diff options
author | Łukasz Langa <lukasz@langa.pl> | 2021-06-28 10:08:34 (GMT) |
---|---|---|
committer | Łukasz Langa <lukasz@langa.pl> | 2021-06-28 10:08:34 (GMT) |
commit | c3ffbbdf3d5645ee07c22649f2028f9dffc762ba (patch) | |
tree | 6eb4040f844b13c315e775fc1283b19ca2badeaa /Misc | |
parent | 634da2de88af06eb8c6ebdb90d8c00005847063d (diff) | |
download | cpython-c3ffbbdf3d5645ee07c22649f2028f9dffc762ba.zip cpython-c3ffbbdf3d5645ee07c22649f2028f9dffc762ba.tar.gz cpython-c3ffbbdf3d5645ee07c22649f2028f9dffc762ba.tar.bz2 |
Python 3.8.11v3.8.11
Diffstat (limited to 'Misc')
6 files changed, 52 insertions, 13 deletions
diff --git a/Misc/NEWS.d/3.8.11.rst b/Misc/NEWS.d/3.8.11.rst new file mode 100644 index 0000000..7a9ee05 --- /dev/null +++ b/Misc/NEWS.d/3.8.11.rst @@ -0,0 +1,52 @@ +.. bpo: 44022 +.. date: 2021-05-05-17-37-04 +.. nonce: bS3XJ9 +.. release date: 2021-06-28 +.. section: Security + +mod:`http.client` now avoids infinitely reading potential HTTP headers after +a ``100 Continue`` status response from the server. + +.. + +.. bpo: 43882 +.. date: 2021-04-25-07-46-37 +.. nonce: Jpwx85 +.. section: Security + +The presence of newline or tab characters in parts of a URL could allow some +forms of attacks. + +Following the controlling specification for URLs defined by WHATWG +:func:`urllib.parse` now removes ASCII newlines and tabs from URLs, +preventing such attacks. + +.. + +.. bpo: 42800 +.. date: 2021-01-09-17-07-36 +.. nonce: _dtZvW +.. section: Security + +Audit hooks are now fired for frame.f_code, traceback.tb_frame, and +generator code/frame attribute access. + +.. + +.. bpo: 44070 +.. date: 2021-05-10-22-30-12 +.. nonce: 5bBtKx +.. section: Core and Builtins + +No longer eagerly makes import filenames absolute, except for extension +modules, which was introduced in 3.8.10. + +.. + +.. bpo: 44061 +.. date: 2021-05-07-08-39-23 +.. nonce: MvElG6 +.. section: Library + +Fix regression in previous release when calling :func:`pkgutil.iter_modules` +with a list of :class:`pathlib.Path` objects diff --git a/Misc/NEWS.d/next/Core and Builtins/2021-05-10-22-30-12.bpo-44070.5bBtKx.rst b/Misc/NEWS.d/next/Core and Builtins/2021-05-10-22-30-12.bpo-44070.5bBtKx.rst deleted file mode 100644 index 6f7f307..0000000 --- a/Misc/NEWS.d/next/Core and Builtins/2021-05-10-22-30-12.bpo-44070.5bBtKx.rst +++ /dev/null @@ -1,2 +0,0 @@ -No longer eagerly makes import filenames absolute, except for extension -modules, which was introduced in 3.8.10. diff --git a/Misc/NEWS.d/next/Library/2021-05-07-08-39-23.bpo-44061.MvElG6.rst b/Misc/NEWS.d/next/Library/2021-05-07-08-39-23.bpo-44061.MvElG6.rst deleted file mode 100644 index e41f285..0000000 --- a/Misc/NEWS.d/next/Library/2021-05-07-08-39-23.bpo-44061.MvElG6.rst +++ /dev/null @@ -1,2 +0,0 @@ -Fix regression in previous release when calling :func:`pkgutil.iter_modules` -with a list of :class:`pathlib.Path` objects diff --git a/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst b/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst deleted file mode 100644 index d01c0c3..0000000 --- a/Misc/NEWS.d/next/Security/2021-01-09-17-07-36.bpo-42800._dtZvW.rst +++ /dev/null @@ -1 +0,0 @@ -Audit hooks are now fired for frame.f_code, traceback.tb_frame, and generator code/frame attribute access. diff --git a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst b/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst deleted file mode 100644 index a326d07..0000000 --- a/Misc/NEWS.d/next/Security/2021-04-25-07-46-37.bpo-43882.Jpwx85.rst +++ /dev/null @@ -1,6 +0,0 @@ -The presence of newline or tab characters in parts of a URL could allow -some forms of attacks. - -Following the controlling specification for URLs defined by WHATWG -:func:`urllib.parse` now removes ASCII newlines and tabs from URLs, -preventing such attacks. diff --git a/Misc/NEWS.d/next/Security/2021-05-05-17-37-04.bpo-44022.bS3XJ9.rst b/Misc/NEWS.d/next/Security/2021-05-05-17-37-04.bpo-44022.bS3XJ9.rst deleted file mode 100644 index cf6b63e..0000000 --- a/Misc/NEWS.d/next/Security/2021-05-05-17-37-04.bpo-44022.bS3XJ9.rst +++ /dev/null @@ -1,2 +0,0 @@ -mod:`http.client` now avoids infinitely reading potential HTTP headers after a -``100 Continue`` status response from the server. |