Python-checkins

Download

python-checkins@python.org

September 2026

1 participants
980 discussions

[3.14] gh-158536: Skip some Android logging tests on OS versions with aggressive "chatty" filtering (GH-158531) (#158538)
by freakboy3742 Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/e47e10150172d1262a92f340536a752a22… commit: e47e10150172d1262a92f340536a752a22eb6ea4 branch: 3.14 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: freakboy3742 <russell(a)keith-magee.com> date: 2026-09-30T23:19:01Z summary: [3.14] gh-158536: Skip some Android logging tests on OS versions with aggressive "chatty" filtering (GH-158531) (#158538) Address a test suite failure when run on Android 26-30 (inclusive) due to the adb logger dropping lines with a "chatty ... Identical 3 lines" marker. (cherry picked from commit 763b6edb0ec959bdfb78f098b76829365de36ca5) Co-authored-by: Malcolm Smith <smith(a)chaquo.com> files: M Lib/test/test_android.py diff --git a/Lib/test/test_android.py b/Lib/test/test_android.py index 31daafbc3d6300..edab0fe71a610a 100644 --- a/Lib/test/test_android.py +++ b/Lib/test/test_android.py @@ -1,4 +1,5 @@ import io +import platform import queue import re import subprocess @@ -16,6 +17,11 @@ if sys.platform != "android": raise unittest.SkipTest("Android-specific") +# Some API levels filter out consecutive identical lines and replace them with a +# "chatty" marker. +api_level = platform.android_ver().api_level +chatty_issue = (26 <= api_level <= 30) + # (name, level, fileno) STREAM_INFO = [("stdout", "I", 1), ("stderr", "W", 2)] @@ -174,15 +180,13 @@ def write(s, lines=None, *, write_len=None): write("\u0000b", [r"\xc0\x80b"]) write("a\u0000b", [r"a\xc0\x80b"]) - # Multi-line messages. Avoid identical consecutive lines, as - # they may activate "chatty" filtering and break the tests. - # - # Additional spaces will appear in the output where necessary to - # protect leading newlines. + # Multi-line messages. Additional spaces will appear in the output where + # necessary to protect leading newlines. write("\nx", [" "]) write("\na\n", ["x", "a"]) write("\n", [" "]) - write("\n\n", [" ", " "]) + if not chatty_issue: + write("\n\n", [" ", " "]) write("b\n", ["b"]) write("c\n\n", ["c", " "]) write("d\ne", ["d"]) @@ -201,7 +205,8 @@ def write(s, lines=None, *, write_len=None): write("\nx", [" ", "x"]) write("\na\n", [" ", "a"]) write("\n", [" "]) - write("\n\n", [" ", " "]) + if not chatty_issue: + write("\n\n", [" ", " "]) write("b\n", ["b"]) write("c\n\n", ["c", " "]) write("d\ne", ["d", "e"])

1 0

gh-158536: Skip some Android logging tests on OS versions with aggressive "chatty" filtering (#158531)
by freakboy3742 Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/763b6edb0ec959bdfb78f098b76829365d… commit: 763b6edb0ec959bdfb78f098b76829365de36ca5 branch: main author: Malcolm Smith <smith(a)chaquo.com> committer: freakboy3742 <russell(a)keith-magee.com> date: 2026-10-01T06:48:34+08:00 summary: gh-158536: Skip some Android logging tests on OS versions with aggressive "chatty" filtering (#158531) Address a test suite failure when run on Android 26-30 (inclusive) due to the adb logger dropping lines with a "chatty ... Identical 3 lines" marker. files: M Lib/test/test_android.py diff --git a/Lib/test/test_android.py b/Lib/test/test_android.py index 201d701aff11eb..45c2911afa8bba 100644 --- a/Lib/test/test_android.py +++ b/Lib/test/test_android.py @@ -1,4 +1,5 @@ import io +import platform import queue import re import subprocess @@ -16,6 +17,11 @@ if sys.platform != "android": raise unittest.SkipTest("Android-specific") +# Some API levels filter out consecutive identical lines and replace them with a +# "chatty" marker. +api_level = platform.android_ver().api_level +chatty_issue = (26 <= api_level <= 30) + # (name, level, fileno) STREAM_INFO = [("stdout", "I", 1), ("stderr", "W", 2)] @@ -179,15 +185,13 @@ def write(s, lines=None, *, write_len=None): write("\u0000b", [r"\xc0\x80b"]) write("a\u0000b", [r"a\xc0\x80b"]) - # Multi-line messages. Avoid identical consecutive lines, as - # they may activate "chatty" filtering and break the tests. - # - # Additional spaces will appear in the output where necessary to - # protect leading newlines. + # Multi-line messages. Additional spaces will appear in the output where + # necessary to protect leading newlines. write("\nx", [" "]) write("\na\n", ["x", "a"]) write("\n", [" "]) - write("\n\n", [" ", " "]) + if not chatty_issue: + write("\n\n", [" ", " "]) write("b\n", ["b"]) write("c\n\n", ["c", " "]) write("d\ne", ["d"]) @@ -206,7 +210,8 @@ def write(s, lines=None, *, write_len=None): write("\nx", [" ", "x"]) write("\na\n", [" ", "a"]) write("\n", [" "]) - write("\n\n", [" ", " "]) + if not chatty_issue: + write("\n\n", [" ", " "]) write("b\n", ["b"]) write("c\n\n", ["c", " "]) write("d\ne", ["d", "e"])

1 0

Python 3.12.15
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/e848e4b09ca4bc67c0041c9ce7526dae47… commit: e848e4b09ca4bc67c0041c9ce7526dae471d4c36 branch: 3.12 author: Thomas Wouters <thomas(a)python.org> committer: Yhg1s <thomas(a)python.org> date: 2026-10-01T00:04:19+02:00 summary: Python 3.12.15 files: A Misc/NEWS.d/3.12.15.rst D Misc/NEWS.d/next/Build/2026-08-13-12-57-27.gh-issue-155757._5cg0h.rst D Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst D Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst D Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst D Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst D Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst D Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst D Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst D Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst D Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst D Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst D Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst D Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst D Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst M Doc/library/asyncio-eventloop.rst M Doc/library/asyncio-stream.rst M Doc/library/ssl.rst M Doc/library/tarfile.rst M Doc/library/urllib.request.rst M Include/patchlevel.h M Lib/pydoc_data/topics.py M README.rst diff --git a/Doc/library/asyncio-eventloop.rst b/Doc/library/asyncio-eventloop.rst index a84583bc9d83958..caa137403e4bc80 100644 --- a/Doc/library/asyncio-eventloop.rst +++ b/Doc/library/asyncio-eventloop.rst @@ -544,7 +544,7 @@ Opening network connections .. versionchanged:: 3.12 *all_errors* was added. - .. versionchanged:: next + .. versionchanged:: 3.12.15 Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. In Python 3.13 and later a ``ValueError`` is raised instead. diff --git a/Doc/library/asyncio-stream.rst b/Doc/library/asyncio-stream.rst index f826c0511ff7852..31b3951af3f1fa7 100644 --- a/Doc/library/asyncio-stream.rst +++ b/Doc/library/asyncio-stream.rst @@ -382,7 +382,7 @@ StreamWriter .. versionchanged:: 3.12 Added the *ssl_shutdown_timeout* parameter. - .. versionchanged:: next + .. versionchanged:: 3.12.15 Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. In Python 3.13 and later a ``ValueError`` is raised instead. diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 88c8da42096ddbc..0dcbd5e3cdd9e8b 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -1695,7 +1695,7 @@ to speed up repeated connections from the same clients. .. versionadded:: 3.7 - .. versionchanged:: next + .. versionchanged:: 3.12.15 After the callback assigns a new :attr:`SSLSocket.context`, later ClientHello messages on the connection are dispatched to the new context's *sni_callback*. @@ -1833,7 +1833,7 @@ to speed up repeated connections from the same clients. The method returns an instance of :attr:`SSLContext.sslobject_class` instead of hard-coded :class:`SSLObject`. - .. versionchanged:: next + .. versionchanged:: 3.12.15 The *server_side*, *server_hostname* and *session* parameters are now validated as :meth:`SSLContext.wrap_socket` validates them. Previously a context with :attr:`~SSLContext.check_hostname` enabled and no diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index 4535d2d415be811..13cefa46c5dc4cd 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -1047,7 +1047,7 @@ reused in custom filters: Return the modified ``TarInfo`` member. - .. versionchanged:: next + .. versionchanged:: 3.12.15 Filenames containing ``..`` components are now normalized. diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst index 1d119b3447357ea..09a8c0edc5ef7b5 100644 --- a/Doc/library/urllib.request.rst +++ b/Doc/library/urllib.request.rst @@ -956,7 +956,7 @@ These methods are available on :class:`HTTPPasswordMgr` and match authentication URIs with the same scheme or no scheme. A URI without a scheme matches authentication URIs with any scheme. - .. versionchanged:: next + .. versionchanged:: 3.12.15 Authentication credentials for URIs with a scheme are now scoped by that scheme. diff --git a/Include/patchlevel.h b/Include/patchlevel.h index 63f5c603598b561..67ea722817f345a 100644 --- a/Include/patchlevel.h +++ b/Include/patchlevel.h @@ -18,12 +18,12 @@ /*--start constants--*/ #define PY_MAJOR_VERSION 3 #define PY_MINOR_VERSION 12 -#define PY_MICRO_VERSION 14 +#define PY_MICRO_VERSION 15 #define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL #define PY_RELEASE_SERIAL 0 /* Version as a string */ -#define PY_VERSION "3.12.14+" +#define PY_VERSION "3.12.15" /*--end constants--*/ /* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2. diff --git a/Lib/pydoc_data/topics.py b/Lib/pydoc_data/topics.py index 69e4d51008109b6..099408f7bfd2b6d 100644 --- a/Lib/pydoc_data/topics.py +++ b/Lib/pydoc_data/topics.py @@ -1,4 +1,4 @@ -# Autogenerated by Sphinx on Wed Aug 12 15:57:50 2026 +# Autogenerated by Sphinx on Thu Oct 1 00:04:15 2026 # as part of the release process. topics = { diff --git a/Misc/NEWS.d/3.12.15.rst b/Misc/NEWS.d/3.12.15.rst new file mode 100644 index 000000000000000..af49e1020d02470 --- /dev/null +++ b/Misc/NEWS.d/3.12.15.rst @@ -0,0 +1,170 @@ +.. date: 2026-09-29-16-32-46 +.. gh-issue: 158446 +.. nonce: dToaPr +.. release date: 2026-10-01 +.. section: Security + +Fix a crash or incorrect output that could occur when formatting a +:class:`float` or :class:`complex` with a precision close to the platform's +``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` +for any precision of that magnitude, regardless of presentation type or +value, as the format string parsers already did for precisions above +``INT_MAX``. + +.. + +.. date: 2026-09-23-11-34-30 +.. gh-issue: 156793 +.. nonce: zC_AjF +.. section: Security + +:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and +:meth:`loop.create_connection() <asyncio.loop.create_connection>` now +validate the *server_hostname* argument if an :class:`ssl.SSLContext` is +passed with *check_hostname* set to ``True``, emitting +:exc:`DeprecationWarning` if *server_hostname* is missing. (This will raise +:exc:`ValueError` in Python 3.13 and later.) + +.. + +.. date: 2026-09-16-14-05-19 +.. gh-issue: 156793 +.. nonce: Qa1T5Z +.. section: Security + +:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, +*server_hostname* and *session* arguments similar to +:meth:`ssl.SSLContext.wrap_socket`, but for backward compatiblity reasons +emits :exc:`DeprecationWarning` instead of :exc:`ValueError`. + +In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled +and no *server_hostname* passed to :meth:`!wrap_bio` now emits +:exc:`DeprecationWarning` to indicate the hostname wasn't checked. (In +Python 3.13 and later, this raises :exc:`ValueError`.) + +.. + +.. date: 2026-09-10-13-38-11 +.. gh-issue: 157265 +.. nonce: -vYuMp +.. section: Security + +In :mod:`tarfile`, when extracting a link falls back to extracting a member +of the archive, skip the member when the filter function returns None when +called with the extracted member's name replaced with the link's. + +.. + +.. date: 2026-09-06-11-02-46 +.. gh-issue: 157190 +.. nonce: tarhln +.. section: Security + +Fixed a vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction +filters where a crafted archive using a hard link to a symbolic link could +change the permissions and modification time of a file outside the +destination directory, and expose its contents inside the extracted tree. +This addresses :cve:`2026-82049`. + +.. + +.. date: 2026-08-31-16-47-33 +.. gh-issue: 157953 +.. nonce: KxCF5N +.. section: Security + +Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.5. + +.. + +.. date: 2026-08-18-13-54-05 +.. gh-issue: 156002 +.. nonce: CcWXPP +.. section: Security + +Bound the amount of data :mod:`zipfile` decompresses per read for members +compressed with bzip2, LZMA, or Zstandard, matching the existing limit for +deflate. A small archive member could previously expand into an unbounded +allocation even when read in small chunks. + +.. + +.. date: 2026-08-13-13-08-11 +.. gh-issue: 155999 +.. nonce: Xt4rWq +.. section: Security + +Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating +directories outside the destination for members whose name leaves the +destination and returns to it, such as ``../evil/../dest/sub/file``. The +containment check used the resolved path, but intermediate directories were +created from the name as given. + +.. + +.. date: 2026-08-10-12-00-00 +.. gh-issue: 156293 +.. nonce: sNIcbk +.. section: Security + +Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` +switches a connection to another :class:`~ssl.SSLContext` and the context +that carries the callback is no longer referenced by the application. +Servers that keep their ``sni_callback`` context alive (the usual case when +it wraps the listening socket or is stored on the server object) were not +affected. This addresses :cve:`2026-19445`. + +.. + +.. date: 2026-08-06-11-43-20 +.. gh-issue: 155292 +.. nonce: j4pHBO +.. section: Security + +Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not +consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. + +.. + +.. date: 2026-07-31-16-20-17 +.. gh-issue: 155694 +.. nonce: SsxlKG +.. section: Security + +Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr` +credentials to the URL scheme, preventing credentials stored for an HTTPS +URL from being used for a matching HTTP URL, while URIs without a scheme +continue to match any scheme. + +.. + +.. date: 2026-09-08-13-06-29 +.. gh-issue: 156002 +.. nonce: vmOC8T +.. section: Library + +:mod:`zipfile` again reads members through a third-party decompressor +installed by monkey-patching the private ``_get_decompressor()`` to return +an object that only implements old BZ2Decompressor API from Python 3.3. Note +that decompressors without ``needs_input`` and two-argument ``decompress()`` +are vulnerable to :cve:`2026-15310`. + +.. + +.. date: 2026-08-26-02-30-00 +.. gh-issue: 156353 +.. nonce: abcdef +.. section: Library + +Fix :mod:`configparser` parsing when using whitespace in *delimiters*. + +.. + +.. date: 2026-08-13-12-57-27 +.. gh-issue: 155757 +.. nonce: _5cg0h +.. section: Build + +Set the ``--argv0`` argument to wasmtime for WASI builds so the test suite +passes. Otherwise the calculated paths to the stdlib for frozen modules is +incorrect. diff --git a/Misc/NEWS.d/next/Build/2026-08-13-12-57-27.gh-issue-155757._5cg0h.rst b/Misc/NEWS.d/next/Build/2026-08-13-12-57-27.gh-issue-155757._5cg0h.rst deleted file mode 100644 index 5113bc93d937015..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-13-12-57-27.gh-issue-155757._5cg0h.rst +++ /dev/null @@ -1,3 +0,0 @@ -Set the ``--argv0`` argument to wasmtime for WASI builds so the test suite -passes. Otherwise the calculated paths to the stdlib for frozen modules is -incorrect. diff --git a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst b/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst deleted file mode 100644 index 0dd925cf596277a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst +++ /dev/null @@ -1 +0,0 @@ -Fix :mod:`configparser` parsing when using whitespace in *delimiters*. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst b/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst deleted file mode 100644 index a21386803cca0f4..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`zipfile` again reads members through a third-party decompressor -installed by monkey-patching the private ``_get_decompressor()`` to return an -object that only implements old BZ2Decompressor API from Python 3.3. -Note that decompressors without ``needs_input`` and two-argument -``decompress()`` are vulnerable to :cve:`2026-15310`. diff --git a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst b/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst deleted file mode 100644 index dbc2119640702c9..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr` -credentials to the URL scheme, preventing credentials stored for an HTTPS -URL from being used for a matching HTTP URL, while URIs without a scheme -continue to match any scheme. diff --git a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst b/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst deleted file mode 100644 index 7a81a8ba1eef1cd..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst +++ /dev/null @@ -1,2 +0,0 @@ -Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not -consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. diff --git a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst b/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst deleted file mode 100644 index 0cc620b3fdca205..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst +++ /dev/null @@ -1,7 +0,0 @@ -Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` -switches a connection to another :class:`~ssl.SSLContext` and the context -that carries the callback is no longer referenced by the application. -Servers that keep their ``sni_callback`` context alive (the usual case when -it wraps the listening socket or is stored on the server object) were not -affected. -This addresses :cve:`2026-19445`. diff --git a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst deleted file mode 100644 index 59b725e55bbffda..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating -directories outside the destination for members whose name leaves the -destination and returns to it, such as ``../evil/../dest/sub/file``. The -containment check used the resolved path, but intermediate directories were -created from the name as given. diff --git a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst b/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst deleted file mode 100644 index 4e49ad5ce8fa00a..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst +++ /dev/null @@ -1,4 +0,0 @@ -Bound the amount of data :mod:`zipfile` decompresses per read for members -compressed with bzip2, LZMA, or Zstandard, matching the existing limit for -deflate. A small archive member could previously expand into an unbounded -allocation even when read in small chunks. diff --git a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst b/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst deleted file mode 100644 index 5b3ea77cb368632..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst +++ /dev/null @@ -1 +0,0 @@ -Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.5. diff --git a/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst b/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst deleted file mode 100644 index 3dffa3bf5b5a5a8..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fixed a vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction -filters where a crafted archive using a hard link to a symbolic link could -change the permissions and modification time of a file outside the -destination directory, and expose its contents inside the extracted tree. -This addresses :cve:`2026-82049`. diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst deleted file mode 100644 index ba27e47f734bfb1..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst +++ /dev/null @@ -1,3 +0,0 @@ -In :mod:`tarfile`, when extracting a link falls back to extracting a member -of the archive, skip the member when the filter function returns None when -called with the extracted member's name replaced with the link's. diff --git a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst b/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst deleted file mode 100644 index ce43a563f3a1df0..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst +++ /dev/null @@ -1,9 +0,0 @@ -:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, -*server_hostname* and *session* arguments similar to -:meth:`ssl.SSLContext.wrap_socket`, but for backward compatiblity reasons -emits :exc:`DeprecationWarning` instead of :exc:`ValueError`. - -In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled -and no *server_hostname* passed to :meth:`!wrap_bio` now emits -:exc:`DeprecationWarning` to indicate the hostname wasn't checked. -(In Python 3.13 and later, this raises :exc:`ValueError`.) diff --git a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst b/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst deleted file mode 100644 index 9afd6e9c454aaff..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst +++ /dev/null @@ -1,6 +0,0 @@ -:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and -:meth:`loop.create_connection() <asyncio.loop.create_connection>` now -validate the *server_hostname* argument if an :class:`ssl.SSLContext` is -passed with *check_hostname* set to ``True``, emitting -:exc:`DeprecationWarning` if *server_hostname* is missing. (This will raise -:exc:`ValueError` in Python 3.13 and later.) diff --git a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst b/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst deleted file mode 100644 index f17a3f68b93e855..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix a crash or incorrect output that could occur when formatting a -:class:`float` or :class:`complex` with a precision close to the platform's -``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` for -any precision of that magnitude, regardless of presentation type or value, as -the format string parsers already did for precisions above ``INT_MAX``. diff --git a/README.rst b/README.rst index 576d825d4e00da0..380206921c9f6de 100644 --- a/README.rst +++ b/README.rst @@ -1,5 +1,5 @@ -This is Python version 3.12.14+ -=============================== +This is Python version 3.12.15 +============================== .. image:: https://github.com/python/cpython/workflows/Tests/badge.svg :alt: CPython build status on GitHub Actions

1 0

Python 3.13.16
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/cbc944f4bc59639a444dd971c737788ba2… commit: cbc944f4bc59639a444dd971c737788ba2283a91 branch: 3.13 author: Thomas Wouters <thomas(a)python.org> committer: Yhg1s <thomas(a)python.org> date: 2026-09-30T20:57:20+02:00 summary: Python 3.13.16 files: A Misc/NEWS.d/3.13.16.rst D Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst D Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst D Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst D Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst D Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst D Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst D Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst D Misc/NEWS.d/next/Core_and_Builtins/2025-02-14-00-32-52.gh-issue-130094.m3EF9E.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-07-30-14-40-00.gh-issue-154711.nUxYXc.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-16-00-00.gh-issue-156189.Zt4nQp.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-18-00-00.gh-issue-156196.Mv7kBq.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-05-16-24-52.gh-issue-154175.YJon4M.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst D Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst D Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst D Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst D Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst D Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst D Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst D Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst D Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst D Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst D Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst D Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst D Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst D Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst D Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst D Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst D Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst D Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst D Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst D Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst D Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst D Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst D Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst D Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst D Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst D Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst D Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst D Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst D Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst D Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst D Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst D Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst D Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst D Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst D Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst D Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst D Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst D Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst D Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst D Misc/NEWS.d/next/Library/2026-03-16-00-00-00.gh-issue-146004.xOptProp.rst D Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst D Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst D Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst D Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst D Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst D Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst D Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst D Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst D Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst D Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst D Misc/NEWS.d/next/Library/2026-07-22-19-21-20.gh-issue-82535.METFqd.rst D Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst D Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst D Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst D Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst D Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst D Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst D Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst D Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst D Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst D Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst D Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst D Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst D Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst D Misc/NEWS.d/next/Library/2026-08-15-13-12-09.gh-issue-155835.DsbSmy.rst D Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst D Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst D Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst D Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst D Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst D Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst D Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst D Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst D Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst D Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst D Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst D Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst D Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst D Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-156698.gyDxUe.rst D Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst D Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst D Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst D Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst D Misc/NEWS.d/next/Library/2026-09-04-09-18-05.gh-issue-156920.lONsKT.rst D Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst D Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst D Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst D Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst D Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst D Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst D Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst D Misc/NEWS.d/next/Library/2026-09-11-14-14-51.gh-issue-157301.QxcE2r.rst D Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst D Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst D Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst D Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst D Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst D Misc/NEWS.d/next/Library/2026-09-16-14-04-38.gh-issue-157621.R6v2S8.rst D Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst D Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst D Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst D Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst D Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst D Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst D Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst D Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst D Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst D Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst D Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst D Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst D Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst D Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst D Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst D Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst D Misc/NEWS.d/next/Tests/2026-08-18-10-16-44.gh-issue-75876.PEZplM.rst D Misc/NEWS.d/next/Tests/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst D Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst D Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst D Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst D Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst D Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst D Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst D Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst M Doc/library/asyncio-eventloop.rst M Doc/library/asyncio-stream.rst M Doc/library/ssl.rst M Doc/library/tarfile.rst M Doc/library/urllib.request.rst M Include/patchlevel.h M Lib/pydoc_data/module_docs.py M Lib/pydoc_data/topics.py M README.rst diff --git a/Doc/library/asyncio-eventloop.rst b/Doc/library/asyncio-eventloop.rst index a533411ec63182d..478a12d2975e14a 100644 --- a/Doc/library/asyncio-eventloop.rst +++ b/Doc/library/asyncio-eventloop.rst @@ -576,7 +576,7 @@ Opening network connections .. versionchanged:: 3.12 *all_errors* was added. - .. versionchanged:: next + .. versionchanged:: 3.13.16 Raises a ``ValueError`` if ``ssl.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. diff --git a/Doc/library/asyncio-stream.rst b/Doc/library/asyncio-stream.rst index 8472bb6e02e1b1a..d39b52934a23706 100644 --- a/Doc/library/asyncio-stream.rst +++ b/Doc/library/asyncio-stream.rst @@ -418,7 +418,7 @@ StreamWriter .. versionchanged:: 3.12 Added the *ssl_shutdown_timeout* parameter. - .. versionchanged:: next + .. versionchanged:: 3.13.16 Raises a ``ValueError`` if ``sslcontext.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 5b5cd7493be91ba..be0d2127c58277a 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -1744,7 +1744,7 @@ to speed up repeated connections from the same clients. .. versionadded:: 3.7 - .. versionchanged:: next + .. versionchanged:: 3.13.16 After the callback assigns a new :attr:`SSLSocket.context`, later ClientHello messages on the connection are dispatched to the new context's *sni_callback*. @@ -1883,7 +1883,7 @@ to speed up repeated connections from the same clients. The method returns an instance of :attr:`SSLContext.sslobject_class` instead of hard-coded :class:`SSLObject`. - .. versionchanged:: next + .. versionchanged:: 3.13.16 The *server_side*, *server_hostname* and *session* parameters are now validated as :meth:`SSLContext.wrap_socket` validates them. Previously a context with :attr:`~SSLContext.check_hostname` enabled and no diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index d5c5328210cd7e4..d2152be86de1c91 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -1061,7 +1061,7 @@ reused in custom filters: Return the modified ``TarInfo`` member. - .. versionchanged:: next + .. versionchanged:: 3.13.16 Filenames containing ``..`` components are now normalized. diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst index bd8bbdd82baa38d..83d34872a4582f6 100644 --- a/Doc/library/urllib.request.rst +++ b/Doc/library/urllib.request.rst @@ -948,7 +948,7 @@ These methods are available on :class:`HTTPPasswordMgr` and match authentication URIs with the same scheme or no scheme. A URI without a scheme matches authentication URIs with any scheme. - .. versionchanged:: next + .. versionchanged:: 3.13.16 Authentication credentials for URIs with a scheme are now scoped by that scheme. diff --git a/Include/patchlevel.h b/Include/patchlevel.h index cbc872b15299ef7..a83be1da96b3de6 100644 --- a/Include/patchlevel.h +++ b/Include/patchlevel.h @@ -18,12 +18,12 @@ /*--start constants--*/ #define PY_MAJOR_VERSION 3 #define PY_MINOR_VERSION 13 -#define PY_MICRO_VERSION 15 +#define PY_MICRO_VERSION 16 #define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL #define PY_RELEASE_SERIAL 0 /* Version as a string */ -#define PY_VERSION "3.13.15+" +#define PY_VERSION "3.13.16" /*--end constants--*/ /* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2. diff --git a/Lib/pydoc_data/module_docs.py b/Lib/pydoc_data/module_docs.py index 0cfb85d3298d42d..dc3ea58cbb4668e 100644 --- a/Lib/pydoc_data/module_docs.py +++ b/Lib/pydoc_data/module_docs.py @@ -1,4 +1,4 @@ -# Autogenerated by Sphinx on Wed Aug 5 14:25:38 2026 +# Autogenerated by Sphinx on Wed Sep 30 20:57:15 2026 # as part of the release process. module_docs = { diff --git a/Lib/pydoc_data/topics.py b/Lib/pydoc_data/topics.py index c23420979bd8c06..8e3aab93b45443b 100644 --- a/Lib/pydoc_data/topics.py +++ b/Lib/pydoc_data/topics.py @@ -1,4 +1,4 @@ -# Autogenerated by Sphinx on Wed Aug 5 14:25:38 2026 +# Autogenerated by Sphinx on Wed Sep 30 20:57:15 2026 # as part of the release process. topics = { @@ -2726,7 +2726,7 @@ class attributes; they are shared by instances. Instance attributes | parameter_list_no_posonly parameter_list_no_posonly ::= defparameter ("," defparameter)* ["," [parameter_list_starargs]] | parameter_list_starargs - parameter_list_starargs ::= "*" [star_parameter] ("," defparameter)* ["," [parameter_star_kwargs]] + parameter_list_starargs ::= "*" star_parameter ("," defparameter)* ["," [parameter_star_kwargs]] | "*" ("," defparameter)+ ["," [parameter_star_kwargs]] | parameter_star_kwargs parameter_star_kwargs ::= "**" parameter [","] @@ -4447,7 +4447,7 @@ def middle(): def inner(x): 1 / x - out() + out() calling "pdb.pm()" will allow to move between exceptions: @@ -5809,7 +5809,7 @@ class of the instance or a *non-virtual base class* thereof. The | parameter_list_no_posonly parameter_list_no_posonly ::= defparameter ("," defparameter)* ["," [parameter_list_starargs]] | parameter_list_starargs - parameter_list_starargs ::= "*" [star_parameter] ("," defparameter)* ["," [parameter_star_kwargs]] + parameter_list_starargs ::= "*" star_parameter ("," defparameter)* ["," [parameter_star_kwargs]] | "*" ("," defparameter)+ ["," [parameter_star_kwargs]] | parameter_star_kwargs parameter_star_kwargs ::= "**" parameter [","] @@ -10067,7 +10067,7 @@ class is used in a class pattern with positional arguments, each characters are those characters defined in the Unicode character database as “Letter”, i.e., those with general category property being one of “Lm”, “Lt”, “Lu”, “Ll”, or “Lo”. Note that this is - different from the Alphabetic property defined in the section 4.10 + different from the Alphabetic property defined in section 4.10 ‘Letters, Alphabetic, and Ideographic’ of the Unicode Standard. For example: @@ -10475,9 +10475,9 @@ class is used in a class pattern with positional arguments, each Return a list of the words in the string, using *sep* as the delimiter string. If *maxsplit* is given, at most *maxsplit* splits are done, the *rightmost* ones. If *sep* is not specified or - "None", any whitespace string is a separator. Except for splitting - from the right, "rsplit()" behaves like "split()" which is - described in detail below. + "None", any "whitespace" string is a separator. Except for + splitting from the right, "rsplit()" behaves like "split()" which + is described in detail below. str.rstrip(chars=None, /) @@ -10529,7 +10529,7 @@ class is used in a class pattern with positional arguments, each ['1', '2', '3<4'] If *sep* is not specified or is "None", a different splitting - algorithm is applied: runs of consecutive whitespace are regarded + algorithm is applied: runs of consecutive "whitespace" are regarded as a single separator, and the result will contain no empty strings at the start or end if the string has leading or trailing whitespace. Consequently, splitting an empty string or a string @@ -11708,12 +11708,12 @@ class is used in a class pattern with positional arguments, each Generator functions ------------------- -A function or method which uses the "yield" statement (see section The -yield statement) is called a *generator function*. Such a function, +A function or method which contains a "yield" expression (see section +Yield expressions) is called a *generator function*. Such a function, when called, always returns an *iterator* object which can be used to execute the body of the function: calling the iterator’s "iterator.__next__()" method will cause the function to execute until -it provides a value using the "yield" statement. When the function +it provides a value using the "yield" expression. When the function executes a "return" statement or falls off the end, a "StopIteration" exception is raised and the iterator will have reached the end of the set of values to be returned. @@ -11732,11 +11732,11 @@ class is used in a class pattern with positional arguments, each Asynchronous generator functions -------------------------------- -A function or method which is defined using "async def" and which uses -the "yield" statement is called a *asynchronous generator function*. -Such a function, when called, returns an *asynchronous iterator* -object which can be used in an "async for" statement to execute the -body of the function. +A function or method which is defined using "async def" and which +contains a "yield" expression is called a *asynchronous generator +function*. Such a function, when called, returns an *asynchronous +iterator* object which can be used in an "async for" statement to +execute the body of the function. Calling the asynchronous iterator’s "aiterator.__anext__" method will return an *awaitable* which when awaited will execute until it @@ -13002,7 +13002,7 @@ class dict(iterable, /, **kwargs) Methods are functions that are called using the attribute notation. There are two flavors: built-in methods (such as "append()" on lists) -and class instance method. Built-in methods are described with the +and class instance methods. Built-in methods are described with the types that support them. If you access a method (a function defined in a class namespace) @@ -13351,8 +13351,8 @@ class dict(iterable, /, **kwargs) sequence.pop(index=-1, /) - Retrieve the item at *index* and also removes it from *sequence*. - By default, the last item in *sequence* is removed and returned. + Retrieve the item at *index* and also remove it from *sequence*. By + default, the last item in *sequence* is removed and returned. sequence.remove(value, /) @@ -13705,8 +13705,8 @@ class range(start, stop, step=1, /) sequence.pop(index=-1, /) - Retrieve the item at *index* and also removes it from *sequence*. - By default, the last item in *sequence* is removed and returned. + Retrieve the item at *index* and also remove it from *sequence*. By + default, the last item in *sequence* is removed and returned. sequence.remove(value, /) diff --git a/Misc/NEWS.d/3.13.16.rst b/Misc/NEWS.d/3.13.16.rst new file mode 100644 index 000000000000000..64bacb6dceebafa --- /dev/null +++ b/Misc/NEWS.d/3.13.16.rst @@ -0,0 +1,1619 @@ +.. date: 2026-09-23-12-08-52 +.. gh-issue: 158010 +.. nonce: Q8fLPe +.. release date: 2026-09-30 +.. section: macOS + +Updated macOS installer to use OpenSSL 3.5.9, jumping from the 3.0 series to +3.5 after 3.0's end of public support in September 2026. + +.. + +.. date: 2026-09-23-12-05-40 +.. gh-issue: 158010 +.. nonce: MPcRL5 +.. section: Windows + +Updated Windows builds to use OpenSSL 3.5.9, jumping from the 3.0 series to +3.5 after 3.0's end of public support in September 2026. + +.. + +.. date: 2026-08-09-14-20-00 +.. gh-issue: 72353 +.. nonce: Vw7Kq2 +.. section: Windows + +Reading from the console on Windows now continues if the read was cancelled +by Ctrl+C, but the :const:`~signal.SIGINT` handler did not raise an +exception. Previously the read ended as if at end of file. + +.. + +.. date: 2026-08-09-07-00-00 +.. gh-issue: 86427 +.. nonce: consolecp +.. section: Windows + +Fix the encoding of the standard streams in the legacy Windows stdio mode +(:envvar:`PYTHONLEGACYWINDOWSSTDIO`). It is now the code page of the +console, as in Python 3.7, not the ANSI code page. + +.. + +.. date: 2026-08-09-04-00-00 +.. gh-issue: 87587 +.. nonce: devenc +.. section: Windows + +:func:`os.device_encoding` on Windows now returns the code page of any +console file descriptor, not only 0, 1 and 2, and returns ``None`` for other +character devices like ``NUL``. The UTF-8 code page is now reported as +``"utf-8"`` instead of ``"cp65001"``. + +.. + +.. date: 2026-08-14-12-45-57 +.. gh-issue: 113318 +.. nonce: G1B0oH +.. section: Tools/Demos + +Fix Argument Clinic for ``@getter`` and ``@setter`` in a preprocessor +conditional block. It failed with an internal error. Argument Clinic now +also rejects the accessors of the same attribute with different C basenames, +and the same accessor defined twice, which silently generated invalid or +duplicated entries of :c:type:`PyGetSetDef`. + +.. + +.. date: 2026-09-24-10-40-28 +.. gh-issue: 158051 +.. nonce: B1ZBTA +.. section: Tests + +The iOS testbed has been updated for compatibilty with Xcode 27. + +.. + +.. date: 2026-08-18-13-41-00 +.. gh-issue: 155997 +.. nonce: CjbD1F +.. section: Tests + +Fix :func:`!test.support.interpreters.list_all`. It failed if an +interpreter was destroyed during the call, in particular by a garbage +collection which finalized the object owning the last reference to it. + +.. + +.. date: 2026-08-18-10-16-44 +.. gh-issue: 75876 +.. nonce: PEZplM +.. section: Tests + +A test decorated with :func:`~test.support.bigmemtest` now runs in a +subprocess if it really allocates the memory it asks for (that is, if the +``-M`` option is used), so that the memory it uses and the address space it +fragments are released when it ends. A dummy run stays in the process. The +separate memory watchdog process is no longer used. + +.. + +.. date: 2026-08-09-14-00-00 +.. gh-issue: 155411 +.. nonce: Qw8Lm2 +.. section: Tests + +Fix :func:`!test.support.subTests` for asynchronous test methods. They were +wrapped in a synchronous function, which discarded the coroutine without +awaiting it, so the test silently did not run at all. + +.. + +.. date: 2026-08-06-18-20-00 +.. gh-issue: 132581 +.. nonce: envchg +.. section: Tests + +The list of tests which altered the execution environment now includes the +reasons why the environment was considered altered, for example an +unraisable exception or a modified :data:`sys.path`. The final result no +longer repeats the same state twice (like ``ENV CHANGED then ENV CHANGED``). + +.. + +.. date: 2026-09-29-16-32-46 +.. gh-issue: 158446 +.. nonce: dToaPr +.. section: Security + +Fix a crash or incorrect output that could occur when formatting a +:class:`float` or :class:`complex` with a precision close to the platform's +``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` +for any precision of that magnitude, regardless of presentation type or +value, as the format string parsers already did for precisions above +``INT_MAX``. + +.. + +.. date: 2026-09-23-11-34-30 +.. gh-issue: 156793 +.. nonce: zC_AjF +.. section: Security + +:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and +:meth:`loop.create_connection() <asyncio.loop.create_connection>` now +validate the *server_hostname* argument if an :class:`ssl.SSLContext` is +passed with *check_hostname* set to ``True``. + +.. + +.. date: 2026-09-16-14-05-19 +.. gh-issue: 156793 +.. nonce: Qa1T5Z +.. section: Security + +:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, +*server_hostname* and *session* arguments similar to +:meth:`ssl.SSLContext.wrap_socket`. + +In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled +and no *server_hostname* passed to :meth:`!wrap_bio` now raises +:exc:`ValueError` instead of completing a handshake that verified the +certificate chain without verifying the peer's identity, with no indication +that the check had been skipped. + +.. + +.. date: 2026-09-10-13-38-11 +.. gh-issue: 157265 +.. nonce: -vYuMp +.. section: Security + +In :mod:`tarfile`, when extracting a link falls back to extracting a member +of the archive, skip the member when the filter function returns None when +called with the extracted member's name replaced with the link's. + +.. + +.. date: 2026-09-06-11-02-46 +.. gh-issue: 157190 +.. nonce: tarhln +.. section: Security + +Fixed a vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction +filters where a crafted archive using a hard link to a symbolic link could +change the permissions and modification time of a file outside the +destination directory, and expose its contents inside the extracted tree. +This addresses :cve:`2026-82049`. + +.. + +.. date: 2026-08-31-16-47-33 +.. gh-issue: 157953 +.. nonce: KxCF5N +.. section: Security + +Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.5. + +.. + +.. date: 2026-08-18-13-54-05 +.. gh-issue: 156002 +.. nonce: CcWXPP +.. section: Security + +Bound the amount of data :mod:`zipfile` decompresses per read for members +compressed with bzip2, LZMA, or Zstandard, matching the existing limit for +deflate. A small archive member could previously expand into an unbounded +allocation even when read in small chunks. + +.. + +.. date: 2026-08-13-13-08-11 +.. gh-issue: 155999 +.. nonce: Xt4rWq +.. section: Security + +Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating +directories outside the destination for members whose name leaves the +destination and returns to it, such as ``../evil/../dest/sub/file``. The +containment check used the resolved path, but intermediate directories were +created from the name as given. + +.. + +.. date: 2026-08-10-12-00-00 +.. gh-issue: 156293 +.. nonce: sNIcbk +.. section: Security + +Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` +switches a connection to another :class:`~ssl.SSLContext` and the context +that carries the callback is no longer referenced by the application. +Servers that keep their ``sni_callback`` context alive (the usual case when +it wraps the listening socket or is stored on the server object) were not +affected. This addresses :cve:`2026-19445`. + +.. + +.. date: 2026-08-06-11-43-20 +.. gh-issue: 155292 +.. nonce: j4pHBO +.. section: Security + +Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not +consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. + +.. + +.. date: 2026-07-31-16-20-17 +.. gh-issue: 155694 +.. nonce: SsxlKG +.. section: Security + +Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr` +credentials to the URL scheme, preventing credentials stored for an HTTPS +URL from being used for a matching HTTP URL, while URIs without a scheme +continue to match any scheme. + +.. + +.. date: 2026-09-25-22-15-54 +.. gh-issue: 158169 +.. nonce: ZlibTail +.. section: Library + +Fix :attr:`zlib.Decompress.unconsumed_tail` duplicating +:attr:`~zlib.Decompress.unused_data` after end of stream when *max_length* +was used. + +.. + +.. date: 2026-09-17-14-00-00 +.. gh-issue: 157672 +.. nonce: tksigs +.. section: Library + +Fix :mod:`tkinter` on macOS: creating a :class:`~tkinter.Tk` instance no +longer replaces the Python handlers of SIGINT, SIGHUP and SIGTERM with Tk's +handler which exits the process, so Ctrl-C raises :exc:`KeyboardInterrupt` +again. + +.. + +.. date: 2026-09-17-03-20-24 +.. gh-issue: 157639 +.. nonce: VP3kc4 +.. section: Library + +Fix a crash in :mod:`!cProfile` when an external timer re-enters the +profiler. Profiling events raised while the external timer runs are now +ignored. + +.. + +.. date: 2026-09-16-14-04-38 +.. gh-issue: 157621 +.. nonce: R6v2S8 +.. section: Library + +Fix a crash when a weak-reference callback is attached to a +:class:`typing.ParamSpecArgs` or :class:`typing.ParamSpecKwargs` instance. + +.. + +.. date: 2026-09-15-16-37-19 +.. gh-issue: 69919 +.. nonce: izH1zP +.. section: Library + +:meth:`code.InteractiveInterpreter.runsource` and the REPL now report any +exception raised by compiling the source, such as :exc:`MemoryError` or +:exc:`RecursionError` for too deeply nested source, instead of propagating +it or printing a traceback of the REPL internals. + +.. + +.. date: 2026-09-14-00-30-00 +.. gh-issue: 157451 +.. nonce: k7Qm2x +.. section: Library + +Fix :mod:`gettext` plural form selection when the ``Plural-Forms`` +expression combines the unary ``!`` operator with a binary operator, for +example ``!n + 1`` or ``2 * !n``. The latter raised :exc:`SyntaxError`. + +.. + +.. date: 2026-09-13-15-58-28 +.. gh-issue: 157335 +.. nonce: efaMah +.. section: Library + +Fix out-of-bounds write in ``mmap.mmap.__setitem__`` that could occur when +converting the index or the assigned value (via :meth:`~object.__index__` +for a single item, or via the buffer protocol for a slice) resized or closed +the mmap object during the assignment. + +.. + +.. date: 2026-09-13-10-30-00 +.. gh-issue: 157406 +.. nonce: a3kZq7 +.. section: Library + +Fix the Python implementation of :class:`xml.etree.ElementTree.XMLParser`: +the ``doctype()`` method of the target is now called for a document type +declaration without an external identifier, like ``<!DOCTYPE html>``, as in +the C implementation. + +.. + +.. date: 2026-09-11-16-50-11 +.. gh-issue: 157325 +.. nonce: hzTild +.. section: Library + +Fix an out-of-bounds read in the ``hz`` incremental decoder when the input +ends with ``~``. + +.. + +.. date: 2026-09-11-14-14-51 +.. gh-issue: 157301 +.. nonce: QxcE2r +.. section: Library + +Fix :class:`asyncio.Task` hanging the event loop when an eager start fails +to enter the task's context. + +.. + +.. date: 2026-09-08-13-06-29 +.. gh-issue: 156002 +.. nonce: vmOC8T +.. section: Library + +:mod:`zipfile` again reads members through a third-party decompressor +installed by monkey-patching the private ``_get_decompressor()`` to return +an object that only implements old BZ2Decompressor API from Python 3.3. Note +that decompressors without ``needs_input`` and two-argument ``decompress()`` +are vulnerable to :cve:`2026-15310`. + +.. + +.. date: 2026-09-08-09-30-00 +.. gh-issue: 157159 +.. nonce: tabNny +.. section: Library + +The usage message printed by ``python -m tabnanny`` when no arguments are +given now suggests ``python -m`` instead of the source file. + +.. + +.. date: 2026-09-07-00-21-31 +.. gh-issue: 156933 +.. nonce: OalCjC +.. section: Library + +Fix incorrect integer return values from :mod:`ctypes` callbacks on some +platforms, such as s390x. + +.. + +.. date: 2026-09-06-15-23-24 +.. gh-issue: 157048 +.. nonce: UtFyiJ +.. section: Library + +Preserve the position and contents of :class:`io.BytesIO` when +:meth:`!BytesIO.__init__` fails because a buffer is exported. + +.. + +.. date: 2026-09-05-22-39-22 +.. gh-issue: 156961 +.. nonce: ZtYqoA +.. section: Library + +Fix :func:`tkinter.font.nametofont` and the :class:`tkinter.font.Font` +constructor for a font name returned by Tk as a Tcl object, for example by +:meth:`ttk.Style.lookup() <tkinter.ttk.Style.lookup>`. + +.. + +.. date: 2026-09-05-15-27-11 +.. gh-issue: 156970 +.. nonce: DxlgbB +.. section: Library + +Set the docstring of :attr:`unittest.mock.Mock.return_value`. + +.. + +.. date: 2026-09-04-16-05-45 +.. gh-issue: 156946 +.. nonce: 0ZYCdh +.. section: Library + +Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user +pointer runs while the panel is being deallocated. The panel is now taken +off the panel stack before its user pointer is dropped. + +.. + +.. date: 2026-09-04-09-18-05 +.. gh-issue: 156920 +.. nonce: lONsKT +.. section: Library + +Fix :mod:`asyncio` on Windows: closing a :class:`~asyncio.DatagramTransport` +under :class:`~asyncio.ProactorEventLoop` while datagrams were still queued, +or while an in-flight write failed right as ``close()`` was draining the +buffer, could strand the queued data and never call ``connection_lost()``, +hanging the close indefinitely. + +.. + +.. date: 2026-09-01-16-58-30 +.. gh-issue: 156797 +.. nonce: Qm4tRs +.. section: Library + +Fix :class:`xml.sax.saxutils.XMLGenerator`: the namespace URI is now escaped +in the namespace declaration. Previously a URI containing ``&``, ``<`` or a +quote character produced a document which cannot be parsed. + +.. + +.. date: 2026-08-31-23-10-00 +.. gh-issue: 83895 +.. nonce: Jm5tR3 +.. section: Library + +:mod:`xml.etree.ElementTree` now accepts input larger than 2 GiB in the C +implementation. The data is fed to Expat in chunks, as +:mod:`xml.parsers.expat` already did, instead of raising +:exc:`OverflowError`. + +.. + +.. date: 2026-08-31-20-30-00 +.. gh-issue: 99064 +.. nonce: Rt4mZ9 +.. section: Library + +Fix :func:`xml.etree.ElementTree.parse` with a text file or other source of +:class:`str` data in the C implementation. The encoding declared in the +document was applied to the already decoded text, which produced mojibake. +It is now ignored, as when parsing with :meth:`!XMLParser.feed` or +:func:`~xml.etree.ElementTree.fromstring`. + +.. + +.. date: 2026-08-31-17-10-00 +.. gh-issue: 156713 +.. nonce: Nt2URL +.. section: Library + +Fix :func:`!nturl2path.pathname2url` and :func:`!nturl2path.url2pathname`: +the filesystem encoding and error handler are now used for percent-encoding +and decoding, as in :mod:`urllib.request`. Previously paths containing +surrogate characters raised :exc:`UnicodeEncodeError`. + +.. + +.. date: 2026-08-31-00-00-00 +.. gh-issue: 156698 +.. nonce: gyDxUe +.. section: Library + +Fix :class:`asyncio.ProactorEventLoop` UDP transports so that a write error +no longer strands a paused protocol: the write loop is now rescheduled when +data remains buffered, and the protocol is resumed when the buffer has +drained. + +.. + +.. date: 2026-08-31-00-00-00 +.. gh-issue: 127057 +.. nonce: N9yg62 +.. section: Library + +Fix :class:`asyncio.ProactorEventLoop` UDP transports so that a +:exc:`ConnectionResetError` raised by ``WSARecvFrom`` no longer stops the +read loop. + +.. + +.. date: 2026-08-30-19-30-00 +.. gh-issue: 156658 +.. nonce: Xq5Nt7 +.. section: Library + +:mod:`xml.dom` and :mod:`xml.etree.ElementTree` no longer treat characters +which are not white space in XML (such as U+00A0) as white space. Previously +they could be lost in :func:`~xml.etree.ElementTree.indent`, +:func:`~xml.etree.ElementTree.canonicalize` with ``strip_text=True``, and +when parsing with the ``whitespace-in-element-content`` feature turned off. + +.. + +.. date: 2026-08-28-00-59-00 +.. gh-issue: 156476 +.. nonce: rQhxc7 +.. section: Library + +The pure Python implementation of :meth:`queue.SimpleQueue.get` now ignores +*timeout* when *block* is false, matching the documented behavior and the C +implementation. It previously raised :exc:`ValueError`. + +.. + +.. date: 2026-08-27-08-31-29 +.. gh-issue: 156444 +.. nonce: klcySy +.. section: Library + +Fix matching of a negated character set in a bytes pattern compiled with +both :const:`re.IGNORECASE` and :const:`re.LOCALE`. The case closure is now +applied to the members of the set, so that ``[^bc]`` no longer matches +``b'B'``. + +.. + +.. date: 2026-08-26-02-30-00 +.. gh-issue: 156353 +.. nonce: abcdef +.. section: Library + +Fix :mod:`configparser` parsing when using whitespace in *delimiters*. + +.. + +.. date: 2026-08-21-13-30-00 +.. gh-issue: 156166 +.. nonce: Xv8pQm +.. section: Library + +:mod:`ssl`: A failed assignment or deletion of the ``_msg_callback`` +attribute of :class:`ssl.SSLContext` no longer removes the current callback. +Deleting it now raises :exc:`AttributeError` instead of :exc:`TypeError`. + +.. + +.. date: 2026-08-21-11-56-28 +.. gh-issue: 156173 +.. nonce: mhZa8a +.. section: Library + +Calling :meth:`zlib.Decompress.flush` on invalid compressed data now raises +:exc:`zlib.error` instead of being silently ignored. + +.. + +.. date: 2026-08-21-11-00-00 +.. gh-issue: 152817 +.. nonce: Rt6mNc +.. section: Library + +:mod:`sqlite3`: Disallow removing the ``row_factory`` attribute of a cursor +to prevent a crash on a query. + +.. + +.. date: 2026-08-20-13-50-49 +.. gh-issue: 156112 +.. nonce: yEcma8 +.. section: Library + +:mod:`!_ios_support` no longer fails to import when +:func:`ctypes.util.find_library` cannot resolve the ObjC runtime through the +dyld shared cache, as is the case on iOS 13. The runtime is now loaded by +name, which dyld resolves against the cache directly. + +.. + +.. date: 2026-08-20-12-05-00 +.. gh-issue: 156100 +.. nonce: Lm7qWz +.. section: Library + +Fix crashes in :class:`sqlite3.Connection` when deleting the +:attr:`~sqlite3.Connection.autocommit` attribute or setting it to an integer +which does not fit in C :c:expr:`long`. Both now raise an exception. + +.. + +.. date: 2026-08-20-12-00-00 +.. gh-issue: 156099 +.. nonce: Kp4vRt +.. section: Library + +Fix a crash when deleting the ``keylog_filename`` attribute of +:class:`ssl.SSLContext`. It now raises :exc:`AttributeError`. + +.. + +.. date: 2026-08-19-21-01-19 +.. gh-issue: 156067 +.. nonce: 1CXkqc +.. section: Library + +Fix error handling in the :mod:`zoneinfo` accelerator module when a +transition index is ``-1`` or a TZ string's ``__bool__`` raises. + +.. + +.. date: 2026-08-17-12-40-00 +.. gh-issue: 155952 +.. nonce: Vq3Lm8 +.. section: Library + +Fix the signatures of :meth:`sqlite3.Connection.execute`, +:func:`warnings.warn` and :func:`locale.setlocale` which rendered +``<unrepresentable>`` instead of the correct defaults for parameters. + +.. + +.. date: 2026-08-15-13-12-09 +.. gh-issue: 155835 +.. nonce: DsbSmy +.. section: Library + +:mod:`hashlib`: Fix data races when accessing +:attr:`~hashlib.hash.digest_size` and :attr:`~hashlib.hash.block_size` on +SHA-3 objects. Patch by Bénédikt Tran. + +.. + +.. date: 2026-08-14-14-10-00 +.. gh-issue: 155775 +.. nonce: Kq3vTx +.. section: Library + +Fix a regression in :mod:`imaplib` introduced in the fix for :gh:`63121`: +refreshing the capabilities after a successful :meth:`~imaplib.IMAP4.login` +or :meth:`~imaplib.IMAP4.authenticate` consumed the ``CAPABILITY`` response, +so it could no longer be read with :meth:`~imaplib.IMAP4.response`. + +.. + +.. date: 2026-08-14-12-46-07 +.. gh-issue: 113318 +.. nonce: DYGQjo +.. section: Library + +Fix crashes when deleting an attribute whose setter is generated by Argument +Clinic and is not prepared for deletion, among them the ``context``, +``owner`` and ``session`` attributes of ``_ssl._SSLSocket``. Deleting such +attribute now raises :exc:`AttributeError`. + +.. + +.. date: 2026-08-10-15-24-13 +.. gh-issue: 155468 +.. nonce: W7qL2p +.. section: Library + +Fix :mod:`netrc` to distinguish empty quoted tokens from end-of-file, so +malformed files no longer cause the remaining content to be silently +ignored. + +.. + +.. date: 2026-08-10-09-00-18 +.. gh-issue: 155336 +.. nonce: vrTXoU +.. section: Library + +Fix error handling in :func:`socket.gethostbyaddr` and +:func:`socket.gethostbyname_ex` when hostname resolution fails. + +.. + +.. date: 2026-08-09-01-30-00 +.. gh-issue: 102475 +.. nonce: rpjoin +.. section: Library + +Fix :func:`os.path.realpath` on Windows: the unresolved part of the path is +now appended, not joined, so a file name which looks like a drive (e.g. +``spam:eggs``) no longer discards the resolved part. A path relative to +another drive is now resolved against the root directory of that drive. + +.. + +.. date: 2026-08-09-00-30-00 +.. gh-issue: 89760 +.. nonce: rpvol +.. section: Library + +Fix :func:`os.path.realpath` on Windows: the ``\\?\`` prefix is no longer +stripped from a volume GUID path, which made the result invalid. + +.. + +.. date: 2026-08-08-21-40-00 +.. gh-issue: 84419 +.. nonce: statexe +.. section: Library + +Fix :func:`os.stat` on Windows: trailing dots and spaces, which are ignored +by the operating system, are no longer taken into account when the execute +permissions are guessed from the file extension. + +.. + +.. date: 2026-08-07-02-20-00 +.. gh-issue: 155319 +.. nonce: srcline +.. section: Library + +:func:`warnings.warn_explicit` now displays the source line taken from the +loader of the module whose globals are passed as *module_globals*. It also +no longer raises :exc:`IndexError` if *lineno* is out of the range of the +module source. + +.. + +.. date: 2026-08-07-01-10-00 +.. gh-issue: 123011 +.. nonce: warnexp +.. section: Library + +:func:`warnings.warn_explicit` no longer emits a spurious +:exc:`DeprecationWarning` or raises :exc:`ImportError` when it is called +with the globals of the :mod:`__main__` module. + +.. + +.. date: 2026-08-05-17-30-00 +.. gh-issue: 69370 +.. nonce: inspCLI +.. section: Library + +:program:`python -m inspect --details` no longer fails with +:exc:`UnicodeEncodeError` if the path of the module contains characters +unencodable in the encoding of :data:`sys.stdout`. Such characters are now +escaped with backslashes. + +.. + +.. date: 2026-08-05-16-40-00 +.. gh-issue: 69371 +.. nonce: pyDocU +.. section: Library + +Fix :mod:`pydoc` for modules whose path contains undecodable bytes. +:func:`!pydoc.writedoc` and the pydoc HTTP server no longer fail with +:exc:`UnicodeEncodeError`: the file URL is now percent-encoded using the +filesystem encoding, and characters unencodable in the generated HTML page +are escaped with backslashes. + +.. + +.. date: 2026-07-29-14-20-40 +.. gh-issue: 154855 +.. nonce: vfF453 +.. section: Library + +Fix :meth:`curses.window.instr` returning one character too few when the +:mod:`curses` module is built against a curses library that counts the +terminator in the requested length, such as the NetBSD one. + +.. + +.. date: 2026-07-23-14-13-39 +.. gh-issue: 135683 +.. nonce: droBu7 +.. section: Library + +:class:`logging.FileHandler` and +:class:`logging.handlers.WatchedFileHandler` now honor +:data:`logging.raiseExceptions` for errors that occur while opening the +file, like for other errors during logging. + +.. + +.. date: 2026-07-22-19-21-20 +.. gh-issue: 82535 +.. nonce: METFqd +.. section: Library + +:class:`logging.handlers.SysLogHandler` no longer fails if the address +cannot be resolved when the handler is created. The address is resolved +again when a record is emitted. + +.. + +.. date: 2026-07-22-12-00-00 +.. gh-issue: 153970 +.. nonce: Kq7Wn3 +.. section: Library + +Calling :func:`str` on a :exc:`subprocess.CalledProcessError` no longer +raises :exc:`TypeError` when its :attr:`!returncode` is not an integer, such +as ``None``. + +.. + +.. date: 2026-07-19-17-45-00 +.. gh-issue: 153005 +.. nonce: F6WH92 +.. section: Library + +:meth:`!concurrent.interpreters.Queue.get` and +:meth:`!concurrent.interpreters.Queue.put` now compute their ``timeout`` +deadline from :func:`time.monotonic` instead of the wall clock, so adjusting +the system clock during the call no longer makes them over- or under-wait. + +.. + +.. date: 2026-07-19-17-05-00 +.. gh-issue: 153772 +.. nonce: cobjTK +.. section: Library + +:func:`isinstance` checks against :mod:`collections.abc` classes such as +:class:`~collections.abc.Mapping` no longer raise :exc:`AttributeError` when +the instance has no ``__class__``. The abstract base class machinery now +falls back to the object's type in that case, matching the behaviour of the +built-in :func:`isinstance`. + +.. + +.. date: 2026-07-18-04-09-44 +.. gh-issue: 81241 +.. nonce: gGRbBr +.. section: Library + +Fix :exc:`OSError` when importing :mod:`ctypes` from a statically linked +interpreter. + +.. + +.. date: 2026-07-11-13-24-49 +.. gh-issue: 153603 +.. nonce: YbKlry +.. section: Library + +Fix a crash in the ISO-2022 decoders when decoding a byte after an unknown +charset designation is set via the decoder's ``setstate`` method. Patch by +tonghuaroot. + +.. + +.. date: 2026-07-11-12-21-12 +.. gh-issue: 153539 +.. nonce: gBs2T5 +.. section: Library + +Fix a crash in the C implementation of :meth:`io.TextIOWrapper.tell` when +the decoder's ``getstate`` method triggers a reentrant seek, or when another +thread seeks the same stream concurrently. Patch by tonghuaroot. + +.. + +.. date: 2026-07-08-23-20-00 +.. gh-issue: 152907 +.. nonce: oyPV9Y +.. section: Library + +Restore cooked-mode terminal output flags around :c:data:`PyOS_InputHook` +callbacks in the new :term:`REPL` (:mod:`!_pyrepl`), so that output written +by an input hook (for example a GUI toolkit event loop) is no longer emitted +with ``OPOST`` disabled and keeps its carriage returns. + +.. + +.. date: 2026-07-08-19-40-00 +.. gh-issue: 153319 +.. nonce: Qk7bE2 +.. section: Library + +The :mod:`turtledemo` viewer now reads each demo script as UTF-8 instead of +the locale encoding. + +.. + +.. date: 2026-06-25-14-05-00 +.. gh-issue: 152204 +.. nonce: k9Qm3v +.. section: Library + +Fix the pure-Python implementations of :meth:`datetime.date.fromisoformat`, +:meth:`datetime.time.fromisoformat` and +:meth:`datetime.datetime.fromisoformat` silently accepting some malformed +ISO 8601 strings, such as non-ASCII digits or a sign in a fixed-width field +(for example ``'2020+12'`` or ``'20201212T0102٣٤'``). Each field is now +required to be exactly *N* ASCII digits, matching the C implementation. + +.. + +.. date: 2026-05-20-14-00-00 +.. gh-issue: 145856 +.. nonce: Pl5kZx +.. section: Library + +Fix :func:`plistlib.dumps` and :func:`plistlib.dump` so that +``skipkeys=True`` together with ``sort_keys=True`` correctly drops +non-string keys when the dictionary contains a mix of string and non-string +keys. Previously the sort ran before the filter and raised +:exc:`TypeError`. + +.. + +.. date: 2026-03-16-00-00-00 +.. gh-issue: 146004 +.. nonce: xOptProp +.. section: Library + +All :option:`-X` options from the Python command line are now propagated to +child processes spawned by :mod:`multiprocessing`, not just a hard-coded +subset. This makes the behavior consistent between default "spawn" and +"forkserver" start methods and the old "fork" start method. The options +that were previously not propagated are: ``context_aware_warnings``, +``cpu_count``, ``disable-remote-debug``, ``int_max_str_digits``, +``lazy_imports``, ``no_debug_ranges``, ``pathconfig_warnings``, ``perf``, +``perf_jit``, ``presite``, ``pycache_prefix``, ``thread_inherit_context``, +and ``warn_default_encoding``. + +.. + +.. date: 2023-12-20-22-05-40 +.. gh-issue: 113329 +.. nonce: 1CJy3o +.. section: Library + +Fix :exc:`OSError` being raised when trying to run doctests on a class +objects in the REPL. Patch by Sten Wessel. + +.. + +.. date: 2023-03-23-19-47-05 +.. gh-issue: 102967 +.. nonce: gfIYkN +.. section: Library + +A bug in :func:`!doctest._SpoofOut.truncate` was causing None to be passed +to :func:`!StringIO.seek` when no size was given. A simple fix skips the +seek call when no size is given so the buffer can be truncated from the +current position. + +.. + +.. date: 2023-02-11-09-49-49 +.. gh-issue: 82039 +.. nonce: caTE7O +.. section: Library + +:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format +signature line in a case-insensitive manner. Patch by Ashley Harvey. + +.. + +.. date: 2022-01-03-12-50-42 +.. gh-issue: 70758 +.. nonce: 2NjFW_ +.. section: Library + +Creating a new :mod:`turtle` screen after the previous one was closed no +longer raises ``turtle.Terminator`` on the first turtle command. + +.. + +.. bpo: 44012 +.. date: 2021-06-03-22-23-38 +.. nonce: BK3HfA +.. section: Library + +The ``exploded`` attribute of :class:`ipaddress.IPv6Address` and +:class:`ipaddress.IPv6Interface` now supports addresses with a scope ID +(link-local addresses). Previously the former raised +:exc:`~ipaddress.AddressValueError` and the latter omitted the scope ID. + +.. + +.. date: 2020-02-19-16-35-52 +.. gh-issue: 83869 +.. nonce: EPD_zn +.. section: Library + +Fix :mod:`tarfile` reading an archive with a GNU sparse 1.0 member whose +size is set in the pax extended header. The offset of the next header was +computed from the offset of the data, which is already past the sparse map, +and from the size of the member, which can be the apparent size of the +sparse file. All following members were unreachable. + +.. + +.. date: 2019-02-08-17-33-49 +.. gh-issue: 61366 +.. nonce: k6W5Sp +.. section: Library + +:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written +by curl and Wget, which use ``0`` in the expiration time field. Contributed +by Jérémie Detrey. + +.. + +.. date: 2026-09-24-12-00-00 +.. gh-issue: 158067 +.. nonce: opnPy1 +.. section: IDLE + +Fix the IDLE File Open dialog listing text files before Python files when +opened from the Shell or an Output window. + +.. + +.. date: 2026-09-17-23-00-00 +.. gh-issue: 56596 +.. nonce: capslock +.. section: IDLE + +Make IDLE keyboard shortcuts with ascii letters work when Caps Lock is on +even when only one of the upper and lowercase versions are defined. + +.. + +.. date: 2026-09-17-22-00-00 +.. gh-issue: 75512 +.. nonce: asyncout +.. section: IDLE + +Output from a thread printed in the IDLE Shell while a statement is being +entered no longer takes over the prompt of the statement. + +.. + +.. date: 2026-09-17-21-00-00 +.. gh-issue: 64007 +.. nonce: inputcolor +.. section: IDLE + +IDLE no longer applies syntax coloring to the text entered for :func:`input` +in the Shell. + +.. + +.. date: 2026-09-17-18-00-00 +.. gh-issue: 85560 +.. nonce: elseexpr +.. section: IDLE + +Fix IDLE failing to find the opening parenthesis when a continuation line +inside the parentheses starts with ``else`` of a conditional expression or +with ``yield``. + +.. + +.. date: 2026-09-17-17-00-00 +.. gh-issue: 75487 +.. nonce: blankint +.. section: IDLE + +Fix saving a truncated number when an integer entry in the IDLE Settings +dialog is blanked with the Backspace key. + +.. + +.. date: 2026-09-17-12-00-00 +.. gh-issue: 74112 +.. nonce: sigint +.. section: IDLE + +Ctrl-C in the IDLE Shell now interrupts blocking calls such as +:func:`time.sleep` and :meth:`socket.recv <socket.socket.recv>`. + +.. + +.. date: 2026-09-17-08-53-12 +.. gh-issue: 151471 +.. nonce: -yvE03 +.. section: IDLE + +Colorize the soft keyword ``type`` in IDLE. + +.. + +.. date: 2026-09-17-02-00-00 +.. gh-issue: 103089 +.. nonce: longline +.. section: IDLE + +IDLE no longer hangs when opening a file with very long lines. Only the +first 2,000 characters of a line are colorized. + +.. + +.. date: 2026-09-17-01-00-00 +.. gh-issue: 89544 +.. nonce: rstbuf +.. section: IDLE + +Fix IDLE hanging after Restart Shell while receiving a large output from the +user process. + +.. + +.. date: 2026-09-16-22-00-00 +.. gh-issue: 70331 +.. nonce: shadow +.. section: IDLE + +IDLE no longer fails to start with ``python -m idlelib``, and its user +process no longer fails to start, when the current directory contains user +files with the same names as standard library modules that IDLE imports, +such as ``random.py`` or ``tkinter.py``. + +.. + +.. date: 2026-09-16-20-00-00 +.. gh-issue: 93016 +.. nonce: cliarg +.. section: IDLE + +Fix parsing of command line arguments in the IDLE "Run... Customized" dialog +on Windows: backslashes are no longer treated as escape characters. Fix also +display of the previous arguments in the dialog. + +.. + +.. date: 2026-09-16-18-00-00 +.. gh-issue: 59568 +.. nonce: tilde1 +.. section: IDLE + +Fix "Save As" and "Open" dialogs in IDLE for a file whose name starts with +``~`` on Windows and X11 with Tcl/Tk older than 9. + +.. + +.. date: 2026-09-15-23-27-38 +.. gh-issue: 69004 +.. nonce: Z7Ym9G +.. section: IDLE + +The Debugger item of the IDLE Debug menu is now disabled while user code +runs, like Stack Viewer. + +.. + +.. date: 2026-09-15-22-34-33 +.. gh-issue: 69365 +.. nonce: KehjZN +.. section: IDLE + +The IDLE search dialogs now show a regular expression error below the entry +instead of in a message box. + +.. + +.. date: 2026-09-15-22-10-17 +.. gh-issue: 93966 +.. nonce: ch4fTB +.. section: IDLE + +The highlighting of a syntax error in the IDLE Shell is now removed when the +next statement is entered, not only when the next syntax error occurs. + +.. + +.. date: 2026-09-15-21-54-04 +.. gh-issue: 105689 +.. nonce: ASoU37 +.. section: IDLE + +Fix calltips, parenthesis matching and auto-indent in the IDLE Shell after +output containing unbalanced quotes or parentheses. + +.. + +.. date: 2026-09-15-21-44-35 +.. gh-issue: 60402 +.. nonce: iFz6X6 +.. section: IDLE + +In IDLE, Tab in a string that is not the start of a file name inserts a tab +instead of opening the completion list. + +.. + +.. date: 2026-09-15-21-20-04 +.. gh-issue: 68453 +.. nonce: hlxbog +.. section: IDLE + +Fix running IDLE with the -s option together with -c, -r or -: the command +or script now runs after the startup file, without an error dialog and +without restarting the shell. + +.. + +.. date: 2026-09-15-20-14-08 +.. gh-issue: 75234 +.. nonce: O8ZNFV +.. section: IDLE + +Fix editing help sources and key bindings in the IDLE Settings dialog after +selecting them with the keyboard. + +.. + +.. date: 2026-09-15-16-37-19 +.. gh-issue: 69919 +.. nonce: f6AamT +.. section: IDLE + +IDLE now reports any exception raised by compiling the source, such as +:exc:`MemoryError` for too deeply nested source, instead of hanging the +Shell. + +.. + +.. date: 2026-09-15-16-19-25 +.. gh-issue: 91398 +.. nonce: PBdiDB +.. section: IDLE + +Remove the border around the IDLE Shell sidebar, which was drawn in the +window background color and stood out with dark themes. + +.. + +.. date: 2026-09-15-15-46-35 +.. gh-issue: 71136 +.. nonce: vwGO0v +.. section: IDLE + +Fix a hang of the IDLE Shell when code run under the debugger raises +:exc:`KeyboardInterrupt`. + +.. + +.. date: 2026-09-05-16-00-00 +.. gh-issue: 154511 +.. nonce: hV2wQn +.. section: IDLE + +Consolidate IDLE's mouse wheel handling in ``idlelib.util``. ``wheel_event`` +moves there from ``idlelib.tree`` and joins ``x11_buttons``, which tells +whether Tk reports wheel rotations to a widget as +``<Button-4>``/``<Button-5>`` events, and ``bind_wheel``, which binds +whichever events Tk sends. + +.. + +.. date: 2026-09-03-17-16-26 +.. gh-issue: 156896 +.. nonce: XTQJlq +.. section: IDLE + +Stop deleting tkinter submodules when idlelib.run is imported. + +.. + +.. date: 2026-07-10-19-41-00 +.. gh-issue: 153480 +.. nonce: EdMt1x +.. section: IDLE + +Fix IDLE failing to start when opening a file which does not exist yet. Fix +a traceback when a file open in the IDLE editor is deleted by another +program; IDLE now asks whether to close the window, save the file elsewhere, +or ignore it. + +.. + +.. date: 2026-07-01-21-00-00 +.. gh-issue: 55646 +.. nonce: kBind9 +.. section: IDLE + +Fix IDLE crash at startup when the user configuration contains an invalid +key binding, such as ``<Alt-Key-up>`` instead of ``<Alt-Key-Up>``. The +invalid binding is now ignored with a warning. + +.. + +.. date: 2026-07-01-13-30-00 +.. gh-issue: 66172 +.. nonce: Qm4xR7 +.. section: IDLE + +IDLE no longer fails to start when a user configuration file is corrupt. The +unparsable file is renamed with a ".bad" suffix, default settings are used +instead, and a warning lists the affected files. + +.. + +.. date: 2026-06-27-17-27-21 +.. gh-issue: 90304 +.. nonce: 464d22 +.. section: IDLE + +Prevent IDLE from failing to start when a font reports a zero width for the +``'0'`` character. Such a broken font caused a :exc:`ZeroDivisionError`; +the editor now falls back to the configured width. + +.. + +.. date: 2025-08-08-10-50-59 +.. gh-issue: 135511 +.. nonce: 9Rw5Zg +.. section: IDLE + +Fix display of :exc:`NameError` and :exc:`AttributeError` with multi-line +message. + +.. + +.. date: 2026-09-24-10-10-15 +.. gh-issue: 57491 +.. nonce: UA-2uN +.. section: Documentation + +Reduce the depth of the table of contents in the EPUB documentation from +three levels to two, making it much shorter and easier to navigate in e-book +readers. + +.. + +.. date: 2026-09-28-18-58-27 +.. gh-issue: 158364 +.. nonce: jBqmTs +.. section: Core and Builtins + +Fix crash when :func:`sys._current_frames` or +:func:`sys._current_exceptions` is called while another interpreter is +running. + +.. + +.. date: 2026-09-26-15-39-32 +.. gh-issue: 158254 +.. nonce: qT7vRk +.. section: Core and Builtins + +Reverse iterators over a :class:`dict` and its views now raise +:exc:`RuntimeError` if the dictionary's keys change during iteration, like +forward iterators, instead of yielding entries for the new keys. + +.. + +.. date: 2026-09-05-16-24-52 +.. gh-issue: 154175 +.. nonce: YJon4M +.. section: Core and Builtins + +Move GIL drop request bit fetching to live under the :term:`GIL` so the +:c:type:`PyThreadState` it accesses is guaranteed not to be deallocated. +Deallocation could occur when a daemon thread was shutting down after the +main thread. + +.. + +.. date: 2026-09-04-14-06-00 +.. gh-issue: 156091 +.. nonce: nested-comp +.. section: Core and Builtins + +Fix a crash when compiling deeply nested inlined list, set, or dict +comprehensions. A :exc:`SyntaxError` is now raised when the nesting exceeds +the compiler's static block limit. + +.. + +.. date: 2026-09-03-15-20-00 +.. gh-issue: 156894 +.. nonce: Rt9Bx4 +.. section: Core and Builtins + +Fix the position of syntax errors which cover a range if the line contains +non-ASCII characters before the error. + +.. + +.. date: 2026-09-01-07-15-20 +.. gh-issue: 155525 +.. nonce: A7kP2m +.. section: Core and Builtins + +Fix quadratic-time tokenization of modules containing many f-strings. + +.. + +.. date: 2026-08-23-12-00-00 +.. gh-issue: 156114 +.. nonce: Kq7fXz +.. section: Core and Builtins + +Fix a crash in the perf trampoline when a code object has a name or filename +that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. + +.. + +.. date: 2026-08-21-18-00-00 +.. gh-issue: 156196 +.. nonce: Mv7kBq +.. section: Core and Builtins + +A failed assignment to an attribute defined with :c:type:`PyMemberDef` of +type ``Py_T_LONG``, ``Py_T_LONGLONG``, ``Py_T_PYSSIZET`` or ``Py_T_DOUBLE`` +no longer changes its value. + +.. + +.. date: 2026-08-21-16-00-00 +.. gh-issue: 156189 +.. nonce: Zt4nQp +.. section: Core and Builtins + +Fix a crash when deleting the :attr:`~frame.f_trace_opcodes` attribute of a +frame object. It now raises :exc:`AttributeError`. + +.. + +.. date: 2026-08-13-13-50-00 +.. gh-issue: 155752 +.. nonce: Rp7K2x +.. section: Core and Builtins + +Fix a crash when a :class:`types.GenericAlias` argument gains a +``__typing_subst__`` hook after the alias parameters have been cached. + +.. + +.. date: 2026-08-11-06-04-26 +.. gh-issue: 155526 +.. nonce: W7ZHXu +.. section: Core and Builtins + +Fix spurious :exc:`OverflowError` for ``abs(nanj)`` in case :c:data:`errno` +was previously set to :c:macro:`!ERANGE` by some library call. Patch by +Sergey B Kirpichev. + +.. + +.. date: 2026-08-10-11-20-00 +.. gh-issue: 155515 +.. nonce: Lp3qWc +.. section: Core and Builtins + +Track the internal HAMT iterators, which back iteration over a +:class:`contextvars.Context`, with the garbage collector. A reference cycle +running through such an iterator was never collected, leaking the whole +context it iterated over. + +.. + +.. date: 2026-07-30-14-40-00 +.. gh-issue: 154711 +.. nonce: nUxYXc +.. section: Core and Builtins + +Fix a bug where a comment placed after a string that ends with an escaped +quote could leak into the output of a debug f-string. Now the comment is +stripped as expected. + +.. + +.. date: 2026-07-29-08-43-14 +.. gh-issue: 151464 +.. nonce: o_mtmz +.. section: Core and Builtins + +Exclude invalid token ``<>`` from :mod:`tokenize` output. :exc:`SyntaxError` +for ``<>`` now suggests ``!=``. + +.. + +.. date: 2026-07-11-15-45-00 +.. gh-issue: 153578 +.. nonce: Qm4Zt9 +.. section: Core and Builtins + +Fix an out-of-bounds write in :meth:`bytearray.extend` when the bytearray is +resized while the argument's :meth:`~object.__buffer__` is being acquired, +for example by another thread. Patch by tonghuaroot. + +.. + +.. date: 2026-03-19-01-19-34 +.. gh-issue: 146096 +.. nonce: R9tkJX +.. section: Core and Builtins + +Fixed segmentation fault when called repr for BaseExceptionGroup with empty +or 1-size tuple args. + +.. + +.. date: 2025-02-14-00-32-52 +.. gh-issue: 130094 +.. nonce: m3EF9E +.. section: Core and Builtins + +Fix two race conditions involving concurrent imports that could lead to +spurious failures with :exc:`ModuleNotFoundError`. + +.. + +.. date: 2020-06-23-13-59-37 +.. gh-issue: 85260 +.. nonce: o_LJ76 +.. section: Core and Builtins + +:func:`compile` now raises :exc:`ValueError` instead of crashing on a debug +build if an identifier field of an AST node (such as the name of a function, +a class, an imported module or a caught exception) is ``"None"``, ``"True"`` +or ``"False"``. + +.. + +.. date: 2026-09-12-21-00-42 +.. gh-issue: 156995 +.. nonce: UVjqQe +.. section: C API + +``_PyBytes_Resize(&obj, 1)`` no longer returns a single byte singleton if +the reference count is greater than ``1``. Patch by Stan Ulbrych. + +.. + +.. date: 2026-09-23-12-01-50 +.. gh-issue: 158010 +.. nonce: Hk83NK +.. section: Build + +Updated Android builds to use OpenSSL 3.5.9, jumping from the 3.0 series to +3.5 after 3.0's end of public support in September 2026. + +.. + +.. date: 2026-09-07-23-40-00 +.. gh-issue: 157142 +.. nonce: gpnoop +.. section: Build + +Fix the link of ``Programs/_freeze_module`` when extension modules are built +in (``MODULE_BUILDTYPE=static``) and the test modules are enabled: +``Modules/getpath_noop.c`` now defines ``_Py_Get_Getpath_CodeObject()``, +which ``_testinternalcapi`` uses. + +.. + +.. date: 2026-08-20-17-41-11 +.. gh-issue: 155911 +.. nonce: yL3z8q +.. section: Build + +Fix curses detection when a curses library is already in ``LIBS``. Patch by +Shamil Abdulaev. + +.. + +.. date: 2026-08-20-14-02-33 +.. gh-issue: 156115 +.. nonce: KXr8wU +.. section: Build + +iOS simulator builds are now configured with ``-mios-simulator-version-min`` +instead of the device's ``-mios-version-min``. The device flag made the +linker reject libraries resolved from the simulator SDK, so library +detection silently failed. + +.. + +.. date: 2026-08-02-12-00-01 +.. gh-issue: 152023 +.. nonce: pT7dKb +.. section: Build + +Update Android builds to SQLite 3.53.4. Additionally, enable the +``median()`` and ``percentile()`` functions. diff --git a/Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst b/Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst deleted file mode 100644 index 4d81c66d163a7c2..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst +++ /dev/null @@ -1,2 +0,0 @@ -Update Android builds to SQLite 3.53.4. Additionally, enable the ``median()`` -and ``percentile()`` functions. diff --git a/Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst b/Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst deleted file mode 100644 index 612180d3b65db21..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst +++ /dev/null @@ -1,4 +0,0 @@ -iOS simulator builds are now configured with -``-mios-simulator-version-min`` instead of the device's -``-mios-version-min``. The device flag made the linker reject libraries -resolved from the simulator SDK, so library detection silently failed. diff --git a/Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst b/Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst deleted file mode 100644 index ec3c798995849b2..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix curses detection when a curses library is already in ``LIBS``. -Patch by Shamil Abdulaev. diff --git a/Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst b/Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst deleted file mode 100644 index ac2890b5324ba4a..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix the link of ``Programs/_freeze_module`` when extension modules are built -in (``MODULE_BUILDTYPE=static``) and the test modules are enabled: -``Modules/getpath_noop.c`` now defines ``_Py_Get_Getpath_CodeObject()``, -which ``_testinternalcapi`` uses. diff --git a/Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst b/Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst deleted file mode 100644 index 89e3d32be025a13..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst +++ /dev/null @@ -1,2 +0,0 @@ -Updated Android builds to use OpenSSL 3.5.9, jumping from the 3.0 series -to 3.5 after 3.0's end of public support in September 2026. diff --git a/Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst b/Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst deleted file mode 100644 index 11629eca29bdcf2..000000000000000 --- a/Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst +++ /dev/null @@ -1,2 +0,0 @@ -``_PyBytes_Resize(&obj, 1)`` no longer returns a single byte singleton if the -reference count is greater than ``1``. Patch by Stan Ulbrych. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst b/Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst deleted file mode 100644 index d156efe4ca24144..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst +++ /dev/null @@ -1,4 +0,0 @@ -:func:`compile` now raises :exc:`ValueError` instead of crashing on a debug -build if an identifier field of an AST node (such as the name of a function, -a class, an imported module or a caught exception) is ``"None"``, ``"True"`` -or ``"False"``. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-02-14-00-32-52.gh-issue-130094.m3EF9E.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-02-14-00-32-52.gh-issue-130094.m3EF9E.rst deleted file mode 100644 index 15d5831808df638..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2025-02-14-00-32-52.gh-issue-130094.m3EF9E.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix two race conditions involving concurrent imports that could lead to -spurious failures with :exc:`ModuleNotFoundError`. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst deleted file mode 100644 index 8d7e177c6140a77..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fixed segmentation fault when called repr for BaseExceptionGroup with empty -or 1-size tuple args. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst deleted file mode 100644 index 2d5d4058a04ef2c..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix an out-of-bounds write in :meth:`bytearray.extend` when the bytearray is -resized while the argument's :meth:`~object.__buffer__` is being acquired, for -example by another thread. Patch by tonghuaroot. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst deleted file mode 100644 index ba7dbe132540373..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst +++ /dev/null @@ -1,2 +0,0 @@ -Exclude invalid token ``<>`` from :mod:`tokenize` output. :exc:`SyntaxError` -for ``<>`` now suggests ``!=``. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-30-14-40-00.gh-issue-154711.nUxYXc.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-30-14-40-00.gh-issue-154711.nUxYXc.rst deleted file mode 100644 index 58ad001d3befb78..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-30-14-40-00.gh-issue-154711.nUxYXc.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a bug where a comment placed after a string that ends with an escaped -quote could leak into the output of a debug f-string. Now the comment is -stripped as expected. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst deleted file mode 100644 index 96b9c608780c2ec..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst +++ /dev/null @@ -1,4 +0,0 @@ -Track the internal HAMT iterators, which back iteration over a -:class:`contextvars.Context`, with the garbage collector. A reference cycle -running through such an iterator was never collected, leaking the whole -context it iterated over. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst deleted file mode 100644 index ae0c08973a8195b..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix spurious :exc:`OverflowError` for ``abs(nanj)`` in case :c:data:`errno` was -previously set to :c:macro:`!ERANGE` by some library call. -Patch by Sergey B Kirpichev. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst deleted file mode 100644 index 300e97ad5d257bc..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash when a :class:`types.GenericAlias` argument gains a -``__typing_subst__`` hook after the alias parameters have been cached. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-16-00-00.gh-issue-156189.Zt4nQp.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-16-00-00.gh-issue-156189.Zt4nQp.rst deleted file mode 100644 index 2ced97c87956f08..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-16-00-00.gh-issue-156189.Zt4nQp.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash when deleting the :attr:`~frame.f_trace_opcodes` attribute of -a frame object. It now raises :exc:`AttributeError`. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-18-00-00.gh-issue-156196.Mv7kBq.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-18-00-00.gh-issue-156196.Mv7kBq.rst deleted file mode 100644 index 65d824884eccaaf..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-21-18-00-00.gh-issue-156196.Mv7kBq.rst +++ /dev/null @@ -1,3 +0,0 @@ -A failed assignment to an attribute defined with :c:type:`PyMemberDef` of -type ``Py_T_LONG``, ``Py_T_LONGLONG``, ``Py_T_PYSSIZET`` or ``Py_T_DOUBLE`` -no longer changes its value. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst deleted file mode 100644 index 096216f7e6c7b3c..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash in the perf trampoline when a code object has a name or filename -that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst deleted file mode 100644 index 1a67289d595d6a4..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst +++ /dev/null @@ -1 +0,0 @@ -Fix quadratic-time tokenization of modules containing many f-strings. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst deleted file mode 100644 index 9b279ab27947867..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix the position of syntax errors which cover a range if the line contains -non-ASCII characters before the error. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst deleted file mode 100644 index fdceb3209b7f7cb..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash when compiling deeply nested inlined list, set, or dict -comprehensions. A :exc:`SyntaxError` is now raised when the nesting exceeds -the compiler's static block limit. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-05-16-24-52.gh-issue-154175.YJon4M.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-05-16-24-52.gh-issue-154175.YJon4M.rst deleted file mode 100644 index 682cfca7d1c7212..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-05-16-24-52.gh-issue-154175.YJon4M.rst +++ /dev/null @@ -1,4 +0,0 @@ -Move GIL drop request bit fetching to live under the :term:`GIL` so the -:c:type:`PyThreadState` it accesses is guaranteed not to be deallocated. -Deallocation could occur when a daemon thread was shutting down after the -main thread. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst deleted file mode 100644 index 21908eea4a8236b..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst +++ /dev/null @@ -1,3 +0,0 @@ -Reverse iterators over a :class:`dict` and its views now raise -:exc:`RuntimeError` if the dictionary's keys change during iteration, like -forward iterators, instead of yielding entries for the new keys. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst deleted file mode 100644 index 14ab4ef12becae6..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix crash when :func:`sys._current_frames` or -:func:`sys._current_exceptions` is called while another interpreter is -running. diff --git a/Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst b/Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst deleted file mode 100644 index c7c8057776bec4a..000000000000000 --- a/Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst +++ /dev/null @@ -1,3 +0,0 @@ -Reduce the depth of the table of contents in the EPUB documentation from -three levels to two, making it much shorter and easier to navigate in e-book -readers. diff --git a/Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst b/Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst deleted file mode 100644 index 10e59572b53746e..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst +++ /dev/null @@ -1 +0,0 @@ -Fix display of :exc:`NameError` and :exc:`AttributeError` with multi-line message. diff --git a/Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst b/Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst deleted file mode 100644 index c92c1f75b9d7a7d..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst +++ /dev/null @@ -1,4 +0,0 @@ -Prevent IDLE from failing to start when a font reports a zero width for -the ``'0'`` character. Such a broken font caused a -:exc:`ZeroDivisionError`; the editor now falls back to the configured -width. diff --git a/Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst b/Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst deleted file mode 100644 index c4248f85b98a258..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst +++ /dev/null @@ -1,3 +0,0 @@ -IDLE no longer fails to start when a user configuration file is corrupt. -The unparsable file is renamed with a ".bad" suffix, default settings are -used instead, and a warning lists the affected files. diff --git a/Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst b/Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst deleted file mode 100644 index 31e97b3c64bcfee..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix IDLE crash at startup when the user configuration contains an invalid key -binding, such as ``<Alt-Key-up>`` instead of ``<Alt-Key-Up>``. The invalid -binding is now ignored with a warning. diff --git a/Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst b/Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst deleted file mode 100644 index e00c76fc2d0d6f0..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix IDLE failing to start when opening a file which does not exist yet. -Fix a traceback when a file open in the IDLE editor is deleted by another -program; IDLE now asks whether to close the window, save the file elsewhere, -or ignore it. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst b/Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst deleted file mode 100644 index fd759cdbe92c2ff..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst +++ /dev/null @@ -1 +0,0 @@ -Stop deleting tkinter submodules when idlelib.run is imported. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst b/Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst deleted file mode 100644 index 591c1582fa8d75a..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst +++ /dev/null @@ -1,5 +0,0 @@ -Consolidate IDLE's mouse wheel handling in ``idlelib.util``. -``wheel_event`` moves there from ``idlelib.tree`` and joins ``x11_buttons``, -which tells whether Tk reports wheel rotations to a widget as -``<Button-4>``/``<Button-5>`` events, and ``bind_wheel``, which binds -whichever events Tk sends. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst deleted file mode 100644 index 794a51b2b32e857..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a hang of the IDLE Shell when code run under the debugger raises -:exc:`KeyboardInterrupt`. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst deleted file mode 100644 index 9db16c5a74a2429..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst +++ /dev/null @@ -1,2 +0,0 @@ -Remove the border around the IDLE Shell sidebar, which was drawn in the -window background color and stood out with dark themes. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst deleted file mode 100644 index fc9091521130770..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst +++ /dev/null @@ -1,2 +0,0 @@ -IDLE now reports any exception raised by compiling the source, such as -:exc:`MemoryError` for too deeply nested source, instead of hanging the Shell. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst deleted file mode 100644 index 70d64aa09a6dee4..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix editing help sources and key bindings in the IDLE Settings dialog after -selecting them with the keyboard. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst deleted file mode 100644 index 4d8cfc1dbc6574a..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix running IDLE with the -s option together with -c, -r or -: the command -or script now runs after the startup file, without an error dialog and -without restarting the shell. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst deleted file mode 100644 index 9b876ab0486f20d..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst +++ /dev/null @@ -1,2 +0,0 @@ -In IDLE, Tab in a string that is not the start of a file name inserts a tab -instead of opening the completion list. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst deleted file mode 100644 index 7b4924fa0af2283..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix calltips, parenthesis matching and auto-indent in the IDLE Shell after -output containing unbalanced quotes or parentheses. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst deleted file mode 100644 index 3260b42211b780b..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst +++ /dev/null @@ -1,2 +0,0 @@ -The highlighting of a syntax error in the IDLE Shell is now removed when the -next statement is entered, not only when the next syntax error occurs. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst deleted file mode 100644 index d29c87aed78e1a0..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst +++ /dev/null @@ -1,2 +0,0 @@ -The IDLE search dialogs now show a regular expression error below the entry -instead of in a message box. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst deleted file mode 100644 index 05d42efd451458e..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst +++ /dev/null @@ -1,2 +0,0 @@ -The Debugger item of the IDLE Debug menu is now disabled while user code -runs, like Stack Viewer. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst b/Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst deleted file mode 100644 index 3eabd4e176ad8a6..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix "Save As" and "Open" dialogs in IDLE for a file whose name starts with -``~`` on Windows and X11 with Tcl/Tk older than 9. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst b/Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst deleted file mode 100644 index a9fe00a72fe87c3..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix parsing of command line arguments in the IDLE "Run... Customized" dialog -on Windows: backslashes are no longer treated as escape characters. Fix also -display of the previous arguments in the dialog. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst b/Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst deleted file mode 100644 index 1a7124e76cd49f8..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst +++ /dev/null @@ -1,4 +0,0 @@ -IDLE no longer fails to start with ``python -m idlelib``, and its user process -no longer fails to start, when the current directory contains user files with -the same names as standard library modules that IDLE imports, such as -``random.py`` or ``tkinter.py``. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst deleted file mode 100644 index 4a4c885eff96818..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix IDLE hanging after Restart Shell while receiving a large output from the -user process. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst deleted file mode 100644 index 0a7037eab869ff1..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst +++ /dev/null @@ -1,2 +0,0 @@ -IDLE no longer hangs when opening a file with very long lines. -Only the first 2,000 characters of a line are colorized. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst deleted file mode 100644 index cc04822f6d33216..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst +++ /dev/null @@ -1 +0,0 @@ -Colorize the soft keyword ``type`` in IDLE. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst deleted file mode 100644 index 18a230e75913b59..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst +++ /dev/null @@ -1,2 +0,0 @@ -Ctrl-C in the IDLE Shell now interrupts blocking calls such as -:func:`time.sleep` and :meth:`socket.recv <socket.socket.recv>`. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst deleted file mode 100644 index 5ae2d360f5c6a93..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix saving a truncated number when an integer entry in the IDLE Settings -dialog is blanked with the Backspace key. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst deleted file mode 100644 index 9e20622bb535b0c..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix IDLE failing to find the opening parenthesis when a continuation line -inside the parentheses starts with ``else`` of a conditional expression or -with ``yield``. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst deleted file mode 100644 index 2e77f55751fa318..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst +++ /dev/null @@ -1,2 +0,0 @@ -IDLE no longer applies syntax coloring to the text entered for -:func:`input` in the Shell. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst deleted file mode 100644 index 166cb6971f9b0e2..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst +++ /dev/null @@ -1,2 +0,0 @@ -Output from a thread printed in the IDLE Shell while a statement is being -entered no longer takes over the prompt of the statement. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst deleted file mode 100644 index 70878e4f8012638..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst +++ /dev/null @@ -1,2 +0,0 @@ -Make IDLE keyboard shortcuts with ascii letters work when Caps Lock is on even when only one -of the upper and lowercase versions are defined. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst b/Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst deleted file mode 100644 index 2e34cf6a67b8274..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix the IDLE File Open dialog listing text files before Python files when -opened from the Shell or an Output window. diff --git a/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst b/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst deleted file mode 100644 index 2a286a6b62a8f1b..000000000000000 --- a/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst +++ /dev/null @@ -1,3 +0,0 @@ -:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written -by curl and Wget, which use ``0`` in the expiration time field. -Contributed by Jérémie Detrey. diff --git a/Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst b/Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst deleted file mode 100644 index efadbb289c3498c..000000000000000 --- a/Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix :mod:`tarfile` reading an archive with a GNU sparse 1.0 member whose -size is set in the pax extended header. -The offset of the next header was computed from the offset of the data, -which is already past the sparse map, and from the size of the member, -which can be the apparent size of the sparse file. -All following members were unreachable. diff --git a/Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst b/Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst deleted file mode 100644 index 28c21c327504bde..000000000000000 --- a/Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst +++ /dev/null @@ -1,5 +0,0 @@ -The ``exploded`` attribute of :class:`ipaddress.IPv6Address` and -:class:`ipaddress.IPv6Interface` now supports addresses with a scope ID -(link-local addresses). -Previously the former raised :exc:`~ipaddress.AddressValueError` -and the latter omitted the scope ID. diff --git a/Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst b/Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst deleted file mode 100644 index c59f6fed93fd630..000000000000000 --- a/Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst +++ /dev/null @@ -1,2 +0,0 @@ -Creating a new :mod:`turtle` screen after the previous one was closed no -longer raises ``turtle.Terminator`` on the first turtle command. diff --git a/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst b/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst deleted file mode 100644 index cb75ae83780eaf6..000000000000000 --- a/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst +++ /dev/null @@ -1,2 +0,0 @@ -:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format -signature line in a case-insensitive manner. Patch by Ashley Harvey. diff --git a/Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst b/Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst deleted file mode 100644 index 677b8ee86e6c8f6..000000000000000 --- a/Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst +++ /dev/null @@ -1,2 +0,0 @@ -A bug in :func:`!doctest._SpoofOut.truncate` was causing None to be passed to :func:`!StringIO.seek` when no size was given. -A simple fix skips the seek call when no size is given so the buffer can be truncated from the current position. diff --git a/Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst b/Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst deleted file mode 100644 index d5abc0ec28dc9b9..000000000000000 --- a/Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst +++ /dev/null @@ -1 +0,0 @@ -Fix :exc:`OSError` being raised when trying to run doctests on a class objects in the REPL. Patch by Sten Wessel. diff --git a/Misc/NEWS.d/next/Library/2026-03-16-00-00-00.gh-issue-146004.xOptProp.rst b/Misc/NEWS.d/next/Library/2026-03-16-00-00-00.gh-issue-146004.xOptProp.rst deleted file mode 100644 index 234e6102c6a2523..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-03-16-00-00-00.gh-issue-146004.xOptProp.rst +++ /dev/null @@ -1,9 +0,0 @@ -All :option:`-X` options from the Python command line are now propagated to -child processes spawned by :mod:`multiprocessing`, not just a hard-coded -subset. This makes the behavior consistent between default "spawn" and -"forkserver" start methods and the old "fork" start method. The options -that were previously not propagated are: ``context_aware_warnings``, -``cpu_count``, ``disable-remote-debug``, ``int_max_str_digits``, -``lazy_imports``, ``no_debug_ranges``, ``pathconfig_warnings``, ``perf``, -``perf_jit``, ``presite``, ``pycache_prefix``, ``thread_inherit_context``, -and ``warn_default_encoding``. diff --git a/Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst b/Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst deleted file mode 100644 index 9f8cc32fd81c88c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`plistlib.dumps` and :func:`plistlib.dump` so that ``skipkeys=True`` -together with ``sort_keys=True`` correctly drops non-string keys when the -dictionary contains a mix of string and non-string keys. Previously the sort -ran before the filter and raised :exc:`TypeError`. diff --git a/Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst b/Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst deleted file mode 100644 index 1ba1f872eb41a61..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix the pure-Python implementations of :meth:`datetime.date.fromisoformat`, -:meth:`datetime.time.fromisoformat` and :meth:`datetime.datetime.fromisoformat` -silently accepting some malformed ISO 8601 strings, such as non-ASCII digits or -a sign in a fixed-width field (for example ``'2020+12'`` or ``'20201212T0102٣٤'``). -Each field is now required to be exactly *N* ASCII digits, matching the C -implementation. diff --git a/Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst b/Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst deleted file mode 100644 index 95f8e2fb7f4f8be..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst +++ /dev/null @@ -1,2 +0,0 @@ -The :mod:`turtledemo` viewer now reads each demo script as UTF-8 instead of -the locale encoding. diff --git a/Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst b/Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst deleted file mode 100644 index 33247f0f3a3b968..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst +++ /dev/null @@ -1,4 +0,0 @@ -Restore cooked-mode terminal output flags around :c:data:`PyOS_InputHook` -callbacks in the new :term:`REPL` (:mod:`!_pyrepl`), so that output written -by an input hook (for example a GUI toolkit event loop) is no longer emitted -with ``OPOST`` disabled and keeps its carriage returns. diff --git a/Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst b/Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst deleted file mode 100644 index 241d67949680925..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in the C implementation of :meth:`io.TextIOWrapper.tell` when the -decoder's ``getstate`` method triggers a reentrant seek, or when another thread -seeks the same stream concurrently. Patch by tonghuaroot. diff --git a/Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst b/Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst deleted file mode 100644 index 5c60a302883931c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in the ISO-2022 decoders when decoding a byte after an unknown -charset designation is set via the decoder's ``setstate`` method. -Patch by tonghuaroot. diff --git a/Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst b/Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst deleted file mode 100644 index 6110b7404a811e4..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :exc:`OSError` when importing :mod:`ctypes` from a statically linked -interpreter. diff --git a/Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst b/Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst deleted file mode 100644 index 9393384151450d8..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst +++ /dev/null @@ -1,5 +0,0 @@ -:func:`isinstance` checks against :mod:`collections.abc` classes such as -:class:`~collections.abc.Mapping` no longer raise :exc:`AttributeError` -when the instance has no ``__class__``. The abstract base class machinery -now falls back to the object's type in that case, matching the behaviour of -the built-in :func:`isinstance`. diff --git a/Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst b/Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst deleted file mode 100644 index 7f3d10b3072ef94..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst +++ /dev/null @@ -1,4 +0,0 @@ -:meth:`!concurrent.interpreters.Queue.get` and -:meth:`!concurrent.interpreters.Queue.put` now compute their ``timeout`` -deadline from :func:`time.monotonic` instead of the wall clock, so adjusting -the system clock during the call no longer makes them over- or under-wait. diff --git a/Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst b/Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst deleted file mode 100644 index def943b46b59420..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst +++ /dev/null @@ -1,3 +0,0 @@ -Calling :func:`str` on a :exc:`subprocess.CalledProcessError` no longer -raises :exc:`TypeError` when its :attr:`!returncode` is not an integer, such -as ``None``. diff --git a/Misc/NEWS.d/next/Library/2026-07-22-19-21-20.gh-issue-82535.METFqd.rst b/Misc/NEWS.d/next/Library/2026-07-22-19-21-20.gh-issue-82535.METFqd.rst deleted file mode 100644 index e027f81256b703e..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-22-19-21-20.gh-issue-82535.METFqd.rst +++ /dev/null @@ -1,3 +0,0 @@ -:class:`logging.handlers.SysLogHandler` no longer fails -if the address cannot be resolved when the handler is created. -The address is resolved again when a record is emitted. diff --git a/Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst b/Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst deleted file mode 100644 index 532ae22d017a565..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst +++ /dev/null @@ -1,3 +0,0 @@ -:class:`logging.FileHandler` and :class:`logging.handlers.WatchedFileHandler` -now honor :data:`logging.raiseExceptions` for errors that occur while opening -the file, like for other errors during logging. diff --git a/Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst b/Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst deleted file mode 100644 index d8895e32bafe8a9..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :meth:`curses.window.instr` returning one character too few when the -:mod:`curses` module is built against a curses library that counts the -terminator in the requested length, such as the NetBSD one. diff --git a/Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst b/Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst deleted file mode 100644 index 4d8f866366f5beb..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix :mod:`pydoc` for modules whose path contains undecodable bytes. -:func:`!pydoc.writedoc` and the pydoc HTTP server no longer fail with -:exc:`UnicodeEncodeError`: the file URL is now percent-encoded using the -filesystem encoding, and characters unencodable in the generated HTML page -are escaped with backslashes. diff --git a/Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst b/Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst deleted file mode 100644 index 27c97f9bdf07b48..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst +++ /dev/null @@ -1,4 +0,0 @@ -:program:`python -m inspect --details` no longer fails with -:exc:`UnicodeEncodeError` if the path of the module contains characters -unencodable in the encoding of :data:`sys.stdout`. Such characters are now -escaped with backslashes. diff --git a/Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst b/Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst deleted file mode 100644 index 6c990b2eb938452..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst +++ /dev/null @@ -1,3 +0,0 @@ -:func:`warnings.warn_explicit` no longer emits a spurious -:exc:`DeprecationWarning` or raises :exc:`ImportError` when it is called with -the globals of the :mod:`__main__` module. diff --git a/Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst b/Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst deleted file mode 100644 index 34a7ff83a73c0b8..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst +++ /dev/null @@ -1,4 +0,0 @@ -:func:`warnings.warn_explicit` now displays the source line taken from the -loader of the module whose globals are passed as *module_globals*. It also -no longer raises :exc:`IndexError` if *lineno* is out of the range of the -module source. diff --git a/Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst b/Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst deleted file mode 100644 index 03b90b42e8c3e63..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`os.stat` on Windows: trailing dots and spaces, which are ignored -by the operating system, are no longer taken into account when the execute -permissions are guessed from the file extension. diff --git a/Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst b/Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst deleted file mode 100644 index 9218ecfe9ce62e3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :func:`os.path.realpath` on Windows: the ``\\?\`` prefix is no longer -stripped from a volume GUID path, which made the result invalid. diff --git a/Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst b/Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst deleted file mode 100644 index fb647720791dac0..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`os.path.realpath` on Windows: the unresolved part of the path is -now appended, not joined, so a file name which looks like a drive (e.g. -``spam:eggs``) no longer discards the resolved part. A path relative to -another drive is now resolved against the root directory of that drive. diff --git a/Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst b/Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst deleted file mode 100644 index 87f8a7f4a21e66d..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix error handling in :func:`socket.gethostbyaddr` and -:func:`socket.gethostbyname_ex` when hostname resolution fails. diff --git a/Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst b/Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst deleted file mode 100644 index 4d495b9de62fa5a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :mod:`netrc` to distinguish empty quoted tokens from end-of-file, so -malformed files no longer cause the remaining content to be silently ignored. diff --git a/Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst b/Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst deleted file mode 100644 index 69ca0b32e238404..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix crashes when deleting an attribute whose setter is generated by Argument -Clinic and is not prepared for deletion, among them the ``context``, ``owner`` -and ``session`` attributes of ``_ssl._SSLSocket``. -Deleting such attribute now raises :exc:`AttributeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst b/Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst deleted file mode 100644 index 309421ae08240f8..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix a regression in :mod:`imaplib` introduced in the fix for :gh:`63121`: -refreshing the capabilities after a successful :meth:`~imaplib.IMAP4.login` -or :meth:`~imaplib.IMAP4.authenticate` consumed the ``CAPABILITY`` response, -so it could no longer be read with :meth:`~imaplib.IMAP4.response`. diff --git a/Misc/NEWS.d/next/Library/2026-08-15-13-12-09.gh-issue-155835.DsbSmy.rst b/Misc/NEWS.d/next/Library/2026-08-15-13-12-09.gh-issue-155835.DsbSmy.rst deleted file mode 100644 index 7c48daad1c29d8f..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-15-13-12-09.gh-issue-155835.DsbSmy.rst +++ /dev/null @@ -1,3 +0,0 @@ -:mod:`hashlib`: Fix data races when accessing -:attr:`~hashlib.hash.digest_size` and :attr:`~hashlib.hash.block_size` on -SHA-3 objects. Patch by Bénédikt Tran. diff --git a/Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst b/Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst deleted file mode 100644 index 92b4a55692ee50a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix the signatures of :meth:`sqlite3.Connection.execute`, :func:`warnings.warn` -and :func:`locale.setlocale` which rendered ``<unrepresentable>`` instead of the -correct defaults for parameters. diff --git a/Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst b/Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst deleted file mode 100644 index af4c778ece5d703..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix error handling in the :mod:`zoneinfo` accelerator module when a -transition index is ``-1`` or a TZ string's ``__bool__`` raises. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst b/Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst deleted file mode 100644 index 1092a5a53785635..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash when deleting the ``keylog_filename`` attribute of -:class:`ssl.SSLContext`. -It now raises :exc:`AttributeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst b/Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst deleted file mode 100644 index 8c296a9a8919fc3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix crashes in :class:`sqlite3.Connection` when deleting the -:attr:`~sqlite3.Connection.autocommit` attribute or setting it to an integer -which does not fit in C :c:expr:`long`. -Both now raise an exception. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst b/Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst deleted file mode 100644 index ba92df3c5cb6c1d..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst +++ /dev/null @@ -1,4 +0,0 @@ -:mod:`!_ios_support` no longer fails to import when -:func:`ctypes.util.find_library` cannot resolve the ObjC runtime through the -dyld shared cache, as is the case on iOS 13. The runtime is now loaded by name, -which dyld resolves against the cache directly. diff --git a/Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst b/Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst deleted file mode 100644 index 1cc45cc6846713f..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst +++ /dev/null @@ -1,2 +0,0 @@ -:mod:`sqlite3`: Disallow removing the ``row_factory`` attribute of a cursor -to prevent a crash on a query. diff --git a/Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst b/Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst deleted file mode 100644 index 846931a1cab5117..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst +++ /dev/null @@ -1,2 +0,0 @@ -Calling :meth:`zlib.Decompress.flush` on invalid compressed data now -raises :exc:`zlib.error` instead of being silently ignored. diff --git a/Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst b/Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst deleted file mode 100644 index 2417479d333e3e6..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst +++ /dev/null @@ -1,3 +0,0 @@ -:mod:`ssl`: A failed assignment or deletion of the ``_msg_callback`` -attribute of :class:`ssl.SSLContext` no longer removes the current callback. -Deleting it now raises :exc:`AttributeError` instead of :exc:`TypeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst b/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst deleted file mode 100644 index 0dd925cf596277a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst +++ /dev/null @@ -1 +0,0 @@ -Fix :mod:`configparser` parsing when using whitespace in *delimiters*. diff --git a/Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst b/Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst deleted file mode 100644 index cae73e534c47ddd..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix matching of a negated character set in a bytes pattern compiled with both -:const:`re.IGNORECASE` and :const:`re.LOCALE`. The case closure is now applied -to the members of the set, so that ``[^bc]`` no longer matches ``b'B'``. diff --git a/Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst b/Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst deleted file mode 100644 index c92fce3bc05969a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst +++ /dev/null @@ -1,3 +0,0 @@ -The pure Python implementation of :meth:`queue.SimpleQueue.get` now ignores -*timeout* when *block* is false, matching the documented behavior and -the C implementation. It previously raised :exc:`ValueError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst b/Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst deleted file mode 100644 index 3f2f105116c1838..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`xml.dom` and :mod:`xml.etree.ElementTree` no longer treat characters -which are not white space in XML (such as U+00A0) as white space. Previously -they could be lost in :func:`~xml.etree.ElementTree.indent`, -:func:`~xml.etree.ElementTree.canonicalize` with ``strip_text=True``, and when -parsing with the ``whitespace-in-element-content`` feature turned off. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst b/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst deleted file mode 100644 index f47da0453249cad..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :class:`asyncio.ProactorEventLoop` UDP transports so that a -:exc:`ConnectionResetError` raised by ``WSARecvFrom`` no longer stops the -read loop. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-156698.gyDxUe.rst b/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-156698.gyDxUe.rst deleted file mode 100644 index 4e3a292ce9b8217..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-156698.gyDxUe.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :class:`asyncio.ProactorEventLoop` UDP transports so that a write -error no longer strands a paused protocol: the write loop is now -rescheduled when data remains buffered, and the protocol is resumed -when the buffer has drained. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst b/Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst deleted file mode 100644 index 1d21fc70fd9256f..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`!nturl2path.pathname2url` and :func:`!nturl2path.url2pathname`: -the filesystem encoding and error handler are now used for percent-encoding -and decoding, as in :mod:`urllib.request`. Previously paths containing -surrogate characters raised :exc:`UnicodeEncodeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst b/Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst deleted file mode 100644 index 37a8c0b620310a3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix :func:`xml.etree.ElementTree.parse` with a text file or other source -of :class:`str` data in the C implementation. -The encoding declared in the document was applied to the already decoded -text, which produced mojibake. It is now ignored, as when parsing with -:meth:`!XMLParser.feed` or :func:`~xml.etree.ElementTree.fromstring`. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst b/Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst deleted file mode 100644 index c6e2c77897cbc29..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst +++ /dev/null @@ -1,4 +0,0 @@ -:mod:`xml.etree.ElementTree` now accepts input larger than 2 GiB -in the C implementation. -The data is fed to Expat in chunks, as :mod:`xml.parsers.expat` already did, -instead of raising :exc:`OverflowError`. diff --git a/Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst b/Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst deleted file mode 100644 index 7879ac7e71c71d9..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :class:`xml.sax.saxutils.XMLGenerator`: the namespace URI is now escaped -in the namespace declaration. Previously a URI containing ``&``, ``<`` or a -quote character produced a document which cannot be parsed. diff --git a/Misc/NEWS.d/next/Library/2026-09-04-09-18-05.gh-issue-156920.lONsKT.rst b/Misc/NEWS.d/next/Library/2026-09-04-09-18-05.gh-issue-156920.lONsKT.rst deleted file mode 100644 index f6bcf0cd54a6678..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-04-09-18-05.gh-issue-156920.lONsKT.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix :mod:`asyncio` on Windows: closing a :class:`~asyncio.DatagramTransport` -under :class:`~asyncio.ProactorEventLoop` while datagrams were still queued, -or while an in-flight write failed right as ``close()`` was draining the -buffer, could strand the queued data and never call ``connection_lost()``, -hanging the close indefinitely. diff --git a/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst b/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst deleted file mode 100644 index 5b72fd3561e804c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user -pointer runs while the panel is being deallocated. The panel is now taken -off the panel stack before its user pointer is dropped. diff --git a/Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst b/Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst deleted file mode 100644 index dd60841efe821c2..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst +++ /dev/null @@ -1 +0,0 @@ -Set the docstring of :attr:`unittest.mock.Mock.return_value`. diff --git a/Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst b/Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst deleted file mode 100644 index 20ded0775d7a70a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`tkinter.font.nametofont` and the :class:`tkinter.font.Font` -constructor for a font name returned by Tk as a Tcl object, -for example by :meth:`ttk.Style.lookup() <tkinter.ttk.Style.lookup>`. diff --git a/Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst b/Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst deleted file mode 100644 index 1638968e475ca4a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst +++ /dev/null @@ -1,2 +0,0 @@ -Preserve the position and contents of :class:`io.BytesIO` when -:meth:`!BytesIO.__init__` fails because a buffer is exported. diff --git a/Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst b/Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst deleted file mode 100644 index afe1dffa96b403d..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix incorrect integer return values from :mod:`ctypes` callbacks on some -platforms, such as s390x. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst b/Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst deleted file mode 100644 index 982c4afb43dac11..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst +++ /dev/null @@ -1,2 +0,0 @@ -The usage message printed by ``python -m tabnanny`` when no arguments are -given now suggests ``python -m`` instead of the source file. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst b/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst deleted file mode 100644 index a21386803cca0f4..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`zipfile` again reads members through a third-party decompressor -installed by monkey-patching the private ``_get_decompressor()`` to return an -object that only implements old BZ2Decompressor API from Python 3.3. -Note that decompressors without ``needs_input`` and two-argument -``decompress()`` are vulnerable to :cve:`2026-15310`. diff --git a/Misc/NEWS.d/next/Library/2026-09-11-14-14-51.gh-issue-157301.QxcE2r.rst b/Misc/NEWS.d/next/Library/2026-09-11-14-14-51.gh-issue-157301.QxcE2r.rst deleted file mode 100644 index 9a1d2e435be9066..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-11-14-14-51.gh-issue-157301.QxcE2r.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :class:`asyncio.Task` hanging the event loop when an eager start fails -to enter the task's context. diff --git a/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst b/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst deleted file mode 100644 index a5adf101c9dad3c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix an out-of-bounds read in the ``hz`` incremental decoder when the input -ends with ``~``. diff --git a/Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst b/Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst deleted file mode 100644 index 53f2bf561eefbb7..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix the Python implementation of :class:`xml.etree.ElementTree.XMLParser`: -the ``doctype()`` method of the target is now called for a document type -declaration without an external identifier, like ``<!DOCTYPE html>``, -as in the C implementation. diff --git a/Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst b/Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst deleted file mode 100644 index fb0bcad30605640..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix out-of-bounds write in ``mmap.mmap.__setitem__`` that could occur -when converting the index or the assigned value (via :meth:`~object.__index__` -for a single item, or via the buffer protocol for a slice) resized or closed the mmap -object during the assignment. diff --git a/Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst b/Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst deleted file mode 100644 index 45e3fedf4ca3278..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :mod:`gettext` plural form selection when the ``Plural-Forms`` expression -combines the unary ``!`` operator with a binary operator, for example -``!n + 1`` or ``2 * !n``. The latter raised :exc:`SyntaxError`. diff --git a/Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst b/Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst deleted file mode 100644 index 87fd4a7aedee846..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst +++ /dev/null @@ -1,4 +0,0 @@ -:meth:`code.InteractiveInterpreter.runsource` and the REPL now report any -exception raised by compiling the source, such as :exc:`MemoryError` or -:exc:`RecursionError` for too deeply nested source, instead of propagating -it or printing a traceback of the REPL internals. diff --git a/Misc/NEWS.d/next/Library/2026-09-16-14-04-38.gh-issue-157621.R6v2S8.rst b/Misc/NEWS.d/next/Library/2026-09-16-14-04-38.gh-issue-157621.R6v2S8.rst deleted file mode 100644 index b8342da0faebb91..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-16-14-04-38.gh-issue-157621.R6v2S8.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash when a weak-reference callback is attached to a -:class:`typing.ParamSpecArgs` or :class:`typing.ParamSpecKwargs` instance. diff --git a/Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst b/Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst deleted file mode 100644 index de1fd1286d7a574..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in :mod:`!cProfile` when an external timer re-enters the -profiler. Profiling events raised while the external timer runs are now -ignored. diff --git a/Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst b/Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst deleted file mode 100644 index a751a2f9dc406b1..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :mod:`tkinter` on macOS: creating a :class:`~tkinter.Tk` instance no -longer replaces the Python handlers of SIGINT, SIGHUP and SIGTERM with Tk's -handler which exits the process, so Ctrl-C raises :exc:`KeyboardInterrupt` -again. diff --git a/Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst b/Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst deleted file mode 100644 index 7c965451c056a44..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :attr:`zlib.Decompress.unconsumed_tail` duplicating -:attr:`~zlib.Decompress.unused_data` after end of stream when *max_length* was used. diff --git a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst b/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst deleted file mode 100644 index dbc2119640702c9..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr` -credentials to the URL scheme, preventing credentials stored for an HTTPS -URL from being used for a matching HTTP URL, while URIs without a scheme -continue to match any scheme. diff --git a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst b/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst deleted file mode 100644 index 7a81a8ba1eef1cd..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst +++ /dev/null @@ -1,2 +0,0 @@ -Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not -consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. diff --git a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst b/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst deleted file mode 100644 index 0cc620b3fdca205..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst +++ /dev/null @@ -1,7 +0,0 @@ -Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` -switches a connection to another :class:`~ssl.SSLContext` and the context -that carries the callback is no longer referenced by the application. -Servers that keep their ``sni_callback`` context alive (the usual case when -it wraps the listening socket or is stored on the server object) were not -affected. -This addresses :cve:`2026-19445`. diff --git a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst deleted file mode 100644 index 59b725e55bbffda..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating -directories outside the destination for members whose name leaves the -destination and returns to it, such as ``../evil/../dest/sub/file``. The -containment check used the resolved path, but intermediate directories were -created from the name as given. diff --git a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst b/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst deleted file mode 100644 index 4e49ad5ce8fa00a..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst +++ /dev/null @@ -1,4 +0,0 @@ -Bound the amount of data :mod:`zipfile` decompresses per read for members -compressed with bzip2, LZMA, or Zstandard, matching the existing limit for -deflate. A small archive member could previously expand into an unbounded -allocation even when read in small chunks. diff --git a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst b/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst deleted file mode 100644 index 5b3ea77cb368632..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst +++ /dev/null @@ -1 +0,0 @@ -Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.5. diff --git a/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst b/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst deleted file mode 100644 index 3dffa3bf5b5a5a8..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fixed a vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction -filters where a crafted archive using a hard link to a symbolic link could -change the permissions and modification time of a file outside the -destination directory, and expose its contents inside the extracted tree. -This addresses :cve:`2026-82049`. diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst deleted file mode 100644 index ba27e47f734bfb1..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst +++ /dev/null @@ -1,3 +0,0 @@ -In :mod:`tarfile`, when extracting a link falls back to extracting a member -of the archive, skip the member when the filter function returns None when -called with the extracted member's name replaced with the link's. diff --git a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst b/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst deleted file mode 100644 index 2a521dbc9dc4e68..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst +++ /dev/null @@ -1,9 +0,0 @@ -:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, -*server_hostname* and *session* arguments similar to -:meth:`ssl.SSLContext.wrap_socket`. - -In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled -and no *server_hostname* passed to :meth:`!wrap_bio` now raises :exc:`ValueError` -instead of completing a handshake that verified the certificate chain -without verifying the peer's identity, with no indication that the -check had been skipped. diff --git a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst b/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst deleted file mode 100644 index 42a31b3c28f5ce1..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst +++ /dev/null @@ -1,4 +0,0 @@ -:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and -:meth:`loop.create_connection() <asyncio.loop.create_connection>` now -validate the *server_hostname* argument if an :class:`ssl.SSLContext` is -passed with *check_hostname* set to ``True``. diff --git a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst b/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst deleted file mode 100644 index f17a3f68b93e855..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix a crash or incorrect output that could occur when formatting a -:class:`float` or :class:`complex` with a precision close to the platform's -``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` for -any precision of that magnitude, regardless of presentation type or value, as -the format string parsers already did for precisions above ``INT_MAX``. diff --git a/Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst b/Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst deleted file mode 100644 index ff71f7a90a021b6..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst +++ /dev/null @@ -1,4 +0,0 @@ -The list of tests which altered the execution environment now includes the -reasons why the environment was considered altered, for example an unraisable -exception or a modified :data:`sys.path`. The final result no longer repeats -the same state twice (like ``ENV CHANGED then ENV CHANGED``). diff --git a/Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst b/Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst deleted file mode 100644 index 50f684052526051..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`!test.support.subTests` for asynchronous test methods. They were -wrapped in a synchronous function, which discarded the coroutine without -awaiting it, so the test silently did not run at all. diff --git a/Misc/NEWS.d/next/Tests/2026-08-18-10-16-44.gh-issue-75876.PEZplM.rst b/Misc/NEWS.d/next/Tests/2026-08-18-10-16-44.gh-issue-75876.PEZplM.rst deleted file mode 100644 index 438911cd3877795..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-08-18-10-16-44.gh-issue-75876.PEZplM.rst +++ /dev/null @@ -1,5 +0,0 @@ -A test decorated with :func:`~test.support.bigmemtest` now runs in a -subprocess if it really allocates the memory it asks for (that is, if the -``-M`` option is used), so that the memory it uses and the address space it -fragments are released when it ends. A dummy run stays in the process. The -separate memory watchdog process is no longer used. diff --git a/Misc/NEWS.d/next/Tests/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst b/Misc/NEWS.d/next/Tests/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst deleted file mode 100644 index e55c531130055b0..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`!test.support.interpreters.list_all`. It failed if an interpreter -was destroyed during the call, in particular by a garbage collection which -finalized the object owning the last reference to it. diff --git a/Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst b/Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst deleted file mode 100644 index 202fb12086210c7..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst +++ /dev/null @@ -1 +0,0 @@ -The iOS testbed has been updated for compatibilty with Xcode 27. diff --git a/Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst b/Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst deleted file mode 100644 index 3ea0a37288fe880..000000000000000 --- a/Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix Argument Clinic for ``@getter`` and ``@setter`` in a preprocessor -conditional block. -It failed with an internal error. -Argument Clinic now also rejects the accessors of the same attribute with -different C basenames, and the same accessor defined twice, which silently -generated invalid or duplicated entries of :c:type:`PyGetSetDef`. diff --git a/Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst b/Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst deleted file mode 100644 index 06bba3e1f3d8558..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst +++ /dev/null @@ -1,4 +0,0 @@ -:func:`os.device_encoding` on Windows now returns the code page of any -console file descriptor, not only 0, 1 and 2, and returns ``None`` for other -character devices like ``NUL``. The UTF-8 code page is now reported as -``"utf-8"`` instead of ``"cp65001"``. diff --git a/Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst b/Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst deleted file mode 100644 index 1cbf188c12e4070..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix the encoding of the standard streams in the legacy Windows stdio mode -(:envvar:`PYTHONLEGACYWINDOWSSTDIO`). It is now the code page of the -console, as in Python 3.7, not the ANSI code page. diff --git a/Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst b/Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst deleted file mode 100644 index 95c771823ab77f5..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst +++ /dev/null @@ -1,3 +0,0 @@ -Reading from the console on Windows now continues if the read was cancelled -by Ctrl+C, but the :const:`~signal.SIGINT` handler did not raise an -exception. Previously the read ended as if at end of file. diff --git a/Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst b/Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst deleted file mode 100644 index 92435a86b426ab2..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst +++ /dev/null @@ -1,2 +0,0 @@ -Updated Windows builds to use OpenSSL 3.5.9, jumping from the 3.0 series -to 3.5 after 3.0's end of public support in September 2026. diff --git a/Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst b/Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst deleted file mode 100644 index 1475e331d9e1b4f..000000000000000 --- a/Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst +++ /dev/null @@ -1,2 +0,0 @@ -Updated macOS installer to use OpenSSL 3.5.9, jumping from the 3.0 series -to 3.5 after 3.0's end of public support in September 2026. diff --git a/README.rst b/README.rst index 957d8b1fe1ce44a..7501701fd3cd147 100644 --- a/README.rst +++ b/README.rst @@ -1,5 +1,5 @@ -This is Python version 3.13.15+ -=============================== +This is Python version 3.13.16 +============================== .. image:: https://github.com/python/cpython/workflows/Tests/badge.svg :alt: CPython build status on GitHub Actions

1 0

Python 3.14.8
by hugovk Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/8e6e75d9102e39bed2a2b279203a396741… commit: 8e6e75d9102e39bed2a2b279203a396741180f12 branch: 3.14 author: Hugo van Kemenade <1324225+hugovk(a)users.noreply.github.com> committer: hugovk <1324225+hugovk(a)users.noreply.github.com> date: 2026-09-30T20:55:09+03:00 summary: Python 3.14.8 files: A Misc/NEWS.d/3.14.8.rst D Misc/NEWS.d/next/Build/2026-02-10-18-26-04.gh-issue-144679.FIH73W.rst D Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst D Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst D Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst D Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst D Misc/NEWS.d/next/Build/2026-09-19-16-54-58.gh-issue-157549.uk6QNH.rst D Misc/NEWS.d/next/Build/2026-09-29-09-40-25.gh-issue-158010.H4Top_.rst D Misc/NEWS.d/next/C_API/2026-08-25-12-00-00.gh-issue-131740.Ft7Rz2.rst D Misc/NEWS.d/next/C_API/2026-08-31-19-14-15.gh-issue-156101.d4PSIF.rst D Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst D Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-04-26-15-08-53.gh-issue-148817.cuN07H.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-07-27-17-20-49.gh-issue-154719.eI88Gs.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-11-47-15.gh-issue-154902.DIi6sf.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-17-55-29.gh-issue-154937.m9IBba.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-01-45-24.gh-issue-129752.Zo3OUx.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-13-50-35.gh-issue-155504.PsTqZm.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-20-22-13-20.gh-issue-156126.pXm4Qr.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-26-01-08-38.gh-issue-156371.USpwKG.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-08-31-10-45-11.gh-issue-156689.Jq3xNv.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-12-22-29-51.gh-issue-157377.O6WYlM.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-10-43-24.gh-issue-156762.Kbf2mo.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-12-46-10.gh-issue-157378.Rg7Tq2.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-22-12-00-00.gh-issue-157838.brcMrg.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst D Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst D Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst D Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst D Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst D Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst D Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst D Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst D Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst D Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst D Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst D Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst D Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst D Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst D Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst D Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst D Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst D Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst D Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst D Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst D Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst D Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst D Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst D Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst D Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst D Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst D Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst D Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst D Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst D Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst D Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst D Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst D Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst D Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst D Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst D Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst D Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst D Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst D Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst D Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst D Misc/NEWS.d/next/Library/2026-02-11-16-47-27.gh-issue-140729.2uTPQp.rst D Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst D Misc/NEWS.d/next/Library/2026-06-09-12-00-00.gh-issue-150771.K7mNx2.rst D Misc/NEWS.d/next/Library/2026-06-22-18-01-00.gh-issue-151955.6u5iwm.rst D Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst D Misc/NEWS.d/next/Library/2026-07-02-19-21-15.gh-issue-152068.ThsmJU.rst D Misc/NEWS.d/next/Library/2026-07-05-17-39-16.gh-issue-153133.kKSH7g.rst D Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst D Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst D Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst D Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst D Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst D Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst D Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst D Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst D Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst D Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst D Misc/NEWS.d/next/Library/2026-07-29-19-48-59.gh-issue-154871.tgZILS.rst D Misc/NEWS.d/next/Library/2026-08-03-22-46-07.gh-issue-155143.9-byZp.rst D Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst D Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst D Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst D Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst D Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst D Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst D Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst D Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst D Misc/NEWS.d/next/Library/2026-08-10-13-27-36.gh-issue-155519.9M6SFX.rst D Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst D Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst D Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst D Misc/NEWS.d/next/Library/2026-08-16-11-38-17.gh-issue-155888.pO-nAp.rst D Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst D Misc/NEWS.d/next/Library/2026-08-17-21-00-00.gh-issue-155941.strmCb.rst D Misc/NEWS.d/next/Library/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst D Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst D Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst D Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst D Misc/NEWS.d/next/Library/2026-08-20-12-10-00.gh-issue-156101.Qb2xNv.rst D Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst D Misc/NEWS.d/next/Library/2026-08-20-16-30-00.gh-issue-156124.Kq3vXz.rst D Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst D Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst D Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst D Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst D Misc/NEWS.d/next/Library/2026-08-26-12-48-10.gh-issue-156408.-Yd0k7.rst D Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst D Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst D Misc/NEWS.d/next/Library/2026-08-28-18-10-25.gh-issue-156523.llJqo9.rst D Misc/NEWS.d/next/Library/2026-08-30-13-25-53.gh-issue-156512.tVTOIV.rst D Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst D Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst D Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst D Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst D Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst D Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst D Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst D Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst D Misc/NEWS.d/next/Library/2026-09-05-18-23-30.gh-issue-156988.nEUQE6.rst D Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst D Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst D Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst D Misc/NEWS.d/next/Library/2026-09-07-12-24-11.gh-issue-157058.2SoQU7.rst D Misc/NEWS.d/next/Library/2026-09-08-04-10-00.gh-issue-123018.hV2kQe.rst D Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst D Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst D Misc/NEWS.d/next/Library/2026-09-09-13-46-38.gh-issue-157213.rYg7pO.rst D Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst D Misc/NEWS.d/next/Library/2026-09-13-07-14-35.gh-issue-128509.9F2GCE.rst D Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst D Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst D Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst D Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst D Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst D Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst D Misc/NEWS.d/next/Library/2026-09-18-12-00-00.gh-issue-157660.tlbc.rst D Misc/NEWS.d/next/Library/2026-09-19-14-10-18.gh-issue-157788.v70Lxd.rst D Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst D Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst D Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst D Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst D Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst D Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst D Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst D Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst D Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst D Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst D Misc/NEWS.d/next/Tests/2026-01-21-02-03-31.gh-issue-142414.CfcgiR.rst D Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst D Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst D Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst D Misc/NEWS.d/next/Tools-Demos/2026-08-04-17-12-33.gh-issue-64502.Qv7mLp.rst D Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst D Misc/NEWS.d/next/Tools-Demos/2026-09-30-06-55-37.gh-issue-158451.pZE56z.rst D Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst D Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst D Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst D Misc/NEWS.d/next/Windows/2026-09-12-18-59-21.gh-issue-157368.2DirHP.rst D Misc/NEWS.d/next/Windows/2026-09-29-09-56-14.gh-issue-158010.MPQX4w.rst D Misc/NEWS.d/next/macOS/2026-09-29-09-29-17.gh-issue-158010.2zJnoj.rst M Doc/library/asyncio-eventloop.rst M Doc/library/asyncio-stream.rst M Doc/library/ssl.rst M Doc/library/tarfile.rst M Doc/library/urllib.request.rst M Include/patchlevel.h M Lib/pydoc_data/module_docs.py M Lib/pydoc_data/topics.py M README.rst diff --git a/Doc/library/asyncio-eventloop.rst b/Doc/library/asyncio-eventloop.rst index f4bc696d9cd5799..18447a7e49eda56 100644 --- a/Doc/library/asyncio-eventloop.rst +++ b/Doc/library/asyncio-eventloop.rst @@ -592,7 +592,7 @@ Opening network connections .. versionchanged:: 3.12 *all_errors* was added. - .. versionchanged:: next + .. versionchanged:: 3.14.8 Raises a ``ValueError`` if ``ssl.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. diff --git a/Doc/library/asyncio-stream.rst b/Doc/library/asyncio-stream.rst index 8472bb6e02e1b1a..7cd5e010c79e2d5 100644 --- a/Doc/library/asyncio-stream.rst +++ b/Doc/library/asyncio-stream.rst @@ -418,7 +418,7 @@ StreamWriter .. versionchanged:: 3.12 Added the *ssl_shutdown_timeout* parameter. - .. versionchanged:: next + .. versionchanged:: 3.14.8 Raises a ``ValueError`` if ``sslcontext.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 91df617d3e1da1a..43f07bbfab44966 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -1751,7 +1751,7 @@ to speed up repeated connections from the same clients. .. versionadded:: 3.7 - .. versionchanged:: next + .. versionchanged:: 3.14.8 After the callback assigns a new :attr:`SSLSocket.context`, later ClientHello messages on the connection are dispatched to the new context's *sni_callback*. @@ -1890,7 +1890,7 @@ to speed up repeated connections from the same clients. The method returns an instance of :attr:`SSLContext.sslobject_class` instead of hard-coded :class:`SSLObject`. - .. versionchanged:: next + .. versionchanged:: 3.14.8 The *server_side*, *server_hostname* and *session* parameters are now validated as :meth:`SSLContext.wrap_socket` validates them. Previously a context with :attr:`~SSLContext.check_hostname` enabled and no diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index bbb913eec89f8bc..0d4665d3761037a 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -1112,7 +1112,7 @@ reused in custom filters: Return the modified ``TarInfo`` member. - .. versionchanged:: next + .. versionchanged:: 3.14.8 Filenames containing ``..`` components are now normalized. diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst index f1308dd568fd0cd..80d4cbb83bfebbe 100644 --- a/Doc/library/urllib.request.rst +++ b/Doc/library/urllib.request.rst @@ -996,7 +996,7 @@ These methods are available on :class:`HTTPPasswordMgr` and match authentication URIs with the same scheme or no scheme. A URI without a scheme matches authentication URIs with any scheme. - .. versionchanged:: next + .. versionchanged:: 3.14.8 Authentication credentials for URIs with a scheme are now scoped by that scheme. diff --git a/Include/patchlevel.h b/Include/patchlevel.h index ffc9821fea5f1e2..d0e488a4ddaa59b 100644 --- a/Include/patchlevel.h +++ b/Include/patchlevel.h @@ -19,12 +19,12 @@ /*--start constants--*/ #define PY_MAJOR_VERSION 3 #define PY_MINOR_VERSION 14 -#define PY_MICRO_VERSION 7 +#define PY_MICRO_VERSION 8 #define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL #define PY_RELEASE_SERIAL 0 /* Version as a string */ -#define PY_VERSION "3.14.7+" +#define PY_VERSION "3.14.8" /*--end constants--*/ diff --git a/Lib/pydoc_data/module_docs.py b/Lib/pydoc_data/module_docs.py index 2d3543f298376bb..705dfb7da790655 100644 --- a/Lib/pydoc_data/module_docs.py +++ b/Lib/pydoc_data/module_docs.py @@ -1,4 +1,4 @@ -# Autogenerated by Sphinx on Wed Aug 5 13:29:41 2026 +# Autogenerated by Sphinx on Wed Sep 30 20:53:51 2026 # as part of the release process. module_docs = { diff --git a/Lib/pydoc_data/topics.py b/Lib/pydoc_data/topics.py index 753d9d430693869..0d702aa5d722f5b 100644 --- a/Lib/pydoc_data/topics.py +++ b/Lib/pydoc_data/topics.py @@ -1,4 +1,4 @@ -# Autogenerated by Sphinx on Wed Aug 5 13:29:41 2026 +# Autogenerated by Sphinx on Wed Sep 30 20:53:51 2026 # as part of the release process. topics = { @@ -1851,7 +1851,7 @@ class attributes; they are shared by instances. Instance attributes iterable. The first item provided by the iterator is then assigned to the target list using the standard rules for assignments (see Assignment statements), and the suite is executed. This repeats for -each item provided by the iterator. When the iterator is exhausted, +each item provided by the iterator. When the iterator is *exhausted*, the suite in the "else" clause, if present, is executed, and the loop terminates. @@ -2832,7 +2832,7 @@ def foo(): | parameter_list_no_posonly parameter_list_no_posonly: defparameter ("," defparameter)* ["," [parameter_list_starargs]] | parameter_list_starargs - parameter_list_starargs: "*" [star_parameter] ("," defparameter)* ["," [parameter_star_kwargs]] + parameter_list_starargs: "*" star_parameter ("," defparameter)* ["," [parameter_star_kwargs]] | "*" ("," defparameter)+ ["," [parameter_star_kwargs]] | parameter_star_kwargs parameter_star_kwargs: "**" parameter [","] @@ -4686,7 +4686,7 @@ def middle(): def inner(x): 1 / x - out() + out() calling "pdb.pm()" will allow to move between exceptions: @@ -5497,7 +5497,7 @@ class of the instance or a *non-virtual base class* thereof. The iterable. The first item provided by the iterator is then assigned to the target list using the standard rules for assignments (see Assignment statements), and the suite is executed. This repeats for -each item provided by the iterator. When the iterator is exhausted, +each item provided by the iterator. When the iterator is *exhausted*, the suite in the "else" clause, if present, is executed, and the loop terminates. @@ -6096,7 +6096,7 @@ class of the instance or a *non-virtual base class* thereof. The | parameter_list_no_posonly parameter_list_no_posonly: defparameter ("," defparameter)* ["," [parameter_list_starargs]] | parameter_list_starargs - parameter_list_starargs: "*" [star_parameter] ("," defparameter)* ["," [parameter_star_kwargs]] + parameter_list_starargs: "*" star_parameter ("," defparameter)* ["," [parameter_star_kwargs]] | "*" ("," defparameter)+ ["," [parameter_star_kwargs]] | parameter_star_kwargs parameter_star_kwargs: "**" parameter [","] @@ -10754,7 +10754,7 @@ class is used in a class pattern with positional arguments, each characters are those characters defined in the Unicode character database as “Letter”, i.e., those with general category property being one of “Lm”, “Lt”, “Lu”, “Ll”, or “Lo”. Note that this is - different from the Alphabetic property defined in the section 4.10 + different from the Alphabetic property defined in section 4.10 ‘Letters, Alphabetic, and Ideographic’ of the Unicode Standard. For example: @@ -11162,9 +11162,9 @@ class is used in a class pattern with positional arguments, each Return a list of the words in the string, using *sep* as the delimiter string. If *maxsplit* is given, at most *maxsplit* splits are done, the *rightmost* ones. If *sep* is not specified or - "None", any whitespace string is a separator. Except for splitting - from the right, "rsplit()" behaves like "split()" which is - described in detail below. + "None", any "whitespace" string is a separator. Except for + splitting from the right, "rsplit()" behaves like "split()" which + is described in detail below. str.rstrip(chars=None, /) @@ -11216,7 +11216,7 @@ class is used in a class pattern with positional arguments, each ['1', '2', '3<4'] If *sep* is not specified or is "None", a different splitting - algorithm is applied: runs of consecutive whitespace are regarded + algorithm is applied: runs of consecutive "whitespace" are regarded as a single separator, and the result will contain no empty strings at the start or end if the string has leading or trailing whitespace. Consequently, splitting an empty string or a string @@ -12914,12 +12914,12 @@ def foo(): Generator functions ------------------- -A function or method which uses the "yield" statement (see section The -yield statement) is called a *generator function*. Such a function, +A function or method which contains a "yield" expression (see section +Yield expressions) is called a *generator function*. Such a function, when called, always returns an *iterator* object which can be used to execute the body of the function: calling the iterator’s "iterator.__next__()" method will cause the function to execute until -it provides a value using the "yield" statement. When the function +it provides a value using the "yield" expression. When the function executes a "return" statement or falls off the end, a "StopIteration" exception is raised and the iterator will have reached the end of the set of values to be returned. @@ -12938,11 +12938,11 @@ def foo(): Asynchronous generator functions -------------------------------- -A function or method which is defined using "async def" and which uses -the "yield" statement is called a *asynchronous generator function*. -Such a function, when called, returns an *asynchronous iterator* -object which can be used in an "async for" statement to execute the -body of the function. +A function or method which is defined using "async def" and which +contains a "yield" expression is called a *asynchronous generator +function*. Such a function, when called, returns an *asynchronous +iterator* object which can be used in an "async for" statement to +execute the body of the function. Calling the asynchronous iterator’s "aiterator.__anext__" method will return an *awaitable* which when awaited will execute until it @@ -13518,6 +13518,15 @@ class instance has a namespace implemented as a dictionary which is | | version 3.12: This attribute of code objects is | | | deprecated, and may be removed in Python 3.15. | +----------------------------------------------------+----------------------------------------------------+ +| codeobject.co_linetable | A "bytes" object containing encoded source | +| | location information. The exact format is an | +| | implementation detail and may change between | +| | Python versions. Use "co_lines()" and | +| | "co_positions()" for supported access to line and | +| | position information. To create a modified copy of | +| | a code object, use "replace()". Added in version | +| | 3.10. | ++----------------------------------------------------+----------------------------------------------------+ | codeobject.co_stacksize | The required stack size of the code object | +----------------------------------------------------+----------------------------------------------------+ | codeobject.co_flags | An "integer" encoding a number of flags for the | @@ -13845,6 +13854,8 @@ class instance has a namespace implemented as a dictionary which is Mappings are mutable objects. There is currently only one standard mapping type, the *dictionary*. (For other containers see the built- in "list", "set", and "tuple" classes, and the "collections" module.) +See Time complexity of operations on built-in types for the costs of +the various dictionary operations. A dictionary’s keys are *almost* arbitrary values. Values that are not *hashable*, that is, values containing lists, dictionaries or @@ -14240,7 +14251,7 @@ class dict(iterable, /, **kwargs) Methods are functions that are called using the attribute notation. There are two flavors: built-in methods (such as "append()" on lists) -and class instance method. Built-in methods are described with the +and class instance methods. Built-in methods are described with the types that support them. If you access a method (a function defined in a class namespace) @@ -14324,6 +14335,9 @@ class dict(iterable, /, **kwargs) operations have the same priority as the corresponding numeric operations. [3] +See Time complexity of operations on built-in types for the costs of +the various sequence operations. + +----------------------------+----------------------------------+------------+ | Operation | Result | Notes | |============================|==================================|============| @@ -14589,8 +14603,8 @@ class dict(iterable, /, **kwargs) sequence.pop(index=-1, /) - Retrieve the item at *index* and also removes it from *sequence*. - By default, the last item in *sequence* is removed and returned. + Retrieve the item at *index* and also remove it from *sequence*. By + default, the last item in *sequence* is removed and returned. sequence.remove(value, /) @@ -14948,8 +14962,8 @@ class range(start, stop, step=1, /) sequence.pop(index=-1, /) - Retrieve the item at *index* and also removes it from *sequence*. - By default, the last item in *sequence* is removed and returned. + Retrieve the item at *index* and also remove it from *sequence*. By + default, the last item in *sequence* is removed and returned. sequence.remove(value, /) diff --git a/Misc/NEWS.d/3.14.8.rst b/Misc/NEWS.d/3.14.8.rst new file mode 100644 index 000000000000000..94b31bfd30ae40e --- /dev/null +++ b/Misc/NEWS.d/3.14.8.rst @@ -0,0 +1,1907 @@ +.. date: 2026-09-29-16-32-46 +.. gh-issue: 158446 +.. nonce: dToaPr +.. release date: 2026-09-30 +.. section: Security + +Fix a crash or incorrect output that could occur when formatting a +:class:`float` or :class:`complex` with a precision close to the platform's +``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` +for any precision of that magnitude, regardless of presentation type or +value, as the format string parsers already did for precisions above +``INT_MAX``. + +.. + +.. date: 2026-09-23-11-34-30 +.. gh-issue: 156793 +.. nonce: zC_AjF +.. section: Security + +:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and +:meth:`loop.create_connection() <asyncio.loop.create_connection>` now +validate the *server_hostname* argument if an :class:`ssl.SSLContext` is +passed with *check_hostname* set to ``True``. + +.. + +.. date: 2026-09-16-14-05-19 +.. gh-issue: 156793 +.. nonce: Qa1T5Z +.. section: Security + +:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, +*server_hostname* and *session* arguments similar to +:meth:`ssl.SSLContext.wrap_socket`. + +In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled +and no *server_hostname* passed to :meth:`!wrap_bio` now raises +:exc:`ValueError` instead of completing a handshake that verified the +certificate chain without verifying the peer's identity, with no indication +that the check had been skipped. + +.. + +.. date: 2026-08-31-16-47-33 +.. gh-issue: 157953 +.. nonce: KxCF5N +.. section: Security + +Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.5. + +.. + +.. date: 2026-08-18-13-54-05 +.. gh-issue: 156002 +.. nonce: CcWXPP +.. section: Security + +Bound the amount of data :mod:`zipfile` decompresses per read for members +compressed with bzip2, LZMA, or Zstandard, matching the existing limit for +deflate. A small archive member could previously expand into an unbounded +allocation even when read in small chunks. + +.. + +.. date: 2026-08-13-13-08-11 +.. gh-issue: 155999 +.. nonce: Xt4rWq +.. section: Security + +Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating +directories outside the destination for members whose name leaves the +destination and returns to it, such as ``../evil/../dest/sub/file``. The +containment check used the resolved path, but intermediate directories were +created from the name as given. + +.. + +.. date: 2026-08-10-12-00-00 +.. gh-issue: 156293 +.. nonce: sNIcbk +.. section: Security + +Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` +switches a connection to another :class:`~ssl.SSLContext` and the context +that carries the callback is no longer referenced by the application. +Servers that keep their ``sni_callback`` context alive (the usual case when +it wraps the listening socket or is stored on the server object) were not +affected. This addresses :cve:`2026-19445`. + +.. + +.. date: 2026-08-06-11-43-20 +.. gh-issue: 155292 +.. nonce: j4pHBO +.. section: Security + +Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not +consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. + +.. + +.. date: 2026-07-31-16-20-17 +.. gh-issue: 155694 +.. nonce: SsxlKG +.. section: Security + +Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr` +credentials to the URL scheme, preventing credentials stored for an HTTPS +URL from being used for a matching HTTP URL, while URIs without a scheme +continue to match any scheme. + +.. + +.. date: 2026-09-28-18-58-27 +.. gh-issue: 158364 +.. nonce: jBqmTs +.. section: Core and Builtins + +Fix crash when :func:`sys._current_frames` or +:func:`sys._current_exceptions` is called while another interpreter is +running. + +.. + +.. date: 2026-09-26-15-39-32 +.. gh-issue: 158254 +.. nonce: qT7vRk +.. section: Core and Builtins + +Reverse iterators over a :class:`dict` and its views now raise +:exc:`RuntimeError` if the dictionary's keys change during iteration, like +forward iterators, instead of yielding entries for the new keys. + +.. + +.. date: 2026-09-22-12-00-00 +.. gh-issue: 157838 +.. nonce: brcMrg +.. section: Core and Builtins + +Merge biased reference counts on behalf of threads that are detached instead +of waiting for them to attach again, in the free-threaded build. + +.. + +.. date: 2026-09-13-12-46-10 +.. gh-issue: 157378 +.. nonce: Rg7Tq2 +.. section: Core and Builtins + +Fix ``SyntaxError.offset`` and ``SyntaxError.end_offset`` for the "Non-UTF-8 +code starting with ..." error when a non-ASCII character precedes the +invalid byte on the same line. Patch by Shamil Abdulaev. + +.. + +.. date: 2026-09-13-10-43-24 +.. gh-issue: 156762 +.. nonce: Kbf2mo +.. section: Core and Builtins + +Fix undefined behaviour in :class:`operator.methodcaller`: its +:c:member:`~PyTypeObject.tp_clear` slot function returned ``void`` instead +of ``int``, so the garbage collector called it through an incompatible +function type. Patched by Shamil Abdulaev. + +.. + +.. date: 2026-09-12-22-29-51 +.. gh-issue: 157377 +.. nonce: O6WYlM +.. section: Core and Builtins + +Fix :func:`gc.get_count` on the free-threaded build resetting the +thread-local allocation counter that schedules automatic garbage collection. +A thread that called it while allocating could prevent cyclic garbage from +ever being collected. + +.. + +.. date: 2026-09-04-14-06-00 +.. gh-issue: 156091 +.. nonce: nested-comp +.. section: Core and Builtins + +Fix a crash when compiling deeply nested inlined list, set, or dict +comprehensions. A :exc:`SyntaxError` is now raised when the nesting exceeds +the compiler's static block limit. + +.. + +.. date: 2026-09-03-15-20-00 +.. gh-issue: 156894 +.. nonce: Rt9Bx4 +.. section: Core and Builtins + +Fix the position of syntax errors which cover a range if the line contains +non-ASCII characters before the error. + +.. + +.. date: 2026-09-01-07-15-20 +.. gh-issue: 155525 +.. nonce: A7kP2m +.. section: Core and Builtins + +Fix quadratic-time tokenization of modules containing many f-strings or +t-strings. + +.. + +.. date: 2026-08-31-10-45-11 +.. gh-issue: 156689 +.. nonce: Jq3xNv +.. section: Core and Builtins + +Fix an out-of-bounds read in :func:`compile` and :func:`ast.parse` when an +AST object is passed with ``mode='func_type'``. + +.. + +.. date: 2026-08-26-01-08-38 +.. gh-issue: 156371 +.. nonce: USpwKG +.. section: Core and Builtins + +Fix missing ``PyRefTracer_DESTROY`` events for trashcan deferred objects. +Patch by Donghee Na. + +.. + +.. date: 2026-08-23-12-00-00 +.. gh-issue: 156114 +.. nonce: Kq7fXz +.. section: Core and Builtins + +Fix a crash in the perf trampoline when a code object has a name or filename +that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. + +.. + +.. date: 2026-08-20-22-13-20 +.. gh-issue: 156126 +.. nonce: pXm4Qr +.. section: Core and Builtins + +Fix a crash when importing a module whose name contains characters that +cannot be encoded to UTF-8 (such as lone surrogates) while :option:`-X +importtime <-X>` is enabled. + +.. + +.. date: 2026-08-13-13-50-00 +.. gh-issue: 155752 +.. nonce: Rp7K2x +.. section: Core and Builtins + +Fix a crash when a :class:`types.GenericAlias` argument gains a +``__typing_subst__`` hook after the alias parameters have been cached. + +.. + +.. date: 2026-08-11-13-50-35 +.. gh-issue: 155504 +.. nonce: PsTqZm +.. section: Core and Builtins + +Fix a crash when thread state creation fails before the thread state is +fully initialized. + +.. + +.. date: 2026-08-11-06-04-26 +.. gh-issue: 155526 +.. nonce: W7ZHXu +.. section: Core and Builtins + +Fix spurious :exc:`OverflowError` for ``abs(nanj)`` in case :c:data:`errno` +was previously set to :c:macro:`!ERANGE` by some library call. Patch by +Sergey B Kirpichev. + +.. + +.. date: 2026-08-11-01-45-24 +.. gh-issue: 129752 +.. nonce: Zo3OUx +.. section: Core and Builtins + +Don't update adaptive counters in the free-threaded build when thread-local +bytecode is disabled (``-X tlbc=0``). Patch by Donghee Na. + +.. + +.. date: 2026-08-10-11-20-00 +.. gh-issue: 155515 +.. nonce: Lp3qWc +.. section: Core and Builtins + +Track the internal HAMT iterators, which back iteration over a +:class:`contextvars.Context`, with the garbage collector. A reference cycle +running through such an iterator was never collected, leaking the whole +context it iterated over. + +.. + +.. date: 2026-08-02-17-55-29 +.. gh-issue: 154937 +.. nonce: m9IBba +.. section: Core and Builtins + +Fix a data race on thread handle identifiers when ``_thread._shutdown()`` +runs concurrently with the startup of non-daemon threads in the +:term:`free-threaded build`. + +.. + +.. date: 2026-08-02-11-47-15 +.. gh-issue: 154902 +.. nonce: DIi6sf +.. section: Core and Builtins + +Fix a crash when ``__conditional_annotations__`` is rebound to a non-set +object. + +.. + +.. date: 2026-07-29-08-43-14 +.. gh-issue: 151464 +.. nonce: o_mtmz +.. section: Core and Builtins + +Exclude invalid token ``<>`` from :mod:`tokenize` output. :exc:`SyntaxError` +for ``<>`` now suggests ``!=``. + +.. + +.. date: 2026-07-27-17-20-49 +.. gh-issue: 154719 +.. nonce: eI88Gs +.. section: Core and Builtins + +Trailing whitespace in a t-string interpolation expression is now preserved +in :attr:`string.templatelib.Interpolation.expression`, up to the closing +``}`` or the conversion (``!``), format (``:``), or debug (``=``) delimiter. +Explicit line continuations following a debug ``=`` remain part of the debug +text and are excluded from +:attr:`~string.templatelib.Interpolation.expression`. Escaped quotes are now +preserved while reconstructing t-string interpolation metadata and f-string +debug text containing comments. + +.. + +.. date: 2026-07-11-15-45-00 +.. gh-issue: 153578 +.. nonce: Qm4Zt9 +.. section: Core and Builtins + +Fix an out-of-bounds write in :meth:`bytearray.extend` when the bytearray is +resized while the argument's :meth:`~object.__buffer__` is being acquired, +for example by another thread. Patch by tonghuaroot. + +.. + +.. date: 2026-04-26-15-08-53 +.. gh-issue: 148817 +.. nonce: cuN07H +.. section: Core and Builtins + +Fold large constant list and set literals used as the iterable of a +:keyword:`for` loop or ``in``/``not in`` test into a constant :class:`tuple` +or :class:`frozenset`, restoring an optimization previously done by the AST +optimizer that was lost when constant folding moved to the CFG. + +.. + +.. date: 2026-03-19-01-19-34 +.. gh-issue: 146096 +.. nonce: R9tkJX +.. section: Core and Builtins + +Fixed segmentation fault when called repr for BaseExceptionGroup with empty +or 1-size tuple args. + +.. + +.. date: 2020-06-23-13-59-37 +.. gh-issue: 85260 +.. nonce: o_LJ76 +.. section: Core and Builtins + +:func:`compile` now raises :exc:`ValueError` instead of crashing on a debug +build if an identifier field of an AST node (such as the name of a function, +a class, an imported module or a caught exception) is ``"None"``, ``"True"`` +or ``"False"``. + +.. + +.. date: 2026-09-25-22-15-54 +.. gh-issue: 158169 +.. nonce: ZlibTail +.. section: Library + +Fix :attr:`zlib.Decompress.unconsumed_tail` duplicating +:attr:`~zlib.Decompress.unused_data` after end of stream when *max_length* +was used. + +.. + +.. date: 2026-09-19-14-10-18 +.. gh-issue: 157788 +.. nonce: v70Lxd +.. section: Library + +Fix ``python -m asyncio ps`` failing on a process that has a task with a +name longer than 255 characters. + +.. + +.. date: 2026-09-18-12-00-00 +.. gh-issue: 157660 +.. nonce: tlbc +.. section: Library + +Fix ``_remote_debugging`` reporting errors or incorrect line numbers in +free-threaded builds when a thread-local bytecode array grows or gains +entries after being cached. + +.. + +.. date: 2026-09-17-14-00-00 +.. gh-issue: 157672 +.. nonce: tksigs +.. section: Library + +Fix :mod:`tkinter` on macOS: creating a :class:`~tkinter.Tk` instance no +longer replaces the Python handlers of SIGINT, SIGHUP and SIGTERM with Tk's +handler which exits the process, so Ctrl-C raises :exc:`KeyboardInterrupt` +again. + +.. + +.. date: 2026-09-17-03-20-24 +.. gh-issue: 157639 +.. nonce: VP3kc4 +.. section: Library + +Fix a crash in :mod:`!cProfile` when an external timer re-enters the +profiler. Profiling events raised while the external timer runs are now +ignored. + +.. + +.. date: 2026-09-15-16-37-19 +.. gh-issue: 69919 +.. nonce: izH1zP +.. section: Library + +:meth:`code.InteractiveInterpreter.runsource` and the REPL now report any +exception raised by compiling the source, such as :exc:`MemoryError` or +:exc:`RecursionError` for too deeply nested source, instead of propagating +it or printing a traceback of the REPL internals. + +.. + +.. date: 2026-09-14-00-30-00 +.. gh-issue: 157451 +.. nonce: k7Qm2x +.. section: Library + +Fix :mod:`gettext` plural form selection when the ``Plural-Forms`` +expression combines the unary ``!`` operator with a binary operator, for +example ``!n + 1`` or ``2 * !n``. The latter raised :exc:`SyntaxError`. + +.. + +.. date: 2026-09-13-15-58-28 +.. gh-issue: 157335 +.. nonce: efaMah +.. section: Library + +Fix out-of-bounds write in ``mmap.mmap.__setitem__`` that could occur when +converting the index or the assigned value (via :meth:`~object.__index__` +for a single item, or via the buffer protocol for a slice) resized or closed +the mmap object during the assignment. + +.. + +.. date: 2026-09-13-10-30-00 +.. gh-issue: 157406 +.. nonce: a3kZq7 +.. section: Library + +Fix the Python implementation of :class:`xml.etree.ElementTree.XMLParser`: +the ``doctype()`` method of the target is now called for a document type +declaration without an external identifier, like ``<!DOCTYPE html>``, as in +the C implementation. + +.. + +.. date: 2026-09-13-07-14-35 +.. gh-issue: 128509 +.. nonce: 9F2GCE +.. section: Library + +:func:`marshal.load` and :func:`marshal.loads` can now get 1-byte string +singletons. Patch by Victor Stinner. + +.. + +.. date: 2026-09-11-16-50-11 +.. gh-issue: 157325 +.. nonce: hzTild +.. section: Library + +Fix an out-of-bounds read in the ``hz`` incremental decoder when the input +ends with ``~``. + +.. + +.. date: 2026-09-09-13-46-38 +.. gh-issue: 157213 +.. nonce: rYg7pO +.. section: Library + +Fix :func:`asyncio.gather` leaving stale await-graph edges on children that +outlive it. + +.. + +.. date: 2026-09-08-13-06-29 +.. gh-issue: 156002 +.. nonce: vmOC8T +.. section: Library + +:mod:`zipfile` again reads members through a third-party decompressor +installed by monkey-patching the private ``_get_decompressor()`` to return +an object that only implements old BZ2Decompressor API from Python 3.3. Note +that decompressors without ``needs_input`` and two-argument ``decompress()`` +are vulnerable to :cve:`2026-15310`. + +.. + +.. date: 2026-09-08-09-30-00 +.. gh-issue: 157159 +.. nonce: tabNny +.. section: Library + +The usage message printed by ``python -m tabnanny`` when no arguments are +given now suggests ``python -m`` instead of the source file. + +.. + +.. date: 2026-09-08-04-10-00 +.. gh-issue: 123018 +.. nonce: hV2kQe +.. section: Library + +Fix :func:`readline.write_history_file` and +:func:`readline.append_history_file` producing a history file that +:func:`readline.read_history_file` could not load when a limit was set with +:func:`readline.set_history_length` and Python was built against +``libedit``. This works around `NetBSD PR 60322 +<https://gnats.netbsd.org/60322>`_. + +.. + +.. date: 2026-09-07-12-24-11 +.. gh-issue: 157058 +.. nonce: 2SoQU7 +.. section: Library + +:func:`asyncio.wait_for` with a non-positive timeout now records the waiter +in the call graph. + +.. + +.. date: 2026-09-07-00-21-31 +.. gh-issue: 156933 +.. nonce: OalCjC +.. section: Library + +Fix incorrect integer return values from :mod:`ctypes` callbacks on some +platforms, such as s390x. + +.. + +.. date: 2026-09-06-15-23-24 +.. gh-issue: 157048 +.. nonce: UtFyiJ +.. section: Library + +Preserve the position and contents of :class:`io.BytesIO` when +:meth:`!BytesIO.__init__` fails because a buffer is exported. + +.. + +.. date: 2026-09-05-22-39-22 +.. gh-issue: 156961 +.. nonce: ZtYqoA +.. section: Library + +Fix :func:`tkinter.font.nametofont` and the :class:`tkinter.font.Font` +constructor for a font name returned by Tk as a Tcl object, for example by +:meth:`ttk.Style.lookup() <tkinter.ttk.Style.lookup>`. + +.. + +.. date: 2026-09-05-18-23-30 +.. gh-issue: 156988 +.. nonce: nEUQE6 +.. section: Library + +:func:`asyncio.print_call_graph` no longer truncates the call stack at a +synchronous generator. + +.. + +.. date: 2026-09-05-15-27-11 +.. gh-issue: 156970 +.. nonce: DxlgbB +.. section: Library + +Set the docstring of :attr:`unittest.mock.Mock.return_value`. + +.. + +.. date: 2026-09-04-16-05-45 +.. gh-issue: 156946 +.. nonce: 0ZYCdh +.. section: Library + +Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user +pointer runs while the panel is being deallocated. The panel is now taken +off the panel stack before its user pointer is dropped. + +.. + +.. date: 2026-09-01-16-58-30 +.. gh-issue: 156797 +.. nonce: Qm4tRs +.. section: Library + +Fix :class:`xml.sax.saxutils.XMLGenerator`: the namespace URI is now escaped +in the namespace declaration. Previously a URI containing ``&``, ``<`` or a +quote character produced a document which cannot be parsed. + +.. + +.. date: 2026-08-31-23-10-00 +.. gh-issue: 83895 +.. nonce: Jm5tR3 +.. section: Library + +:mod:`xml.etree.ElementTree` now accepts input larger than 2 GiB in the C +implementation. The data is fed to Expat in chunks, as +:mod:`xml.parsers.expat` already did, instead of raising +:exc:`OverflowError`. + +.. + +.. date: 2026-08-31-20-30-00 +.. gh-issue: 99064 +.. nonce: Rt4mZ9 +.. section: Library + +Fix :func:`xml.etree.ElementTree.parse` with a text file or other source of +:class:`str` data in the C implementation. The encoding declared in the +document was applied to the already decoded text, which produced mojibake. +It is now ignored, as when parsing with :meth:`!XMLParser.feed` or +:func:`~xml.etree.ElementTree.fromstring`. + +.. + +.. date: 2026-08-31-17-10-00 +.. gh-issue: 156713 +.. nonce: Nt2URL +.. section: Library + +Fix :func:`!nturl2path.pathname2url` and :func:`!nturl2path.url2pathname`: +the filesystem encoding and error handler are now used for percent-encoding +and decoding, as in :mod:`urllib.request`. Previously paths containing +surrogate characters raised :exc:`UnicodeEncodeError`. + +.. + +.. date: 2026-08-31-00-00-00 +.. gh-issue: 127057 +.. nonce: N9yg62 +.. section: Library + +Fix :class:`asyncio.ProactorEventLoop` UDP transports so that a +:exc:`ConnectionResetError` raised by ``WSARecvFrom`` no longer stops the +read loop. + +.. + +.. date: 2026-08-30-19-30-00 +.. gh-issue: 156658 +.. nonce: Xq5Nt7 +.. section: Library + +:mod:`xml.dom` and :mod:`xml.etree.ElementTree` no longer treat characters +which are not white space in XML (such as U+00A0) as white space. Previously +they could be lost in :func:`~xml.etree.ElementTree.indent`, +:func:`~xml.etree.ElementTree.canonicalize` with ``strip_text=True``, and +when parsing with the ``whitespace-in-element-content`` feature turned off. + +.. + +.. date: 2026-08-30-13-25-53 +.. gh-issue: 156512 +.. nonce: tVTOIV +.. section: Library + +Fix :mod:`asyncio` losing a connection twice when ``resume_writing()`` +closes the transport. + +.. + +.. date: 2026-08-28-18-10-25 +.. gh-issue: 156523 +.. nonce: llJqo9 +.. section: Library + +Fix :func:`asyncio.as_completed` not recording the awaiting task in the call +graph. + +.. + +.. date: 2026-08-28-00-59-00 +.. gh-issue: 156476 +.. nonce: rQhxc7 +.. section: Library + +The pure Python implementation of :meth:`queue.SimpleQueue.get` now ignores +*timeout* when *block* is false, matching the documented behavior and the C +implementation. It previously raised :exc:`ValueError`. + +.. + +.. date: 2026-08-27-08-31-29 +.. gh-issue: 156444 +.. nonce: klcySy +.. section: Library + +Fix matching of a negated character set in a bytes pattern compiled with +both :const:`re.IGNORECASE` and :const:`re.LOCALE`. The case closure is now +applied to the members of the set, so that ``[^bc]`` no longer matches +``b'B'``. + +.. + +.. date: 2026-08-26-12-48-10 +.. gh-issue: 156408 +.. nonce: -Yd0k7 +.. section: Library + +Fix :func:`asyncio.print_call_graph` raising :exc:`AttributeError` when +called on a task that has already finished. + +.. + +.. date: 2026-08-26-02-30-00 +.. gh-issue: 156353 +.. nonce: abcdef +.. section: Library + +Fix :mod:`configparser` parsing when using whitespace in *delimiters*. + +.. + +.. date: 2026-08-21-13-30-00 +.. gh-issue: 156166 +.. nonce: Xv8pQm +.. section: Library + +:mod:`ssl`: A failed assignment or deletion of the ``_msg_callback`` +attribute of :class:`ssl.SSLContext` no longer removes the current callback. +Deleting it now raises :exc:`AttributeError` instead of :exc:`TypeError`. + +.. + +.. date: 2026-08-21-11-56-28 +.. gh-issue: 156173 +.. nonce: mhZa8a +.. section: Library + +Calling :meth:`zlib.Decompress.flush` on invalid compressed data now raises +:exc:`zlib.error` instead of being silently ignored. + +.. + +.. date: 2026-08-21-11-00-00 +.. gh-issue: 152817 +.. nonce: Rt6mNc +.. section: Library + +:mod:`sqlite3`: Disallow removing the ``row_factory`` attribute of a cursor +to prevent a crash on a query. + +.. + +.. date: 2026-08-20-16-30-00 +.. gh-issue: 156124 +.. nonce: Kq3vXz +.. section: Library + +Fix a crash in the free-threaded build when deleting the :attr:`!contents` +attribute of a :mod:`ctypes` pointer. + +.. + +.. date: 2026-08-20-13-50-49 +.. gh-issue: 156112 +.. nonce: yEcma8 +.. section: Library + +:mod:`!_ios_support` no longer fails to import when +:func:`ctypes.util.find_library` cannot resolve the ObjC runtime through the +dyld shared cache, as is the case on iOS 13. The runtime is now loaded by +name, which dyld resolves against the cache directly. + +.. + +.. date: 2026-08-20-12-10-00 +.. gh-issue: 156101 +.. nonce: Qb2xNv +.. section: Library + +Fix :attr:`sqlite3.Cursor.arraysize` being set to 0 if the assigned value is +too large. The attribute is now left unchanged if the assignment fails. + +.. + +.. date: 2026-08-20-12-05-00 +.. gh-issue: 156100 +.. nonce: Lm7qWz +.. section: Library + +Fix crashes in :class:`sqlite3.Connection` when deleting the +:attr:`~sqlite3.Connection.autocommit` attribute or setting it to an integer +which does not fit in C :c:expr:`long`. Both now raise an exception. + +.. + +.. date: 2026-08-20-12-00-00 +.. gh-issue: 156099 +.. nonce: Kp4vRt +.. section: Library + +Fix a crash when deleting the ``keylog_filename`` attribute of +:class:`ssl.SSLContext`. It now raises :exc:`AttributeError`. + +.. + +.. date: 2026-08-19-21-01-19 +.. gh-issue: 156067 +.. nonce: 1CXkqc +.. section: Library + +Fix error handling in the :mod:`zoneinfo` accelerator module when a +transition index is ``-1`` or a TZ string's ``__bool__`` raises. + +.. + +.. date: 2026-08-18-13-41-00 +.. gh-issue: 155997 +.. nonce: CjbD1F +.. section: Library + +Fix :func:`concurrent.interpreters.list_all`. It failed if an interpreter +was destroyed during the call, in particular by a garbage collection which +finalized the object owning the last reference to it. + +.. + +.. date: 2026-08-17-21-00-00 +.. gh-issue: 155941 +.. nonce: strmCb +.. section: Library + +Fix :func:`asyncio.start_server` when a plain-function *client_connected_cb* +raises: the error is now reported like the coroutine case and the transport +is closed, instead of leaving the connection open forever (which also made +:meth:`asyncio.Server.wait_closed` hang). + +.. + +.. date: 2026-08-17-12-40-00 +.. gh-issue: 155952 +.. nonce: Vq3Lm8 +.. section: Library + +Fix the signatures of :meth:`sqlite3.Connection.execute`, +:func:`warnings.warn` and :func:`locale.setlocale` which rendered +``<unrepresentable>`` instead of the correct defaults for parameters. + +.. + +.. date: 2026-08-16-11-38-17 +.. gh-issue: 155888 +.. nonce: pO-nAp +.. section: Library + +Fix :meth:`asyncio.WriteTransport.writelines` hanging the transport when the +last data chunk is empty. + +.. + +.. date: 2026-08-14-14-10-00 +.. gh-issue: 155775 +.. nonce: Kq3vTx +.. section: Library + +Fix a regression in :mod:`imaplib` introduced in the fix for :gh:`63121`: +refreshing the capabilities after a successful :meth:`~imaplib.IMAP4.login` +or :meth:`~imaplib.IMAP4.authenticate` consumed the ``CAPABILITY`` response, +so it could no longer be read with :meth:`~imaplib.IMAP4.response`. + +.. + +.. date: 2026-08-14-12-46-07 +.. gh-issue: 113318 +.. nonce: DYGQjo +.. section: Library + +Fix crashes when deleting an attribute whose setter is generated by Argument +Clinic and is not prepared for deletion, among them +:attr:`frame.f_trace_opcodes` and the ``context``, ``owner`` and ``session`` +attributes of ``_ssl._SSLSocket``. Deleting such attribute now raises +:exc:`AttributeError`. + +.. + +.. date: 2026-08-10-15-24-13 +.. gh-issue: 155468 +.. nonce: W7qL2p +.. section: Library + +Fix :mod:`netrc` to distinguish empty quoted tokens from end-of-file, so +malformed files no longer cause the remaining content to be silently +ignored. + +.. + +.. date: 2026-08-10-13-27-36 +.. gh-issue: 155519 +.. nonce: 9M6SFX +.. section: Library + +Avoid a data-race in free-threaded builds when reading and writing context +variables from different threads. + +.. + +.. date: 2026-08-10-09-00-18 +.. gh-issue: 155336 +.. nonce: vrTXoU +.. section: Library + +Fix error handling in :func:`socket.gethostbyaddr` and +:func:`socket.gethostbyname_ex` when hostname resolution fails. + +.. + +.. date: 2026-08-09-01-30-00 +.. gh-issue: 102475 +.. nonce: rpjoin +.. section: Library + +Fix :func:`os.path.realpath` on Windows: the unresolved part of the path is +now appended, not joined, so a file name which looks like a drive (e.g. +``spam:eggs``) no longer discards the resolved part. A path relative to +another drive is now resolved against the root directory of that drive. + +.. + +.. date: 2026-08-09-00-30-00 +.. gh-issue: 89760 +.. nonce: rpvol +.. section: Library + +Fix :func:`os.path.realpath` on Windows: the ``\\?\`` prefix is no longer +stripped from a volume GUID path, which made the result invalid. + +.. + +.. date: 2026-08-08-21-40-00 +.. gh-issue: 84419 +.. nonce: statexe +.. section: Library + +Fix :func:`os.stat` on Windows: trailing dots and spaces, which are ignored +by the operating system, are no longer taken into account when the execute +permissions are guessed from the file extension. + +.. + +.. date: 2026-08-07-02-20-00 +.. gh-issue: 155319 +.. nonce: srcline +.. section: Library + +:func:`warnings.warn_explicit` now displays the source line taken from the +loader of the module whose globals are passed as *module_globals*. It also +no longer raises :exc:`IndexError` if *lineno* is out of the range of the +module source. + +.. + +.. date: 2026-08-07-01-10-00 +.. gh-issue: 123011 +.. nonce: warnexp +.. section: Library + +:func:`warnings.warn_explicit` no longer emits a spurious +:exc:`DeprecationWarning` or raises :exc:`ImportError` when it is called +with the globals of the :mod:`__main__` module. + +.. + +.. date: 2026-08-05-17-30-00 +.. gh-issue: 69370 +.. nonce: inspCLI +.. section: Library + +:program:`python -m inspect --details` no longer fails with +:exc:`UnicodeEncodeError` if the path of the module contains characters +unencodable in the encoding of :data:`sys.stdout`. Such characters are now +escaped with backslashes. + +.. + +.. date: 2026-08-05-16-40-00 +.. gh-issue: 69371 +.. nonce: pyDocU +.. section: Library + +Fix :mod:`pydoc` for modules whose path contains undecodable bytes. +:func:`!pydoc.writedoc` and the pydoc HTTP server no longer fail with +:exc:`UnicodeEncodeError`: the file URL is now percent-encoded using the +filesystem encoding, and characters unencodable in the generated HTML page +are escaped with backslashes. + +.. + +.. date: 2026-08-03-22-46-07 +.. gh-issue: 155143 +.. nonce: 9-byZp +.. section: Library + +Fix :func:`asyncio.shield` leaking the calling task via the await-graph and +callbacks when called on a future that never resolves. + +.. + +.. date: 2026-07-29-19-48-59 +.. gh-issue: 154871 +.. nonce: tgZILS +.. section: Library + +Fixed a crash in :meth:`asyncio.Task.get_context` when called on an +uninitialized task. + +.. + +.. date: 2026-07-29-14-20-40 +.. gh-issue: 154855 +.. nonce: vfF453 +.. section: Library + +Fix :meth:`curses.window.instr` returning one character too few when the +:mod:`curses` module is built against a curses library that counts the +terminator in the requested length, such as the NetBSD one. + +.. + +.. date: 2026-07-23-14-13-39 +.. gh-issue: 135683 +.. nonce: droBu7 +.. section: Library + +:class:`logging.FileHandler` and +:class:`logging.handlers.WatchedFileHandler` now honor +:data:`logging.raiseExceptions` for errors that occur while opening the +file, like for other errors during logging. + +.. + +.. date: 2026-07-22-12-00-00 +.. gh-issue: 153970 +.. nonce: Kq7Wn3 +.. section: Library + +Calling :func:`str` on a :exc:`subprocess.CalledProcessError` no longer +raises :exc:`TypeError` when its :attr:`!returncode` is not an integer, such +as ``None``. + +.. + +.. date: 2026-07-19-17-45-00 +.. gh-issue: 153005 +.. nonce: F6WH92 +.. section: Library + +:meth:`!concurrent.interpreters.Queue.get` and +:meth:`!concurrent.interpreters.Queue.put` now compute their ``timeout`` +deadline from :func:`time.monotonic` instead of the wall clock, so adjusting +the system clock during the call no longer makes them over- or under-wait. + +.. + +.. date: 2026-07-19-17-05-00 +.. gh-issue: 153772 +.. nonce: cobjTK +.. section: Library + +:func:`isinstance` checks against :mod:`collections.abc` classes such as +:class:`~collections.abc.Mapping` no longer raise :exc:`AttributeError` when +the instance has no ``__class__``. The abstract base class machinery now +falls back to the object's type in that case, matching the behaviour of the +built-in :func:`isinstance`. + +.. + +.. date: 2026-07-18-04-09-44 +.. gh-issue: 81241 +.. nonce: gGRbBr +.. section: Library + +Fix :exc:`OSError` when importing :mod:`ctypes` from a statically linked +interpreter. + +.. + +.. date: 2026-07-11-13-24-49 +.. gh-issue: 153603 +.. nonce: YbKlry +.. section: Library + +Fix a crash in the ISO-2022 decoders when decoding a byte after an unknown +charset designation is set via the decoder's ``setstate`` method. Patch by +tonghuaroot. + +.. + +.. date: 2026-07-11-12-21-12 +.. gh-issue: 153539 +.. nonce: gBs2T5 +.. section: Library + +Fix a crash in the C implementation of :meth:`io.TextIOWrapper.tell` when +the decoder's ``getstate`` method triggers a reentrant seek, or when another +thread seeks the same stream concurrently. Patch by tonghuaroot. + +.. + +.. date: 2026-07-08-23-20-00 +.. gh-issue: 152907 +.. nonce: oyPV9Y +.. section: Library + +Restore cooked-mode terminal output flags around :c:data:`PyOS_InputHook` +callbacks in the new :term:`REPL` (:mod:`!_pyrepl`), so that output written +by an input hook (for example a GUI toolkit event loop) is no longer emitted +with ``OPOST`` disabled and keeps its carriage returns. + +.. + +.. date: 2026-07-08-19-40-00 +.. gh-issue: 153319 +.. nonce: Qk7bE2 +.. section: Library + +The :mod:`turtledemo` viewer now reads each demo script as UTF-8 instead of +the locale encoding. + +.. + +.. date: 2026-07-05-17-39-16 +.. gh-issue: 153133 +.. nonce: kKSH7g +.. section: Library + +Fix a socket leak in :meth:`asyncio.loop.create_connection` when the +transport cannot be created. + +.. + +.. date: 2026-07-02-19-21-15 +.. gh-issue: 152068 +.. nonce: ThsmJU +.. section: Library + +Fixes a bug when a line was split (particularly on macOS Terminal.app) in +the middle of a colorized keyword, causing the ANSI Color Reset sequence +(ESC0m) to not be properly printed, causing the output to be colored when it +shouldn't + +.. + +.. date: 2026-06-25-14-05-00 +.. gh-issue: 152204 +.. nonce: k9Qm3v +.. section: Library + +Fix the pure-Python implementations of :meth:`datetime.date.fromisoformat`, +:meth:`datetime.time.fromisoformat` and +:meth:`datetime.datetime.fromisoformat` silently accepting some malformed +ISO 8601 strings, such as non-ASCII digits or a sign in a fixed-width field +(for example ``'2020+12'`` or ``'20201212T0102٣٤'``). Each field is now +required to be exactly *N* ASCII digits, matching the C implementation. + +.. + +.. date: 2026-06-22-18-01-00 +.. gh-issue: 151955 +.. nonce: 6u5iwm +.. section: Library + +Allow more types to be used in the ``bound`` argument to +:class:`typing.ParamSpec`. + +.. + +.. date: 2026-06-09-12-00-00 +.. gh-issue: 150771 +.. nonce: K7mNx2 +.. section: Library + +Fix serialization of :mod:`email` messages using the ``shift_jis`` or +``euc-jp`` charsets: ``set_content()`` now encodes the payload using the +output charset, so ``str(m)`` no longer raises :exc:`UnicodeEncodeError`. + +.. + +.. date: 2026-05-20-14-00-00 +.. gh-issue: 145856 +.. nonce: Pl5kZx +.. section: Library + +Fix :func:`plistlib.dumps` and :func:`plistlib.dump` so that +``skipkeys=True`` together with ``sort_keys=True`` correctly drops +non-string keys when the dictionary contains a mix of string and non-string +keys. Previously the sort ran before the filter and raised +:exc:`TypeError`. + +.. + +.. date: 2026-02-11-16-47-27 +.. gh-issue: 140729 +.. nonce: 2uTPQp +.. section: Library + +Fix a pickling error in the ``cProfile`` module when profiling a script that +uses :class:`multiprocessing.Process` with the ``spawn`` and ``forkserver`` +start methods. + +.. + +.. date: 2023-12-20-22-05-40 +.. gh-issue: 113329 +.. nonce: 1CJy3o +.. section: Library + +Fix :exc:`OSError` being raised when trying to run doctests on a class +objects in the REPL. Patch by Sten Wessel. + +.. + +.. date: 2023-03-23-19-47-05 +.. gh-issue: 102967 +.. nonce: gfIYkN +.. section: Library + +A bug in :func:`!doctest._SpoofOut.truncate` was causing None to be passed +to :func:`!StringIO.seek` when no size was given. A simple fix skips the +seek call when no size is given so the buffer can be truncated from the +current position. + +.. + +.. date: 2023-02-11-09-49-49 +.. gh-issue: 82039 +.. nonce: caTE7O +.. section: Library + +:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format +signature line in a case-insensitive manner. Patch by Ashley Harvey. + +.. + +.. date: 2022-01-03-12-50-42 +.. gh-issue: 70758 +.. nonce: 2NjFW_ +.. section: Library + +Creating a new :mod:`turtle` screen after the previous one was closed no +longer raises ``turtle.Terminator`` on the first turtle command. + +.. + +.. bpo: 44012 +.. date: 2021-06-03-22-23-38 +.. nonce: BK3HfA +.. section: Library + +The ``exploded`` attribute of :class:`ipaddress.IPv6Address` and +:class:`ipaddress.IPv6Interface` now supports addresses with a scope ID +(link-local addresses). Previously the former raised +:exc:`~ipaddress.AddressValueError` and the latter omitted the scope ID. + +.. + +.. date: 2020-02-19-16-35-52 +.. gh-issue: 83869 +.. nonce: EPD_zn +.. section: Library + +Fix :mod:`tarfile` reading an archive with a GNU sparse 1.0 member whose +size is set in the pax extended header. The offset of the next header was +computed from the offset of the data, which is already past the sparse map, +and from the size of the member, which can be the apparent size of the +sparse file. All following members were unreachable. + +.. + +.. date: 2019-02-08-17-33-49 +.. gh-issue: 61366 +.. nonce: k6W5Sp +.. section: Library + +:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written +by curl and Wget, which use ``0`` in the expiration time field. Contributed +by Jérémie Detrey. + +.. + +.. date: 2026-09-24-10-10-15 +.. gh-issue: 57491 +.. nonce: UA-2uN +.. section: Documentation + +Reduce the depth of the table of contents in the EPUB documentation from +three levels to two, making it much shorter and easier to navigate in e-book +readers. + +.. + +.. date: 2026-09-24-10-40-28 +.. gh-issue: 158051 +.. nonce: B1ZBTA +.. section: Tests + +The iOS testbed has been updated for compatibilty with Xcode 27. + +.. + +.. date: 2026-08-09-14-00-00 +.. gh-issue: 155411 +.. nonce: Qw8Lm2 +.. section: Tests + +Fix :func:`!test.support.subTests` for asynchronous test methods. They were +wrapped in a synchronous function, which discarded the coroutine without +awaiting it, so the test silently did not run at all. + +.. + +.. date: 2026-08-06-18-20-00 +.. gh-issue: 132581 +.. nonce: envchg +.. section: Tests + +The list of tests which altered the execution environment now includes the +reasons why the environment was considered altered, for example an +unraisable exception or a modified :data:`sys.path`. The final result no +longer repeats the same state twice (like ``ENV CHANGED then ENV CHANGED``). + +.. + +.. date: 2026-01-21-02-03-31 +.. gh-issue: 142414 +.. nonce: CfcgiR +.. section: Tests + +Isolate reloading modules in test_interpreters to avoid having broken +references. + +.. + +.. date: 2026-09-29-09-40-25 +.. gh-issue: 158010 +.. nonce: H4Top_ +.. section: Build + +Update Android and iOS build scripts to use OpenSSL 3.5.9. + +.. + +.. date: 2026-09-19-16-54-58 +.. gh-issue: 157549 +.. nonce: uk6QNH +.. section: Build + +Use ``sysconf(_SC_PAGESIZE)`` instead of ``getpagesize()`` in +``remote_debug.h`` so ``_remote_debugging`` builds on Darwin with +``-Werror=implicit-function-declaration``. + +.. + +.. date: 2026-09-07-23-40-00 +.. gh-issue: 157142 +.. nonce: gpnoop +.. section: Build + +Fix the link of ``Programs/_freeze_module`` when extension modules are built +in (``MODULE_BUILDTYPE=static``) and the test modules are enabled: +``Modules/getpath_noop.c`` now defines ``_Py_Get_Getpath_CodeObject()``, +which ``_testinternalcapi`` uses. + +.. + +.. date: 2026-08-20-17-41-11 +.. gh-issue: 155911 +.. nonce: yL3z8q +.. section: Build + +Fix curses detection when a curses library is already in ``LIBS``. Patch by +Shamil Abdulaev. + +.. + +.. date: 2026-08-20-14-02-33 +.. gh-issue: 156115 +.. nonce: KXr8wU +.. section: Build + +iOS simulator builds are now configured with ``-mios-simulator-version-min`` +instead of the device's ``-mios-version-min``. The device flag made the +linker reject libraries resolved from the simulator SDK, so library +detection silently failed. + +.. + +.. date: 2026-08-02-12-00-01 +.. gh-issue: 152023 +.. nonce: pT7dKb +.. section: Build + +Update Android builds to SQLite 3.53.4. Additionally, enable the +``median()`` and ``percentile()`` functions. + +.. + +.. date: 2026-02-10-18-26-04 +.. gh-issue: 144679 +.. nonce: FIH73W +.. section: Build + +When building with Visual Studio 2026 (Version 18), use PlatformToolSet v145 +by default. Patch by Chris Eibl. + +.. + +.. date: 2026-09-29-09-56-14 +.. gh-issue: 158010 +.. nonce: MPQX4w +.. section: Windows + +Updated Windows builds to use OpenSSL 3.5.9. + +.. + +.. date: 2026-09-12-18-59-21 +.. gh-issue: 157368 +.. nonce: 2DirHP +.. section: Windows + +Fix truncated :data:`sys.version` in the case of clang-cl versions 22 or +newer on Windows. Also fixes the Windows on Arm case, where the Microsoft +compiler was reported instead of clang. Patch by Chris Eibl. + +.. + +.. date: 2026-08-09-14-20-00 +.. gh-issue: 72353 +.. nonce: Vw7Kq2 +.. section: Windows + +Reading from the console on Windows now continues if the read was cancelled +by Ctrl+C, but the :const:`~signal.SIGINT` handler did not raise an +exception. Previously the read ended as if at end of file. + +.. + +.. date: 2026-08-09-07-00-00 +.. gh-issue: 86427 +.. nonce: consolecp +.. section: Windows + +Fix the encoding of the standard streams in the legacy Windows stdio mode +(:envvar:`PYTHONLEGACYWINDOWSSTDIO`). It is now the code page of the +console, as in Python 3.7, not the ANSI code page. + +.. + +.. date: 2026-08-09-04-00-00 +.. gh-issue: 87587 +.. nonce: devenc +.. section: Windows + +:func:`os.device_encoding` on Windows now returns the code page of any +console file descriptor, not only 0, 1 and 2, and returns ``None`` for other +character devices like ``NUL``. The UTF-8 code page is now reported as +``"utf-8"`` instead of ``"cp65001"``. + +.. + +.. date: 2026-09-29-09-29-17 +.. gh-issue: 158010 +.. nonce: 2zJnoj +.. section: macOS + +Update macOS installer to use OpenSSL 3.5.9. + +.. + +.. date: 2026-09-24-12-00-00 +.. gh-issue: 158067 +.. nonce: opnPy1 +.. section: IDLE + +Fix the IDLE File Open dialog listing text files before Python files when +opened from the Shell or an Output window. + +.. + +.. date: 2026-09-17-23-00-00 +.. gh-issue: 56596 +.. nonce: capslock +.. section: IDLE + +Make IDLE keyboard shortcuts with ascii letters work when Caps Lock is on +even when only one of the upper and lowercase versions are defined. + +.. + +.. date: 2026-09-17-22-00-00 +.. gh-issue: 75512 +.. nonce: asyncout +.. section: IDLE + +Output from a thread printed in the IDLE Shell while a statement is being +entered no longer takes over the prompt of the statement. + +.. + +.. date: 2026-09-17-21-00-00 +.. gh-issue: 64007 +.. nonce: inputcolor +.. section: IDLE + +IDLE no longer applies syntax coloring to the text entered for :func:`input` +in the Shell. + +.. + +.. date: 2026-09-17-18-00-00 +.. gh-issue: 85560 +.. nonce: elseexpr +.. section: IDLE + +Fix IDLE failing to find the opening parenthesis when a continuation line +inside the parentheses starts with ``else`` of a conditional expression or +with ``yield``. + +.. + +.. date: 2026-09-17-17-00-00 +.. gh-issue: 75487 +.. nonce: blankint +.. section: IDLE + +Fix saving a truncated number when an integer entry in the IDLE Settings +dialog is blanked with the Backspace key. + +.. + +.. date: 2026-09-17-12-00-00 +.. gh-issue: 74112 +.. nonce: sigint +.. section: IDLE + +Ctrl-C in the IDLE Shell now interrupts blocking calls such as +:func:`time.sleep` and :meth:`socket.recv <socket.socket.recv>`. + +.. + +.. date: 2026-09-17-08-53-12 +.. gh-issue: 151471 +.. nonce: -yvE03 +.. section: IDLE + +Colorize the soft keyword ``type`` in IDLE. + +.. + +.. date: 2026-09-17-02-00-00 +.. gh-issue: 103089 +.. nonce: longline +.. section: IDLE + +IDLE no longer hangs when opening a file with very long lines. Only the +first 2,000 characters of a line are colorized. + +.. + +.. date: 2026-09-17-01-00-00 +.. gh-issue: 89544 +.. nonce: rstbuf +.. section: IDLE + +Fix IDLE hanging after Restart Shell while receiving a large output from the +user process. + +.. + +.. date: 2026-09-16-22-00-00 +.. gh-issue: 70331 +.. nonce: shadow +.. section: IDLE + +IDLE no longer fails to start with ``python -m idlelib``, and its user +process no longer fails to start, when the current directory contains user +files with the same names as standard library modules that IDLE imports, +such as ``random.py`` or ``tkinter.py``. + +.. + +.. date: 2026-09-16-20-00-00 +.. gh-issue: 93016 +.. nonce: cliarg +.. section: IDLE + +Fix parsing of command line arguments in the IDLE "Run... Customized" dialog +on Windows: backslashes are no longer treated as escape characters. Fix also +display of the previous arguments in the dialog. + +.. + +.. date: 2026-09-16-18-00-00 +.. gh-issue: 59568 +.. nonce: tilde1 +.. section: IDLE + +Fix "Save As" and "Open" dialogs in IDLE for a file whose name starts with +``~`` on Windows and X11 with Tcl/Tk older than 9. + +.. + +.. date: 2026-09-15-23-27-38 +.. gh-issue: 69004 +.. nonce: Z7Ym9G +.. section: IDLE + +The Debugger item of the IDLE Debug menu is now disabled while user code +runs, like Stack Viewer. + +.. + +.. date: 2026-09-15-22-34-33 +.. gh-issue: 69365 +.. nonce: KehjZN +.. section: IDLE + +The IDLE search dialogs now show a regular expression error below the entry +instead of in a message box. + +.. + +.. date: 2026-09-15-22-10-17 +.. gh-issue: 93966 +.. nonce: ch4fTB +.. section: IDLE + +The highlighting of a syntax error in the IDLE Shell is now removed when the +next statement is entered, not only when the next syntax error occurs. + +.. + +.. date: 2026-09-15-21-54-04 +.. gh-issue: 105689 +.. nonce: ASoU37 +.. section: IDLE + +Fix calltips, parenthesis matching and auto-indent in the IDLE Shell after +output containing unbalanced quotes or parentheses. + +.. + +.. date: 2026-09-15-21-44-35 +.. gh-issue: 60402 +.. nonce: iFz6X6 +.. section: IDLE + +In IDLE, Tab in a string that is not the start of a file name inserts a tab +instead of opening the completion list. + +.. + +.. date: 2026-09-15-21-20-04 +.. gh-issue: 68453 +.. nonce: hlxbog +.. section: IDLE + +Fix running IDLE with the -s option together with -c, -r or -: the command +or script now runs after the startup file, without an error dialog and +without restarting the shell. + +.. + +.. date: 2026-09-15-20-14-08 +.. gh-issue: 75234 +.. nonce: O8ZNFV +.. section: IDLE + +Fix editing help sources and key bindings in the IDLE Settings dialog after +selecting them with the keyboard. + +.. + +.. date: 2026-09-15-16-37-19 +.. gh-issue: 69919 +.. nonce: f6AamT +.. section: IDLE + +IDLE now reports any exception raised by compiling the source, such as +:exc:`MemoryError` for too deeply nested source, instead of hanging the +Shell. + +.. + +.. date: 2026-09-15-16-19-25 +.. gh-issue: 91398 +.. nonce: PBdiDB +.. section: IDLE + +Remove the border around the IDLE Shell sidebar, which was drawn in the +window background color and stood out with dark themes. + +.. + +.. date: 2026-09-15-15-46-35 +.. gh-issue: 71136 +.. nonce: vwGO0v +.. section: IDLE + +Fix a hang of the IDLE Shell when code run under the debugger raises +:exc:`KeyboardInterrupt`. + +.. + +.. date: 2026-09-05-16-00-00 +.. gh-issue: 154511 +.. nonce: hV2wQn +.. section: IDLE + +Consolidate IDLE's mouse wheel handling in ``idlelib.util``. ``wheel_event`` +moves there from ``idlelib.tree`` and joins ``x11_buttons``, which tells +whether Tk reports wheel rotations to a widget as +``<Button-4>``/``<Button-5>`` events, and ``bind_wheel``, which binds +whichever events Tk sends. + +.. + +.. date: 2026-09-03-17-16-26 +.. gh-issue: 156896 +.. nonce: XTQJlq +.. section: IDLE + +Stop deleting tkinter submodules when idlelib.run is imported. + +.. + +.. date: 2026-07-10-19-41-00 +.. gh-issue: 153480 +.. nonce: EdMt1x +.. section: IDLE + +Fix IDLE failing to start when opening a file which does not exist yet. Fix +a traceback when a file open in the IDLE editor is deleted by another +program; IDLE now asks whether to close the window, save the file elsewhere, +or ignore it. + +.. + +.. date: 2026-07-01-21-00-00 +.. gh-issue: 55646 +.. nonce: kBind9 +.. section: IDLE + +Fix IDLE crash at startup when the user configuration contains an invalid +key binding, such as ``<Alt-Key-up>`` instead of ``<Alt-Key-Up>``. The +invalid binding is now ignored with a warning. + +.. + +.. date: 2026-07-01-13-30-00 +.. gh-issue: 66172 +.. nonce: Qm4xR7 +.. section: IDLE + +IDLE no longer fails to start when a user configuration file is corrupt. The +unparsable file is renamed with a ".bad" suffix, default settings are used +instead, and a warning lists the affected files. + +.. + +.. date: 2026-06-27-17-27-21 +.. gh-issue: 90304 +.. nonce: 464d22 +.. section: IDLE + +Prevent IDLE from failing to start when a font reports a zero width for the +``'0'`` character. Such a broken font caused a :exc:`ZeroDivisionError`; +the editor now falls back to the configured width. + +.. + +.. date: 2025-08-08-10-50-59 +.. gh-issue: 135511 +.. nonce: 9Rw5Zg +.. section: IDLE + +Fix display of :exc:`NameError` and :exc:`AttributeError` with multi-line +message. + +.. + +.. date: 2026-09-30-06-55-37 +.. gh-issue: 158451 +.. nonce: pZE56z +.. section: Tools/Demos + +``python-gdb.py`` is now able to format an invalid Unicode string: render +invalid characters as ``\Uhhhhhhhh`` instead of raising an exception. Patch +by Victor Stinner. + +.. + +.. date: 2026-08-14-12-45-57 +.. gh-issue: 113318 +.. nonce: G1B0oH +.. section: Tools/Demos + +Fix Argument Clinic for ``@getter`` and ``@setter`` in a preprocessor +conditional block. It failed with an internal error. Argument Clinic now +also rejects the accessors of the same attribute with different C basenames, +and the same accessor defined twice, which silently generated invalid or +duplicated entries of :c:type:`PyGetSetDef`. + +.. + +.. date: 2026-08-04-17-12-33 +.. gh-issue: 64502 +.. nonce: Qv7mLp +.. section: Tools/Demos + +Fix Argument Clinic support of parameters with a default value used together +with optional groups. Such parameters were always required in the generated +parsing code. + +.. + +.. date: 2026-09-12-21-00-42 +.. gh-issue: 156995 +.. nonce: UVjqQe +.. section: C API + +On Free Threading, ``_PyBytes_Resize(&obj, 1)`` no longer returns a single +byte singleton if the current thread is different than the thread which +created the object. Patch by Stan Ulbrych. + +.. + +.. date: 2026-08-31-19-14-15 +.. gh-issue: 156101 +.. nonce: d4PSIF +.. section: C API + +Don't set the result in error in :c:func:`PyLong_AsInt32`, +:c:func:`PyLong_AsUInt32`, :c:func:`PyLong_AsInt64` and +:c:func:`PyLong_AsUInt64`. Leave the result unchanged in this case. Patch by +Victor Stinner. + +.. + +.. date: 2026-08-25-12-00-00 +.. gh-issue: 131740 +.. nonce: Ft7Rz2 +.. section: C API + +On the free-threaded build, :c:func:`PyUnstable_GC_VisitObjects` now also +visits frozen objects (objects moved to the permanent generation by +:func:`gc.freeze`), matching the behavior of the default build. diff --git a/Misc/NEWS.d/next/Build/2026-02-10-18-26-04.gh-issue-144679.FIH73W.rst b/Misc/NEWS.d/next/Build/2026-02-10-18-26-04.gh-issue-144679.FIH73W.rst deleted file mode 100644 index ebcfda54da39a75..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-02-10-18-26-04.gh-issue-144679.FIH73W.rst +++ /dev/null @@ -1,2 +0,0 @@ -When building with Visual Studio 2026 (Version 18), use PlatformToolSet v145 -by default. Patch by Chris Eibl. diff --git a/Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst b/Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst deleted file mode 100644 index 4d81c66d163a7c2..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-02-12-00-01.gh-issue-152023.pT7dKb.rst +++ /dev/null @@ -1,2 +0,0 @@ -Update Android builds to SQLite 3.53.4. Additionally, enable the ``median()`` -and ``percentile()`` functions. diff --git a/Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst b/Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst deleted file mode 100644 index 612180d3b65db21..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-20-14-02-33.gh-issue-156115.KXr8wU.rst +++ /dev/null @@ -1,4 +0,0 @@ -iOS simulator builds are now configured with -``-mios-simulator-version-min`` instead of the device's -``-mios-version-min``. The device flag made the linker reject libraries -resolved from the simulator SDK, so library detection silently failed. diff --git a/Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst b/Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst deleted file mode 100644 index ec3c798995849b2..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-08-20-17-41-11.gh-issue-155911.yL3z8q.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix curses detection when a curses library is already in ``LIBS``. -Patch by Shamil Abdulaev. diff --git a/Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst b/Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst deleted file mode 100644 index ac2890b5324ba4a..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-09-07-23-40-00.gh-issue-157142.gpnoop.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix the link of ``Programs/_freeze_module`` when extension modules are built -in (``MODULE_BUILDTYPE=static``) and the test modules are enabled: -``Modules/getpath_noop.c`` now defines ``_Py_Get_Getpath_CodeObject()``, -which ``_testinternalcapi`` uses. diff --git a/Misc/NEWS.d/next/Build/2026-09-19-16-54-58.gh-issue-157549.uk6QNH.rst b/Misc/NEWS.d/next/Build/2026-09-19-16-54-58.gh-issue-157549.uk6QNH.rst deleted file mode 100644 index eab0335aa671148..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-09-19-16-54-58.gh-issue-157549.uk6QNH.rst +++ /dev/null @@ -1,3 +0,0 @@ -Use ``sysconf(_SC_PAGESIZE)`` instead of ``getpagesize()`` in -``remote_debug.h`` so ``_remote_debugging`` builds on Darwin with -``-Werror=implicit-function-declaration``. diff --git a/Misc/NEWS.d/next/Build/2026-09-29-09-40-25.gh-issue-158010.H4Top_.rst b/Misc/NEWS.d/next/Build/2026-09-29-09-40-25.gh-issue-158010.H4Top_.rst deleted file mode 100644 index 76e81855af90b0c..000000000000000 --- a/Misc/NEWS.d/next/Build/2026-09-29-09-40-25.gh-issue-158010.H4Top_.rst +++ /dev/null @@ -1 +0,0 @@ -Update Android and iOS build scripts to use OpenSSL 3.5.9. diff --git a/Misc/NEWS.d/next/C_API/2026-08-25-12-00-00.gh-issue-131740.Ft7Rz2.rst b/Misc/NEWS.d/next/C_API/2026-08-25-12-00-00.gh-issue-131740.Ft7Rz2.rst deleted file mode 100644 index 83701b66ca85f85..000000000000000 --- a/Misc/NEWS.d/next/C_API/2026-08-25-12-00-00.gh-issue-131740.Ft7Rz2.rst +++ /dev/null @@ -1,3 +0,0 @@ -On the free-threaded build, :c:func:`PyUnstable_GC_VisitObjects` now also -visits frozen objects (objects moved to the permanent generation by -:func:`gc.freeze`), matching the behavior of the default build. diff --git a/Misc/NEWS.d/next/C_API/2026-08-31-19-14-15.gh-issue-156101.d4PSIF.rst b/Misc/NEWS.d/next/C_API/2026-08-31-19-14-15.gh-issue-156101.d4PSIF.rst deleted file mode 100644 index 68822d6702e3bc2..000000000000000 --- a/Misc/NEWS.d/next/C_API/2026-08-31-19-14-15.gh-issue-156101.d4PSIF.rst +++ /dev/null @@ -1,4 +0,0 @@ -Don't set the result in error in :c:func:`PyLong_AsInt32`, -:c:func:`PyLong_AsUInt32`, :c:func:`PyLong_AsInt64` and -:c:func:`PyLong_AsUInt64`. Leave the result unchanged in this case. Patch by -Victor Stinner. diff --git a/Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst b/Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst deleted file mode 100644 index ac2b7f7aae52fd9..000000000000000 --- a/Misc/NEWS.d/next/C_API/2026-09-12-21-00-42.gh-issue-156995.UVjqQe.rst +++ /dev/null @@ -1,3 +0,0 @@ -On Free Threading, ``_PyBytes_Resize(&obj, 1)`` no longer returns a single byte -singleton if the current thread is different than the thread which created the -object. Patch by Stan Ulbrych. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst b/Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst deleted file mode 100644 index d156efe4ca24144..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2020-06-23-13-59-37.gh-issue-85260.o_LJ76.rst +++ /dev/null @@ -1,4 +0,0 @@ -:func:`compile` now raises :exc:`ValueError` instead of crashing on a debug -build if an identifier field of an AST node (such as the name of a function, -a class, an imported module or a caught exception) is ``"None"``, ``"True"`` -or ``"False"``. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst deleted file mode 100644 index 8d7e177c6140a77..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-19-01-19-34.gh-issue-146096.R9tkJX.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fixed segmentation fault when called repr for BaseExceptionGroup with empty -or 1-size tuple args. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-26-15-08-53.gh-issue-148817.cuN07H.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-26-15-08-53.gh-issue-148817.cuN07H.rst deleted file mode 100644 index 87850754c85a140..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-26-15-08-53.gh-issue-148817.cuN07H.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fold large constant list and set literals used as the iterable of a -:keyword:`for` loop or ``in``/``not in`` test into a constant -:class:`tuple` or :class:`frozenset`, restoring an optimization -previously done by the AST optimizer that was lost when constant -folding moved to the CFG. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst deleted file mode 100644 index 2d5d4058a04ef2c..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-15-45-00.gh-issue-153578.Qm4Zt9.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix an out-of-bounds write in :meth:`bytearray.extend` when the bytearray is -resized while the argument's :meth:`~object.__buffer__` is being acquired, for -example by another thread. Patch by tonghuaroot. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-27-17-20-49.gh-issue-154719.eI88Gs.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-27-17-20-49.gh-issue-154719.eI88Gs.rst deleted file mode 100644 index 950d3ef0039f3d3..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-27-17-20-49.gh-issue-154719.eI88Gs.rst +++ /dev/null @@ -1,7 +0,0 @@ -Trailing whitespace in a t-string interpolation expression is now preserved -in :attr:`string.templatelib.Interpolation.expression`, up to the closing ``}`` -or the conversion (``!``), format (``:``), or debug (``=``) delimiter. -Explicit line continuations following a debug ``=`` remain part of the debug -text and are excluded from :attr:`~string.templatelib.Interpolation.expression`. -Escaped quotes are now preserved while reconstructing t-string interpolation -metadata and f-string debug text containing comments. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst deleted file mode 100644 index ba7dbe132540373..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-29-08-43-14.gh-issue-151464.o_mtmz.rst +++ /dev/null @@ -1,2 +0,0 @@ -Exclude invalid token ``<>`` from :mod:`tokenize` output. :exc:`SyntaxError` -for ``<>`` now suggests ``!=``. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-11-47-15.gh-issue-154902.DIi6sf.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-11-47-15.gh-issue-154902.DIi6sf.rst deleted file mode 100644 index 49f34eaeddec4e4..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-11-47-15.gh-issue-154902.DIi6sf.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash when ``__conditional_annotations__`` is rebound to a non-set -object. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-17-55-29.gh-issue-154937.m9IBba.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-17-55-29.gh-issue-154937.m9IBba.rst deleted file mode 100644 index 475dc8358a8d811..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-02-17-55-29.gh-issue-154937.m9IBba.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a data race on thread handle identifiers when ``_thread._shutdown()`` -runs concurrently with the startup of non-daemon threads in the -:term:`free-threaded build`. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst deleted file mode 100644 index 96b9c608780c2ec..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-10-11-20-00.gh-issue-155515.Lp3qWc.rst +++ /dev/null @@ -1,4 +0,0 @@ -Track the internal HAMT iterators, which back iteration over a -:class:`contextvars.Context`, with the garbage collector. A reference cycle -running through such an iterator was never collected, leaking the whole -context it iterated over. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-01-45-24.gh-issue-129752.Zo3OUx.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-01-45-24.gh-issue-129752.Zo3OUx.rst deleted file mode 100644 index aad13dc0adef34f..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-01-45-24.gh-issue-129752.Zo3OUx.rst +++ /dev/null @@ -1,2 +0,0 @@ -Don't update adaptive counters in the free-threaded build when thread-local -bytecode is disabled (``-X tlbc=0``). Patch by Donghee Na. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst deleted file mode 100644 index ae0c08973a8195b..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-06-04-26.gh-issue-155526.W7ZHXu.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix spurious :exc:`OverflowError` for ``abs(nanj)`` in case :c:data:`errno` was -previously set to :c:macro:`!ERANGE` by some library call. -Patch by Sergey B Kirpichev. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-13-50-35.gh-issue-155504.PsTqZm.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-13-50-35.gh-issue-155504.PsTqZm.rst deleted file mode 100644 index e042bf3554e6f05..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-11-13-50-35.gh-issue-155504.PsTqZm.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash when thread state creation fails before the thread state is fully -initialized. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst deleted file mode 100644 index 300e97ad5d257bc..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-13-13-50-00.gh-issue-155752.Rp7K2x.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash when a :class:`types.GenericAlias` argument gains a -``__typing_subst__`` hook after the alias parameters have been cached. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-20-22-13-20.gh-issue-156126.pXm4Qr.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-20-22-13-20.gh-issue-156126.pXm4Qr.rst deleted file mode 100644 index d8cfefb86b06dd2..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-20-22-13-20.gh-issue-156126.pXm4Qr.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash when importing a module whose name contains characters that -cannot be encoded to UTF-8 (such as lone surrogates) while :option:`-X -importtime <-X>` is enabled. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst deleted file mode 100644 index 096216f7e6c7b3c..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-23-12-00-00.gh-issue-156114.Kq7fXz.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash in the perf trampoline when a code object has a name or filename -that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-26-01-08-38.gh-issue-156371.USpwKG.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-26-01-08-38.gh-issue-156371.USpwKG.rst deleted file mode 100644 index 31ebff6f247f7e3..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-26-01-08-38.gh-issue-156371.USpwKG.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix missing ``PyRefTracer_DESTROY`` events for trashcan deferred objects. -Patch by Donghee Na. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-31-10-45-11.gh-issue-156689.Jq3xNv.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-31-10-45-11.gh-issue-156689.Jq3xNv.rst deleted file mode 100644 index 868997320b2f7cb..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-31-10-45-11.gh-issue-156689.Jq3xNv.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix an out-of-bounds read in :func:`compile` and :func:`ast.parse` when an AST -object is passed with ``mode='func_type'``. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst deleted file mode 100644 index 9da3c38ce4691b1..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-01-07-15-20.gh-issue-155525.A7kP2m.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix quadratic-time tokenization of modules containing many f-strings or -t-strings. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst deleted file mode 100644 index 9b279ab27947867..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-03-15-20-00.gh-issue-156894.Rt9Bx4.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix the position of syntax errors which cover a range if the line contains -non-ASCII characters before the error. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst deleted file mode 100644 index fdceb3209b7f7cb..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-14-06-00.gh-issue-156091.nested-comp.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash when compiling deeply nested inlined list, set, or dict -comprehensions. A :exc:`SyntaxError` is now raised when the nesting exceeds -the compiler's static block limit. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-12-22-29-51.gh-issue-157377.O6WYlM.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-12-22-29-51.gh-issue-157377.O6WYlM.rst deleted file mode 100644 index 0e8c5584a316a5c..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-12-22-29-51.gh-issue-157377.O6WYlM.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`gc.get_count` on the free-threaded build resetting the thread-local -allocation counter that schedules automatic garbage collection. A thread that -called it while allocating could prevent cyclic garbage from ever being -collected. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-10-43-24.gh-issue-156762.Kbf2mo.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-10-43-24.gh-issue-156762.Kbf2mo.rst deleted file mode 100644 index f6f9bb038f4909d..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-10-43-24.gh-issue-156762.Kbf2mo.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix undefined behaviour in :class:`operator.methodcaller`: its -:c:member:`~PyTypeObject.tp_clear` slot function returned ``void`` instead of -``int``, so the garbage collector called it through an incompatible function -type. Patched by Shamil Abdulaev. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-12-46-10.gh-issue-157378.Rg7Tq2.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-12-46-10.gh-issue-157378.Rg7Tq2.rst deleted file mode 100644 index 569642492992d3a..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-12-46-10.gh-issue-157378.Rg7Tq2.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix ``SyntaxError.offset`` and ``SyntaxError.end_offset`` for the -"Non-UTF-8 code starting with ..." error when a non-ASCII character precedes -the invalid byte on the same line. Patch by Shamil Abdulaev. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-22-12-00-00.gh-issue-157838.brcMrg.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-22-12-00-00.gh-issue-157838.brcMrg.rst deleted file mode 100644 index 931bcf99f321464..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-22-12-00-00.gh-issue-157838.brcMrg.rst +++ /dev/null @@ -1 +0,0 @@ -Merge biased reference counts on behalf of threads that are detached instead of waiting for them to attach again, in the free-threaded build. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst deleted file mode 100644 index 21908eea4a8236b..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-26-15-39-32.gh-issue-158254.qT7vRk.rst +++ /dev/null @@ -1,3 +0,0 @@ -Reverse iterators over a :class:`dict` and its views now raise -:exc:`RuntimeError` if the dictionary's keys change during iteration, like -forward iterators, instead of yielding entries for the new keys. diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst deleted file mode 100644 index 14ab4ef12becae6..000000000000000 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-28-18-58-27.gh-issue-158364.jBqmTs.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix crash when :func:`sys._current_frames` or -:func:`sys._current_exceptions` is called while another interpreter is -running. diff --git a/Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst b/Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst deleted file mode 100644 index c7c8057776bec4a..000000000000000 --- a/Misc/NEWS.d/next/Documentation/2026-09-24-10-10-15.gh-issue-57491.UA-2uN.rst +++ /dev/null @@ -1,3 +0,0 @@ -Reduce the depth of the table of contents in the EPUB documentation from -three levels to two, making it much shorter and easier to navigate in e-book -readers. diff --git a/Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst b/Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst deleted file mode 100644 index 10e59572b53746e..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2025-08-08-10-50-59.gh-issue-135511.9Rw5Zg.rst +++ /dev/null @@ -1 +0,0 @@ -Fix display of :exc:`NameError` and :exc:`AttributeError` with multi-line message. diff --git a/Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst b/Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst deleted file mode 100644 index c92c1f75b9d7a7d..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-06-27-17-27-21.gh-issue-90304.464d22.rst +++ /dev/null @@ -1,4 +0,0 @@ -Prevent IDLE from failing to start when a font reports a zero width for -the ``'0'`` character. Such a broken font caused a -:exc:`ZeroDivisionError`; the editor now falls back to the configured -width. diff --git a/Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst b/Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst deleted file mode 100644 index c4248f85b98a258..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-07-01-13-30-00.gh-issue-66172.Qm4xR7.rst +++ /dev/null @@ -1,3 +0,0 @@ -IDLE no longer fails to start when a user configuration file is corrupt. -The unparsable file is renamed with a ".bad" suffix, default settings are -used instead, and a warning lists the affected files. diff --git a/Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst b/Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst deleted file mode 100644 index 31e97b3c64bcfee..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-07-01-21-00-00.gh-issue-55646.kBind9.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix IDLE crash at startup when the user configuration contains an invalid key -binding, such as ``<Alt-Key-up>`` instead of ``<Alt-Key-Up>``. The invalid -binding is now ignored with a warning. diff --git a/Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst b/Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst deleted file mode 100644 index e00c76fc2d0d6f0..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-07-10-19-41-00.gh-issue-153480.EdMt1x.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix IDLE failing to start when opening a file which does not exist yet. -Fix a traceback when a file open in the IDLE editor is deleted by another -program; IDLE now asks whether to close the window, save the file elsewhere, -or ignore it. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst b/Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst deleted file mode 100644 index fd759cdbe92c2ff..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-03-17-16-26.gh-issue-156896.XTQJlq.rst +++ /dev/null @@ -1 +0,0 @@ -Stop deleting tkinter submodules when idlelib.run is imported. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst b/Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst deleted file mode 100644 index 591c1582fa8d75a..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-05-16-00-00.gh-issue-154511.hV2wQn.rst +++ /dev/null @@ -1,5 +0,0 @@ -Consolidate IDLE's mouse wheel handling in ``idlelib.util``. -``wheel_event`` moves there from ``idlelib.tree`` and joins ``x11_buttons``, -which tells whether Tk reports wheel rotations to a widget as -``<Button-4>``/``<Button-5>`` events, and ``bind_wheel``, which binds -whichever events Tk sends. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst deleted file mode 100644 index 794a51b2b32e857..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-15-46-35.gh-issue-71136.vwGO0v.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a hang of the IDLE Shell when code run under the debugger raises -:exc:`KeyboardInterrupt`. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst deleted file mode 100644 index 9db16c5a74a2429..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-16-19-25.gh-issue-91398.PBdiDB.rst +++ /dev/null @@ -1,2 +0,0 @@ -Remove the border around the IDLE Shell sidebar, which was drawn in the -window background color and stood out with dark themes. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst deleted file mode 100644 index fc9091521130770..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-16-37-19.gh-issue-69919.f6AamT.rst +++ /dev/null @@ -1,2 +0,0 @@ -IDLE now reports any exception raised by compiling the source, such as -:exc:`MemoryError` for too deeply nested source, instead of hanging the Shell. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst deleted file mode 100644 index 70d64aa09a6dee4..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-20-14-08.gh-issue-75234.O8ZNFV.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix editing help sources and key bindings in the IDLE Settings dialog after -selecting them with the keyboard. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst deleted file mode 100644 index 4d8cfc1dbc6574a..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-21-20-04.gh-issue-68453.hlxbog.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix running IDLE with the -s option together with -c, -r or -: the command -or script now runs after the startup file, without an error dialog and -without restarting the shell. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst deleted file mode 100644 index 9b876ab0486f20d..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-21-44-35.gh-issue-60402.iFz6X6.rst +++ /dev/null @@ -1,2 +0,0 @@ -In IDLE, Tab in a string that is not the start of a file name inserts a tab -instead of opening the completion list. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst deleted file mode 100644 index 7b4924fa0af2283..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-21-54-04.gh-issue-105689.ASoU37.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix calltips, parenthesis matching and auto-indent in the IDLE Shell after -output containing unbalanced quotes or parentheses. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst deleted file mode 100644 index 3260b42211b780b..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-22-10-17.gh-issue-93966.ch4fTB.rst +++ /dev/null @@ -1,2 +0,0 @@ -The highlighting of a syntax error in the IDLE Shell is now removed when the -next statement is entered, not only when the next syntax error occurs. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst deleted file mode 100644 index d29c87aed78e1a0..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-22-34-33.gh-issue-69365.KehjZN.rst +++ /dev/null @@ -1,2 +0,0 @@ -The IDLE search dialogs now show a regular expression error below the entry -instead of in a message box. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst b/Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst deleted file mode 100644 index 05d42efd451458e..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-15-23-27-38.gh-issue-69004.Z7Ym9G.rst +++ /dev/null @@ -1,2 +0,0 @@ -The Debugger item of the IDLE Debug menu is now disabled while user code -runs, like Stack Viewer. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst b/Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst deleted file mode 100644 index 3eabd4e176ad8a6..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-16-18-00-00.gh-issue-59568.tilde1.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix "Save As" and "Open" dialogs in IDLE for a file whose name starts with -``~`` on Windows and X11 with Tcl/Tk older than 9. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst b/Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst deleted file mode 100644 index a9fe00a72fe87c3..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-16-20-00-00.gh-issue-93016.cliarg.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix parsing of command line arguments in the IDLE "Run... Customized" dialog -on Windows: backslashes are no longer treated as escape characters. Fix also -display of the previous arguments in the dialog. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst b/Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst deleted file mode 100644 index 1a7124e76cd49f8..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-16-22-00-00.gh-issue-70331.shadow.rst +++ /dev/null @@ -1,4 +0,0 @@ -IDLE no longer fails to start with ``python -m idlelib``, and its user process -no longer fails to start, when the current directory contains user files with -the same names as standard library modules that IDLE imports, such as -``random.py`` or ``tkinter.py``. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst deleted file mode 100644 index 4a4c885eff96818..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-01-00-00.gh-issue-89544.rstbuf.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix IDLE hanging after Restart Shell while receiving a large output from the -user process. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst deleted file mode 100644 index 0a7037eab869ff1..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-02-00-00.gh-issue-103089.longline.rst +++ /dev/null @@ -1,2 +0,0 @@ -IDLE no longer hangs when opening a file with very long lines. -Only the first 2,000 characters of a line are colorized. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst deleted file mode 100644 index cc04822f6d33216..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-08-53-12.gh-issue-151471.-yvE03.rst +++ /dev/null @@ -1 +0,0 @@ -Colorize the soft keyword ``type`` in IDLE. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst deleted file mode 100644 index 18a230e75913b59..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-12-00-00.gh-issue-74112.sigint.rst +++ /dev/null @@ -1,2 +0,0 @@ -Ctrl-C in the IDLE Shell now interrupts blocking calls such as -:func:`time.sleep` and :meth:`socket.recv <socket.socket.recv>`. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst deleted file mode 100644 index 5ae2d360f5c6a93..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-17-00-00.gh-issue-75487.blankint.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix saving a truncated number when an integer entry in the IDLE Settings -dialog is blanked with the Backspace key. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst deleted file mode 100644 index 9e20622bb535b0c..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-18-00-00.gh-issue-85560.elseexpr.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix IDLE failing to find the opening parenthesis when a continuation line -inside the parentheses starts with ``else`` of a conditional expression or -with ``yield``. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst deleted file mode 100644 index 2e77f55751fa318..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-21-00-00.gh-issue-64007.inputcolor.rst +++ /dev/null @@ -1,2 +0,0 @@ -IDLE no longer applies syntax coloring to the text entered for -:func:`input` in the Shell. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst deleted file mode 100644 index 166cb6971f9b0e2..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-22-00-00.gh-issue-75512.asyncout.rst +++ /dev/null @@ -1,2 +0,0 @@ -Output from a thread printed in the IDLE Shell while a statement is being -entered no longer takes over the prompt of the statement. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst b/Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst deleted file mode 100644 index 70878e4f8012638..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-17-23-00-00.gh-issue-56596.capslock.rst +++ /dev/null @@ -1,2 +0,0 @@ -Make IDLE keyboard shortcuts with ascii letters work when Caps Lock is on even when only one -of the upper and lowercase versions are defined. diff --git a/Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst b/Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst deleted file mode 100644 index 2e34cf6a67b8274..000000000000000 --- a/Misc/NEWS.d/next/IDLE/2026-09-24-12-00-00.gh-issue-158067.opnPy1.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix the IDLE File Open dialog listing text files before Python files when -opened from the Shell or an Output window. diff --git a/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst b/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst deleted file mode 100644 index 2a286a6b62a8f1b..000000000000000 --- a/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst +++ /dev/null @@ -1,3 +0,0 @@ -:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written -by curl and Wget, which use ``0`` in the expiration time field. -Contributed by Jérémie Detrey. diff --git a/Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst b/Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst deleted file mode 100644 index efadbb289c3498c..000000000000000 --- a/Misc/NEWS.d/next/Library/2020-02-19-16-35-52.gh-issue-83869.EPD_zn.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix :mod:`tarfile` reading an archive with a GNU sparse 1.0 member whose -size is set in the pax extended header. -The offset of the next header was computed from the offset of the data, -which is already past the sparse map, and from the size of the member, -which can be the apparent size of the sparse file. -All following members were unreachable. diff --git a/Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst b/Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst deleted file mode 100644 index 28c21c327504bde..000000000000000 --- a/Misc/NEWS.d/next/Library/2021-06-03-22-23-38.bpo-44012.BK3HfA.rst +++ /dev/null @@ -1,5 +0,0 @@ -The ``exploded`` attribute of :class:`ipaddress.IPv6Address` and -:class:`ipaddress.IPv6Interface` now supports addresses with a scope ID -(link-local addresses). -Previously the former raised :exc:`~ipaddress.AddressValueError` -and the latter omitted the scope ID. diff --git a/Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst b/Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst deleted file mode 100644 index c59f6fed93fd630..000000000000000 --- a/Misc/NEWS.d/next/Library/2022-01-03-12-50-42.gh-issue-70758.2NjFW_.rst +++ /dev/null @@ -1,2 +0,0 @@ -Creating a new :mod:`turtle` screen after the previous one was closed no -longer raises ``turtle.Terminator`` on the first turtle command. diff --git a/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst b/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst deleted file mode 100644 index cb75ae83780eaf6..000000000000000 --- a/Misc/NEWS.d/next/Library/2023-02-11-09-49-49.gh-issue-82039.caTE7O.rst +++ /dev/null @@ -1,2 +0,0 @@ -:meth:`http.cookiejar.FileCookieJar.load` now checks the first, format -signature line in a case-insensitive manner. Patch by Ashley Harvey. diff --git a/Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst b/Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst deleted file mode 100644 index 677b8ee86e6c8f6..000000000000000 --- a/Misc/NEWS.d/next/Library/2023-03-23-19-47-05.gh-issue-102967.gfIYkN.rst +++ /dev/null @@ -1,2 +0,0 @@ -A bug in :func:`!doctest._SpoofOut.truncate` was causing None to be passed to :func:`!StringIO.seek` when no size was given. -A simple fix skips the seek call when no size is given so the buffer can be truncated from the current position. diff --git a/Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst b/Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst deleted file mode 100644 index d5abc0ec28dc9b9..000000000000000 --- a/Misc/NEWS.d/next/Library/2023-12-20-22-05-40.gh-issue-113329.1CJy3o.rst +++ /dev/null @@ -1 +0,0 @@ -Fix :exc:`OSError` being raised when trying to run doctests on a class objects in the REPL. Patch by Sten Wessel. diff --git a/Misc/NEWS.d/next/Library/2026-02-11-16-47-27.gh-issue-140729.2uTPQp.rst b/Misc/NEWS.d/next/Library/2026-02-11-16-47-27.gh-issue-140729.2uTPQp.rst deleted file mode 100644 index 49c9adc4679abbf..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-02-11-16-47-27.gh-issue-140729.2uTPQp.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a pickling error in the ``cProfile`` module when profiling a script that -uses :class:`multiprocessing.Process` with the ``spawn`` and ``forkserver`` -start methods. diff --git a/Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst b/Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst deleted file mode 100644 index 9f8cc32fd81c88c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-05-20-14-00-00.gh-issue-145856.Pl5kZx.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`plistlib.dumps` and :func:`plistlib.dump` so that ``skipkeys=True`` -together with ``sort_keys=True`` correctly drops non-string keys when the -dictionary contains a mix of string and non-string keys. Previously the sort -ran before the filter and raised :exc:`TypeError`. diff --git a/Misc/NEWS.d/next/Library/2026-06-09-12-00-00.gh-issue-150771.K7mNx2.rst b/Misc/NEWS.d/next/Library/2026-06-09-12-00-00.gh-issue-150771.K7mNx2.rst deleted file mode 100644 index 2965176d438172e..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-06-09-12-00-00.gh-issue-150771.K7mNx2.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix serialization of :mod:`email` messages using the ``shift_jis`` or -``euc-jp`` charsets: ``set_content()`` now encodes the payload using -the output charset, so ``str(m)`` no longer raises -:exc:`UnicodeEncodeError`. diff --git a/Misc/NEWS.d/next/Library/2026-06-22-18-01-00.gh-issue-151955.6u5iwm.rst b/Misc/NEWS.d/next/Library/2026-06-22-18-01-00.gh-issue-151955.6u5iwm.rst deleted file mode 100644 index 243b3308a57ad32..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-06-22-18-01-00.gh-issue-151955.6u5iwm.rst +++ /dev/null @@ -1,2 +0,0 @@ -Allow more types to be used in the ``bound`` argument to -:class:`typing.ParamSpec`. diff --git a/Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst b/Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst deleted file mode 100644 index 1ba1f872eb41a61..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-06-25-14-05-00.gh-issue-152204.k9Qm3v.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix the pure-Python implementations of :meth:`datetime.date.fromisoformat`, -:meth:`datetime.time.fromisoformat` and :meth:`datetime.datetime.fromisoformat` -silently accepting some malformed ISO 8601 strings, such as non-ASCII digits or -a sign in a fixed-width field (for example ``'2020+12'`` or ``'20201212T0102٣٤'``). -Each field is now required to be exactly *N* ASCII digits, matching the C -implementation. diff --git a/Misc/NEWS.d/next/Library/2026-07-02-19-21-15.gh-issue-152068.ThsmJU.rst b/Misc/NEWS.d/next/Library/2026-07-02-19-21-15.gh-issue-152068.ThsmJU.rst deleted file mode 100644 index 9ec8413b4ac424c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-02-19-21-15.gh-issue-152068.ThsmJU.rst +++ /dev/null @@ -1 +0,0 @@ -Fixes a bug when a line was split (particularly on macOS Terminal.app) in the middle of a colorized keyword, causing the ANSI Color Reset sequence (ESC0m) to not be properly printed, causing the output to be colored when it shouldn't diff --git a/Misc/NEWS.d/next/Library/2026-07-05-17-39-16.gh-issue-153133.kKSH7g.rst b/Misc/NEWS.d/next/Library/2026-07-05-17-39-16.gh-issue-153133.kKSH7g.rst deleted file mode 100644 index a7a68158ac895e3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-05-17-39-16.gh-issue-153133.kKSH7g.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a socket leak in :meth:`asyncio.loop.create_connection` when the -transport cannot be created. diff --git a/Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst b/Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst deleted file mode 100644 index 95f8e2fb7f4f8be..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-08-19-40-00.gh-issue-153319.Qk7bE2.rst +++ /dev/null @@ -1,2 +0,0 @@ -The :mod:`turtledemo` viewer now reads each demo script as UTF-8 instead of -the locale encoding. diff --git a/Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst b/Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst deleted file mode 100644 index 33247f0f3a3b968..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-08-23-20-00.gh-issue-152907.oyPV9Y.rst +++ /dev/null @@ -1,4 +0,0 @@ -Restore cooked-mode terminal output flags around :c:data:`PyOS_InputHook` -callbacks in the new :term:`REPL` (:mod:`!_pyrepl`), so that output written -by an input hook (for example a GUI toolkit event loop) is no longer emitted -with ``OPOST`` disabled and keeps its carriage returns. diff --git a/Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst b/Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst deleted file mode 100644 index 241d67949680925..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-11-12-21-12.gh-issue-153539.gBs2T5.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in the C implementation of :meth:`io.TextIOWrapper.tell` when the -decoder's ``getstate`` method triggers a reentrant seek, or when another thread -seeks the same stream concurrently. Patch by tonghuaroot. diff --git a/Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst b/Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst deleted file mode 100644 index 5c60a302883931c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-11-13-24-49.gh-issue-153603.YbKlry.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in the ISO-2022 decoders when decoding a byte after an unknown -charset designation is set via the decoder's ``setstate`` method. -Patch by tonghuaroot. diff --git a/Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst b/Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst deleted file mode 100644 index 6110b7404a811e4..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-18-04-09-44.gh-issue-81241.gGRbBr.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :exc:`OSError` when importing :mod:`ctypes` from a statically linked -interpreter. diff --git a/Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst b/Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst deleted file mode 100644 index 9393384151450d8..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-19-17-05-00.gh-issue-153772.cobjTK.rst +++ /dev/null @@ -1,5 +0,0 @@ -:func:`isinstance` checks against :mod:`collections.abc` classes such as -:class:`~collections.abc.Mapping` no longer raise :exc:`AttributeError` -when the instance has no ``__class__``. The abstract base class machinery -now falls back to the object's type in that case, matching the behaviour of -the built-in :func:`isinstance`. diff --git a/Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst b/Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst deleted file mode 100644 index 7f3d10b3072ef94..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-19-17-45-00.gh-issue-153005.F6WH92.rst +++ /dev/null @@ -1,4 +0,0 @@ -:meth:`!concurrent.interpreters.Queue.get` and -:meth:`!concurrent.interpreters.Queue.put` now compute their ``timeout`` -deadline from :func:`time.monotonic` instead of the wall clock, so adjusting -the system clock during the call no longer makes them over- or under-wait. diff --git a/Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst b/Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst deleted file mode 100644 index def943b46b59420..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-22-12-00-00.gh-issue-153970.Kq7Wn3.rst +++ /dev/null @@ -1,3 +0,0 @@ -Calling :func:`str` on a :exc:`subprocess.CalledProcessError` no longer -raises :exc:`TypeError` when its :attr:`!returncode` is not an integer, such -as ``None``. diff --git a/Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst b/Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst deleted file mode 100644 index 532ae22d017a565..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-23-14-13-39.gh-issue-135683.droBu7.rst +++ /dev/null @@ -1,3 +0,0 @@ -:class:`logging.FileHandler` and :class:`logging.handlers.WatchedFileHandler` -now honor :data:`logging.raiseExceptions` for errors that occur while opening -the file, like for other errors during logging. diff --git a/Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst b/Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst deleted file mode 100644 index d8895e32bafe8a9..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-29-14-20-40.gh-issue-154855.vfF453.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :meth:`curses.window.instr` returning one character too few when the -:mod:`curses` module is built against a curses library that counts the -terminator in the requested length, such as the NetBSD one. diff --git a/Misc/NEWS.d/next/Library/2026-07-29-19-48-59.gh-issue-154871.tgZILS.rst b/Misc/NEWS.d/next/Library/2026-07-29-19-48-59.gh-issue-154871.tgZILS.rst deleted file mode 100644 index 8f0f1096dfe6347..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-07-29-19-48-59.gh-issue-154871.tgZILS.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fixed a crash in :meth:`asyncio.Task.get_context` -when called on an uninitialized task. diff --git a/Misc/NEWS.d/next/Library/2026-08-03-22-46-07.gh-issue-155143.9-byZp.rst b/Misc/NEWS.d/next/Library/2026-08-03-22-46-07.gh-issue-155143.9-byZp.rst deleted file mode 100644 index ae39b30e40a643e..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-03-22-46-07.gh-issue-155143.9-byZp.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :func:`asyncio.shield` leaking the calling task via the await-graph and -callbacks when called on a future that never resolves. diff --git a/Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst b/Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst deleted file mode 100644 index 4d8f866366f5beb..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-05-16-40-00.gh-issue-69371.pyDocU.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix :mod:`pydoc` for modules whose path contains undecodable bytes. -:func:`!pydoc.writedoc` and the pydoc HTTP server no longer fail with -:exc:`UnicodeEncodeError`: the file URL is now percent-encoded using the -filesystem encoding, and characters unencodable in the generated HTML page -are escaped with backslashes. diff --git a/Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst b/Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst deleted file mode 100644 index 27c97f9bdf07b48..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-05-17-30-00.gh-issue-69370.inspCLI.rst +++ /dev/null @@ -1,4 +0,0 @@ -:program:`python -m inspect --details` no longer fails with -:exc:`UnicodeEncodeError` if the path of the module contains characters -unencodable in the encoding of :data:`sys.stdout`. Such characters are now -escaped with backslashes. diff --git a/Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst b/Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst deleted file mode 100644 index 6c990b2eb938452..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-07-01-10-00.gh-issue-123011.warnexp.rst +++ /dev/null @@ -1,3 +0,0 @@ -:func:`warnings.warn_explicit` no longer emits a spurious -:exc:`DeprecationWarning` or raises :exc:`ImportError` when it is called with -the globals of the :mod:`__main__` module. diff --git a/Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst b/Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst deleted file mode 100644 index 34a7ff83a73c0b8..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-07-02-20-00.gh-issue-155319.srcline.rst +++ /dev/null @@ -1,4 +0,0 @@ -:func:`warnings.warn_explicit` now displays the source line taken from the -loader of the module whose globals are passed as *module_globals*. It also -no longer raises :exc:`IndexError` if *lineno* is out of the range of the -module source. diff --git a/Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst b/Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst deleted file mode 100644 index 03b90b42e8c3e63..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-08-21-40-00.gh-issue-84419.statexe.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`os.stat` on Windows: trailing dots and spaces, which are ignored -by the operating system, are no longer taken into account when the execute -permissions are guessed from the file extension. diff --git a/Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst b/Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst deleted file mode 100644 index 9218ecfe9ce62e3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-09-00-30-00.gh-issue-89760.rpvol.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :func:`os.path.realpath` on Windows: the ``\\?\`` prefix is no longer -stripped from a volume GUID path, which made the result invalid. diff --git a/Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst b/Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst deleted file mode 100644 index fb647720791dac0..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-09-01-30-00.gh-issue-102475.rpjoin.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`os.path.realpath` on Windows: the unresolved part of the path is -now appended, not joined, so a file name which looks like a drive (e.g. -``spam:eggs``) no longer discards the resolved part. A path relative to -another drive is now resolved against the root directory of that drive. diff --git a/Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst b/Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst deleted file mode 100644 index 87f8a7f4a21e66d..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-10-09-00-18.gh-issue-155336.vrTXoU.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix error handling in :func:`socket.gethostbyaddr` and -:func:`socket.gethostbyname_ex` when hostname resolution fails. diff --git a/Misc/NEWS.d/next/Library/2026-08-10-13-27-36.gh-issue-155519.9M6SFX.rst b/Misc/NEWS.d/next/Library/2026-08-10-13-27-36.gh-issue-155519.9M6SFX.rst deleted file mode 100644 index 6c21837d43d5544..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-10-13-27-36.gh-issue-155519.9M6SFX.rst +++ /dev/null @@ -1,2 +0,0 @@ -Avoid a data-race in free-threaded builds when reading and writing context -variables from different threads. diff --git a/Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst b/Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst deleted file mode 100644 index 4d495b9de62fa5a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-10-15-24-13.gh-issue-155468.W7qL2p.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :mod:`netrc` to distinguish empty quoted tokens from end-of-file, so -malformed files no longer cause the remaining content to be silently ignored. diff --git a/Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst b/Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst deleted file mode 100644 index 4cd4acd01886368..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-14-12-46-07.gh-issue-113318.DYGQjo.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix crashes when deleting an attribute whose setter is generated by Argument -Clinic and is not prepared for deletion, among them -:attr:`frame.f_trace_opcodes` and the ``context``, ``owner`` and ``session`` -attributes of ``_ssl._SSLSocket``. -Deleting such attribute now raises :exc:`AttributeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst b/Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst deleted file mode 100644 index 309421ae08240f8..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-14-14-10-00.gh-issue-155775.Kq3vTx.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix a regression in :mod:`imaplib` introduced in the fix for :gh:`63121`: -refreshing the capabilities after a successful :meth:`~imaplib.IMAP4.login` -or :meth:`~imaplib.IMAP4.authenticate` consumed the ``CAPABILITY`` response, -so it could no longer be read with :meth:`~imaplib.IMAP4.response`. diff --git a/Misc/NEWS.d/next/Library/2026-08-16-11-38-17.gh-issue-155888.pO-nAp.rst b/Misc/NEWS.d/next/Library/2026-08-16-11-38-17.gh-issue-155888.pO-nAp.rst deleted file mode 100644 index df3db71b912e1c2..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-16-11-38-17.gh-issue-155888.pO-nAp.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :meth:`asyncio.WriteTransport.writelines` hanging the transport when the -last data chunk is empty. diff --git a/Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst b/Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst deleted file mode 100644 index 92b4a55692ee50a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-17-12-40-00.gh-issue-155952.Vq3Lm8.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix the signatures of :meth:`sqlite3.Connection.execute`, :func:`warnings.warn` -and :func:`locale.setlocale` which rendered ``<unrepresentable>`` instead of the -correct defaults for parameters. diff --git a/Misc/NEWS.d/next/Library/2026-08-17-21-00-00.gh-issue-155941.strmCb.rst b/Misc/NEWS.d/next/Library/2026-08-17-21-00-00.gh-issue-155941.strmCb.rst deleted file mode 100644 index 6cee7eb4eb9090e..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-17-21-00-00.gh-issue-155941.strmCb.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`asyncio.start_server` when a plain-function *client_connected_cb* -raises: the error is now reported like the coroutine case and the transport -is closed, instead of leaving the connection open forever (which also made -:meth:`asyncio.Server.wait_closed` hang). diff --git a/Misc/NEWS.d/next/Library/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst b/Misc/NEWS.d/next/Library/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst deleted file mode 100644 index 2727ba34aad8ff5..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-18-13-41-00.gh-issue-155997.CjbD1F.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`concurrent.interpreters.list_all`. It failed if an interpreter -was destroyed during the call, in particular by a garbage collection which -finalized the object owning the last reference to it. diff --git a/Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst b/Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst deleted file mode 100644 index af4c778ece5d703..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-19-21-01-19.gh-issue-156067.1CXkqc.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix error handling in the :mod:`zoneinfo` accelerator module when a -transition index is ``-1`` or a TZ string's ``__bool__`` raises. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst b/Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst deleted file mode 100644 index 1092a5a53785635..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-12-00-00.gh-issue-156099.Kp4vRt.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash when deleting the ``keylog_filename`` attribute of -:class:`ssl.SSLContext`. -It now raises :exc:`AttributeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst b/Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst deleted file mode 100644 index 8c296a9a8919fc3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-12-05-00.gh-issue-156100.Lm7qWz.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix crashes in :class:`sqlite3.Connection` when deleting the -:attr:`~sqlite3.Connection.autocommit` attribute or setting it to an integer -which does not fit in C :c:expr:`long`. -Both now raise an exception. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-12-10-00.gh-issue-156101.Qb2xNv.rst b/Misc/NEWS.d/next/Library/2026-08-20-12-10-00.gh-issue-156101.Qb2xNv.rst deleted file mode 100644 index 817f4a7207d7fa1..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-12-10-00.gh-issue-156101.Qb2xNv.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :attr:`sqlite3.Cursor.arraysize` being set to 0 if the assigned value is -too large. -The attribute is now left unchanged if the assignment fails. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst b/Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst deleted file mode 100644 index ba92df3c5cb6c1d..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-13-50-49.gh-issue-156112.yEcma8.rst +++ /dev/null @@ -1,4 +0,0 @@ -:mod:`!_ios_support` no longer fails to import when -:func:`ctypes.util.find_library` cannot resolve the ObjC runtime through the -dyld shared cache, as is the case on iOS 13. The runtime is now loaded by name, -which dyld resolves against the cache directly. diff --git a/Misc/NEWS.d/next/Library/2026-08-20-16-30-00.gh-issue-156124.Kq3vXz.rst b/Misc/NEWS.d/next/Library/2026-08-20-16-30-00.gh-issue-156124.Kq3vXz.rst deleted file mode 100644 index 64882cbc40e2450..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-20-16-30-00.gh-issue-156124.Kq3vXz.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix a crash in the free-threaded build when deleting the :attr:`!contents` -attribute of a :mod:`ctypes` pointer. diff --git a/Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst b/Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst deleted file mode 100644 index 1cc45cc6846713f..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-21-11-00-00.gh-issue-152817.Rt6mNc.rst +++ /dev/null @@ -1,2 +0,0 @@ -:mod:`sqlite3`: Disallow removing the ``row_factory`` attribute of a cursor -to prevent a crash on a query. diff --git a/Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst b/Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst deleted file mode 100644 index 846931a1cab5117..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-21-11-56-28.gh-issue-156173.mhZa8a.rst +++ /dev/null @@ -1,2 +0,0 @@ -Calling :meth:`zlib.Decompress.flush` on invalid compressed data now -raises :exc:`zlib.error` instead of being silently ignored. diff --git a/Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst b/Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst deleted file mode 100644 index 2417479d333e3e6..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-21-13-30-00.gh-issue-156166.Xv8pQm.rst +++ /dev/null @@ -1,3 +0,0 @@ -:mod:`ssl`: A failed assignment or deletion of the ``_msg_callback`` -attribute of :class:`ssl.SSLContext` no longer removes the current callback. -Deleting it now raises :exc:`AttributeError` instead of :exc:`TypeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst b/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst deleted file mode 100644 index 0dd925cf596277a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst +++ /dev/null @@ -1 +0,0 @@ -Fix :mod:`configparser` parsing when using whitespace in *delimiters*. diff --git a/Misc/NEWS.d/next/Library/2026-08-26-12-48-10.gh-issue-156408.-Yd0k7.rst b/Misc/NEWS.d/next/Library/2026-08-26-12-48-10.gh-issue-156408.-Yd0k7.rst deleted file mode 100644 index 62c92838b5c1266..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-26-12-48-10.gh-issue-156408.-Yd0k7.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :func:`asyncio.print_call_graph` raising :exc:`AttributeError` when -called on a task that has already finished. diff --git a/Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst b/Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst deleted file mode 100644 index cae73e534c47ddd..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-27-08-31-29.gh-issue-156444.klcySy.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix matching of a negated character set in a bytes pattern compiled with both -:const:`re.IGNORECASE` and :const:`re.LOCALE`. The case closure is now applied -to the members of the set, so that ``[^bc]`` no longer matches ``b'B'``. diff --git a/Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst b/Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst deleted file mode 100644 index c92fce3bc05969a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-28-00-59-00.gh-issue-156476.rQhxc7.rst +++ /dev/null @@ -1,3 +0,0 @@ -The pure Python implementation of :meth:`queue.SimpleQueue.get` now ignores -*timeout* when *block* is false, matching the documented behavior and -the C implementation. It previously raised :exc:`ValueError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-28-18-10-25.gh-issue-156523.llJqo9.rst b/Misc/NEWS.d/next/Library/2026-08-28-18-10-25.gh-issue-156523.llJqo9.rst deleted file mode 100644 index c1c95d76c0d23bb..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-28-18-10-25.gh-issue-156523.llJqo9.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :func:`asyncio.as_completed` not recording the awaiting task in the call -graph. diff --git a/Misc/NEWS.d/next/Library/2026-08-30-13-25-53.gh-issue-156512.tVTOIV.rst b/Misc/NEWS.d/next/Library/2026-08-30-13-25-53.gh-issue-156512.tVTOIV.rst deleted file mode 100644 index 16d6b7bdeae9859..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-30-13-25-53.gh-issue-156512.tVTOIV.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :mod:`asyncio` losing a connection twice when ``resume_writing()`` -closes the transport. diff --git a/Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst b/Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst deleted file mode 100644 index 3f2f105116c1838..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-30-19-30-00.gh-issue-156658.Xq5Nt7.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`xml.dom` and :mod:`xml.etree.ElementTree` no longer treat characters -which are not white space in XML (such as U+00A0) as white space. Previously -they could be lost in :func:`~xml.etree.ElementTree.indent`, -:func:`~xml.etree.ElementTree.canonicalize` with ``strip_text=True``, and when -parsing with the ``whitespace-in-element-content`` feature turned off. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst b/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst deleted file mode 100644 index f47da0453249cad..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-00-00-00.gh-issue-127057.N9yg62.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :class:`asyncio.ProactorEventLoop` UDP transports so that a -:exc:`ConnectionResetError` raised by ``WSARecvFrom`` no longer stops the -read loop. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst b/Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst deleted file mode 100644 index 1d21fc70fd9256f..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-17-10-00.gh-issue-156713.Nt2URL.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :func:`!nturl2path.pathname2url` and :func:`!nturl2path.url2pathname`: -the filesystem encoding and error handler are now used for percent-encoding -and decoding, as in :mod:`urllib.request`. Previously paths containing -surrogate characters raised :exc:`UnicodeEncodeError`. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst b/Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst deleted file mode 100644 index 37a8c0b620310a3..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-20-30-00.gh-issue-99064.Rt4mZ9.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix :func:`xml.etree.ElementTree.parse` with a text file or other source -of :class:`str` data in the C implementation. -The encoding declared in the document was applied to the already decoded -text, which produced mojibake. It is now ignored, as when parsing with -:meth:`!XMLParser.feed` or :func:`~xml.etree.ElementTree.fromstring`. diff --git a/Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst b/Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst deleted file mode 100644 index c6e2c77897cbc29..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-08-31-23-10-00.gh-issue-83895.Jm5tR3.rst +++ /dev/null @@ -1,4 +0,0 @@ -:mod:`xml.etree.ElementTree` now accepts input larger than 2 GiB -in the C implementation. -The data is fed to Expat in chunks, as :mod:`xml.parsers.expat` already did, -instead of raising :exc:`OverflowError`. diff --git a/Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst b/Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst deleted file mode 100644 index 7879ac7e71c71d9..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-01-16-58-30.gh-issue-156797.Qm4tRs.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :class:`xml.sax.saxutils.XMLGenerator`: the namespace URI is now escaped -in the namespace declaration. Previously a URI containing ``&``, ``<`` or a -quote character produced a document which cannot be parsed. diff --git a/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst b/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst deleted file mode 100644 index 5b72fd3561e804c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user -pointer runs while the panel is being deallocated. The panel is now taken -off the panel stack before its user pointer is dropped. diff --git a/Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst b/Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst deleted file mode 100644 index dd60841efe821c2..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-05-15-27-11.gh-issue-156970.DxlgbB.rst +++ /dev/null @@ -1 +0,0 @@ -Set the docstring of :attr:`unittest.mock.Mock.return_value`. diff --git a/Misc/NEWS.d/next/Library/2026-09-05-18-23-30.gh-issue-156988.nEUQE6.rst b/Misc/NEWS.d/next/Library/2026-09-05-18-23-30.gh-issue-156988.nEUQE6.rst deleted file mode 100644 index 6cb2f1f4cf14ae0..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-05-18-23-30.gh-issue-156988.nEUQE6.rst +++ /dev/null @@ -1,2 +0,0 @@ -:func:`asyncio.print_call_graph` no longer truncates the call stack at a -synchronous generator. diff --git a/Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst b/Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst deleted file mode 100644 index 20ded0775d7a70a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-05-22-39-22.gh-issue-156961.ZtYqoA.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`tkinter.font.nametofont` and the :class:`tkinter.font.Font` -constructor for a font name returned by Tk as a Tcl object, -for example by :meth:`ttk.Style.lookup() <tkinter.ttk.Style.lookup>`. diff --git a/Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst b/Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst deleted file mode 100644 index 1638968e475ca4a..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-06-15-23-24.gh-issue-157048.UtFyiJ.rst +++ /dev/null @@ -1,2 +0,0 @@ -Preserve the position and contents of :class:`io.BytesIO` when -:meth:`!BytesIO.__init__` fails because a buffer is exported. diff --git a/Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst b/Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst deleted file mode 100644 index afe1dffa96b403d..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-07-00-21-31.gh-issue-156933.OalCjC.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix incorrect integer return values from :mod:`ctypes` callbacks on some -platforms, such as s390x. diff --git a/Misc/NEWS.d/next/Library/2026-09-07-12-24-11.gh-issue-157058.2SoQU7.rst b/Misc/NEWS.d/next/Library/2026-09-07-12-24-11.gh-issue-157058.2SoQU7.rst deleted file mode 100644 index 9122ae0919dcb11..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-07-12-24-11.gh-issue-157058.2SoQU7.rst +++ /dev/null @@ -1,2 +0,0 @@ -:func:`asyncio.wait_for` with a non-positive timeout now records the waiter -in the call graph. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-04-10-00.gh-issue-123018.hV2kQe.rst b/Misc/NEWS.d/next/Library/2026-09-08-04-10-00.gh-issue-123018.hV2kQe.rst deleted file mode 100644 index d75aa6950eb0711..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-04-10-00.gh-issue-123018.hV2kQe.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix :func:`readline.write_history_file` and -:func:`readline.append_history_file` producing a history file that -:func:`readline.read_history_file` could not load when a limit was set with -:func:`readline.set_history_length` and Python was built against -``libedit``. This works around `NetBSD PR 60322 -<https://gnats.netbsd.org/60322>`_. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst b/Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst deleted file mode 100644 index 982c4afb43dac11..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-09-30-00.gh-issue-157159.tabNny.rst +++ /dev/null @@ -1,2 +0,0 @@ -The usage message printed by ``python -m tabnanny`` when no arguments are -given now suggests ``python -m`` instead of the source file. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst b/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst deleted file mode 100644 index a21386803cca0f4..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`zipfile` again reads members through a third-party decompressor -installed by monkey-patching the private ``_get_decompressor()`` to return an -object that only implements old BZ2Decompressor API from Python 3.3. -Note that decompressors without ``needs_input`` and two-argument -``decompress()`` are vulnerable to :cve:`2026-15310`. diff --git a/Misc/NEWS.d/next/Library/2026-09-09-13-46-38.gh-issue-157213.rYg7pO.rst b/Misc/NEWS.d/next/Library/2026-09-09-13-46-38.gh-issue-157213.rYg7pO.rst deleted file mode 100644 index 801a76c3f3e7ad6..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-09-13-46-38.gh-issue-157213.rYg7pO.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :func:`asyncio.gather` leaving stale await-graph edges on children that -outlive it. diff --git a/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst b/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst deleted file mode 100644 index a5adf101c9dad3c..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix an out-of-bounds read in the ``hz`` incremental decoder when the input -ends with ``~``. diff --git a/Misc/NEWS.d/next/Library/2026-09-13-07-14-35.gh-issue-128509.9F2GCE.rst b/Misc/NEWS.d/next/Library/2026-09-13-07-14-35.gh-issue-128509.9F2GCE.rst deleted file mode 100644 index 7699242c8c647ea..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-13-07-14-35.gh-issue-128509.9F2GCE.rst +++ /dev/null @@ -1,2 +0,0 @@ -:func:`marshal.load` and :func:`marshal.loads` can now get 1-byte string -singletons. Patch by Victor Stinner. diff --git a/Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst b/Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst deleted file mode 100644 index 53f2bf561eefbb7..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-13-10-30-00.gh-issue-157406.a3kZq7.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix the Python implementation of :class:`xml.etree.ElementTree.XMLParser`: -the ``doctype()`` method of the target is now called for a document type -declaration without an external identifier, like ``<!DOCTYPE html>``, -as in the C implementation. diff --git a/Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst b/Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst deleted file mode 100644 index fb0bcad30605640..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix out-of-bounds write in ``mmap.mmap.__setitem__`` that could occur -when converting the index or the assigned value (via :meth:`~object.__index__` -for a single item, or via the buffer protocol for a slice) resized or closed the mmap -object during the assignment. diff --git a/Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst b/Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst deleted file mode 100644 index 45e3fedf4ca3278..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-14-00-30-00.gh-issue-157451.k7Qm2x.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :mod:`gettext` plural form selection when the ``Plural-Forms`` expression -combines the unary ``!`` operator with a binary operator, for example -``!n + 1`` or ``2 * !n``. The latter raised :exc:`SyntaxError`. diff --git a/Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst b/Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst deleted file mode 100644 index 87fd4a7aedee846..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-15-16-37-19.gh-issue-69919.izH1zP.rst +++ /dev/null @@ -1,4 +0,0 @@ -:meth:`code.InteractiveInterpreter.runsource` and the REPL now report any -exception raised by compiling the source, such as :exc:`MemoryError` or -:exc:`RecursionError` for too deeply nested source, instead of propagating -it or printing a traceback of the REPL internals. diff --git a/Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst b/Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst deleted file mode 100644 index de1fd1286d7a574..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-17-03-20-24.gh-issue-157639.VP3kc4.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix a crash in :mod:`!cProfile` when an external timer re-enters the -profiler. Profiling events raised while the external timer runs are now -ignored. diff --git a/Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst b/Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst deleted file mode 100644 index a751a2f9dc406b1..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-17-14-00-00.gh-issue-157672.tksigs.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :mod:`tkinter` on macOS: creating a :class:`~tkinter.Tk` instance no -longer replaces the Python handlers of SIGINT, SIGHUP and SIGTERM with Tk's -handler which exits the process, so Ctrl-C raises :exc:`KeyboardInterrupt` -again. diff --git a/Misc/NEWS.d/next/Library/2026-09-18-12-00-00.gh-issue-157660.tlbc.rst b/Misc/NEWS.d/next/Library/2026-09-18-12-00-00.gh-issue-157660.tlbc.rst deleted file mode 100644 index 846c5fdc8ebd5d6..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-18-12-00-00.gh-issue-157660.tlbc.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix ``_remote_debugging`` reporting errors or incorrect line numbers in free-threaded -builds when a thread-local bytecode array grows or gains entries after being cached. diff --git a/Misc/NEWS.d/next/Library/2026-09-19-14-10-18.gh-issue-157788.v70Lxd.rst b/Misc/NEWS.d/next/Library/2026-09-19-14-10-18.gh-issue-157788.v70Lxd.rst deleted file mode 100644 index 641ca0a82a0915e..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-19-14-10-18.gh-issue-157788.v70Lxd.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix ``python -m asyncio ps`` failing on a process that has a task with a -name longer than 255 characters. diff --git a/Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst b/Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst deleted file mode 100644 index 7c965451c056a44..000000000000000 --- a/Misc/NEWS.d/next/Library/2026-09-25-22-15-54.gh-issue-158169.ZlibTail.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix :attr:`zlib.Decompress.unconsumed_tail` duplicating -:attr:`~zlib.Decompress.unused_data` after end of stream when *max_length* was used. diff --git a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst b/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst deleted file mode 100644 index dbc2119640702c9..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr` -credentials to the URL scheme, preventing credentials stored for an HTTPS -URL from being used for a matching HTTP URL, while URIs without a scheme -continue to match any scheme. diff --git a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst b/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst deleted file mode 100644 index 7a81a8ba1eef1cd..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst +++ /dev/null @@ -1,2 +0,0 @@ -Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not -consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. diff --git a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst b/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst deleted file mode 100644 index 0cc620b3fdca205..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst +++ /dev/null @@ -1,7 +0,0 @@ -Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` -switches a connection to another :class:`~ssl.SSLContext` and the context -that carries the callback is no longer referenced by the application. -Servers that keep their ``sni_callback`` context alive (the usual case when -it wraps the listening socket or is stored on the server object) were not -affected. -This addresses :cve:`2026-19445`. diff --git a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst deleted file mode 100644 index 59b725e55bbffda..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating -directories outside the destination for members whose name leaves the -destination and returns to it, such as ``../evil/../dest/sub/file``. The -containment check used the resolved path, but intermediate directories were -created from the name as given. diff --git a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst b/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst deleted file mode 100644 index 4e49ad5ce8fa00a..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst +++ /dev/null @@ -1,4 +0,0 @@ -Bound the amount of data :mod:`zipfile` decompresses per read for members -compressed with bzip2, LZMA, or Zstandard, matching the existing limit for -deflate. A small archive member could previously expand into an unbounded -allocation even when read in small chunks. diff --git a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst b/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst deleted file mode 100644 index 5b3ea77cb368632..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst +++ /dev/null @@ -1 +0,0 @@ -Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.8.5. diff --git a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst b/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst deleted file mode 100644 index 2a521dbc9dc4e68..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst +++ /dev/null @@ -1,9 +0,0 @@ -:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, -*server_hostname* and *session* arguments similar to -:meth:`ssl.SSLContext.wrap_socket`. - -In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled -and no *server_hostname* passed to :meth:`!wrap_bio` now raises :exc:`ValueError` -instead of completing a handshake that verified the certificate chain -without verifying the peer's identity, with no indication that the -check had been skipped. diff --git a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst b/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst deleted file mode 100644 index 42a31b3c28f5ce1..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst +++ /dev/null @@ -1,4 +0,0 @@ -:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and -:meth:`loop.create_connection() <asyncio.loop.create_connection>` now -validate the *server_hostname* argument if an :class:`ssl.SSLContext` is -passed with *check_hostname* set to ``True``. diff --git a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst b/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst deleted file mode 100644 index f17a3f68b93e855..000000000000000 --- a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix a crash or incorrect output that could occur when formatting a -:class:`float` or :class:`complex` with a precision close to the platform's -``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` for -any precision of that magnitude, regardless of presentation type or value, as -the format string parsers already did for precisions above ``INT_MAX``. diff --git a/Misc/NEWS.d/next/Tests/2026-01-21-02-03-31.gh-issue-142414.CfcgiR.rst b/Misc/NEWS.d/next/Tests/2026-01-21-02-03-31.gh-issue-142414.CfcgiR.rst deleted file mode 100644 index 6d4cbfc490a17db..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-01-21-02-03-31.gh-issue-142414.CfcgiR.rst +++ /dev/null @@ -1,2 +0,0 @@ -Isolate reloading modules in test_interpreters to avoid having broken -references. diff --git a/Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst b/Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst deleted file mode 100644 index ff71f7a90a021b6..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-08-06-18-20-00.gh-issue-132581.envchg.rst +++ /dev/null @@ -1,4 +0,0 @@ -The list of tests which altered the execution environment now includes the -reasons why the environment was considered altered, for example an unraisable -exception or a modified :data:`sys.path`. The final result no longer repeats -the same state twice (like ``ENV CHANGED then ENV CHANGED``). diff --git a/Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst b/Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst deleted file mode 100644 index 50f684052526051..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-08-09-14-00-00.gh-issue-155411.Qw8Lm2.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix :func:`!test.support.subTests` for asynchronous test methods. They were -wrapped in a synchronous function, which discarded the coroutine without -awaiting it, so the test silently did not run at all. diff --git a/Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst b/Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst deleted file mode 100644 index 202fb12086210c7..000000000000000 --- a/Misc/NEWS.d/next/Tests/2026-09-24-10-40-28.gh-issue-158051.B1ZBTA.rst +++ /dev/null @@ -1 +0,0 @@ -The iOS testbed has been updated for compatibilty with Xcode 27. diff --git a/Misc/NEWS.d/next/Tools-Demos/2026-08-04-17-12-33.gh-issue-64502.Qv7mLp.rst b/Misc/NEWS.d/next/Tools-Demos/2026-08-04-17-12-33.gh-issue-64502.Qv7mLp.rst deleted file mode 100644 index da9647d1fdd369b..000000000000000 --- a/Misc/NEWS.d/next/Tools-Demos/2026-08-04-17-12-33.gh-issue-64502.Qv7mLp.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix Argument Clinic support of parameters with a default value used together -with optional groups. -Such parameters were always required in the generated parsing code. diff --git a/Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst b/Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst deleted file mode 100644 index 3ea0a37288fe880..000000000000000 --- a/Misc/NEWS.d/next/Tools-Demos/2026-08-14-12-45-57.gh-issue-113318.G1B0oH.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix Argument Clinic for ``@getter`` and ``@setter`` in a preprocessor -conditional block. -It failed with an internal error. -Argument Clinic now also rejects the accessors of the same attribute with -different C basenames, and the same accessor defined twice, which silently -generated invalid or duplicated entries of :c:type:`PyGetSetDef`. diff --git a/Misc/NEWS.d/next/Tools-Demos/2026-09-30-06-55-37.gh-issue-158451.pZE56z.rst b/Misc/NEWS.d/next/Tools-Demos/2026-09-30-06-55-37.gh-issue-158451.pZE56z.rst deleted file mode 100644 index 2d84d6f0a1393f2..000000000000000 --- a/Misc/NEWS.d/next/Tools-Demos/2026-09-30-06-55-37.gh-issue-158451.pZE56z.rst +++ /dev/null @@ -1,3 +0,0 @@ -``python-gdb.py`` is now able to format an invalid Unicode string: render -invalid characters as ``\Uhhhhhhhh`` instead of raising an exception. Patch by -Victor Stinner. diff --git a/Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst b/Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst deleted file mode 100644 index 06bba3e1f3d8558..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-08-09-04-00-00.gh-issue-87587.devenc.rst +++ /dev/null @@ -1,4 +0,0 @@ -:func:`os.device_encoding` on Windows now returns the code page of any -console file descriptor, not only 0, 1 and 2, and returns ``None`` for other -character devices like ``NUL``. The UTF-8 code page is now reported as -``"utf-8"`` instead of ``"cp65001"``. diff --git a/Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst b/Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst deleted file mode 100644 index 1cbf188c12e4070..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-08-09-07-00-00.gh-issue-86427.consolecp.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix the encoding of the standard streams in the legacy Windows stdio mode -(:envvar:`PYTHONLEGACYWINDOWSSTDIO`). It is now the code page of the -console, as in Python 3.7, not the ANSI code page. diff --git a/Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst b/Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst deleted file mode 100644 index 95c771823ab77f5..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-08-09-14-20-00.gh-issue-72353.Vw7Kq2.rst +++ /dev/null @@ -1,3 +0,0 @@ -Reading from the console on Windows now continues if the read was cancelled -by Ctrl+C, but the :const:`~signal.SIGINT` handler did not raise an -exception. Previously the read ended as if at end of file. diff --git a/Misc/NEWS.d/next/Windows/2026-09-12-18-59-21.gh-issue-157368.2DirHP.rst b/Misc/NEWS.d/next/Windows/2026-09-12-18-59-21.gh-issue-157368.2DirHP.rst deleted file mode 100644 index 72e11bfe2b15384..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-09-12-18-59-21.gh-issue-157368.2DirHP.rst +++ /dev/null @@ -1,3 +0,0 @@ -Fix truncated :data:`sys.version` in the case of clang-cl versions 22 or newer -on Windows. Also fixes the Windows on Arm case, where the Microsoft -compiler was reported instead of clang. Patch by Chris Eibl. diff --git a/Misc/NEWS.d/next/Windows/2026-09-29-09-56-14.gh-issue-158010.MPQX4w.rst b/Misc/NEWS.d/next/Windows/2026-09-29-09-56-14.gh-issue-158010.MPQX4w.rst deleted file mode 100644 index 827173387f8e8af..000000000000000 --- a/Misc/NEWS.d/next/Windows/2026-09-29-09-56-14.gh-issue-158010.MPQX4w.rst +++ /dev/null @@ -1 +0,0 @@ -Updated Windows builds to use OpenSSL 3.5.9. diff --git a/Misc/NEWS.d/next/macOS/2026-09-29-09-29-17.gh-issue-158010.2zJnoj.rst b/Misc/NEWS.d/next/macOS/2026-09-29-09-29-17.gh-issue-158010.2zJnoj.rst deleted file mode 100644 index cf9c417eec7fe6d..000000000000000 --- a/Misc/NEWS.d/next/macOS/2026-09-29-09-29-17.gh-issue-158010.2zJnoj.rst +++ /dev/null @@ -1 +0,0 @@ -Update macOS installer to use OpenSSL 3.5.9. diff --git a/README.rst b/README.rst index 349b1dc9d1d82d4..c22b7a3dbdb791b 100644 --- a/README.rst +++ b/README.rst @@ -1,5 +1,5 @@ -This is Python version 3.14.7+ -============================== +This is Python version 3.14.8 +============================= .. image:: https://github.com/python/cpython/actions/workflows/build.yml/badge.svg?bra… :alt: CPython build status on GitHub Actions

1 0

[3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (#158513)
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa3… commit: 869069d52ce0efab2f8c38197e92cdaaa312f1ed branch: 3.12 author: Hugo van Kemenade <1324225+hugovk(a)users.noreply.github.com> committer: Yhg1s <thomas(a)python.org> date: 2026-09-30T23:29:07+02:00 summary: [3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (#158513) * [3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (cherry picked from commit 1697ea386c707142555d98a1263176bbbc014a96) * Raise a DeprecationWarning instead of ValueError Co-authored-by: Seth Larson <seth(a)python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk(a)users.noreply.github.com> Co-authored-by: T. Wouters <thomas(a)python.org> files: A Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst A Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst M Doc/library/asyncio-eventloop.rst M Doc/library/asyncio-stream.rst M Doc/library/ssl.rst M Lib/ssl.py M Lib/test/test_asyncio/test_sslproto.py M Lib/test/test_ssl.py diff --git a/Doc/library/asyncio-eventloop.rst b/Doc/library/asyncio-eventloop.rst index 710ee17b87bf09c..a84583bc9d83958 100644 --- a/Doc/library/asyncio-eventloop.rst +++ b/Doc/library/asyncio-eventloop.rst @@ -544,6 +544,11 @@ Opening network connections .. versionchanged:: 3.12 *all_errors* was added. + .. versionchanged:: next + Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True`` + and ``server_hostname`` is not supplied. In Python 3.13 and + later a ``ValueError`` is raised instead. + .. seealso:: The :func:`open_connection` function is a high-level alternative diff --git a/Doc/library/asyncio-stream.rst b/Doc/library/asyncio-stream.rst index cb381d76e91fbf2..f826c0511ff7852 100644 --- a/Doc/library/asyncio-stream.rst +++ b/Doc/library/asyncio-stream.rst @@ -382,6 +382,11 @@ StreamWriter .. versionchanged:: 3.12 Added the *ssl_shutdown_timeout* parameter. + .. versionchanged:: next + Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True`` + and ``server_hostname`` is not supplied. In Python 3.13 and + later a ``ValueError`` is raised instead. + .. method:: is_closing() diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 71199ceabc6f89d..88c8da42096ddbc 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -1820,7 +1820,11 @@ to speed up repeated connections from the same clients. outgoing BIO. The *server_side*, *server_hostname* and *session* parameters have the - same meaning as in :meth:`SSLContext.wrap_socket`. + same meaning as in :meth:`SSLContext.wrap_socket`, and are validated in + the same way: in particular a :exc:`DeprecationWarning` is raised when + :attr:`~SSLContext.check_hostname` is enabled but no *server_hostname* is + given, since there would be no name to match the peer's certificate + against. In Python 3.13 and later a ``ValueError`` is raised instead. .. versionchanged:: 3.6 *session* argument was added. @@ -1829,6 +1833,13 @@ to speed up repeated connections from the same clients. The method returns an instance of :attr:`SSLContext.sslobject_class` instead of hard-coded :class:`SSLObject`. + .. versionchanged:: next + The *server_side*, *server_hostname* and *session* parameters are now + validated as :meth:`SSLContext.wrap_socket` validates them. Previously + a context with :attr:`~SSLContext.check_hostname` enabled and no + *server_hostname* was accepted, and verified the certificate chain but + never the peer's identity. + .. attribute:: SSLContext.sslobject_class The return type of :meth:`SSLContext.wrap_bio`, defaults to diff --git a/Lib/ssl.py b/Lib/ssl.py index 42ebb8ed38466d2..f243c1c406f2703 100644 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -803,6 +803,19 @@ def __init__(self, *args, **kwargs): @classmethod def _create(cls, incoming, outgoing, server_side=False, server_hostname=None, session=None, context=None): + if server_side: + if server_hostname: + raise ValueError("server_hostname can only be specified " + "in client mode") + if session is not None: + raise ValueError("session can only be specified in " + "client mode") + if context.check_hostname and server_hostname is None: + # Note: server_hostname='' is handled within _wrap_bio(). + warnings.warn("check_hostname requires server_hostname", + category=DeprecationWarning, + stacklevel=3) + self = cls.__new__(cls) sslobj = context._wrap_bio( incoming, outgoing, server_side=server_side, diff --git a/Lib/test/test_asyncio/test_sslproto.py b/Lib/test/test_asyncio/test_sslproto.py index 761904c5146b6a9..c8351e107e0a1f2 100644 --- a/Lib/test/test_asyncio/test_sslproto.py +++ b/Lib/test/test_asyncio/test_sslproto.py @@ -70,6 +70,56 @@ def test_handshake_timeout_negative(self): sslproto.SSLProtocol(self.loop, app_proto, sslcontext, waiter, ssl_handshake_timeout=-10) + def test_check_hostname_accepts_server_hostname(self): + # Supplying a server_hostname succeeds with check_hostname enabled. + sslcontext = test_utils.simple_client_sslcontext(disable_verify=False) + sslcontext.check_hostname = True + app_proto = mock.Mock() + waiter = mock.Mock() + + # No ValueError is raised from SSLProtocol with 'server_hostname'. + ssl_proto = sslproto.SSLProtocol(self.loop, app_proto, sslcontext, waiter, + server_hostname='example.org') + self.addCleanup(ssl_proto._app_transport.close) + + def test_check_hostname_requires_server_hostname(self): + # A caller-supplied context asking for hostname checking used to be + # taken through wrap_bio() with no name to check against, verifying + # the certificate chain but never the peer's identity. + # loop.start_tls() defaults server_hostname to None, and + # loop.create_connection() turns server_hostname='' into None here, + # so both reached that state. + sslcontext = test_utils.simple_client_sslcontext(disable_verify=False) + sslcontext.check_hostname = True + app_proto = mock.Mock() + waiter = mock.Mock() + server_hostname = None + + # Supplying no server_hostname warns with check_hostname enabled. + with self.assertWarnsRegex( + DeprecationWarning, + 'check_hostname requires server_hostname'): + sslproto.SSLProtocol(self.loop, app_proto, sslcontext, + waiter) + + with self.assertWarnsRegex( + DeprecationWarning, + 'check_hostname requires server_hostname'): + sslproto.SSLProtocol(self.loop, app_proto, sslcontext, + waiter, + server_hostname=server_hostname) + + # Disabling check_hostname allows for an empty or unset server_hostname. + sslcontext.check_hostname = False + + ssl_proto = sslproto.SSLProtocol(self.loop, app_proto, sslcontext, waiter) + self.addCleanup(ssl_proto._app_transport.close) + + ssl_proto = sslproto.SSLProtocol(self.loop, app_proto, sslcontext, + waiter, + server_hostname=server_hostname) + self.addCleanup(ssl_proto._app_transport.close) + def test_eof_received_waiter(self): waiter = self.loop.create_future() ssl_proto = self.ssl_protocol(waiter=waiter) diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 7ff475d8f8ec3a1..ad2a0989a2b9560 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -10,6 +10,7 @@ from test.support import threading_helper from test.support import warnings_helper from test.support import asyncore +import contextlib import array import re import socket @@ -322,6 +323,34 @@ def testing_context(server_cert=SIGNED_CERTFILE, *, server_chain=True): return client_context, server_context, hostname +def connected_bio_pair(client_context, server_context, hostname, max_retry=5): + """Handshake a client and a server SSLObject against each other. + + Everything happens in memory, so this needs no socket and no thread. + Returns the two objects followed by their four BIOs, in the order + client, server, c_in, c_out, s_in, s_out. + """ + c_in, c_out = ssl.MemoryBIO(), ssl.MemoryBIO() + s_in, s_out = ssl.MemoryBIO(), ssl.MemoryBIO() + client = client_context.wrap_bio(c_in, c_out, server_hostname=hostname) + server = server_context.wrap_bio(s_in, s_out, server_side=True) + + # Loop on the handshake for a bit to get it settled + for _ in range(max_retry): + with contextlib.suppress(ssl.SSLWantReadError): + client.do_handshake() + if c_out.pending: + s_in.write(c_out.read()) + with contextlib.suppress(ssl.SSLWantReadError): + server.do_handshake() + if s_out.pending: + c_in.write(s_out.read()) + # Now the handshakes should be complete (don't raise WantReadError) + client.do_handshake() + server.do_handshake() + return client, server, c_in, c_out, s_in, s_out + + class BasicSocketTests(unittest.TestCase): def test_constants(self): @@ -1692,6 +1721,10 @@ def test_subclass(self): def test_bad_server_hostname(self): ctx = ssl.create_default_context() + # Omitting the name entirely is bad too: this context checks it. + with self.assertWarns(DeprecationWarning): + ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), + server_hostname=None) with self.assertRaises(ValueError): ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), server_hostname="") @@ -1776,6 +1809,66 @@ def test_private_init(self): with self.assertRaisesRegex(TypeError, "public constructor"): ssl.SSLObject(bio, bio) + def test_check_hostname_requires_server_hostname(self): + # wrap_bio() used to accept a context asking for hostname checking + # without a name to check against, and then verify the certificate + # chain but never the peer's identity without a warning. Now + # a warning is emitted in this scenario. + client_context, _, hostname = testing_context() + self.assertTrue(client_context.check_hostname) + + server_hostname = None + with self.assertWarnsRegex( + DeprecationWarning, + "check_hostname requires server_hostname"): + client_context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), + server_hostname=server_hostname) + # The sibling constructor refuses the very same call, but with + # a ValueError instead of DeprecationWarning. + with socket.socket() as sock: + with self.assertRaisesRegex( + ValueError, + "check_hostname requires server_hostname"): + client_context.wrap_socket( + sock, server_hostname=server_hostname) + + # A name was all that was missing. + with warnings_helper.check_no_warnings(self): + client_context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), + server_hostname=hostname) + + # Asking for no hostname check remains a way to say so explicitly. + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + context.check_hostname = False + self.assertFalse(context.check_hostname) + with warnings_helper.check_no_warnings(self): + context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO()) + + def test_server_side_bad_params(self): + # A server neither sends a hostname nor resumes a client's session, + # so wrap_bio() rejects both in server mode like wrap_socket() + client_context, server_context, hostname = testing_context() + + with self.assertRaisesRegex( + ValueError, + "server_hostname can only be specified in client mode"): + server_context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), + server_side=True, + server_hostname=hostname) + + client, server, *_ = connected_bio_pair( + client_context, server_context, hostname) + session = client.session + self.assertIsNotNone(session) + with self.assertRaisesRegex( + ValueError, "session can only be specified in client mode"): + server_context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), + server_side=True, session=session) + + # Neither argument is what a server passes, so this still works. + server_context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(), + server_side=True) + def test_unwrap(self): client_ctx, server_ctx, hostname = testing_context() c_in = ssl.MemoryBIO() diff --git a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst b/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst new file mode 100644 index 000000000000000..ce43a563f3a1df0 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst @@ -0,0 +1,9 @@ +:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, +*server_hostname* and *session* arguments similar to +:meth:`ssl.SSLContext.wrap_socket`, but for backward compatiblity reasons +emits :exc:`DeprecationWarning` instead of :exc:`ValueError`. + +In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled +and no *server_hostname* passed to :meth:`!wrap_bio` now emits +:exc:`DeprecationWarning` to indicate the hostname wasn't checked. +(In Python 3.13 and later, this raises :exc:`ValueError`.) diff --git a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst b/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst new file mode 100644 index 000000000000000..9afd6e9c454aaff --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst @@ -0,0 +1,6 @@ +:mod:`asyncio`: :meth:`loop.start_tls() <asyncio.loop.start_tls>` and +:meth:`loop.create_connection() <asyncio.loop.create_connection>` now +validate the *server_hostname* argument if an :class:`ssl.SSLContext` is +passed with *check_hostname* set to ``True``, emitting +:exc:`DeprecationWarning` if *server_hostname* is missing. (This will raise +:exc:`ValueError` in Python 3.13 and later.)

1 0

[3.12] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) (#156739)
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f94… commit: 09a2e7e6678b4f65449e7ad8f112c48f944591e2 branch: 3.12 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: Yhg1s <thomas(a)python.org> date: 2026-09-30T22:55:10+02:00 summary: [3.12] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) (#156739) * gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) Patch by @tonghuaroot. zipfile.ZipExtFile._read1() bounds the output of each decompress() call for DEFLATE members by passing a max_length to zlib, but for bzip2, LZMA, and Zstandard members it called decompress() with no bound. A whole compressed chunk was therefore expanded into a single allocation before the data[:self._left] clip ran, so a consumer that deliberately reads in small chunks to limit memory (for example zf.open(name).read(8192)) was silently unprotected for non-DEFLATE members. A small, spec-conformant archive member declaring a large uncompressed size could drive multi-GB peak memory. _read1() now passes a per-call bound to the non-DEFLATE decompress() (mirroring the DEFLATE branch) and drains the decompressor's internal buffer across calls by checking needs_input before reading more compressed input. zipfile's LZMADecompressor wrapper forwards max_length and exposes needs_input so the bound also holds for LZMA members. (cherry picked from commit f897dbf2f36a5935700b7c2d94d4681d2136b7d4) (cherry picked from commit 1b424c0178a01e155fd0267dc28a8fc1159b33a8) * gh-156002: Keep reading through monkey-patched zipfile decompressors (GH-157180) (GH-157557) (cherry picked from commit f507e6946a3194e83e1d7b8ee6e14567175e46de) Co-authored-by: Petr Viktorin <encukou(a)gmail.com> Co-authored-by: tonghuaroot <tonghuaroot(a)gmail.com> Co-authored-by: rasmusfaber <rfaber(a)gmail.com> files: A Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst A Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst M Lib/test/test_zipfile/test_core.py M Lib/zipfile/__init__.py diff --git a/Lib/test/test_zipfile/test_core.py b/Lib/test/test_zipfile/test_core.py index 6d390d321141370..46cf459c05e1d85 100644 --- a/Lib/test/test_zipfile/test_core.py +++ b/Lib/test/test_zipfile/test_core.py @@ -2590,6 +2590,110 @@ def tearDown(self): unlink(TESTFN2) +class AbstractBoundedDecompressTests: + # ZipExtFile._read1() bounds the output of each decompress() call so that a + # small member declaring a large uncompressed size cannot expand into one + # unbounded read. + def test_read1_output_is_bounded(self): + buf = io.BytesIO() + with zipfile.ZipFile(buf, "w", compression=self.compression) as zf: + zf.writestr("big", b"\0" * (4 * 1024 * 1024)) + with zipfile.ZipFile(io.BytesIO(buf.getvalue())) as zf: + with zf.open("big") as f: + self.assertLessEqual(len(f._read1(100)), f.MIN_READ_SIZE) + + +class StoredBoundedDecompressTests(AbstractBoundedDecompressTests, + unittest.TestCase): + compression = zipfile.ZIP_STORED + + +@requires_zlib() +class DeflateBoundedDecompressTests(AbstractBoundedDecompressTests, + unittest.TestCase): + compression = zipfile.ZIP_DEFLATED + + +@requires_bz2() +class Bzip2BoundedDecompressTests(AbstractBoundedDecompressTests, + unittest.TestCase): + compression = zipfile.ZIP_BZIP2 + + +@requires_lzma() +class LzmaBoundedDecompressTests(AbstractBoundedDecompressTests, + unittest.TestCase): + compression = zipfile.ZIP_LZMA + + + +class MonkeypatchedDecompressorTests(unittest.TestCase): + # Some third-party projects monkey-patch _get_decompressor() to add + # additional compression schemes. This can break at any time as the + # internal compressor objects change. + # To protect users, we try to keep this case working. + # See also: GH-156002 and GH-113767. + COMPRESSION = 99 + + class Compressor: + """Compressor with only the original BZ2Compressor API""" + def compress(self, data): + return data.swapcase() + + def flush(self): + return b'' + + class Decompressor: + """Decompressor with only the 3.3+ BZ2Decompressor API""" + eof = False + + def decompress(self, data): + return data.swapcase() + + def setUp(self): + orig_check_compression = zipfile._check_compression + orig_get_compressor = zipfile._get_compressor + orig_get_decompressor = zipfile._get_decompressor + + def check_compression(compression): + if compression != self.COMPRESSION: + orig_check_compression(compression) + + def get_compressor(compress_type, compresslevel=None): + if compress_type == self.COMPRESSION: + return self.Compressor() + return orig_get_compressor(compress_type, compresslevel) + + def get_decompressor(compress_type): + if compress_type == self.COMPRESSION: + return self.Decompressor() + return orig_get_decompressor(compress_type) + + self.enterContext(mock.patch.object( + zipfile, '_check_compression', check_compression)) + self.enterContext(mock.patch.object( + zipfile, '_get_compressor', get_compressor)) + self.enterContext(mock.patch.object( + zipfile, '_get_decompressor', get_decompressor)) + + def test_roundtrip_monkeypatched_decompressor(self): + data = bytes(range(256)) * 8 + buf = io.BytesIO() + with zipfile.ZipFile(buf, "w", compression=self.COMPRESSION) as zf: + zf.writestr("member", data) + self.assertIn(data.swapcase(), buf.getvalue()) + with zipfile.ZipFile(io.BytesIO(buf.getvalue())) as zf: + self.assertEqual(zf.read("member"), data) + with zf.open("member") as f: + self.assertEqual(f.read(100), data[:100]) + self.assertEqual(f.read1(100), data[100:200]) + f.seek(-100, os.SEEK_END) + self.assertEqual(f.read(), data[-100:]) + # Rewinding past the read buffer re-creates the decompressor. + f.seek(0) + self.assertEqual(f.read(), data) + + class AbstractBadCrcTests: def test_testzip_with_bad_crc(self): """Tests that files with bad CRCs return their name from testzip.""" diff --git a/Lib/zipfile/__init__.py b/Lib/zipfile/__init__.py index 4ccca3749709f25..1bb836a587dfc30 100644 --- a/Lib/zipfile/__init__.py +++ b/Lib/zipfile/__init__.py @@ -698,7 +698,16 @@ def __init__(self): self._unconsumed = b'' self.eof = False - def decompress(self, data): + @property + def needs_input(self): + # While the LZMA properties header is still being buffered, more input + # is required; afterwards defer to the wrapped decompressor so a bounded + # decompress() call can be drained across reads. + if self._decomp is None: + return True + return self._decomp.needs_input + + def decompress(self, data, max_length=-1): if self._decomp is None: self._unconsumed += data if len(self._unconsumed) <= 4: @@ -714,7 +723,7 @@ def decompress(self, data): data = self._unconsumed[4 + psize:] del self._unconsumed - result = self._decomp.decompress(data) + result = self._decomp.decompress(data, max_length) self.eof = self._decomp.eof return result @@ -1074,8 +1083,15 @@ def _read1(self, n): data = self._decompressor.unconsumed_tail if n > len(data): data += self._read2(n - len(data)) - else: + elif self._compress_type == ZIP_STORED: data = self._read2(n) + else: + # bzip2/lzma/zstd: a bounded decompress() call may leave input + # buffered inside the decompressor; drain that before reading more. + if getattr(self._decompressor, "needs_input", True): + data = self._read2(n) + else: + data = b'' if self._compress_type == ZIP_STORED: self._eof = self._compress_left <= 0 @@ -1088,8 +1104,17 @@ def _read1(self, n): if self._eof: data += self._decompressor.flush() else: - data = self._decompressor.decompress(data) - self._eof = self._decompressor.eof or self._compress_left <= 0 + # Bound the output of a single decompress() call (mirroring the + # DEFLATE path above) so that a small compressed member cannot + # expand into one unbounded read. + try: + data = self._decompressor.decompress(data, max(n, self.MIN_READ_SIZE)) + except TypeError: + # See MonkeypatchedDecompressorTests in test_core.py + data = self._decompressor.decompress(data) + self._eof = (self._decompressor.eof or + self._compress_left <= 0 and + getattr(self._decompressor, "needs_input", True)) data = data[:self._left] self._left -= len(data) diff --git a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst b/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst new file mode 100644 index 000000000000000..a21386803cca0f4 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst @@ -0,0 +1,5 @@ +:mod:`zipfile` again reads members through a third-party decompressor +installed by monkey-patching the private ``_get_decompressor()`` to return an +object that only implements old BZ2Decompressor API from Python 3.3. +Note that decompressors without ``needs_input`` and two-argument +``decompress()`` are vulnerable to :cve:`2026-15310`. diff --git a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst b/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst new file mode 100644 index 000000000000000..4e49ad5ce8fa00a --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst @@ -0,0 +1,4 @@ +Bound the amount of data :mod:`zipfile` decompresses per read for members +compressed with bzip2, LZMA, or Zstandard, matching the existing limit for +deflate. A small archive member could previously expand into an unbounded +allocation even when read in small chunks.

1 0

[3.12] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) (#157305)
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0… commit: 764fd0af8d9e19d3684a58d2e58bf770f0605036 branch: 3.12 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: Yhg1s <thomas(a)python.org> date: 2026-09-30T22:23:33+02:00 summary: [3.12] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) (#157305) * gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) (cherry picked from commit fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2) Co-authored-by: Petr Viktorin <encukou(a)gmail.com> Co-authored-by: Stan Ulbrych <stan(a)python.org> * gh-157265: Adjust test for Windows (GH-157334) Co-authored-by: Petr Viktorin <encukou(a)gmail.com> Co-authored-by: Stan Ulbrych <stan(a)python.org> files: A Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst M Lib/tarfile.py M Lib/test/test_tarfile.py diff --git a/Lib/tarfile.py b/Lib/tarfile.py index 86d47f30d99ff1..ec0f317b7d2d73 100755 --- a/Lib/tarfile.py +++ b/Lib/tarfile.py @@ -2691,9 +2691,11 @@ def makelink_with_filter(self, tarinfo, targetpath, "makelink_with_filter: if filter_function is not None, " + "extraction_root must also not be None") try: - filter_function( + filtered = filter_function( unfiltered.replace(name=tarinfo.name, deep=False), extraction_root) + if filtered is None: + return filtered = filter_function(unfiltered, extraction_root) except _FILTER_ERRORS as cause: raise LinkFallbackError(tarinfo, unfiltered.name) from cause diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py index b869fd6fa15e4c..1f189d9e091deb 100644 --- a/Lib/test/test_tarfile.py +++ b/Lib/test/test_tarfile.py @@ -4186,9 +4186,15 @@ def test_sneaky_hardlink_fallback(self): for filter in 'tar', 'fully_trusted': with self.subTest(filter), self.check_context(arc.open(), filter): if not os_helper.can_symlink(): - self.expect_file("a/t/dummy") - self.expect_file("b/") - self.expect_file("c/") + if filter == 'fully_trusted' or sys.platform == "win32": + self.expect_file("a/t/dummy") + self.expect_file("b/") + self.expect_file("c/") + else: + self.expect_exception( + tarfile.LinkFallbackError, + "link 'boom' would be extracted as a copy of " + + "'c/escape', which was rejected") else: self.expect_file("a/t/dummy") self.expect_file("b/") @@ -4385,6 +4391,25 @@ def testing_filter(member, path): if os_helper.can_chmod(): self.assertFalse(path.stat().st_mode & stat.S_IWUSR) + @symlink_test + def test_extract_filters_target_none(self): + # Test that when extract() falls back to extracting (rather than + # linking) a hardlink target, the member is skipped if the filter + # returns None. + with ArchiveMaker() as arc: + arc.add('a/b/s', symlink_to='../escape') + arc.add('q', hardlink_to='a/b/s') + def filter_unsafe_members(member, path): + try: + return tarfile.data_filter(member, path) + except tarfile.FilterError as error: + return None + with self.check_context(arc.open(), filter_unsafe_members): + if os_helper.can_symlink(): + self.expect_file('a/b/s', symlink_to='../escape') + else: + self.expect_file('a/b/') # symlink is not extracted + def test_link_fallback_normalizes(self): # Make sure hardlink fallbacks work for non-normalized paths for all # filters diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst new file mode 100644 index 00000000000000..ba27e47f734bfb --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst @@ -0,0 +1,3 @@ +In :mod:`tarfile`, when extracting a link falls back to extracting a member +of the archive, skip the member when the filter function returns None when +called with the extracted member's name replaced with the link's.

1 0

[3.12] GH-157579: Revert GH-158489 (prematurely merged) (#158528)
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316… commit: e1f3590f155c6d66007e958c98c9d69316551993 branch: 3.12 author: T. Wouters <thomas(a)python.org> committer: Yhg1s <thomas(a)python.org> date: 2026-09-30T21:36:13+02:00 summary: [3.12] GH-157579: Revert GH-158489 (prematurely merged) (#158528) Revert "[3.12] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) (#158489)" This reverts commit 458e7134a5af7f86aee9d21b51cf499b41aa4420. files: D Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst M Doc/library/tempfile.rst M Lib/os.py M Lib/shutil.py M Lib/tempfile.py M Lib/test/support/__init__.py M Lib/test/test_shutil.py M Lib/test/test_tempfile.py diff --git a/Doc/library/tempfile.rst b/Doc/library/tempfile.rst index 1c3cb625bc1097..f0a81a093b435b 100644 --- a/Doc/library/tempfile.rst +++ b/Doc/library/tempfile.rst @@ -207,15 +207,6 @@ The module defines the following user-callable items: debugging or when you need your cleanup behavior to be conditional based on other logic. - .. warning:: - - Cleanup is not robust against the tree being modified while it is removed. - Files outside of the tree may have their permissions and file flags reset. - - On systems where :data:`shutil.rmtree.avoids_symlink_attacks` is - false, manipulating symbolic links during cleanup - may cause files outside of the tree to be removed. - .. audit-event:: tempfile.mkdtemp fullpath tempfile.TemporaryDirectory .. versionadded:: 3.2 diff --git a/Lib/os.py b/Lib/os.py index a01eed5497c85d..465742d318440a 100644 --- a/Lib/os.py +++ b/Lib/os.py @@ -110,7 +110,6 @@ def _add(str, fn): _add("HAVE_FCHMODAT", "chmod") _add("HAVE_FCHOWNAT", "chown") _add("HAVE_FSTATAT", "stat") - _add("HAVE_LSTAT", "lstat") _add("HAVE_FUTIMESAT", "utime") _add("HAVE_LINKAT", "link") _add("HAVE_MKDIRAT", "mkdir") diff --git a/Lib/shutil.py b/Lib/shutil.py index 8cfe8c1030e498..90f6c024afe332 100644 --- a/Lib/shutil.py +++ b/Lib/shutil.py @@ -654,7 +654,6 @@ def _rmtree_safe_fd(stack, onexc): # save a call to os.lstat() when walking subdirectories. func, dirfd, path, orig_entry = stack.pop() name = path if orig_entry is None else orig_entry.name - parent_fd = None if func is os.close else dirfd try: if func is os.close: os.close(dirfd) @@ -698,18 +697,17 @@ def _rmtree_safe_fd(stack, onexc): try: os.unlink(entry.name, dir_fd=topfd) except OSError as err: - onexc(os.unlink, fullname, err, direntry=entry, dir_fd=topfd) + onexc(os.unlink, fullname, err) except OSError as err: err.filename = path - onexc(func, path, err, direntry=orig_entry, dir_fd=parent_fd) + onexc(func, path, err) _use_fd_functions = ({os.open, os.stat, os.unlink, os.rmdir} <= os.supports_dir_fd and os.scandir in os.supports_fd and os.stat in os.supports_follow_symlinks) -def rmtree(path, ignore_errors=False, onerror=None, *, onexc=None, dir_fd=None, - _onexc_kwargs=False): +def rmtree(path, ignore_errors=False, onerror=None, *, onexc=None, dir_fd=None): """Recursively delete a directory tree. If dir_fd is not None, it should be a file descriptor open to a directory; @@ -732,29 +730,24 @@ def rmtree(path, ignore_errors=False, onerror=None, *, onexc=None, dir_fd=None, sys.audit("shutil.rmtree", path, dir_fd) if ignore_errors: - def onexc(*args, **kwargs): + def onexc(*args): pass elif onerror is None and onexc is None: - def onexc(*args, **kwargs): + def onexc(*args): raise elif onexc is None: if onerror is None: - def onexc(*args, **kwargs): + def onexc(*args): raise else: # delegate to onerror - def onexc(*args, **kwargs): + def onexc(*args): func, path, exc = args if exc is None: exc_info = None, None, None else: exc_info = type(exc), exc, exc.__traceback__ return onerror(func, path, exc_info) - elif not _onexc_kwargs: - # Only the internal caller in tempfile asks for the extra arguments. - _onexc = onexc - def onexc(func, path, err, **kwargs): - return _onexc(func, path, err) if _use_fd_functions: # While the unsafe rmtree works fine on bytes, the fd based does not. diff --git a/Lib/tempfile.py b/Lib/tempfile.py index 1ceb0bab783dc8..67c02db124d478 100644 --- a/Lib/tempfile.py +++ b/Lib/tempfile.py @@ -43,7 +43,6 @@ import shutil as _shutil import errno as _errno from random import Random as _Random -import stat as _stat import sys as _sys import types as _types import weakref as _weakref @@ -277,68 +276,15 @@ def _dont_follow_symlinks(func, path, *args): elif _os.name == 'nt' or not _os.path.islink(path): func(path, *args) -def _resetflags(path): +def _resetperms(path): try: chflags = _os.chflags except AttributeError: pass else: _dont_follow_symlinks(chflags, path, 0) - -def _resetperms(path): - _resetflags(path) _dont_follow_symlinks(_os.chmod, path, 0o700) -# True if TemporaryDirectory._rmtree() can work relative to open directories -# instead of resolving paths again. -_rmtree_use_dir_fd = ( - {_os.chmod, _os.unlink, _os.lstat} <= _os.supports_dir_fd - and _os.chmod in _os.supports_fd -) - -def _resetperms_fd(dir_fd, path): - # Same as _resetperms(), but for the directory referred to by dir_fd. - if dir_fd is None: - _resetperms(path) - return - _resetflags(path) - _os.chmod(dir_fd, 0o700) - -try: - _nofollow_mode = _os.O_RDONLY | _os.O_NONBLOCK | _os.O_NOFOLLOW -except AttributeError: - _nofollow_mode = None - -def _resetperms_at(name, dir_fd, path): - # Same as _resetperms(), but name is resolved relative to the directory - # file descriptor dir_fd. path is only used for os.chflags(), which - # doesn't support dir_fd or file descriptors. - if dir_fd is None: - _resetperms(path) - return - _resetflags(path) - if _os.chmod in _os.supports_follow_symlinks: - _os.chmod(name, 0o700, dir_fd=dir_fd, follow_symlinks=False) - else: - # dir_fd & follow_symlinks is not supported on this platform. - # Try chmod opening the file with O_NOFOLLOW. - if _nofollow_mode is not None: - try: - fd = _os.open(name, _nofollow_mode, dir_fd=dir_fd) - except OSError: - pass - else: - try: - _os.chmod(fd, 0o700) - finally: - _os.close(fd) - return - # If that did not work, we change by name, which is subject to a race - # condition. - stat = _os.lstat(name, dir_fd=dir_fd) - if not _stat.S_ISLNK(stat.st_mode): - _os.chmod(name, 0o700, dir_fd=dir_fd) - # User visible interfaces. @@ -946,42 +892,23 @@ def __init__(self, suffix=None, prefix=None, dir=None, ignore_errors=self._ignore_cleanup_errors, delete=self._delete) @classmethod - def _rmtree(cls, name, ignore_errors=False, repeated=False, dir_fd=None, - fullname=None): - if fullname is None: - fullname = name - - def onexc(func, path, exc, direntry=None, dir_fd=None): + def _rmtree(cls, name, ignore_errors=False, repeated=False): + def onexc(func, path, exc): if isinstance(exc, PermissionError): if repeated and path == name: if ignore_errors: return raise - # fullpath is path as seen from the working directory - fullpath = fullname + path[len(name):] - # base is path relative to dir_fd, the directory rmtree() - # reached it through, or the whole path when there is none - if dir_fd is None or not _rmtree_use_dir_fd: - base, dir_fd = path, None - elif direntry is None: - base = path - else: - base = direntry.name - try: if path != name: - # The parent directory of path is the one referred to - # by dir_fd. - _resetperms_fd(dir_fd, _os.path.dirname(fullpath)) - _resetperms_at(base, dir_fd, fullpath) + _resetperms(_os.path.dirname(path)) + _resetperms(path) try: - _os.unlink(base, dir_fd=dir_fd) + _os.unlink(path) except IsADirectoryError: - cls._rmtree(base, ignore_errors=ignore_errors, - repeated=(path == name), - dir_fd=dir_fd, fullname=fullpath) + cls._rmtree(path, ignore_errors=ignore_errors) except PermissionError: # The PermissionError handler was originally added for # FreeBSD in directories, but it seems that it is raised @@ -990,27 +917,21 @@ def onexc(func, path, exc, direntry=None, dir_fd=None): # raise NotADirectoryError and mask the PermissionError. # So we must re-raise the current PermissionError if # path is not a directory. - if (not _os.path.isdir(fullpath) - or _os.path.isjunction(fullpath)): + if not _os.path.isdir(path) or _os.path.isjunction(path): if ignore_errors: return raise - cls._rmtree(base, ignore_errors=ignore_errors, - repeated=(path == name), - dir_fd=dir_fd, fullname=fullpath) + cls._rmtree(path, ignore_errors=ignore_errors, + repeated=(path == name)) except FileNotFoundError: pass - except OSError: - if ignore_errors: - return - raise elif isinstance(exc, FileNotFoundError): pass else: if not ignore_errors: raise - _shutil.rmtree(name, onexc=onexc, dir_fd=dir_fd, _onexc_kwargs=True) + _shutil.rmtree(name, onexc=onexc) @classmethod def _cleanup(cls, name, warn_message, ignore_errors=False, delete=True): diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py index fb36d2adb4d456..1ee8ffc1b7aaf8 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py @@ -2598,8 +2598,3 @@ def control_characters_c0() -> list[str]: C0 control characters defined as the byte range 0x00-0x1F, and 0x7F. """ return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"] - - -_ROOT_IN_POSIX = hasattr(os, 'geteuid') and os.geteuid() == 0 -requires_root_user = unittest.skipUnless(_ROOT_IN_POSIX, "test needs root privilege") -requires_non_root_user = unittest.skipIf(_ROOT_IN_POSIX, "test needs non-root account") diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py index fcfffe490b1b63..b7be547de412e1 100644 --- a/Lib/test/test_shutil.py +++ b/Lib/test/test_shutil.py @@ -497,37 +497,6 @@ def check_args_to_onexc(self, func, arg, exc): self.assertTrue(isinstance(exc, OSError)) self.errorState = 3 - @os_helper.skip_if_dac_override - @os_helper.skip_unless_working_chmod - @unittest.skipUnless(shutil.rmtree.avoids_symlink_attacks, - 'requires the fd based implementation of rmtree()') - def test_on_exc_kwargs(self): - os.mkdir(TESTFN) - self.addCleanup(shutil.rmtree, TESTFN) - - child_dir_path = os.path.join(TESTFN, 'b') - child_file_path = os.path.join(child_dir_path, 'a') - os.mkdir(child_dir_path) - os_helper.create_empty_file(child_file_path) - old_child_dir_mode = os.stat(child_dir_path).st_mode - # Make unwritable. - new_mode = stat.S_IREAD|stat.S_IEXEC - os.chmod(child_dir_path, new_mode) - - self.addCleanup(os.chmod, child_dir_path, old_child_dir_mode) - - calls = [] - def onexc(func, path, err, direntry=None, dir_fd=None): - calls.append((func, path, err)) - if func is os.unlink: - self.assertEqual(direntry.name, os.path.basename(path)) - self.assertTrue(os.path.samestat( - os.stat(path), os.stat(direntry.name, dir_fd=dir_fd))) - - shutil.rmtree(TESTFN, onexc=onexc, _onexc_kwargs=True) - self.assertIn((os.unlink, child_file_path), - [(func, path) for func, path, err in calls]) - @unittest.skipIf(sys.platform[:6] == 'cygwin', "This test can't be run on Cygwin (issue #1071513).") @os_helper.skip_if_dac_override diff --git a/Lib/test/test_tempfile.py b/Lib/test/test_tempfile.py index 7b22706e396a91..31982ae6ea2aab 100644 --- a/Lib/test/test_tempfile.py +++ b/Lib/test/test_tempfile.py @@ -14,7 +14,6 @@ import gc import shutil import subprocess -import sysconfig from unittest import mock import unittest @@ -1832,54 +1831,6 @@ def test(target, target_is_directory): new_flags = os.stat(dir1).st_flags self.assertEqual(new_flags, old_flags) - @os_helper.skip_unless_symlink - @os_helper.skip_unless_working_chmod - @support.requires_non_root_user - @unittest.skipIf(support.is_emscripten, 'Fails due to Emscripten bug:' - 'emscripten-core/emscripten#27761') - @unittest.skipUnless(shutil.rmtree.avoids_symlink_attacks, - 'requires the fd based implementation of rmtree()') - def test_cleanup_with_symlink_race(self): - # cleanup() should not operate on files outside of the temporary - # directory when a directory is replaced with a symlink while it - # recovers from a PermissionError (CVE-2026-12345). - with self.do_create(recurse=0) as target: - target_file = os.path.join(target, 'file1') - open(target_file, 'wb').close() - target_mode = os.stat(target_file).st_mode - - d1 = self.do_create(recurse=0) - dir1 = os.path.join(d1.name, 'dir1') - os.mkdir(dir1) - open(os.path.join(dir1, 'file1'), 'wb').close() - # Removing contents of dir1 fails with a PermissionError, and - # dir1 is replaced with a symlink to target at the very moment - # cleanup() starts to recover from that error. - os.chmod(dir1, 0o500) - unlink = os.unlink - def hook(path, *, dir_fd=None): - try: - return unlink(path, dir_fd=dir_fd) - except PermissionError: - if not os.path.islink(dir1): - os.chmod(dir1, 0o700) - os.rename(dir1, dir1 + '_moved') - os.symlink(target, dir1) - raise - try: - with mock.patch('os.unlink', hook): - with contextlib.suppress(OSError): - d1.cleanup() - finally: - if os.path.islink(dir1): - os.unlink(dir1) - os.rename(dir1 + '_moved', dir1) - os.chmod(dir1, 0o700) - d1.cleanup() - - self.assertTrue(os.path.exists(target_file)) - self.assertEqual(os.stat(target_file).st_mode, target_mode) - @support.cpython_only def test_del_on_collection(self): # A TemporaryDirectory is deleted when garbage collected @@ -2052,29 +2003,6 @@ def test_modes(self): d.cleanup() self.assertFalse(os.path.exists(d.name)) - @support.subTests('ignore_errors', (True, False)) - def test_parent_mode_preserved(self, ignore_errors): - # Test that cleanup does not touch the parent directory, - # even if that prevents removal. - for mode in range(8): - mode <<= 6 - with self.subTest(mode=format(mode, '03o')): - outer = self.do_create() - with outer: - d = self.do_create(dir=outer.name, dirs=2, files=2, - ignore_cleanup_errors=ignore_errors) - with d: - os.chmod(outer.name, mode) - orig_mode = os.stat(outer.name).st_mode - try: - d.cleanup() - except PermissionError: - if ignore_errors: - raise - self.assertEqual(os.stat(outer.name).st_mode, orig_mode) - outer.cleanup() - self.assertFalse(os.path.exists(outer.name)) - def check_flags(self, flags): # skip the test if these flags are not supported (ex: FreeBSD 13) filename = os_helper.TESTFN @@ -2112,17 +2040,5 @@ def test_delete_false(self): self.assertTrue(os.path.exists(working_dir)) shutil.rmtree(working_dir) - @unittest.skipUnless( - sysconfig.get_config_var('PY_SUPPORT_TIER') - and sysconfig.get_config_var('PY_SUPPORT_TIER') <= 3, - 'regression test for supported platforms') - @unittest.skipIf(support.MS_WINDOWS, 'dirfd not used on Windows') - @unittest.skipIf(support.is_wasi, 'WASI has no chmod') - def test_cleanup_safe(self): - """Verify that cleanup uses the safer code path""" - # This is a regression test. Feel free to add exceptions for new - # platforms, but don't forget to update the docs. - self.assertTrue(tempfile._rmtree_use_dir_fd) - if __name__ == "__main__": unittest.main() diff --git a/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst b/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst deleted file mode 100644 index 46e87575dba983..00000000000000 --- a/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst +++ /dev/null @@ -1,6 +0,0 @@ -Fix a race condition in the cleanup of :class:`tempfile.TemporaryDirectory`. -When working around file system permission errors, files are now removed -relative to open directory file descriptors instead of resolving their path -again, so that replacing a directory of the tree with a symbolic link can no -longer make the cleanup delete files outside of the temporary directory. -This addresses :cve:`2026-12345`.

1 0

[3.12] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) (#158489)
by Yhg1s Sept. 30, 2026

Sept. 30, 2026

https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41… commit: 458e7134a5af7f86aee9d21b51cf499b41aa4420 branch: 3.12 author: Petr Viktorin <encukou(a)gmail.com> committer: Yhg1s <thomas(a)python.org> date: 2026-09-30T21:15:08+02:00 summary: [3.12] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) (#158489) * gh-157579: Fix race condition in the cleanup of `tempfile.TemporaryDirectory` (GH-157580) (cherry picked from commit 5c20517a4fc56683efe63a7751020db9573f538d) * Add root user checks to test.support This partially backports commit 86b8617747699416fcf9cd4ce6ea1da58a66f70e (GH-146195); making existing tests use the helper is omitted. * gh-134993: Add os.lstat() to os.supports_dir_fd (#135188) Co-authored-by: Stan Ulbrych <stan(a)python.org> Co-authored-by: Victor Stinner <vstinner(a)python.org> Co-authored-by: Petr Viktorin <encukou(a)gmail.com> files: A Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst M Doc/library/tempfile.rst M Lib/os.py M Lib/shutil.py M Lib/tempfile.py M Lib/test/support/__init__.py M Lib/test/test_shutil.py M Lib/test/test_tempfile.py diff --git a/Doc/library/tempfile.rst b/Doc/library/tempfile.rst index f0a81a093b435b..1c3cb625bc1097 100644 --- a/Doc/library/tempfile.rst +++ b/Doc/library/tempfile.rst @@ -207,6 +207,15 @@ The module defines the following user-callable items: debugging or when you need your cleanup behavior to be conditional based on other logic. + .. warning:: + + Cleanup is not robust against the tree being modified while it is removed. + Files outside of the tree may have their permissions and file flags reset. + + On systems where :data:`shutil.rmtree.avoids_symlink_attacks` is + false, manipulating symbolic links during cleanup + may cause files outside of the tree to be removed. + .. audit-event:: tempfile.mkdtemp fullpath tempfile.TemporaryDirectory .. versionadded:: 3.2 diff --git a/Lib/os.py b/Lib/os.py index 465742d318440a..a01eed5497c85d 100644 --- a/Lib/os.py +++ b/Lib/os.py @@ -110,6 +110,7 @@ def _add(str, fn): _add("HAVE_FCHMODAT", "chmod") _add("HAVE_FCHOWNAT", "chown") _add("HAVE_FSTATAT", "stat") + _add("HAVE_LSTAT", "lstat") _add("HAVE_FUTIMESAT", "utime") _add("HAVE_LINKAT", "link") _add("HAVE_MKDIRAT", "mkdir") diff --git a/Lib/shutil.py b/Lib/shutil.py index 90f6c024afe332..8cfe8c1030e498 100644 --- a/Lib/shutil.py +++ b/Lib/shutil.py @@ -654,6 +654,7 @@ def _rmtree_safe_fd(stack, onexc): # save a call to os.lstat() when walking subdirectories. func, dirfd, path, orig_entry = stack.pop() name = path if orig_entry is None else orig_entry.name + parent_fd = None if func is os.close else dirfd try: if func is os.close: os.close(dirfd) @@ -697,17 +698,18 @@ def _rmtree_safe_fd(stack, onexc): try: os.unlink(entry.name, dir_fd=topfd) except OSError as err: - onexc(os.unlink, fullname, err) + onexc(os.unlink, fullname, err, direntry=entry, dir_fd=topfd) except OSError as err: err.filename = path - onexc(func, path, err) + onexc(func, path, err, direntry=orig_entry, dir_fd=parent_fd) _use_fd_functions = ({os.open, os.stat, os.unlink, os.rmdir} <= os.supports_dir_fd and os.scandir in os.supports_fd and os.stat in os.supports_follow_symlinks) -def rmtree(path, ignore_errors=False, onerror=None, *, onexc=None, dir_fd=None): +def rmtree(path, ignore_errors=False, onerror=None, *, onexc=None, dir_fd=None, + _onexc_kwargs=False): """Recursively delete a directory tree. If dir_fd is not None, it should be a file descriptor open to a directory; @@ -730,24 +732,29 @@ def rmtree(path, ignore_errors=False, onerror=None, *, onexc=None, dir_fd=None): sys.audit("shutil.rmtree", path, dir_fd) if ignore_errors: - def onexc(*args): + def onexc(*args, **kwargs): pass elif onerror is None and onexc is None: - def onexc(*args): + def onexc(*args, **kwargs): raise elif onexc is None: if onerror is None: - def onexc(*args): + def onexc(*args, **kwargs): raise else: # delegate to onerror - def onexc(*args): + def onexc(*args, **kwargs): func, path, exc = args if exc is None: exc_info = None, None, None else: exc_info = type(exc), exc, exc.__traceback__ return onerror(func, path, exc_info) + elif not _onexc_kwargs: + # Only the internal caller in tempfile asks for the extra arguments. + _onexc = onexc + def onexc(func, path, err, **kwargs): + return _onexc(func, path, err) if _use_fd_functions: # While the unsafe rmtree works fine on bytes, the fd based does not. diff --git a/Lib/tempfile.py b/Lib/tempfile.py index 67c02db124d478..1ceb0bab783dc8 100644 --- a/Lib/tempfile.py +++ b/Lib/tempfile.py @@ -43,6 +43,7 @@ import shutil as _shutil import errno as _errno from random import Random as _Random +import stat as _stat import sys as _sys import types as _types import weakref as _weakref @@ -276,15 +277,68 @@ def _dont_follow_symlinks(func, path, *args): elif _os.name == 'nt' or not _os.path.islink(path): func(path, *args) -def _resetperms(path): +def _resetflags(path): try: chflags = _os.chflags except AttributeError: pass else: _dont_follow_symlinks(chflags, path, 0) + +def _resetperms(path): + _resetflags(path) _dont_follow_symlinks(_os.chmod, path, 0o700) +# True if TemporaryDirectory._rmtree() can work relative to open directories +# instead of resolving paths again. +_rmtree_use_dir_fd = ( + {_os.chmod, _os.unlink, _os.lstat} <= _os.supports_dir_fd + and _os.chmod in _os.supports_fd +) + +def _resetperms_fd(dir_fd, path): + # Same as _resetperms(), but for the directory referred to by dir_fd. + if dir_fd is None: + _resetperms(path) + return + _resetflags(path) + _os.chmod(dir_fd, 0o700) + +try: + _nofollow_mode = _os.O_RDONLY | _os.O_NONBLOCK | _os.O_NOFOLLOW +except AttributeError: + _nofollow_mode = None + +def _resetperms_at(name, dir_fd, path): + # Same as _resetperms(), but name is resolved relative to the directory + # file descriptor dir_fd. path is only used for os.chflags(), which + # doesn't support dir_fd or file descriptors. + if dir_fd is None: + _resetperms(path) + return + _resetflags(path) + if _os.chmod in _os.supports_follow_symlinks: + _os.chmod(name, 0o700, dir_fd=dir_fd, follow_symlinks=False) + else: + # dir_fd & follow_symlinks is not supported on this platform. + # Try chmod opening the file with O_NOFOLLOW. + if _nofollow_mode is not None: + try: + fd = _os.open(name, _nofollow_mode, dir_fd=dir_fd) + except OSError: + pass + else: + try: + _os.chmod(fd, 0o700) + finally: + _os.close(fd) + return + # If that did not work, we change by name, which is subject to a race + # condition. + stat = _os.lstat(name, dir_fd=dir_fd) + if not _stat.S_ISLNK(stat.st_mode): + _os.chmod(name, 0o700, dir_fd=dir_fd) + # User visible interfaces. @@ -892,23 +946,42 @@ def __init__(self, suffix=None, prefix=None, dir=None, ignore_errors=self._ignore_cleanup_errors, delete=self._delete) @classmethod - def _rmtree(cls, name, ignore_errors=False, repeated=False): - def onexc(func, path, exc): + def _rmtree(cls, name, ignore_errors=False, repeated=False, dir_fd=None, + fullname=None): + if fullname is None: + fullname = name + + def onexc(func, path, exc, direntry=None, dir_fd=None): if isinstance(exc, PermissionError): if repeated and path == name: if ignore_errors: return raise + # fullpath is path as seen from the working directory + fullpath = fullname + path[len(name):] + # base is path relative to dir_fd, the directory rmtree() + # reached it through, or the whole path when there is none + if dir_fd is None or not _rmtree_use_dir_fd: + base, dir_fd = path, None + elif direntry is None: + base = path + else: + base = direntry.name + try: if path != name: - _resetperms(_os.path.dirname(path)) - _resetperms(path) + # The parent directory of path is the one referred to + # by dir_fd. + _resetperms_fd(dir_fd, _os.path.dirname(fullpath)) + _resetperms_at(base, dir_fd, fullpath) try: - _os.unlink(path) + _os.unlink(base, dir_fd=dir_fd) except IsADirectoryError: - cls._rmtree(path, ignore_errors=ignore_errors) + cls._rmtree(base, ignore_errors=ignore_errors, + repeated=(path == name), + dir_fd=dir_fd, fullname=fullpath) except PermissionError: # The PermissionError handler was originally added for # FreeBSD in directories, but it seems that it is raised @@ -917,21 +990,27 @@ def onexc(func, path, exc): # raise NotADirectoryError and mask the PermissionError. # So we must re-raise the current PermissionError if # path is not a directory. - if not _os.path.isdir(path) or _os.path.isjunction(path): + if (not _os.path.isdir(fullpath) + or _os.path.isjunction(fullpath)): if ignore_errors: return raise - cls._rmtree(path, ignore_errors=ignore_errors, - repeated=(path == name)) + cls._rmtree(base, ignore_errors=ignore_errors, + repeated=(path == name), + dir_fd=dir_fd, fullname=fullpath) except FileNotFoundError: pass + except OSError: + if ignore_errors: + return + raise elif isinstance(exc, FileNotFoundError): pass else: if not ignore_errors: raise - _shutil.rmtree(name, onexc=onexc) + _shutil.rmtree(name, onexc=onexc, dir_fd=dir_fd, _onexc_kwargs=True) @classmethod def _cleanup(cls, name, warn_message, ignore_errors=False, delete=True): diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py index 1ee8ffc1b7aaf8..fb36d2adb4d456 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py @@ -2598,3 +2598,8 @@ def control_characters_c0() -> list[str]: C0 control characters defined as the byte range 0x00-0x1F, and 0x7F. """ return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"] + + +_ROOT_IN_POSIX = hasattr(os, 'geteuid') and os.geteuid() == 0 +requires_root_user = unittest.skipUnless(_ROOT_IN_POSIX, "test needs root privilege") +requires_non_root_user = unittest.skipIf(_ROOT_IN_POSIX, "test needs non-root account") diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py index b7be547de412e1..fcfffe490b1b63 100644 --- a/Lib/test/test_shutil.py +++ b/Lib/test/test_shutil.py @@ -497,6 +497,37 @@ def check_args_to_onexc(self, func, arg, exc): self.assertTrue(isinstance(exc, OSError)) self.errorState = 3 + @os_helper.skip_if_dac_override + @os_helper.skip_unless_working_chmod + @unittest.skipUnless(shutil.rmtree.avoids_symlink_attacks, + 'requires the fd based implementation of rmtree()') + def test_on_exc_kwargs(self): + os.mkdir(TESTFN) + self.addCleanup(shutil.rmtree, TESTFN) + + child_dir_path = os.path.join(TESTFN, 'b') + child_file_path = os.path.join(child_dir_path, 'a') + os.mkdir(child_dir_path) + os_helper.create_empty_file(child_file_path) + old_child_dir_mode = os.stat(child_dir_path).st_mode + # Make unwritable. + new_mode = stat.S_IREAD|stat.S_IEXEC + os.chmod(child_dir_path, new_mode) + + self.addCleanup(os.chmod, child_dir_path, old_child_dir_mode) + + calls = [] + def onexc(func, path, err, direntry=None, dir_fd=None): + calls.append((func, path, err)) + if func is os.unlink: + self.assertEqual(direntry.name, os.path.basename(path)) + self.assertTrue(os.path.samestat( + os.stat(path), os.stat(direntry.name, dir_fd=dir_fd))) + + shutil.rmtree(TESTFN, onexc=onexc, _onexc_kwargs=True) + self.assertIn((os.unlink, child_file_path), + [(func, path) for func, path, err in calls]) + @unittest.skipIf(sys.platform[:6] == 'cygwin', "This test can't be run on Cygwin (issue #1071513).") @os_helper.skip_if_dac_override diff --git a/Lib/test/test_tempfile.py b/Lib/test/test_tempfile.py index 31982ae6ea2aab..7b22706e396a91 100644 --- a/Lib/test/test_tempfile.py +++ b/Lib/test/test_tempfile.py @@ -14,6 +14,7 @@ import gc import shutil import subprocess +import sysconfig from unittest import mock import unittest @@ -1831,6 +1832,54 @@ def test(target, target_is_directory): new_flags = os.stat(dir1).st_flags self.assertEqual(new_flags, old_flags) + @os_helper.skip_unless_symlink + @os_helper.skip_unless_working_chmod + @support.requires_non_root_user + @unittest.skipIf(support.is_emscripten, 'Fails due to Emscripten bug:' + 'emscripten-core/emscripten#27761') + @unittest.skipUnless(shutil.rmtree.avoids_symlink_attacks, + 'requires the fd based implementation of rmtree()') + def test_cleanup_with_symlink_race(self): + # cleanup() should not operate on files outside of the temporary + # directory when a directory is replaced with a symlink while it + # recovers from a PermissionError (CVE-2026-12345). + with self.do_create(recurse=0) as target: + target_file = os.path.join(target, 'file1') + open(target_file, 'wb').close() + target_mode = os.stat(target_file).st_mode + + d1 = self.do_create(recurse=0) + dir1 = os.path.join(d1.name, 'dir1') + os.mkdir(dir1) + open(os.path.join(dir1, 'file1'), 'wb').close() + # Removing contents of dir1 fails with a PermissionError, and + # dir1 is replaced with a symlink to target at the very moment + # cleanup() starts to recover from that error. + os.chmod(dir1, 0o500) + unlink = os.unlink + def hook(path, *, dir_fd=None): + try: + return unlink(path, dir_fd=dir_fd) + except PermissionError: + if not os.path.islink(dir1): + os.chmod(dir1, 0o700) + os.rename(dir1, dir1 + '_moved') + os.symlink(target, dir1) + raise + try: + with mock.patch('os.unlink', hook): + with contextlib.suppress(OSError): + d1.cleanup() + finally: + if os.path.islink(dir1): + os.unlink(dir1) + os.rename(dir1 + '_moved', dir1) + os.chmod(dir1, 0o700) + d1.cleanup() + + self.assertTrue(os.path.exists(target_file)) + self.assertEqual(os.stat(target_file).st_mode, target_mode) + @support.cpython_only def test_del_on_collection(self): # A TemporaryDirectory is deleted when garbage collected @@ -2003,6 +2052,29 @@ def test_modes(self): d.cleanup() self.assertFalse(os.path.exists(d.name)) + @support.subTests('ignore_errors', (True, False)) + def test_parent_mode_preserved(self, ignore_errors): + # Test that cleanup does not touch the parent directory, + # even if that prevents removal. + for mode in range(8): + mode <<= 6 + with self.subTest(mode=format(mode, '03o')): + outer = self.do_create() + with outer: + d = self.do_create(dir=outer.name, dirs=2, files=2, + ignore_cleanup_errors=ignore_errors) + with d: + os.chmod(outer.name, mode) + orig_mode = os.stat(outer.name).st_mode + try: + d.cleanup() + except PermissionError: + if ignore_errors: + raise + self.assertEqual(os.stat(outer.name).st_mode, orig_mode) + outer.cleanup() + self.assertFalse(os.path.exists(outer.name)) + def check_flags(self, flags): # skip the test if these flags are not supported (ex: FreeBSD 13) filename = os_helper.TESTFN @@ -2040,5 +2112,17 @@ def test_delete_false(self): self.assertTrue(os.path.exists(working_dir)) shutil.rmtree(working_dir) + @unittest.skipUnless( + sysconfig.get_config_var('PY_SUPPORT_TIER') + and sysconfig.get_config_var('PY_SUPPORT_TIER') <= 3, + 'regression test for supported platforms') + @unittest.skipIf(support.MS_WINDOWS, 'dirfd not used on Windows') + @unittest.skipIf(support.is_wasi, 'WASI has no chmod') + def test_cleanup_safe(self): + """Verify that cleanup uses the safer code path""" + # This is a regression test. Feel free to add exceptions for new + # platforms, but don't forget to update the docs. + self.assertTrue(tempfile._rmtree_use_dir_fd) + if __name__ == "__main__": unittest.main() diff --git a/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst b/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst new file mode 100644 index 00000000000000..46e87575dba983 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-08-14-11-55-00.gh-issue-157579.Kq3Vt2.rst @@ -0,0 +1,6 @@ +Fix a race condition in the cleanup of :class:`tempfile.TemporaryDirectory`. +When working around file system permission errors, files are now removed +relative to open directory file descriptors instead of resolving their path +again, so that replacing a directory of the tree with a symbolic link can no +longer make the cleanup delete files outside of the temporary directory. +This addresses :cve:`2026-12345`.

1 0

Jump to page: