summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Python 3.9.22v3.9.22Łukasz Langa2025-04-089-26/+74
|
* [3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132242)Seth Michael Larson2025-04-085-10/+20
| | | | | (cherry picked from commit c0de6500249469e6fc5b458d6afb6bad1b6755cd) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) ↵Seth Michael Larson2025-04-034-160/+425
| | | | | | | | | (GH-131364) (cherry picked from commit bb0268f60dfe903a9bdb8d84104247a9318c6b18) (cherry picked from commit 6af54d298d5135302037cdda7a1f5535e48cb1b6) Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-121284: Fix email address header folding with parsed encoded-word ↵Petr Viktorin2025-04-033-5/+37
| | | | | | | | | | | | | | | | | (GH-122754) (GH-131412) Email generators using email.policy.default may convert an RFC 2047 encoded-word to unencoded form during header refolding. In a structured header, this could allow 'specials' chars outside a quoted-string, leading to invalid address headers and enabling spoofing. This change ensures a parsed encoded-word that contains specials is kept as an encoded-word while the header is refolded. [Better fix from @bitdancer.] (cherry picked from commit 295b53df2aa18deb625a7da41f7e4babfe6ef34b) Co-authored-by: Mike Edmunds <medmunds@gmail.com> Co-authored-by: R David Murray <rdmurray@bitdance.com>
* [3.9] gh-105704: Disallow square brackets (`[` and `]`) in domain names for ↵Miss Islington (bot)2025-02-193-3/+58
| | | | | | | | | parsed URLs (GH-129418) (#129530) (cherry picked from commit d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Peter Bierma <zintensitydev@gmail.com> Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* [3.9] gh-119511: Fix a potential denial of service in imaplib (GH-119514) ↵Hugo van Kemenade2025-02-193-1/+32
| | | | | | | | | | | | | | (#130248) The IMAP4 client could consume an arbitrary amount of memory when trying to connect to a malicious server, because it read a "literal" data with a single read(size) call, and BufferedReader.read() allocates the bytes object of the specified size before reading. Now the IMAP4 client reads data by chunks, therefore the amount of used memory is limited by the amount of the data actually been sent by the server. (cherry picked from commit 735f25c5e3a0f74438c86468ec4dfbe219d93c91) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-119461: Fix ThreadedVSOCKSocketStreamTest (GH-129171) (GH-129440) ↵Miss Islington (bot)2025-02-191-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (#130075) Fix ThreadedVSOCKSocketStreamTest: if get_cid() returns the host address or the "any" address, use the local communication address (loopback): VMADDR_CID_LOCAL. On Linux 6.9, apparently, the /dev/vsock device is now available but get_cid() returns VMADDR_CID_ANY (-1). (cherry picked from commit 45db419c3104a14007ea9efbc4bff03aef8ed10c) (cherry picked from commit e94dbe4ed83460f18bd72563c5f09f6cdc71f604) (cherry picked from commit c750061047ee520d8299334df4b112fd983d7e48) (cherry picked from commit cbfe3023e46b544b80ea1a38a8c900c6fb881554) --- Restore the skipUnless removed by GH-119465. This test can only pass on virtual machines, not actual machines. Actual machines see: ``` self.cli.connect((cid, VSOCKPORT)) ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ OSError: [Errno 19] No such device ``` Reproduced on (Linux) Ubuntu 24.04.1 running 6.8.0-52-generic. (cherry picked from commit 2bd9f9b0547f6ffe40cd1dd964459ce11b58144d) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>
* [3.9] gh-122544: Change OS image in GitHub Actions to Ubuntu 22.04 (#122566) ↵Hugo van Kemenade2025-02-192-14178/+14659
| | | | | (#130295) Co-authored-by: Damien <81557462+Damien-Chen@users.noreply.github.com>
* [3.9] gh-107262: Update Tkinter tests for Tcl/Tk 8.6.14 (GH-119322) (#130275)Miss Islington (bot)2025-02-193-11/+24
| | | | | | Co-authored-by: James De Bias <81095953+DBJim@users.noreply.github.com> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
* [3.9] gh-129641: Docs GHA build: use upload-artifact@v4 (GH-129642) (#130114)Petr Viktorin2025-02-182-2/+4
| | | | | Co-authored-by: shallow-beach <96891913+shallow-beach@users.noreply.github.com> fix (#128077)
* [3.9] gh-129509: Add required key to the dummy Read the Docs config file ↵Miss Islington (bot)2025-02-181-0/+2
| | | | | | (GH-129510) (#130249) Co-authored-by: Petr Viktorin <encukou@gmail.com>
* [3.9] gh-121277: Allow .. versionadded:: next in docs (GH-121278) (#128117)Petr Viktorin2025-01-232-5/+33
| | | | | | | | | | | | | | | | | | Make `versionchanged:: next`` expand to current (unreleased) version. When a new CPython release is cut, the release manager will replace all such occurences of "next" with the just-released version. (See the issue for release-tools and devguide PRs.) Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> (cherry picked from commit 7d24ea9db3e8fdca52058629c9ba577aba3d8e5c) gh-121277: Raise nice error on `next` as second argument to deprecated-removed (GH-124623) (cherry-picked from e349f73a5ad2856b0a7cbe4aef7cc081c7aed777) (cherry-picked from 3.11: f0895aa9c1d40d0add673cc51bd143556e22100a) (cherry-picked from 3.10: 8773554b717cfb08b4bd11a927813f4ed74762c7)
* Post 3.9.21Łukasz Langa2024-12-031-1/+1
|
* Python 3.9.21v3.9.21Łukasz Langa2024-12-0311-23/+86
|
* [3.9] gh-122792: Make IPv4-mapped IPv6 address properties consistent with ↵Łukasz Langa2024-12-033-5/+55
| | | | | | | | | IPv4 (GH-122793) (GH-123819) (GH-127571) Make IPv4-mapped IPv6 address properties consistent with IPv4. (cherry picked from commit 76a1c5d18312712baed4699fe7333abb050ec9b7) (cherry picked from commit b58da409aac90123c1159916908a4c49144925ee) Co-authored-by: Seth Michael Larson <seth@python.org>
* [3.9] gh-95588: Drop the safety claim from `ast.literal_eval` docs. ↵Miss Islington (bot)2024-12-033-9/+25
| | | | | | | | (GH-95919) (GH-126729) It was never really safe and this claim conflicts directly with the big warning in the docs about it being able to crash the interpreter. (cherry picked from commit 8baef8ae367041a5cfefb40b19c7b87e9bcb56a2) Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-126623: Update libexpat to 2.6.4, make future updates easier ↵Seth Michael Larson2024-12-025-11/+80
| | | | | (GH-126792) (GH-126800) (cherry picked from commit 3c9996909402fadc98e6ca2a64e75a71a7427352)
* [3.9] gh-103848: Adds checks to ensure that bracketed hosts found by ↵Victor Stinner2024-12-023-1/+43
| | | | | | | | urlsplit are of IPv6 or IPvFuture format (#103849) (#126976) Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 29f348e232e82938ba2165843c448c2b291504c5) Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
* [3.9] gh-127359: Pin Tcl/Tk to 8 (8.6) for testing macOS (GH-127365) (#127409)Hugo van Kemenade2024-11-301-1/+4
|
* [3.9] gh-113027: Fix test_variable_tzname in test_email (GH-113821) (GH-126477)Petr Viktorin2024-11-121-0/+2
| | | | | | | Determine the support of the Kyiv timezone by checking the result of astimezone() which uses the system tz database and not the one populated by zoneinfo. (cherry picked from commit 931d7e052e22aa01e18fcc67ed71b6ea305aff71)
* [3.9] gh-109396: Fix test_socket.test_hmac_sha1() in FIPS mode (GH-109423) ↵Miss Islington (bot)2024-11-042-3/+10
| | | | | | | | | | | | (GH-125107) Use a longer key: FIPS mode requires at least of at least 112 bits. The previous key was only 32 bits. (cherry picked from commit e091b9f20fa8e409003af79f3c468b8225e6dcd3) (cherry picked from commit f7bfac4b3dd30920f97a542fd78c355ce62aa267) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>
* [3.9] gh-124651: Quote template strings in `venv` activation scripts ↵Victor Stinner2024-11-047-16/+130
| | | | | (GH-124712) (GH-126185) (GH-126269) (GH-126301) (cherry picked from commit ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97)
* [3.9] gh-125041: gh-90781: test_zlib: For s390x HW acceleration, skip ↵Petr Viktorin2024-10-282-2/+22
| | | | | | | | | | checking the compressed bytes (GH-125042) (#125587) This backports two commits: - GH-31096 skipped the tests unconditionally - GH-125042 skips only the possibly-failing assertion (cherry picked from commit d522856)
* [3.9] gh-107902: gh-108948: Don't test setting suid/sgid/sticky on systems ↵Petr Viktorin2024-10-281-15/+39
| | | | | | | | that don't support them (GH-108368) (GH-109697) (#125576) On FreeBSD, regular users cannot set the sticky bit. Skip the test if chmod() fails with EFTYPE error. Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.9] gh-89452: GHA: Set --with-dbmliborder to avoid issues with homebrew's ↵Petr Viktorin2024-10-091-1/+3
| | | | | | | | | | | | | | | gdbm 1.24 (GH-125112) (#125176) Per https://github.com/python/cpython/issues/89452GH-issuecomment-1116329316, the issue is fixed in configure for 3.11+, and > For older Python versions, the workaround is to build with: > > ./configure --with-dbmliborder=gdbm:ndbm We need this workaround in GitHub Actions, otherwise the tests fail. (cherry picked from commit 850189a64e7f0b920fe48cb12a5da3e648435680) Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* [3.9] gh-100454: Fix running SSL tests with OpenSSL 3.1+ (GH-100456) (GH-125186)Miss Islington (bot)2024-10-092-4/+5
| | | | | | | | This fixes Ubuntu pipeline with OpenSSL 3.1+ (cherry picked from commit 333c7dccd87c637d0b15cf81f9bbec28e39664fd) Co-authored-by: Dimitri John Ledkov <19779+xnox@users.noreply.github.com> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
* Post 3.9.20.Łukasz Langa2024-09-061-1/+1
|
* Python 3.9.20v3.9.20Łukasz Langa2024-09-0621-61/+206
|
* [3.9] [CVE-2023-27043] gh-102988: Reject malformed addresses in ↵Petr Viktorin2024-09-065-21/+371
| | | | | | | | | | | | | | email.parseaddr() (GH-111116) (#123769) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). Add an optional 'strict' parameter to getaddresses() and parseaddr() functions. Patch by Thomas Dwyer. (cherry picked from commit 4a153a1d3b18803a684cd1bcc2cdf3ede3dbae19) Co-authored-by: Victor Stinner <vstinner@python.org> Co-Authored-By: Thomas Dwyer <github@tomd.tel>
* [3.9] gh-123678: Upgrade libexpat 2.6.3 (#123711)Seth Michael Larson2024-09-054-15/+36
| | | (cherry picked from commit fdc04ad75a410ed3af99edfc32c38b5fc3375f52)
* [3.9] gh-67693: Fix urlunparse() and urlunsplit() for URIs with path ↵Serhiy Storchaka2024-09-053-4/+70
| | | | | | | | starting with multiple slashes and no authority (GH-113563) (#119027) (cherry picked from commit e237b25a4fa5626fcd1b1848aa03f725f892e40e) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* [3.9] gh-112275: Fix HEAD_LOCK deadlock in child process after fork ↵Łukasz Langa2024-09-042-1/+4
| | | | | | | | | (GH-112336) (#123688) HEAD_LOCK is called from _PyEval_ReInitThreads->_PyThreadState_DeleteExcept before _PyRuntimeState_ReInitThreads reinit runtime->interpreters.mutex which might be locked before fork. (cherry picked from commit 522799a05e3e820339718151ac055af6d864d463) Co-authored-by: ChuBoning <102216855+ChuBoning@users.noreply.github.com>
* [3.9] gh-119690: Fixes buffer type confusion in _winapi.CreateFile and ↵Miss Islington (bot)2024-09-042-2/+4
| | | | | | | _winapi.CreateNamedPipe audit events (GH-119735) (#123679) (cherry picked from commit 2e861ac1cd4359463f6a13efd3d3578fce71e5ab) Co-authored-by: Steve Dower <steve.dower@python.org>
* [3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie values ↵Miss Islington (bot)2024-09-043-26/+47
| | | | | | | | with backslashes (GH-123075) (#123107) This fixes CVE-2024-7592. (cherry picked from commit 44e458357fca05ca0ae2658d62c8c595b048b5ef) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
* [3.9] gh-123270: Replaced SanitizedNames with a more surgical fix. ↵Jason R. Coombs2024-09-043-2/+87
| | | | | | | | | | (GH-123354) (#123432) Applies changes from zipp 3.20.1 and jaraco/zippGH-124 (cherry picked from commit 2231286d78d328c2f575e0b05b16fe447d1656d6) (cherry picked from commit 17b77bb41409259bad1cd6c74761c18b6ab1e860) Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
* [3.9] gh-121285: Remove backtracking when parsing tarfile headers ↵Seth Michael Larson2024-09-043-38/+111
| | | | | | | | | | | | | | (GH-121286) (#123641) * Remove backtracking when parsing tarfile headers * Rewrite PAX header parsing to be stricter * Optimize parsing of GNU extended sparse headers v0.0 (cherry picked from commit 34ddb64d088dd7ccc321f6103d23153256caa5d4) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru> Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-121650: Encode newlines in headers, and verify headers are sound ↵Łukasz Langa2024-09-0410-4/+162
| | | | | | | | | | | | | | | | | | | | | | | | (GH-122233) (#122610) Per RFC 2047: > [...] these encoding schemes allow the > encoding of arbitrary octet values, mail readers that implement this > decoding should also ensure that display of the decoded data on the > recipient's terminal will not cause unwanted side-effects It seems that the "quoted-word" scheme is a valid way to include a newline character in a header value, just like we already allow undecodable bytes or control characters. They do need to be properly quoted when serialized to text, though. This should fail for custom fold() implementations that aren't careful about newlines. (cherry picked from commit 097633981879b3c9de9a1dd120d3aa585ecc2384) Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Bas Bloemsaat <bas@bloemsaat.org> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
* [3.9] gh-122133: Rework pure Python socketpair tests to avoid use of ↵Miss Islington (bot)2024-08-022-77/+64
| | | | | | | | importlib.reload. (GH-122493) (GH-122508) (cherry picked from commit f071f01b7b7e19d7d6b3a4b0ec62f820ecb14660) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-122133: Authenticate socket connection for `socket.socketpair()` ↵Miss Islington (bot)2024-07-303-3/+147
| | | | | | | | | | fallback (GH-122134) (#122428) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df1043dbdce5c989600616f9f87b4ee72944e5) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>
* [3.9] gh-121957: Emit audit events for python -i and python -m asyncio ↵Łukasz Langa2024-07-225-0/+34
| | | | (GH-122120)
* [3.9] gh-112769: test_zlib: test_zlib: Fix comparison of ↵Ned Deily2024-05-302-12/+18
| | | | | | | | | ZLIB_RUNTIME_VERSION with non-int suffix (GH-112771) (GH-119566) zlib-ng defines the version as "1.3.0.zlib-ng". (cherry picked from commit d384813) Co-authored-by: Miro Hrončok miro@hroncok.cz
* [3.9] gh-118486: Support mkdir(mode=0o700) on Windows (GH-118488) (GH-118741)Steve Dower2024-05-246-3/+107
| | | Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* [3.9] gh-114572: Fix locking in cert_store_stats and get_ca_certs (#118109)Seth Michael Larson2024-05-102-3/+92
|
* [3.9] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges ↵Petr Viktorin2024-05-076-21/+195
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (GH-113179) (GH-113186) (GH-118177) (GH-118472) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] https://github.com/python/cpython/issues/61602 In 3.10 and below, is_private checks whether the network and broadcast address are both private. In later versions (where the test wss backported from), it checks whether they both are in the same private network. For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private, but one is in 0.0.0.0/8 ("This network") and the other in 255.255.255.255/32 ("Limited broadcast"). --------- Co-authored-by: Jakub Stasiak <jakub@stasiak.at>
* [3.9] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118187)Seth Michael Larson2024-05-074-16/+37
| | | (cherry picked from commit c9829eec0883a8991ea4d319d965e123a3cf6c20)
* [3.9] gh-114539: Clarify implicit launching of shells by subprocess ↵Miss Islington (bot)2024-05-071-2/+10
| | | | | | | (GH-117996) (GH-118005) (cherry picked from commit a4b44d39cd6941cc03590fee7538776728bdfd0a) Co-authored-by: Steve Dower <steve.dower@python.org>
* [3.9] gh-116773: Fix overlapped memory corruption crash (GH-116774) (GH-117080)jkriegshauser2024-03-274-12/+71
| | | Co-authored-by: Łukasz Langa <lukasz@langa.pl>
* [3.9] gh-117187: Fix XML tests for vanilla Expat <2.6.0 (GH-117203) (GH-117247)Miss Islington (bot)2024-03-273-9/+9
| | | | | | | This fixes XML unittest fallout from the https://github.com/python/cpython/issues/115398 security fix. When configured using `--with-system-expat` on systems with older pre 2.6.0 versions of libexpat, our unittests were failing. (cherry picked from commit 9f74e86c78853c101a23e938f8e32ea838d8f62e) Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
* Post 3.9.19Łukasz Langa2024-03-191-1/+1
|
* Python 3.9.19v3.9.19Łukasz Langa2024-03-1917-40/+152
|
generated by cgit v0.12 at 2026-03-02 16:17:21 (GMT)