Howdy howdy! It's time to make the next bugfix release of 3.5--and the /final/ release /ever/ of Python 3.4. Here's the schedule I propose:
3.4.10rc1 and 3.5.7rc1 - Saturday March 2 2019 3.4.10 final and 3.5.7 final - Saturday March 16 2019
What's going in these releases? Not much. I have two outstanding PRs against 3.5:
bpo-33127 GH-10994: Compatibility patch for LibreSSL 2.7.0 bpo-34623 GH-9933: XML_SetHashSalt in _elementtree
and one PR against 3.4:
bpo-34623 GH-9953: Use XML_SetHashSalt in _elementtree
I expect to merge all three of those, I just need to get around to it. There's one more recent security fix (bpo-35746, GH-11569) that I want in these releases that still needs backporting.
And that's the entire list. bpo-34623 is the only current release blocker for either 3.4 or 3.5--I'm not aware of anything else in the pipeline. If you have anything you think needs to go into the next 3.5, or the final 3.4, and it's /not/ listed above, please either file a GitHub PR, file a release-blocker bug on bpo, or email me directly.
Good night sweet Python 3.4, and flights of angels sing thee to thy rest!
My thanks to Miro and (especially!) Victor for quickly putting together those lovely PRs. I've now merged everything outstanding for 3.4 and 3.5 except this:
It's a backport of LibreSSL 2.7.0 support for 3.5. This is something I believe Christian Heimes wanted. As it stands, the issue needs a reviewer; I've contacted Christian but received no reply. I'm happy to merge the PR as long as some security-aware core dev approves it.
FWIW, there doesn't appear to be a backport of this patch for 3.4. I don't know if 3.4 should get this backport or not, and there's no discussion of 3.4 on the bpo issue:
Anyway, I'm hoping either to merge or reject this PR before Saturday, so there's no huge rush. Still I'd appreciate it if someone could at least tag themselves as a reviewer in the next day or so.
Putting 3.4 to bed,