Mailman 3 March 2019 - Python-announce-list

Vulnerability: urlsplit does not handle NFKC normalization
by Steve Dower 07 Mar '19

07 Mar '19

We recently disclosed and patched a potential vulnerability in Python applications that use urlsplit() or urlparse() on user-provide URLs. You may be impacted if a user can provide a Unicode URL to your application that is later converted to IDNA (Punycode) or ASCII. This conversion will decompose certain Unicode characters that can affect the netloc part of your URL, potentially resulting in requests being sent to an unexpected host. All versions of Python are affected. Patches have been applied for the next releases of 2.7, 3.7 and 3.8, and are under review for 3.4, 3.5 and 3.6. Full details, links to the patches, and workarounds for applications are available at: * https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html * https://bugs.python.org/issue36216 A CVE number has been requested but is not yet available. The issue was discovered by Jonathan Birch of Microsoft Corporation and Panayiotis Panayiotou, and reported to the Python Security Response Team <security(a)python.org>.

1 0

rJSmin 1.1.0
by André Malo 06 Mar '19

06 Mar '19

Hello World, I'm pleased to announce version 1.1.0 of rJSmin. About rJSmin ============ rJSmin is a javascript minifier written in python. The minifier is based on the semantics of jsmin.c by Douglas Crockford. The module is a re-implementation aiming for speed, so it can be used at runtime (rather than during a preprocessing step). Usually it produces the same results as the original jsmin.c. It differs in the following ways: - there is no error detection: unterminated string, regex and comment literals are treated as regular javascript code and minified as such. - Control characters inside string and regex literals are left untouched; they are not converted to spaces (nor to \n) - Newline characters are not allowed inside string and regex literals, except for line continuations in string literals (ECMA-5). - "return /regex/" is recognized correctly. - Line terminators after regex literals are handled more sensibly - "+ +" and "- -" sequences are not collapsed to "++" or "--" - Newlines before ! operators are removed more sensibly - (Unnested) template literals are supported (ECMA-6) - Comments starting with an exclamation mark ('!') can be kept optionally - rJSmin does not handle streams, but only complete strings. (However, the module provides a "streamy" interface). About Release 1.1.0 =================== Main changes include: - Python version support updated - The C extension is no longer required for installation by default. Also it's only used if its version is matching the python implementation's version - Tentative support for template literals has been added. Only un-nested template literals are recognized for now. - '+', '-' and '*' are recognized in front of regexes Supported Python Versions ========================= * Python 2.7 * Python 3.4 - Untested Python Versions ======================== * PyPy * Jython License ======= rJSmin is available under the terms and conditions of the "Apache License, Version 2.0." Links ===== * Homepage + Documentation: http://opensource.perlig.de/rjsmin/ * PyPI: https://pypi.org/project/rjsmin/ * Github: https://github.com/ndparker/rjsmin * License: http://www.apache.org/licenses/LICENSE-2.0 André "nd" Malo

1 0

Wing Python IDE 6.1.5 released
by Wingware 05 Mar '19

05 Mar '19

Wing Python IDE version 6.1.5 is now available for download <https://wingware.com/downloads>. Changes in 6.1.5 * Improves code intelligence for extension modules on remote hosts <http://wingware.com/doc/proj/remote-hosts> * Adds a debug status icon to the debug process selector, and does a better job truncating items in the process selection menu * Checks for conflicts before introducing names with refactoring <http://wingware.com/doc/refactoring> operations, to avoid inadvertently reusing an existing symbol name * Improves support for py.exe on Windows, so that the correct Python version is launched This release also makes about 30 other minor improvements. See the change log <https://wingware.com/pub/wingide/6.1.5/CHANGELOG.txt> for details. About Wing Wingware's family of cross-platform Python IDEs provide powerful integrated editing, debugging, unit testing, and project management features for interactive Python development. Wing can speed development and improve code quality for any kind of Python project, including web, desktop, scientific, data analysis, embedded scripting, and other applications. For more information, please visit wingware.com <https://wingware.com/> Stephan Deibel Wing Python IDE | The Intelligent Development Environment for Python

1 0

ANN: psutil 5.6.0 with Process.parents() is out
by Giampaolo Rodola' 05 Mar '19

05 Mar '19

Hello all, I'm glad to announce the release of psutil 5.6.1: https://github.com/giampaolo/psutil Blog post: http://grodola.blogspot.com/2019/03/psutil-560-with-processparents-is-out.h… About ===== psutil (process and system utilities) is a cross-platform library for retrieving information on running processes and system utilization (CPU, memory, disks, network) in Python. It is useful mainly for system monitoring, profiling and limiting process resources and management of running processes. It implements many functionalities offered by command line tools such as: ps, top, lsof, netstat, ifconfig, who, df, kill, free, nice, ionice, iostat, iotop, uptime, pidof, tty, taskset, pmap. It currently supports Linux, Windows, macOS, Sun Solaris, FreeBSD, OpenBSD, NetBSD and AIX, both 32-bit and 64-bit architectures. Supported Python versions are 2.6, 2.7 and 3.4+. PyPy is also known to work. What's new ========== 2019-03-05 **Enhancements** - #1379: [Windows] Process suspend() and resume() now use NtSuspendProcess and NtResumeProcess instead of stopping/resuming all threads of a process. This is faster and more reliable (aka this is what ProcessHacker does). - #1420: [Windows] in case of exception disk_usage() now also shows the path name. - #1422: [Windows] Windows APIs requiring to be dynamically loaded from DLL libraries are now loaded only once on startup (instead of on per function call) significantly speeding up different functions and methods. - #1426: [Windows] PAGESIZE and number of processors is now calculated on startup. - #1428: in case of error, the traceback message now shows the underlying C function called which failed. - #1433: new Process.parents() method. (idea by Ghislain Le Meur) - #1437: pids() are returned in sorted order. - #1442: python3 is now the default interpreter used by Makefile. **Bug fixes** - #1353: process_iter() is now thread safe (it rarely raised TypeError). - #1394: [Windows] Process name() and exe() may erroneously return "Registry". QueryFullProcessImageNameW is now used instead of GetProcessImageFileNameW in order to prevent that. - #1411: [BSD] lack of Py_DECREF could cause segmentation fault on process instantiation. - #1419: [Windows] Process.environ() raises NotImplementedError when querying a 64-bit process in 32-bit-WoW mode. Now it raises AccessDenied. - #1427: [OSX] Process cmdline() and environ() may erroneously raise OSError on failed malloc(). - #1429: [Windows] SE DEBUG was not properly set for current process. It is now, and it should result in less AccessDenied exceptions for low-pid processes. - #1432: [Windows] Process.memory_info_ex()'s USS memory is miscalculated because we're not using the actual system PAGESIZE. - #1439: [NetBSD] Process.connections() may return incomplete results if using oneshot(). - #1447: original exception wasn't turned into NSP/AD exceptions when using Process.oneshot() ctx manager. **Incompatible API changes** - #1291: [OSX] Process.memory_maps() was removed because inherently broken (segfault) for years. Links ===== - Home page: https://github.com/giampaolo/psutil - Download: https://pypi.org/project/psutil/#files - Documentation: http://psutil.readthedocs.io - What's new: https://github.com/giampaolo/psutil/blob/master/HISTORY.rst -- Giampaolo - http://grodola.blogspot.com

1 0

[RELEASED] Python 3.4.10rc1 and Python 3.5.7rc1 are now available
by Larry Hastings 04 Mar '19

04 Mar '19

On behalf of the Python development community, I'm chuffed to announce the availability of Python 3.4.10rc1 and Python 3.5.7rc1. Both Python 3.4 and 3.5 are in "security fixes only" mode. Both versions only accept security fixes, not conventional bug fixes, and both releases are source-only. The "final" releases on both these branches should be out in about two weeks. Of particular note: that release of Python 3.4, Python 3.4.10 final, will be the final release ever in the Python 3.4 series. After 3.4.10, the branch will be closed for good and I'll retire as Python 3.4 Release Manager. I'll still be the Python 3.5 Release Manager until 3.5 similarly concludes, approximately eighteen months from now. You can find Python 3.4.10rc1 here: https://www.python.org/downloads/release/python-3410rc1/ And you can find Python 3.5.7rc1 here: https://www.python.org/downloads/release/python-357rc1/ Best wishes, //arry/

1 0

[RELEASE] Python 2.7.16
by Benjamin Peterson 03 Mar '19

03 Mar '19

Hello all, I'm pleased to announce the immediate availability of Python 2.7.16 for download at https://www.python.org/downloads/release/python-2716/. The only change since the release candidate was a fix for the IDLE icon on macOS. See https://bugs.python.org/issue32129. Refer to the changelog for a full list of changes: https://raw.githubusercontent.com/python/cpython/v2.7.16/Misc/NEWS.d/2.7.16… Please report any bugs to https://bugs.python.org/. Regards, Benjamin 2.7 release manager (on behalf of all Python 2.7's contributors)

1 0

[ANN] python-blosc v1.8.0
by Valentin Haenel 03 Mar '19

03 Mar '19

============================= Announcing python-blosc 1.8.0 ============================= What is new? ============ This is a maintenance and fetaure release. A regression affecting windows users has been fixed by Robert McLeod and support for older C compilers has been contributed by Nicholas Devenish. Also, c-blosc v1.16.2 has been included and support for the new `cbuffer_validate` is included. Lastly there have been several minor improvements and cleanups as usual. For more info, you can have a look at the release notes in: https://github.com/Blosc/python-blosc/blob/master/RELEASE_NOTES.rst More docs and examples are available in the documentation site: http://python-blosc.blosc.org What is it? =========== Blosc (http://www.blosc.org) is a high performance compressor optimized for binary data. It has been designed to transmit data to the processor cache faster than the traditional, non-compressed, direct memory fetch approach via a memcpy() OS call. Blosc works well for compressing numerical arrays that contains data with relatively low entropy, like sparse data, time series, grids with regular-spaced values, etc. python-blosc (http://python-blosc.blosc.org/) is the Python wrapper for the Blosc compression library, with added functions (`compress_ptr()` and `pack_array()`) for efficiently compressing NumPy arrays, minimizing the number of memory copies during the process. python-blosc can be used to compress in-memory data buffers for transmission to other machines, persistence or just as a compressed cache. There is also a handy tool built on top of python-blosc called Bloscpack (https://github.com/Blosc/bloscpack). It features a commmand line interface that allows you to compress large binary datafiles on-disk. It also comes with a Python API that has built-in support for serializing and deserializing Numpy arrays both on-disk and in-memory at speeds that are competitive with regular Pickle/cPickle machinery. Sources repository ================== The sources and documentation are managed through github services at: http://github.com/Blosc/python-blosc ---- **Enjoy data!**

1 0

[SC] Update from the Python Steering Council about CPython Development
by Carol Willing 28 Feb '19

28 Feb '19

The Python Steering Council is pleased to provide an update to the Python community about Steering Council activity and CPython development. We've created a GitHub repo for Steering Council updates and helpful documents: https://github.com/python/steering-council Here's the latest update written after our meeting on February 26th: https://github.com/python/steering-council/blob/master/updates/2019-02-26_s… (https://link.getmailspring.com/link/531E84FF-7FB6-466A-8408-1700787065BA@ge…) We'll be posting updates after each steering council meeting which will be roughly twice a month.

1 0