Repository navigation

3.7.17.8: eMudhra distrust, upstream security fixes, expat 2.9.0, pip 24.0 / setuptools 68 - #117

Merged

icanhasmath merged 129 commits into

3.7.17.xfrom

3.7.17.8-security

Oct 29, 2026

Merged

3.7.17.8: eMudhra distrust, upstream security fixes, expat 2.9.0, pip 24.0 / setuptools 68#117
icanhasmath merged 129 commits into
3.7.17.xfrom
3.7.17.8-security

Commits on Oct 29, 2026
- bpo-36384: Leading zeros in IPv4 addresses are no longer tolerated (GH-25099) (GH-25815)
  
  miss-islington
  authored and
  icanhasmath
  committed
  9a8714d
- [3.9] gh-97514: Don't use Linux abstract sockets for multiprocessing (GH-98501) (#98504)
  
  authored and
  icanhasmath
  committed
  d015d59
- [3.9] gh-107845: Fix symlink handling for tarfile.data_filter (GH-107846) (#108274)
  
  authored and
  icanhasmath
  committed
  f75758e
- [3.9] gh-101180: Fix a bug where iso2022_jp_3 and iso2022_jp_2004 codecs read out of bounds (gh-111695) (gh-111780)
  
  authored and
  icanhasmath
  committed
  d4efb30
- [3.9] gh-91133: tempfile.TemporaryDirectory: fix symlink bug in cleanup (GH-99930) (GH-112842)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  bed6f1e
- [3.9] gh-109858: Protect zipfile from "quoted-overlap" zipbomb (GH-110016) (GH-113915)
  
  miss-islington
  authored and
  icanhasmath
  committed
  c35e547
- [3.9] gh-113659: Skip hidden .pth files (GH-113660) (GH-114146)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  793ad24
- [3.9] gh-118486: Support mkdir(mode=0o700) on Windows (GH-118488) (GH-118741)
  
  zooba
  authored and
  icanhasmath
  committed
  95b8788
- [3.9] gh-122133: Authenticate socket connection for `socket.socketpair()` fallback (GH-122134) (#122428)
  
  miss-islington
  authored and
  icanhasmath
  committed
  39dab4f
- [3.9] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) (GH-122508)
  
  authored and
  icanhasmath
  committed
  542ae1b
- [3.9] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) (#122610)
  
  ambv
  authored and
  icanhasmath
  committed
  fb55ab7
- [3.9] gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (#103849) (#126976)
  
  vstinner
  authored and
  icanhasmath
  committed
  f82d701
- [3.9] gh-122792: Make IPv4-mapped IPv6 address properties consistent with IPv4 (GH-122793) (GH-123819) (GH-127571)
  
  authored and
  icanhasmath
  committed
  ea96755
- [3.9] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#130248)
  
  authored and
  icanhasmath
  committed
  5c2ea55
- [3.9] gh-105704: Disallow square brackets (`[` and `]`) in domain names for parsed URLs (GH-129418) (#129530)
  
  miss-islington
  authored and
  icanhasmath
  committed
  e78171c
- [3.9] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) (GH-131412)
  
  authored and
  icanhasmath
  committed
  525a263
- [3.9] gh-80222: Fix email address header folding with long quoted-string (GH-122753) (GH-129111) (GH-132371)
  
  authored and
  icanhasmath
  committed
  856d6cf
- [3.7] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) (#134346)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  a10ddaa
- 3.7.17.x: update testPrivateNetworks for the CVE-2024-4032 fix
  icanhasmath
  committed
  f36450d
- [3.9] gh-128840: Limit the number of parts in IPv6 address parsing (GH-128841) (GH-134615)
  
  miss-islington
  authored and
  icanhasmath
  committed
  2354bae
- [3.9] gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address (GH-134836) (GH-135090)
  
  miss-islington
  authored and
  icanhasmath
  committed
  fe7e9e6
- [3.7] gh-135034: Normalize link targets in tarfile, add `os.path.realpath(strict='allow_missing')` (GH-135037) (GH-135084)
  
  Yhg1s
  authored and
  icanhasmath
  committed
  f0f9c5b
- bpo-12800: tarfile: Restore fix from 011525ee9 (GH-21409)
  
  authored and
  icanhasmath
  committed
  de950ea
- [3.9] gh-135462: Fix quadratic complexity in processing special input in HTMLParser (GH-135464) (GH-135486)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  0c64d04
- [3.9] gh-102555: Fix comment parsing in HTMLParser according to the HTML5 standard (GH-135664) (GH-136276)
  
  authored and
  icanhasmath
  committed
  1b77d81
- [3.9] gh-135661: Fix parsing start and end tags in HTMLParser according to the HTML5 standard (GH-135930) (GH-136268) (#136293)
  
  miss-islington
  authored and
  icanhasmath
  committed
  84f0d1d
- [3.9] gh-135661: Fix parsing attributes with whitespaces around the "=" separator in HTMLParser (GH-136908) (GH-136922)
  
  authored and
  icanhasmath
  committed
  56eebfb
- [3.9] gh-130577: tarfile now validates archives to ensure member offsets are non-negative (GH-137027) (GH-137645)
  
  authored and
  icanhasmath
  committed
  0e237d8
- [3.9] gh-118350: Fix support of elements "textarea" and "title" in HTMLParser (GH-135310) (GH-137784)
  
  authored and
  icanhasmath
  committed
  3aa6279
- [3.9] gh-139400: Make sure that parent parsers outlive their subparsers in `pyexpat` (GH-139403) (GH-139614)
  
  hartwork
  authored and
  icanhasmath
  committed
  6f837c0
- [3.9] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) (GH-116272)
  
  hartwork
  authored and
  icanhasmath
  committed
  bc5dc09
- [3.9] gh-117187: Fix XML tests for vanilla Expat <2.6.0 (GH-117203) (GH-117247)
  
  authored and
  icanhasmath
  committed
  d1c766f
- [3.9] gh-121227: Disallow setting an empty list for NPN (GH-137161)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  22e0603
- [3.9] gh-135661: Fix CDATA section parsing in HTMLParser (GH-135665) (GH-137774) (GH-139661)
  
  miss-islington
  authored and
  icanhasmath
  committed
  e7e7778
- [3.9] gh-139700: Check consistency of the zip64 end of central directory record (GH-139702) (GH-139708) (#139715)
  
  authored and
  icanhasmath
  committed
  b5d3f7c
- [3.9] gh-136063: fix quadratic-complexity parsing in `email.message._parseparam` (GH-136072) (GH-140832)
  
  authored and
  icanhasmath
  committed
  221e4e6
- [3.9] gh-136065: Fix quadratic complexity in os.path.expandvars() (GH-134952) (GH-140839)
  
  ambv
  authored and
  icanhasmath
  committed
  330e6c3
- [3.10] gh-143916: Reject control characters in wsgiref.headers.Headers
  
  gpshead
  authored and
  icanhasmath
  committed
  752f27d
- [3.10] gh-143925: Reject control characters in data: URL mediatypes (#144115)
  
  sethmlarson
  authored and
  icanhasmath
  committed
  a7400ea
- [3.10] gh-143919: Reject control characters in http cookies (#144094)
  
  authored and
  icanhasmath
  committed
  add92c6
- [3.10] gh-144125: email: verify headers are sound in BytesGenerator (#144180)
  
  miss-islington
  authored and
  icanhasmath
  committed
  b759ad0
- [3.10] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216) (#142299)
  
  miss-islington
  authored and
  icanhasmath
  committed
  233f69f
- [3.10] gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146) (#142213)
  
  authored and
  icanhasmath
  committed
  2b8012f
- [3.10] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142142)
  
  miss-islington
  authored and
  icanhasmath
  committed
  567a59c
- [3.10] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (#142151)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  76668b2
- [3.10] gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843) (#144862)
  
  authored and
  icanhasmath
  committed
  84df321
- [3.10] gh-143916: Allow HTAB in wsgiref header values (#145140)
  
  authored and
  icanhasmath
  committed
  a5342bc
- [3.10] gh-143935: Email preserve parens when folding comments (GH-143936) (#144350)
  
  authored and
  icanhasmath
  committed
  a124829
- [3.10] gh-143930: Reject leading dashes in webbrowser URLs (GH-143931) (GH-146359)
  
  tomcruiseqi
  authored and
  icanhasmath
  committed
  500cd3c
- [3.10] gh-143930: Tweak the exception message and increase test coverage (GH-146476) (GH-148045) (GH-148051) (GH-148053)
  
  authored and
  icanhasmath
  committed
  7396392
- [3.10] gh-137586: Open external osascript program with absolute path (GH-137584) (#148177)
  
  authored and
  icanhasmath
  committed
  6f4e61a
- [3.10] gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) (#146002)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  e440d80
- [3.10] gh-148169: Fix webbrowser `%action` substitution bypass of dash-prefix check (GH-148170) (#148521)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  45cb573
- [3.10] gh-148395: Fix a possible UAF in `{LZMA,BZ2}Decompressor` (GH-148396) (#148505)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  9616e26
- [3.10] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long name handling (#145816)
  
  miss-islington
  authored and
  icanhasmath
  committed
  82d7aac
- [3.10] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (#144371) (#145673)
  
  vstinner
  authored and
  icanhasmath
  committed
  1f51b59
- [3.10] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (#151996)
  
  authored and
  icanhasmath
  committed
  27e0b7f
- [3.10] gh-87451: Apply CVE-2021-4189 PASV fix to ftplib.ftpcp() (GH-149648) (#149797)
  
  authored and
  icanhasmath
  committed
  e0a2872
- [3.10] gh-146211: Reject CR/LF in HTTP tunnel request headers (GH-146… (#148350)
  
  authored and
  icanhasmath
  committed
  56dbc23
- [3.10] gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (#145600) (#146027)
  
  authored and
  icanhasmath
  committed
  a279f93
- [3.10] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749) (#152529)
  
  miss-islington
  authored and
  icanhasmath
  committed
  7be289b
- [3.10] gh-150599: Prevent bz2 decompressor reuse after errors (#150600) (#151133)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  7e47422
- [3.10] gh-149486: tarfile.data_filter: validate written link target (GH-149487) (#153180)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  2760765
- [3.10] gh-151987: Pass filter_function to TarFile._extract_one() during .extract() (GH-151988) (#152613)
  
  miss-islington
  authored and
  icanhasmath
  committed
  61479c3
- [3.10] gh-153438: Update NuGet download URL (GH-153482) (GH-153515) (#153610)
  
  authored and
  icanhasmath
  committed
  f221606
- [3.10] gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows (GH-146591) (GH-149071) (#155440)
  
  miss-islington
  authored and
  icanhasmath
  committed
  6f93747
- [3.10] gh-100372: Use BIO_eof to detect EOF for SSL_FILETYPE_ASN1 (GH-100373) (#153312)
  
  miss-islington
  authored and
  icanhasmath
  committed
  369975e
- [3.10] gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() (GH-149080) (GH-150843) (#155159)
  
  authored and
  icanhasmath
  committed
  32e7e3d
- [3.10] gh-109638: Fix exponential time in csv.Sniffer for doubled quotes (GH-154868) (GH-155113) (#155116)
  
  authored and
  icanhasmath
  committed
  7d7ab94
- [3.10] gh-152674: Avoid quadratic behavior in xml.etree.ElementPath index predicates (GH-152676) (#154814)
  
  authored and
  icanhasmath
  committed
  b106739
- [3.10] gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser (GH-153031) (#153043)
  
  authored and
  icanhasmath
  committed
  97d3890
- [3.10] gh-151558: Fix symlink escape via `tarfile` hardlink-extraction fallback (GH-151559) (#152080)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  d732baf
- [3.10] gh-146333: Fix quadratic regex backtracking in configparser option parsing (GH-146399) (GH-148559) (#154878)
  
  authored and
  icanhasmath
  committed
  d050ade
- [3.10] gh-143927: Normalize all line endings (CR, CRLF, and LF) in configparser (GH-143929) (#152007)
  
  authored and
  icanhasmath
  committed
  effdee6
- [3.10] gh-98820: Fix quadratic time in csv.Sniffer for quoted fields (GH-154867) (#155539)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  2239271
- [3.10] gh-149018: Use `XML_SetHashSalt16Bytes` in `pyexpat`/`_elementtree` when possible (GH-149023) (#155611)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  fc065e7
- [3.10] gh-157190: Fix tarfile `data`/`tar` filter bypass via hard link to a symlink (GH-157191) (#158457)
  
  freakboy3742
  authored and
  icanhasmath
  committed
  5bc037f
- [3.10] gh-155694: Scope HTTPPasswordMgr credentials by URL scheme (GH-155696) (#155973)
  
  authored and
  icanhasmath
  committed
  c02dd2c
- [3.10] gh-156293: Use-after-free for server-side SSLContext with sni_callback (GH-158504) (#158524)
  
  gpshead
  authored and
  icanhasmath
  committed
  3f62699
- [3.10] gh-158446: Reject float format precision near INT_MAX (GH-158474) (#158482)
  
  gpshead
  authored and
  icanhasmath
  committed
  5a84184
- [3.10] gh-155292: Don't consider Unicode codepoint attributes outside RFC 3454 (GH-155293) (GH-156020) (#156932)
  
  encukou
  authored and
  icanhasmath
  committed
  5089a20
- [3.10] gh-156353: Fix configparser space delimiter parsing (GH-156382) (#156562)
  
  authored and
  icanhasmath
  committed
  46ef304
- [3.10] gh-157265: tarfile: Honor None result of filter for link fallbacks (GH-157266) (#157304)
  
  authored and
  icanhasmath
  committed
  7d51e6e
- [3.10] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) (#156741)
  
  miss-islington
  authored and
  icanhasmath
  committed
  0dcbc3c
- [3.10] gh-155999: `tarfile`: handle a member that leaves the destination but comes back (GH-156000) (#156046)
  
  authored and
  icanhasmath
  committed
  6328f18
- [3.10] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (#158533)
  
  Yhg1s
  authored and
  icanhasmath
  committed
  045c5f0
- [3.11] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) (#159065)
  
  authored and
  icanhasmath
  committed
  8181aac
- [3.11] gh-159428: Don't read mimetypes.knownfiles by default on Windows (GH-159445) (#159573)
  
  cjames23
  authored and
  icanhasmath
  committed
  2fc7606
- [3.11] gh-160300: Reject cookies with a negative version in http.cookiejar (GH-160301) (#160649)
  
  authored and
  icanhasmath
  committed
  43f9a4e
- [3.11] gh-160097: Reject links replacing the destination in `tarfile.tar_filter` (GH-160098) (#160343)
  
  authored and
  icanhasmath
  committed
  3e69c96
- [3.11] gh-160040: Distrust compromised eMudhra intermediate CA keys (CVE-2026-115557) (GH-160042) (GH-160572)
  
  gpshead
  authored and
  icanhasmath
  committed
  70c0a71
- 3.9.25.x: catch socket.timeout in the gh-119452 CGI read loop
  icanhasmath
  committed
  4099c75
- [3.13] gh-143921: Reject NUL, CR and LF in IMAP commands (GH-143922, GH-153067) (GH-153137) (GH-153287)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  75a1897
- gh-143923: Reject control characters in POP3 commands
  
  sethmlarson
  authored and
  icanhasmath
  committed
  0e6a15e
- gh-150751: validate http.client Content-Length and chunk-size (GH-150752)
  
  metsw24-max
  authored and
  icanhasmath
  committed
  3948f7f
- gh-150751: Ignore optional whitespace around Content-Length in http.client (GH-159156)
  
  danilablagorodniy37
  authored and
  icanhasmath
  committed
  1931dd4
- [3.11] bpo-43153: Don't mask `PermissionError` with `NotADirectoryError` during tempdirectory cleanup (GH-29940) (GH-112754)
  
  miss-islington
  authored and
  icanhasmath
  committed
  003c98d
- [3.11] gh-79325: Fix recursion error in TemporaryDirectory cleanup on Windows (GH-112762) (GH-112848)
  
  serhiy-storchaka
  authored and
  icanhasmath
  committed
  0ba42d4
- [3.10] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (CVE-2026-12345)
  icanhasmath
  committed
  1dfbe1a
- [3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (GH-131364)
  
  authored and
  icanhasmath
  committed
  49a8e4c
- [3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132242)
  
  authored and
  icanhasmath
  committed
  7f28c20
- [3.9] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (GH-139055)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  187ad54
- [3.9] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (GH-139697)
  
  authored and
  icanhasmath
  committed
  cc85809
- [3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144515)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  efa5c0c
- [3.10] gh-146083: Upgrade bundled Expat to 2.7.5 (GH-146085) (#146608)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  33103ef
- [3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) (#149075)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  68fdda1
- [3.10] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#155551)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  5e62684
- [3.10] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#155577)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  112391d
- [3.10] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) (#155618)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  782afe8
- [3.10] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (#156787)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  bad967a
- [3.10] gh-157953: Update bundled Expat to 2.8.5 (GH-157957) (#158327)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  fd6b9d8
- [3.11] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160261)
  
  StanFromIreland
  authored and
  icanhasmath
  committed
  e4a79e3
- bpo-42825: Enable /OPT:REF (GH-24098)
  
  Austin-Lamb
  authored and
  icanhasmath
  committed
  2cd474f
- Add parseaddr Unicode regression test (CVE-2023-27043 follow-up)
  icanhasmath
  committed
  b2ea02b
- Upgrade bundled setuptools to 68.0.0.2 (3.7.17.x)
  
  icanhasmath
  and
  claude
  committed
  71908d7
- Upgrade bundled pip to 24.0.post3 (3.7.17.x)
  
  icanhasmath
  and
  claude
  committed
  927b5ce
- 3.7.17.x: link z.lib from Platform shared/zlib 1.3.2 on Windows
  
  icanhasmath
  and
  claude
  committed
  2639f59
- 3.7.17.x: skip NoneInfoExtractTests where 3.7's Path.glob() fails
  
  icanhasmath
  and
  claude
  committed
  5809b6c
- 3.7.17.x: resolve symbolic links in ntpath.realpath (bpo-9949)
  
  icanhasmath
  and
  claude
  committed
  3c3d071
- Update version to 3.7.17.8 and add release notes
  
  icanhasmath
  and
  claude
  committed
  855e5c8
- Bundle pip 24.0.post4 (3.7.17.x)
  
  icanhasmath
  and
  claude
  committed
  ec96847
- Bundle setuptools 68.0.0.post3 (3.7.17.x)
  
  icanhasmath
  and
  claude
  committed
  e1800cc
- [3.9] gh-137836: Support more RAWTEXT and PLAINTEXT elements in HTMLParser (GH-137837) (GH-140842) (GH-140857)
  
  authored and
  icanhasmath
  committed
  30c75a3
- [3.9] gh-120384: gh-120298: Fix array-out-of-bounds & use after free `list` (GH-121345) (GH-140834)
  
  miss-islington
  authored and
  icanhasmath
  committed
  ebd2dab
- [3.9] gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063) (GH-134481)
  
  miss-islington
  authored and
  icanhasmath
  committed
  4dbfe1e
- 3.7.17.x: bpo-9949 test follow-ups for the resolving ntpath.realpath
  
  icanhasmath
  and
  claude
  committed
  43e3475
- 3.7.17.x: rename the newer Expat API symbols in pyexpatns.h
  
  icanhasmath
  and
  claude
  committed
  69ab1c8
- 3.7.17.x: docs: give backported changes 3.7.17.8 version notes
  
  icanhasmath
  and
  claude
  committed
  aa21066
- 3.7.17.x: release notes for the added fixes; gh-97514 does not apply
  
  icanhasmath
  and
  claude
  committed
  83ed748

Commits

Commits on Oct 29, 2026