SUSE-SU-2025:02074-1

CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the modification of some file metadata. (bsc#1244059)
CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse (bsc#1236705).
CVE-2024-12718: bypass extraction filter to modify file metadata outside extraction directory (bsc#1244056)
CVE-2024-12254: memory exhaustion due to unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290).

Other changes and issues fixed:

Changes from 3.13.5:

Tests
- gh-135120: Add test.support.subTests().
Library
- gh-133967: Do not normalize locale name ‘C.UTF-8’ to ‘en_US.UTF-8’.
- gh-135326: Restore support of integer-like objects with index() in random.getrandbits().
- gh-135321: Raise a correct exception for values greater than 0x7fffffff for the BINSTRING opcode in the C implementation of pickle.
- gh-135276: Backported bugfixes in zipfile.Path from zipp 3.23. Fixed .name, .stem and other basename-based properties on Windows when working with a zipfile on disk.
- gh-134151: email: Fix TypeError in email.utils.decode_params() when sorting RFC 2231 continuations that contain an unnumbered section.
- gh-134152: email: Fix parsing of email message ID with invalid domain.
- gh-127081: Fix libc thread safety issues with os by replacing getlogin with getlogin_r re-entrant version.
- gh-131884: Fix formatting issues in json.dump() when both indent and skipkeys are used.
Core and Builtins
- gh-135171: Roll back changes to generator and list comprehensions that went into 3.13.4 to fix gh-127682, but which involved semantic and bytecode changes not appropriate for a bugfix release.
C API
- gh-134989: Fix PyRETURNNONE, PyRETURNTRUE and PyRETURNFALSE macros in the limited C API 3.11 and older: don’t treat PyNone, PyTrue and Py_False as immortal. Patch by Victor Stinner.
- gh-134989: Implement PyObjectDelAttr() and PyObjectDelAttrString() as macros in the limited C API 3.12 and older. Patch by Victor Stinner.

Changes from 3.13.4:

Security
- gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter='data' and filter='tar') to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032).
- gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273).
- gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
Library
- gh-134718: ast.dump() now only omits None and [] values if they are default values.
- gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
- gh-134696: Built-in HACL* and OpenSSL implementations of hash function constructors now correctly accept the same documented named arguments. For instance, md5() could be previously invoked as md5(data=data) or md5(string=string) depending on the underlying implementation but these calls were not compatible. Patch by Bénédikt Tran.
- gh-134210: curses.window.getch() now correctly handles signals. Patch by Bénédikt Tran.
- gh-80334: multiprocessing.freezesupport() now checks for work on any “spawn” start method platform rather than only on Windows.
- gh-133745: In 3.13.3 we accidentally changed the signature of the asyncio createtask() family of methods and how it calls a custom task factory in a backwards incompatible way. Since some 3rd party libraries have already made changes to work around the issue that might break if we simply reverted the changes, we’re instead changing things to be backwards compatible with 3.13.2 while still supporting those workarounds for 3.13.3. In particular, the special-casing of name and context is back (until 3.14) and consequently eager tasks may still find that their name hasn’t been set before they execute their first yielding await.
- gh-71253: Raise ValueError in open() if opener returns a negative file-descriptor in the Python implementation of io to match the C implementation.
- gh-77057: Fix handling of invalid markup declarations in html.parser.HTMLParser.
- gh-133489: random.getrandbits() can now generate more that 231 bits. random.randbytes() can now generate more that 256 MiB.
- gh-133290: Fix attribute caching issue when setting ctypes.Pointer.type_ in the undocumented and deprecated ctypes.SetPointerType() function and the undocumented settype() method.
- gh-132417: Fix a NULL pointer dereference when a C function called using ctypes with restype pyobject returns NULL.
- gh-132385: Fix instance error suggestions trigger potential exceptions in object.getattr() in traceback.
- gh-132308: A traceback.TracebackException now correctly renders the context and cause attributes from falsey Exception, and the exceptions attribute from falsey ExceptionGroup.
- gh-132250: Fixed the SystemError in cProfile when locating the actual C function of a method raises an exception.
- gh-132063: Prevent exceptions that evaluate as falsey (namely, when their bool method returns False or their len method returns 0) from being ignored by concurrent.futures.ProcessPoolExecutor and concurrent.futures.ThreadPoolExecutor.
- gh-119605: Respect followwrapped for init() and new() methods when getting the class signature for a class with inspect.signature(). Preserve class signature after wrapping with warnings.deprecated(). Patch by Xuehai Pan.
- gh-129719: Fix missing socket.CANRAWERRFILTER constant in the socket module on Linux systems. It was missing since Python 3.11.
- gh-124096: Turn on virtual terminal mode and enable bracketed paste in REPL on Windows console. (If the terminal does not support bracketed paste, enabling it does nothing.)
- gh-122559: Remove reduce() and reduceex() methods that always raise TypeError in the C implementation of io.FileIO, io.BufferedReader, io.BufferedWriter and io.BufferedRandom and replace them with default getstate() methods that raise TypeError. This restores fine details of behavior of Python 3.11 and older versions.
- gh-122179: hashlib.filedigest() now raises BlockingIOError when no data is available during non-blocking I/O. Before, it added spurious null bytes to the digest.
- gh-86155: html.parser.HTMLParser.close() no longer loses data when the <script> tag is not closed. Patch by Waylan Limberg.
- gh-69426: Fix html.parser.HTMLParser to not unescape character entities in attribute values if they are followed by an ASCII alphanumeric or an equals sign.
- bpo-44172: Keep a reference to original curses windows in subwindows so that the original window does not get deleted before subwindows.
Tests
- gh-133744: Fix multiprocessing interrupt test. Add an event to synchronize the parent process with the child process: wait until the child process starts sleeping. Patch by Victor Stinner.
- gh-133639: Fix TestPyReplAutoindent.testautoindentdefault() doesn’t run inputcode.
- gh-133131: The iOS testbed will now select the most recently released “SE-class” device for testing if a device isn’t explicitly specified.
- gh-109981: The test helper that counts the list of open file descriptors now uses the optimised /dev/fd approach on all Apple platforms, not just macOS. This avoids crashes caused by guarded file descriptors.
IDLE
- gh-112936: fix IDLE: no Shell menu item in single-process mode.
Documentation
- gh-107006: Move documentation and example code for threading.local from its docstring to the official docs.
Core and Builtins
- gh-134908: Fix crash when iterating over lines in a text file on the free threaded build.
- gh-127682: No longer call iter twice in list comprehensions. This brings the behavior of list comprehensions in line with other forms of iteration
- gh-134381: Fix RuntimeError when using a not-started threading.Thread after calling os.fork()
- gh-128066: Fixes an edge case where PyREPL improperly threw an error when Python is invoked on a read only filesystem while trying to write history file entries.
- gh-134100: Fix a use-after-free bug that occurs when an imported module isn’t in sys.modules after its initial import. Patch by Nico-Posada.
- gh-133703: Fix hashtable in dict can be bigger than intended in some situations.
- gh-132869: Fix crash in the free threading build when accessing an object attribute that may be concurrently inserted or deleted.
- gh-132762: fromkeys() no longer loops forever when adding a small set of keys to a large base dict. Patch by Angela Liss.
- gh-133543: Fix a possible memory leak that could occur when directly accessing instance dictionaries (dict) that later become part of a reference cycle.
- gh-133516: Raise ValueError when constants True, False or None are used as an identifier after NFKC normalization.
- gh-133441: Fix crash upon setting an attribute with a dict subclass. Patch by Victor Stinner.
- gh-132942: Fix two races in the type lookup cache. This affected the free-threaded build and could cause crashes (apparently quite difficult to trigger).
- gh-132713: Fix repr(list) race condition: hold a strong reference to the item while calling repr(item). Patch by Victor Stinner.
- gh-132747: Fix a crash when calling get() of a method with a None second argument.
- gh-132542: Update Thread.native_id after fork(2) to ensure accuracy. Patch by Noam Cohen.
- gh-124476: Fix decoding from the locale encoding in the C.UTF-8 locale.
- gh-131927: Compiler warnings originating from the same module and line number are now only emitted once, matching the behaviour of warnings emitted from user code. This can also be configured with warnings filters.
- gh-127682: No longer call iter twice when creating and executing a generator expression. Creating a generator expression from a non-interable will raise only when the generator expression is executed. This brings the behavior of generator expressions in line with other generators.
- gh-131878: Handle uncaught exceptions in the main input loop for the new REPL.
- gh-131878: Fix support of unicode characters with two or more codepoints on Windows in the new REPL.
- gh-130804: Fix support of unicode characters on Windows in the new REPL.
- gh-130070: Fixed an assertion error for exec() passed a string source and a non-None closure. Patch by Bartosz Sławecki.
- gh-129958: Fix a bug that was allowing newlines inconsitently in format specifiers for single-quoted f-strings. Patch by Pablo Galindo.
C API
- gh-132909: Fix an overflow when handling the K format in Py_BuildValue(). Patch by Bénédikt Tran.
- Changes from version 3.13.3
Tools/Demos
- gh-131852: msgfmt no longer adds the POT-Creation-Date to generated .mo files for consistency with GNU msgfmt.
- gh-85012: Correctly reset msgctxt when compiling messages in msgfmt.
- gh-130025: The iOS testbed now correctly handles symlinks used as Python framework references.
Tests
- gh-131050: testssl.testdh_params is skipped if the underlying TLS library does not support finite-field ephemeral Diffie-Hellman.
- gh-129200: Multiple iOS testbed runners can now be started at the same time without introducing an ambiguity over simulator ownership.
- gh-130292: The iOS testbed will now run successfully on a machine that has not previously run Xcode tests (such as CI configurations).
- gh-130293: The tests of terminal colorization are no longer sensitive to the value of the TERM variable in the testing environment.
- gh-126332: Add unit tests for pyrepl.
Security
- gh-131809: Update bundled libexpat to 2.7.1
- gh-131261: Upgrade to libexpat 2.7.0
- gh-127371: Avoid unbounded buffering for tempfile.SpooledTemporaryFile.writelines(). Previously, disk spillover was only checked after the lines iterator had been exhausted. This is now done after each line is written.
- gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed.
Library
- gh-132174: Fix function name in error message of interpreters.runstring.
- gh-132171: Fix crash of interpreters.runstring on string subclasses.
- gh-129204: Introduce new PYTHONSUBPROCESSUSEPOSIXSPAWN environment variable knob in subprocess to control the use of os.posixspawn().
- gh-132159: Do not shadow user arguments in generated new() by decorator warnings.deprecated. Patch by Xuehai Pan.
- gh-132075: Fix possible use of socket address structures with uninitialized members. Now all structure members are initialized with zeroes by default.
- gh-132002: Fix crash when deallocating contextvars.ContextVar with weird unahashable string names.
- gh-131668: socket: Fix code parsing AFBLUETOOTH socket addresses.
- gh-129843: Fix incorrect argument passing in warnings.warnexplicit().
- gh-131204: Use monospace font from System Font Stack for cross-platform support in difflib.HtmlDiff.
- gh-130940: The PyConfig.usesystemlogger attribute, introduced in Python 3.13.2, has been removed. The introduction of this attribute inadvertently introduced an ABI breakage on macOS and iOS. The use of the system logger is now enabled by default on iOS, and disabled by default on macOS.
- gh-131045: Fix issue with contains, values, and pseudo-members for enum.Flag.
- gh-130959: Fix pure-Python implementation of datetime.time.fromisoformat() to reject times with spaces in fractional part (for example, 12:34:56.400 +02:00), matching the C implementation. Patch by Michał Gorny.
- gh-130637: Add validation for numeric response data in poplib.POP3.stat() method
- gh-130461: Remove .. index:: directives from the uuid module documentation. These directives previously created entries in the general index for getnode() as well as the uuid1(), uuid3(), uuid4(), and uuid5() constructor functions.
- gh-130379: The zipapp module now calculates the list of files to be added to the archive before creating the archive. This avoids accidentally including the target when it is being created in the source directory.
- gh-130285: Fix corner case for random.sample() allowing the counts parameter to specify an empty population. So now, sample([], 0, counts=[]) and sample('abc', k=0, counts=[0, 0, 0]) both give the same result as sample([], 0).
- gh-130250: Fix regression in traceback.printlast().
- gh-118761: Reverts a change in the previous release attempting to make some stdlib imports used within the subprocess module lazy as this was causing errors during del finalizers calling methods such as terminate, or kill, or sendsignal.
- gh-130164: Fixed failure to raise TypeError in inspect.Signature.bind() for positional-only arguments provided by keyword when a variadic keyword argument (e.g. --kwargs) is present.
- gh-130151: Fix reference leaks in hashlib.hmacnew() and hashlib.hmacdigest(). Patch by Bénédikt Tran.
- gh-130145: Fix asyncio.AbstractEventloop.runforever() when another loop is already running.
- gh-97850: Update the deprecation warning of importlib.abc.Loader.loadmodule().
- gh-129646: Update the locale alias mapping in the locale module to match the latest X Org locale alias mapping and support new locales in Glibc 2.41.
- gh-129603: Fix bugs where sqlite3.Row objects could segfault if their inherited description was set to None. Patch by Erlend Aasland.
- gh-128231: Execution of multiple statements in the new REPL now stops immediately upon the first exception encountered. Patch by Bartosz Sławecki.
- gh-117779: Fix reading duplicated entries in zipfile by name. Reading duplicated entries (except the last one) by ZipInfo now emits a warning instead of raising an exception.
- gh-128772: Fix pydoc for methods with the module attribute equal to None.
- gh-92897: Scheduled the deprecation of the checkhome argument of sysconfig.ispythonbuild() to Python 3.15.
- gh-128703: Fix mimetypes.guesstype() to use default mapping for empty Content-Type in registry.
- gh-128308: Support the name keyword argument for eager tasks in asyncio.loop.createtask(), asyncio.createtask() and asyncio.TaskGroup.createtask(), by passing on all kwargs to the task factory set by asyncio.loop.settask_factory().
- gh-128388: Fix PyREPL on Windows to support more keybindings, like the Control-← and Control-→ word-skipping keybindings and those with meta (i.e. Alt), e.g. Alt-d to kill-word or Alt-Backspace backward-kill-word.
- gh-126037: xml.etree.ElementTree: Fix a crash in Element.find, Element.findtext and Element.findall when the tag to find implements an eq() method mutating the element being queried. Patch by Bénédikt Tran.
- gh-127712: Fix handling of the secure argument of logging.handlers.SMTPHandler.
- gh-126033: xml.etree.ElementTree: Fix a crash in Element.remove when the element is concurrently mutated. Patch by Bénédikt Tran.
- gh-118201: Fixed intermittent failures of os.confstr, os.pathconf and os.sysconf on iOS and Android.
- gh-124927: Non-printing characters are now properly handled in the new REPL.
IDLE
- gh-129873: Simplify displaying the IDLE doc by only copying the text section of idle.html to idlelib/help.html. Patch by Stan Ulbrych.
Documentation
- gh-131417: Mention asyncio.Future and asyncio.Task in generic classes list.
- gh-125722: Require Sphinx 8.2.0 or later to build the Python documentation. Patch by Adam Turner.
- gh-129712: The wheel tags supported by each macOS universal SDK option are now documented.
- gh-46236: C API: Document PyUnicodeRSplit(), PyUnicodePartition() and PyUnicode_RPartition().
Core and Builtins
- gh-132011: Fix crash when calling list.append() as an unbound method.
- gh-131998: Fix a crash when using an unbound method descriptor object in a function where a bound method descriptor was used.
- gh-131988: Fix a performance regression that caused scaling bottlenecks in the free threaded build in 3.13.1 and 3.13.2.
- gh-131719: Fix missing NULL check in PyMemFreeDelayed in free-threaded build.
- gh-131670: Fix anext() failing on sync anext() raising an exception.
- gh-131141: Fix data race in sys.monitoring instrumentation while registering callback.
- gh-130932: Fix incorrect exception handling in PyModuleIsPossiblyShadowing
- gh-130851: Fix a crash in the free threading build when constructing a code object with coconsts that contains instances of types that are not otherwise generated by the bytecode compiler.
- gh-130775: Do not crash on negative column and endcolumn in ast locations.
- gh-130382: Fix PyRefTracerDESTROY not being sent from Python/ceval.c PyDECREF().
- gh-130618: Fix a bug that was causing UnicodeDecodeError or SystemError to be raised when using f-strings with lambda expressions with non-ASCII characters. Patch by Pablo Galindo
- gh-130163: Fix possible crashes related to concurrent change and use of the sys module attributes.
- gh-88887: Fixing multiprocessing Resource Tracker process leaking, usually observed when running Python as PID 1.
- gh-130115: Fix an issue with thread identifiers being sign-extended on some platforms.
- gh-128396: Fix a crash that occurs when calling locals() inside an inline comprehension that uses the same local variable as the outer frame scope where the variable is a free or cell var.
- gh-116042: Fix location for SyntaxErrors of invalid escapes in the tokenizer. Patch by Pablo Galindo
- gh-129983: Fix data race in compiletemplate in sre.c.
- gh-129732: Fixed a race in Pyqsbrreserve in the free threading build.
- gh-129643: Fix thread safety of PyListInsert() in free-threading builds.
- gh-129643: Fix thread safety of PyListSetItem() in free-threading builds. Patch by Kumar Aditya.
- gh-128714: Fix the potential races in get/set dunder methods annotations, annotate and type_params for function object, and add related tests.
- gh-128632: Disallow classdict as the name of a type parameter. Using this name would previously crash the interpreter in some circumstances.
- gh-127953: The time to handle a LINE event in sys.monitoring (and sys.settrace) is now independent of the number of lines in the code object.
- gh-125331: from future import barryasFLUFL now works in more contexts, including when it is used in files, with the -c flag, and in the REPL when there are multiple statements on the same line. Previously, it worked only on subsequent lines in the REPL, and when the appropriate flags were passed directly to compile(). Patch by Pablo Galindo.
C API
- gh-131740: Update PyUnstableGCVisitObjects to traverse perm gen.
- gh-129533: Update PyGCEnable(), PyGCDisable(), PyGC_IsEnabled() to use atomic operation for thread-safety at free-threading build. Patch by Donghee Na.
Build
- gh-131865: The DTrace build now properly passes the CC and CFLAGS variables to the dtrace command when utilizing SystemTap on Linux.
- gh-131675: Fix mimalloc library builds for 32-bit ARM targets.
- gh-130673: Fix potential KeyError when handling object sections during JIT building process.
- gh-130740: Ensure that Python.h is included before stdbool.h unless pyconfig.h is included before or in some platform-specific contexts.
- gh-129838: Don’t redefine PyNOSANITIZEUNDEFINED when compiling with a recent GCC version and undefined sanitizer enabled.
- gh-129660: Drop test_embed from PGO training, whose contribution in recent versions is considered to be ignorable.
- Changes from version 3.13.2:
Tools/Demos
- gh-128152: Fix a bug where Argument Clinic’s C pre-processor parser tried to parse pre-processor directives inside C comments. Patch by Erlend Aasland.
Tests
- gh-127906: Test the limited C API in test_cppext. Patch by Victor Stinner.
- gh-127637: Add tests for the dis command-line interface. Patch by Bénédikt Tran.
- gh-126925: iOS test results are now streamed during test execution, and the deprecated xcresulttool is no longer used.
Security
- gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2. (CVE-2025-0938, bsc#1236705)
- gh-127655: Fixed the asyncio.selectorevents.SelectorSocketTransport transport not pausing writes for the protocol when the buffer reaches the high water mark when using asyncio.WriteTransport.writelines() (CVE-2024-12254, bsc#1234290).
- gh-126108: Fix a possible NULL pointer dereference in PySys_AddWarnOptionUnicode().
- gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed.
- gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is only a mapping, but if this hit a virtual address size limit it could lead to a MemoryError or other process crash. On unusual systems or builds where all allocated memory is touched and backed by actual ram or storage it could’ve consumed resources doing so until similarly crashing.
Library
- gh-129502: Unlikely errors in preparing arguments for ctypes callback are now handled in the same way as errors raised in the callback of in converting the result of the callback – using sys.unraisablehook() instead of sys.excepthook() and not setting sys.lastexc and other variables.
- gh-128894: Fix traceback.TracebackException.formatsyntaxerror not to fail on exceptions with custom metadata.
- gh-128916: Do not attempt to set SOREUSEPORT on sockets of address families other than AFINET and AFINET6, as it is meaningless with these address families, and the call with fail with Linux kernel 6.12.9 and newer.
- gh-128479: Fix asyncio.staggered.staggeredrace() leaking tasks and issuing an unhandled exception.
- gh-128400: Fix crash when using faulthandler.dumptraceback() while other threads are active on the free threaded build.
- gh-128014: Fix resetting the default window icon by passing default='' to the tkinter method wmiconbitmap().
- gh-115514: Fix exceptions and incomplete writes after asyncio.SelectorTransport is closed before writes are completed.
- gh-126742: Fix support of localized error messages reported by dlerror(3) and gdbmstrerror in ctypes and dbm.gnu functions respectively. Patch by Bénédikt Tran.
- gh-127873: When -E is set, only ignore PYTHONCOLORS and not FORCECOLOR/NOCOLOR/TERM when colourising output. Patch by Hugo van Kemenade.
- gh-127870: Detect recursive calls in ctypes asparameter handling. Patch by Victor Stinner.
- gh-127847: Fix the position when doing interleaved seeks and reads in uncompressed, unencrypted zip files returned by zipfile.ZipFile.open().
- gh-127732: The platform module now correctly detects Windows Server 2025.
- gh-126821: macOS and iOS apps can now choose to redirect stdout and stderr to the system log during interpreter configuration.
- gh-93312: Include <sys/pidfd.h> to get os.PIDFDNONBLOCK constant. Patch by Victor Stinner.
- gh-83662: Add missing classgetitem method to the Python implementation of functools.partial(), to make it compatible with the C version. This is mainly relevant for alternative Python implementations like PyPy and GraalPy, because CPython will usually use the C-implementation of that function.
- gh-127586: multiprocessing.pool.Pool now properly restores blocked signal handlers of the parent thread when creating processes via either spawn or forkserver.
- gh-98188: Fix an issue in email.message.Message.get_payload() where data cannot be decoded if the Content Transfer Encoding mechanism contains trailing whitespaces or additional junk text. Patch by Hui Liu.
- gh-127257: In ssl, system call failures that OpenSSL reports using ERRLIBSYS are now raised as OSError.
- gh-127096: Do not recreate unnamed section on every read in configparser.ConfigParser. Patch by Andrey Efremov.
- gh-127196: Fix crash when dict with keys in invalid encoding were passed to several functions in _interpreters module.
- gh-126775: Make linecache.checkcache() thread safe and GC re-entrancy safe.
- gh-126332: Fix _pyrepl crash when entering a double CTRL-Z on an overflowing line.
- gh-126225: getopt and optparse are no longer marked as deprecated. There are legitimate reasons to use one of these modules in preference to argparse, and none of these modules are at risk of being removed from the standard library. Of the three, argparse remains the recommended default choice, unless one of the concerns noted at the top of the optparse module documentation applies.
- gh-125553: Fix round-trip invariance for backslash continuations in tokenize.untokenize().
- gh-123987: Fixed issue in NamespaceReader where a non-path item in a namespace path, such as a sentinel added by an editable installer, would break resource loading.
- gh-123401: The http.cookies module now supports parsing obsolete RFC 850 date formats, in accordance with RFC 9110 requirements. Patch by Nano Zheng.
- gh-122431: readline.appendhistoryfile() now raises a ValueError when given a negative value.
- gh-119257: Show tab completions menu below the current line, which results in less janky behaviour, and fixes a cursor movement bug. Patch by Daniel Hollas
Documentation
- gh-125722: Require Sphinx 8.1.3 or later to build the Python documentation. Patch by Adam Turner.
- gh-67206: Document that string.printable is not printable in the POSIX sense. In particular, string.printable.isprintable() returns False. Patch by Bénédikt Tran.
Core and Builtins
- gh-129345: Fix null pointer dereference in syslog.openlog() when an audit hook raises an exception.
- gh-129093: Fix f-strings such as f'{expr=}' sometimes not displaying the full expression when the expression contains !=.
- gh-124363: Treat debug expressions in f-string as raw strings. Patch by Pablo Galindo
- gh-128799: Add frame of except* to traceback when it wraps a naked exception.
- gh-128078: Fix a SystemError when using anext() with a default tuple value. Patch by Bénédikt Tran.
- gh-128717: Fix a crash when setting the recursion limit while other threads are active on the free threaded build.
- gh-128330: Restore terminal control characters on REPL exit.
- gh-128079: Fix a bug where except* does not properly check the return value of an ExceptionGroup’s split() function, leading to a crash in some cases. Now when split() returns an invalid object, except* raises a TypeError with the original raised ExceptionGroup object chained to it.
- gh-128030: Avoid error from calling PyModule_GetFilenameObject on a non-module object when importing a non-existent symbol from a non-module object.
- gh-127903: Objects/unicodeobject.c: fix a crash on DEBUG builds in copycharacters when there is nothing to copy.
- gh-127599: Fix statistics for increments of object reference counts (in particular, when a reference count was increased by more than 1 in a single operation).
- gh-127651: When raising ImportError for missing symbols in from imports, use file in the error message if spec.origin is not a location
- gh-127582: Fix non-thread-safe object resurrection when calling finalizers and watcher callbacks in the free threading build.
- gh-127434: The iOS compiler shims can now accept arguments with spaces.
- gh-127536: Add missing locks around some list assignment operations in the free threading build.
- gh-126862: Fix a possible overflow when a class inherits from an absurd number of super-classes. Reported by Valery Fedorenko. Patch by Bénédikt Tran.
- gh-127349: Fixed the error when resizing terminal in Python REPL. Patch by Semyon Moroz.
- gh-126076: Relocated objects such as tuple, bytes and str objects are properly tracked by tracemalloc and its associated hooks. Patch by Pablo Galindo.
C API
- gh-127791: Fix loss of callbacks after more than one call to PyUnstable_AtExit().
Build
- gh-129539: Don’t redefine EX_OK when the system has the sysexits.h header.
- gh-128472: Skip BOLT optimization of functions using computed gotos, fixing errors on build with LLVM 19.
- gh-123925: Fix building the curses module on platforms with libncurses but without libncursesw.
- gh-128321: Set LIBS instead of LDFLAGS when checking if sqlite3 library functions are available. This fixes the ordering of linked libraries during checks, which was incorrect when using a statically linked libsqlite3.
- gh-127865: Fix build failure on systems without thread-locals support.
- Changes from version 3.13.1:
Tools/Demos
- gh-126807: Fix extraction warnings in pygettext.py caused by mistaking function definitions for function calls.
- gh-126167: The iOS testbed was modified so that it can be used by third-party projects for testing purposes.
Tests
- gh-126909: Fix test_os extended attribute tests to work on filesystems with 1 KiB xattr size limit.
- gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation.
- gh-124295: Add translation tests to the argparse module.
Security
- gh-126623: Upgrade libexpat to 2.6.4
- gh-125140: Remove the current directory from sys.path when using PyREPL.
- gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are ismulticast, isreserved, islinklocal, isglobal, and isunspecified.
Library
- gh-127321: pdb.settrace() will not stop at an opcode that does not have an associated line number anymore.
- gh-127035: Fix shutil.which on Windows. Now it looks at direct match if and only if the command ends with a PATHEXT extension or XOK is not in mode. Support extensionless files if “.” is in PATHEXT. Support PATHEXT extensions that end with a dot.
- gh-122273: Support PyREPL history on Windows. Patch by devdanzin and Victor Stinner.
- gh-127078: Fix issue where urllib.request.url2pathname() failed to discard an extra slash before a UNC drive in the URL path on Windows.
- gh-126766: Fix issue where urllib.request.url2pathname() failed to discard any ‘localhost’ authority present in the URL.
- gh-127065: Fix crash when calling a operator.methodcaller() instance from multiple threads in the free threading build.
- gh-126997: Fix support of STRING and GLOBAL opcodes with non-ASCII arguments in pickletools. pickletools.dis() now outputs non-ASCII bytes in STRING, BINSTRING and SHORTBINSTRING arguments as escaped (\xXX).
- gh-126789: Fixed the values of sysconfig.getconfigvars(), sysconfig.getpaths(), and their siblings when the site initialization happens after sysconfig has built a cache for sysconfig.getconfigvars().
- gh-126188: Update bundled pip to 24.3.1
- gh-126780: Fix os.path.normpath() for drive-relative paths on Windows.
- gh-126766: Fix issue where urllib.request.url2pathname() failed to discard two leading slashes introducing an empty authority section.
- gh-126727: locale.nllanginfo(locale.ERA) now returns multiple era description segments separated by semicolons. Previously it only returned the first segment on platforms with Glibc.
- gh-126303: Fix pickling and copying of os.schedparam objects.
- gh-126138: Fix a use-after-free crash on asyncio.Task objects whose underlying coroutine yields an object that implements an evil getattribute(). Patch by Nico Posada.
- gh-126220: Fix crash in cProfile.Profile and lsprof.Profiler when their callbacks were directly called with 0 arguments.
- gh-126105: Fix a crash in ast when the ast.AST.fields attribute is deleted.
- gh-126106: Fixes a possible NULL pointer dereference in ssl.
- gh-126080: Fix a use-after-free crash on asyncio.Task objects for which the underlying event loop implements an evil getattribute(). Reported by Nico-Posada. Patch by Bénédikt Tran.
- gh-126083: Fixed a reference leak in asyncio.Task objects when reinitializing the same object with a non-None context. Patch by Nico Posada.
- gh-125984: Fix use-after-free crashes on asyncio.Future objects for which the underlying event loop implements an evil getattribute(). Reported by Nico-Posada. Patch by Bénédikt Tran.
- gh-125969: Fix an out-of-bounds crash when an evil asyncio.loop.callsoon() mutates the length of the internal callbacks list. Patch by Bénédikt Tran.
- gh-125789: Fix possible crash when mutating list of callbacks returned by asyncio.Future.callbacks. It now always returns a new copy in C implementation asyncio. Patch by Kumar Aditya.
- gh-125355: Fix several bugs in argparse.ArgumentParser.parseintermixedargs().
  
  The parser no longer changes temporarily during parsing.
  
  Default values are not processed twice.
  
  Required mutually exclusive groups containing positional arguments are now supported.
  
  The missing arguments report now includes the names of all required optional and positional arguments.
  
  Unknown options can be intermixed with positional arguments in parseknownintermixedargs().
- gh-125666: Avoid the exiting the interpreter if a null byte is given as input in the new REPL.
- gh-125710: [Enum] fix hashable<->nonhashable comparisons for member values
- gh-125631: Restore ability to set persistentid and persistentload attributes of instances of the Pickler and Unpickler classes in the pickle module.
- gh-125378: Fixed the bug in pdb where after a multi-line command, an empty line repeats the first line of the multi-line command, instead of the full command.
- gh-125682: Reject non-ASCII digits in the Python implementation of json.loads() conforming to the JSON specification.
- gh-125660: Reject invalid unicode escapes for Python implementation of json.loads().
- gh-125259: Fix the notes removal logic for errors thrown in enum initialization.
- gh-125590: Allow FrameLocalsProxy to delete and pop if the key is not a fast variable.
- gh-125519: Improve traceback if importlib.reload() is called with an object that is not a module. Patch by Alex Waygood.
- gh-125451: Fix deadlock when concurrent.futures.ProcessPoolExecutor shuts down concurrently with an error when feeding a job to a worker process.
- gh-125422: Fixed the bug where pdb and bdb can step into the bottom caller frame.
- gh-100141: Fixed the bug where pdb will be stuck in an infinite loop when debugging an empty file.
- gh-125115: Fixed a bug in pdb where arguments starting with
  - can’t be passed to the debugged script.
- gh-53203: Fix time.strptime() for %c, %x and %X formats in many locales that use non-ASCII digits, like Persian, Burmese, Odia and Shan.
- gh-125398: Fix the conversion of the VIRTUALENV path in the activate script in venv when running in Git Bash for Windows.
- gh-125096: If the PYTHONBASICREPL environment variable is set, the site module no longer imports the pyrepl module. Moreover, the site module now respects -E and -I command line options: ignore PYTHONBASICREPL in this case. Patch by Victor Stinner.
- gh-124969: Fix locale.nllanginfo(locale.ALTDIGITS) on platforms with glibc. Now it returns a string consisting of up to 100 semicolon-separated symbols (an empty string in most locales) on all Posix platforms. Previously it only returned the first symbol or an empty string.
- gh-124960: Fix support for the barryasFLUFL future flag in the new REPL.
- gh-124984: Fixed thread safety in ssl in the free-threaded build. OpenSSL operations are now protected by a per-object lock.
- gh-124958: Fix refcycles in exceptions raised from asyncio.TaskGroup and the python implementation of asyncio.Future
- gh-53203: Fix time.strptime() for %c and %x formats in many locales: Arabic, Bislama, Breton, Bodo, Kashubian, Chuvash, Estonian, French, Irish, Ge’ez, Gurajati, Manx Gaelic, Hebrew, Hindi, Chhattisgarhi, Haitian Kreyol, Japanese, Kannada, Korean, Marathi, Malay, Norwegian, Nynorsk, Punjabi, Rajasthani, Tok Pisin, Yoruba, Yue Chinese, Yau/Nungon and Chinese.
- gh-124917: Allow calling os.path.exists() and os.path.lexists() with keyword arguments on Windows. Fixes a regression in 3.13.0.
- gh-124653: Fix detection of the minimal Queue API needed by the logging module. Patch by Bénédikt Tran.
- gh-124858: Fix reference cycles left in tracebacks in asyncio.openconnection() when used with happyeyeballsdelay
- gh-124390: Fixed AssertionError when using asyncio.staggered.staggeredrace() with asyncio.eagertaskfactory.
- gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).
- gh-116850: Fix argparse for namespaces with not directly writable dict (e.g. classes).
- gh-58573: Fix conflicts between abbreviated long options in the parent parser and subparsers in argparse.
- gh-124594: All asyncio REPL prompts run in the same context. Contributed by Bartosz Sławecki.
- gh-61181: Fix support of choices with string value in argparse. Substrings of the specified string no longer considered valid values.
- gh-80259: Fix argparse support of positional arguments with nargs='?', default=argparse.SUPPRESS and specified type.
- gh-120378: Fix a crash related to an integer overflow in curses.resizeterm() and curses.resizeterm().
- gh-104860: Fix disallowing abbreviation of single-dash long options in argparse with allowabbrev=False.
- gh-63143: Fix parsing mutually exclusive arguments in argparse. Arguments with the value identical to the default value (e.g. booleans, small integers, empty or 1-character strings) are no longer considered “not present”.
- gh-72795: Positional arguments with nargs equal to '' or argparse.REMAINDER are no longer required. This allows to use positional argument with nargs='' and without default in mutually exclusive group and improves error message about required arguments.
- gh-59317: Fix parsing positional argument with nargs equal to '?' or '*' if it is preceded by an option and another positional argument.
- gh-53780: argparse now ignores the first '--' (double dash) between an option and command.
- gh-124217: Add RFC 9637 reserved IPv6 block 3fff::/20 in ipaddress module.
- gh-81691: Fix handling of multiple '--' (double dashes) in argparse. Only the first one has now been removed, all subsequent ones are now taken literally.
- gh-123978: Remove broken time.threadtime() and time.threadtime_ns() on NetBSD.
- gh-124008: Fix possible crash (in debug build), incorrect output or returning incorrect value from raw binary write() when writing to console on Windows.
- gh-123935: Fix parent slots detection for dataclasses that inherit from classes with dictoffset.
- gh-122765: Fix unbalanced quote errors occurring when activate.csh in venv was sourced with a custom prompt containing unpaired quotes or newlines.
- gh-123370: Fix the canvas not clearing after running turtledemo clock.
- gh-116810: Resolve a memory leak introduced in CPython 3.10’s ssl when the ssl.SSLSocket.session property was accessed. Speeds up read and write access to said property by no longer unnecessarily cloning session objects via serialization.
- gh-120754: Update unbounded read calls in zipfile to specify an explicit size putting a limit on how much data they may read. This also updates handling around ZIP max comment size to match the standard instead of reading comments that are one byte too long.
- gh-70764: Fixed an issue where inspect.getclosurevars() would incorrectly classify an attribute name as a global variable when the name exists both as an attribute name and a global variable.
- gh-118289: posixpath.realpath() now raises NotADirectoryError when strict mode is enabled and a non-directory path with a trailing slash is supplied.
- gh-119826: Always return an absolute path for os.path.abspath() on Windows.
- gh-117766: Always use str() to print choices in argparse.
- gh-101955: Fix SystemError when match regular expression pattern containing some combination of possessive quantifier, alternative and capture group.
- gh-88110: Fixed multiprocessing.Process reporting a .exitcode of 1 even on success when using the 'fork' start method while using a concurrent.futures.ThreadPoolExecutor.
- gh-71936: Fix a race condition in multiprocessing.pool.Pool.
- bpo-46128: Strip unittest.IsolatedAsyncioTestCase stack frames from reported stacktraces.
- bpo-14074: Fix argparse metavar processing to allow positional arguments to have a tuple metavar.
IDLE
- gh-122392: Increase currently inadequate vertical spacing for the IDLE browsers (path, module, and stack) on high-resolution monitors.
Documentation
- gh-126622: Added stub pages for removed modules explaining their removal, where to find replacements, and linking to the last Python version that supported them. Contributed by Ned Batchelder.
- gh-125277: Require Sphinx 7.2.6 or later to build the Python documentation. Patch by Adam Turner.
- gh-124872: Added definitions for context, current context, and context management protocol, updated related definitions to be consistent, and expanded the documentation for contextvars.Context.
- gh-125018: The importlib.metadata documentation now includes semantic cross-reference targets for the significant documented APIs. This means intersphinx references like importlib.metadata.version() will now work as expected.
- gh-70870: Clarified the dual usage of the term “free variable” (both the formal meaning of any reference to names defined outside the local scope, and the narrower pragmatic meaning of nonlocal variables named in cofreevars).
- bpo-34008: The PyMain() documentation moved from the “Very High Level API” section to the “Initialization and Finalization” section.
- Also make it explicit that we expect PyMain to typically be called instead of PyInitialize rather than after it (since PyMain makes its own call to PyInitialize). Document that calling both is supported but is version dependent on which settings will be applied correctly.
Core and Builtins
- gh-113841: Fix possible undefined behavior division by zero in complex’s Pycpow().
- gh-125703: Correctly honour tracemalloc hooks in specialized PyDECREF paths. Patch by Pablo Galindo
- gh-125593: Use color to highlight error locations in traceback from exception group
- gh-125444: Fix illegal instruction for older Arm architectures. Patch by Diego Russo, testing by Ross Burton.
- gh-124375: Fix a crash in the free threading build when the GC runs concurrently with a new thread starting.
- gh-125221: Fix possible race condition when calling reduceex() for the first time in the free threading build.
- gh-118950: Fix bug where SSLProtocol.connectionlost wasn’t getting called when OSError was thrown on writing to socket.
- gh-113570: Fixed a bug in reprlib.repr where it incorrectly called the repr method on shadowed Python built-in types.
- gh-109746: If thread.startnew_thread() fails to start a new thread, it deletes its state from interpreter and thus avoids its repeated cleanup on finalization.
C API
- gh-126554: Fix error handling in ctypes.CDLL objects which could result in a crash in rare situations.
- gh-125608: Fix a bug where dictionary watchers (e.g., PyDictWatch()) on an object’s attribute dictionary (dict) were not triggered when the object’s attributes were modified.
- bpo-34008: Added PyIsInitialized to the list of APIs that are safe to call before the interpreter is initialized, and updated the embedding tests to cover it.
Build
- gh-123877: Set wasm32-wasip1 as the WASI target. The old wasm32-wasi target is deprecated so it can be used for an eventual WASI 1.0.
- gh-89640: Hard-code float word ordering as little endian on WASM.
- gh-125940: The Android build now supports 16 KB page sizes.
- gh-89640: Improve detection of float word ordering on Linux when link-time optimizations are enabled.
- gh-125269: Fix detection of whether -latomic is needed when cross-compiling CPython using the configure script.
- gh-121634: Allow for specifying the target compile triple for WASI.
- gh-122578: Use WASI SDK 24 for testing.
- gh-115382: Fix cross compile failures when the host and target SOABIs match.
- Skip PGO with %wantreproduciblebuilds (bsc#1239210).
- Configure externallymanaged with a bcond https://en.opensuse.org/openSUSE:Python:Externallymanaged (bsc#1228165).

References

Affected packages

SUSE:Linux Enterprise Module for Python 3 15 SP7 / python313

Package

Name: python313
Purl: pkg:rpm/suse/python313&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.13.5-150700.4.11.1

Ecosystem specific

{
    "binaries": [
        {
            "python313-devel": "3.13.5-150700.4.11.1",
            "python313-idle": "3.13.5-150700.4.11.1",
            "python313-tk": "3.13.5-150700.4.11.1",
            "python313": "3.13.5-150700.4.11.1",
            "libpython3_13-1_0": "3.13.5-150700.4.11.1",
            "python313-base": "3.13.5-150700.4.11.1",
            "python313-tools": "3.13.5-150700.4.11.1",
            "python313-dbm": "3.13.5-150700.4.11.1",
            "python313-curses": "3.13.5-150700.4.11.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Python 3 15 SP7 / python313-core

Package

Name: python313-core
Purl: pkg:rpm/suse/python313-core&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.13.5-150700.4.11.1

Ecosystem specific

{
    "binaries": [
        {
            "python313-devel": "3.13.5-150700.4.11.1",
            "python313-idle": "3.13.5-150700.4.11.1",
            "python313-tk": "3.13.5-150700.4.11.1",
            "python313": "3.13.5-150700.4.11.1",
            "libpython3_13-1_0": "3.13.5-150700.4.11.1",
            "python313-base": "3.13.5-150700.4.11.1",
            "python313-tools": "3.13.5-150700.4.11.1",
            "python313-dbm": "3.13.5-150700.4.11.1",
            "python313-curses": "3.13.5-150700.4.11.1"
        }
    ]
}