with
C++. This may trigger compiler warnings, if they
are enabled with e.g. -Wold-style-cast `` or
``-Wzero-as-null-pointer-constant options for g++.
OBS-URL: https://build.opensuse.org/request/show/991283
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=5
- Core and Builtins
- gh-93351: ast.AST node positions are now validated when
provided to compile() and other related functions. If
invalid positions are detected, a ValueError will be
raised.
- gh-94438: Fix an issue that caused extended opcode
arguments and some conditional pops to be ignored when
calculating valid jump targets for assignments to the
f_lineno attribute of frame objects. In some cases, this
could cause inconsistent internal state, resulting in a
hard crash of the interpreter.
- gh-95060: Undocumented PyCode_Addr2Location function now
properly returns when addrq argument is less than zero.
- gh-95113: Replace all EXTENDED_ARG_QUICK instructions
with basic EXTENDED_ARG instructions in unquickened
code. Consumers of non-adaptive bytecode should be able to
handle extended arguments the same way they were handled in
CPython 3.10 and older.
- gh-91409: Fix incorrect source location info caused by
certain optimizations in the bytecode compiler.
- gh-94036: Fix incorrect source location info for some
multi-line attribute accesses and method calls.
- gh-94739: Allow jumping within, out of, and across
exception handlers in the debugger.
- gh-94949: ast.parse() will no longer parse parenthesized
context managers when passed feature_version less than (3,
9). Patch by Shantanu Jain.
- gh-94947: ast.parse() will no longer parse assignment
expressions when passed feature_version less than (3,
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=25
- Update to 3.11.0b4:
- Fixes many bugs and adds following more significant changes
- Security
- gh-68966: The deprecated mailcap module now refuses to inject
Coreunsafe text (filenames, MIME types, parameters) into
shell Corecommands. Instead of using such text, it will
warn and act Coreas if a match was not found (or for test
commands, as if the Coretest failed). and Builtins
- gh-93516: Lazily create a table mapping bytecode offsets to
line numbers to speed up calculation of line numbers when
tracing.
- gh-93461: importlib.invalidate_caches() now drops entries
from sys.path_importer_cache with a relative path as
name. This solves a caching issue when a process changes its
current working directory.
- FileFinder no longer inserts a dot in the path, e.g.
/egg/./spam is now /egg/spam.
Library
- gh-93896: Fix asyncio.run() and
unittest.IsolatedAsyncioTestCase to always the set event loop
as it was done in Python 3.10 and earlier. Patch by Kumar
Aditya.
- gh-94101: Manual instantiation of ssl.SSLSession objects is
no longer allowed as it lead to misconfigured instances that
crashed the interpreter when attributes where accessed on
them.
- gh-83658: Make multiprocessing.Pool raise an exception if
maxtasksperchild is not None or a positive int.
- gh-61162: Clarify sqlite3 behavior when Using the connection
as a context manager.
Tools/Demos
- gh-94538: Fix Argument Clinic output to custom file
destinations. Patch by Erlend E. Aasland.
C API
- gh-93937: The following frame functions and type are now
directly available with #include <Python.h>, it’s no longer
needed to add #include <frameobject.h>:
PyFrame_Check()
PyFrame_GetBack()
PyFrame_GetBuiltins()
PyFrame_GetGenerator()
PyFrame_GetGlobals()
PyFrame_GetLasti()
PyFrame_GetLocals()
PyFrame_Type
OBS-URL: https://build.opensuse.org/request/show/989232
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python311?expand=0&rev=3
- Fixes many bugs and adds following more significant changes
- Security
- gh-68966: The deprecated mailcap module now refuses to inject
Coreunsafe text (filenames, MIME types, parameters) into
shell Corecommands. Instead of using such text, it will
warn and act Coreas if a match was not found (or for test
commands, as if the Coretest failed). and Builtins
- gh-93516: Lazily create a table mapping bytecode offsets to
line numbers to speed up calculation of line numbers when
tracing.
- gh-93461: importlib.invalidate_caches() now drops entries
from sys.path_importer_cache with a relative path as
name. This solves a caching issue when a process changes its
current working directory.
- FileFinder no longer inserts a dot in the path, e.g.
/egg/./spam is now /egg/spam.
Library
- gh-93896: Fix asyncio.run() and
unittest.IsolatedAsyncioTestCase to always the set event loop
as it was done in Python 3.10 and earlier. Patch by Kumar
Aditya.
- gh-94101: Manual instantiation of ssl.SSLSession objects is
no longer allowed as it lead to misconfigured instances that
crashed the interpreter when attributes where accessed on
them.
- gh-83658: Make multiprocessing.Pool raise an exception if
maxtasksperchild is not None or a positive int.
- gh-61162: Clarify sqlite3 behavior when Using the connection
as a context manager.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=20
- PEP 657 – Include Fine-Grained Error Locations in Tracebacks
- PEP 654 – Exception Groups and except*
- PEP 673 – Self Type
- PEP 646 – Variadic Generics
- PEP 680– tomllib: Support for Parsing TOML in the Standard Library
- PEP 675– Arbitrary Literal String Type
- PEP 655– Marking individual TypedDict items as required or potentially-missing
- bpo-46752– Introduce task groups to asyncio
- The Faster Cpython Project is already yielding some exciting
results. Python 3.11 is up to 10-60% faster than Python
3.10. On average, we measured a 1.22x speedup on the standard
benchmark suite. See
https://docs.python.org/3.11/whatsnew/3.11.html#faster-cpython
for details.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=3
