Name: python39-tk	Distribution: openSUSE:Factory:zSystems
Version: 3.9.20	Vendor: openSUSE
Release: 5.1	Build date: Fri Nov 1 22:16:32 2024
Group: Unspecified	Build host: reproducible
Size: 1195971	Source RPM: python39-3.9.20-5.1.src.rpm
Packager: https://bugs.opensuse.org
Url: https://www.python.org/
Summary: TkInter, a Python Tk Interface

Python interface to Tk. Tk is the GUI toolkit that comes with Tcl.

Provides

Requires

License

Python-2.0

Changelog

* Fri Nov 01 2024 Matej Cepl <mcepl@cepl.eu>
- Update CVE-2024-9287-venv_path_unquoted.patch according to the
upstream PR gh#python/cpython!126301.
* Thu Oct 24 2024 Matej Cepl <mcepl@cepl.eu>
- Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
path names provided when creating a virtual environment
(bsc#1232241, CVE-2024-9287)
* Wed Oct 02 2024 Matej Cepl <mcepl@cepl.eu>
- Drop .pyc files from docdir for reproducible builds
(bsc#1230906).
* Fri Sep 20 2024 Matej Cepl <mcepl@cepl.eu>
- Add sphinx-802.patch to overcome working both with the most
recent and older Sphinx versions.
* Mon Sep 09 2024 Matej Cepl <mcepl@cepl.eu>
- Update to 3.9.20:
- Tests
- gh-112769: The tests now correctly compare zlib version when
:const:`zlib.ZLIB_RUNTIME_VERSION` contains non-integer suffixes. For
example zlib-ng defines the version as ``1.3.0.zlib-ng``.
- gh-117187: Fix XML tests for vanilla Expat <2.6.0.
- Security
- gh-123678: Upgrade libexpat to 2.6.3
- gh-121957: Fixed missing audit events around interactive use of Python,
now also properly firing for ``python -i``, as well as for ``python -m
asyncio``. The event in question is ``cpython.run_stdin``.
- gh-122133: Authenticate the socket connection for the
``socket.socketpair()`` fallback on platforms where ``AF_UNIX`` is not
available like Windows.
Patch by Gregory P. Smith <greg@krypto.org> and Seth Larson
<seth@python.org>. Reported by Ellie <el@horse64.org>
- gh-121285: Remove backtracking from tarfile header parsing for
``hdrcharset``, PAX, and GNU sparse headers
(bsc#1230227, CVE-2024-6232).
- gh-118486: :func:`os.mkdir` on Windows now accepts *mode* of ``0o700`` to
restrict the new directory to the current user. This fixes CVE-2024-4030
affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary
directory is more permissive than the default.
- gh-114572: :meth:`ssl.SSLContext.cert_store_stats` and
:meth:`ssl.SSLContext.get_ca_certs` now correctly lock access to the
certificate store, when the :class:`ssl.SSLContext` is shared across
multiple threads (bsc#1226447, CVE-2024-0397).
- gh-116741: Update bundled libexpat to 2.6.2
- Library
- gh-123270: Applied a more surgical fix for malformed payloads in
:class:`zipfile.Path` causing infinite loops (gh-122905) without breaking
contents using legitimate characters (bsc#1229704, CVE-2024-8088).
- gh-123067: Fix quadratic complexity in parsing ``"``-quoted cookie values
with backslashes by :mod:`http.cookies` (bsc#1229596, CVE-2024-7592).
- gh-121650: :mod:`email` headers with embedded newlines are now quoted on
output. The :mod:`~email.generator` will now refuse to serialize (write)
headers that are unsafely folded or delimited; see
:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas
Bloemsaat and Petr Viktorin in :gh:`121650`; CVE-2024-6923, bsc#1228780).
- gh-113171: Fixed various false positives and false negatives in
* :attr:`ipaddress.IPv4Address.is_private` (see these docs for details)
* :attr:`ipaddress.IPv4Address.is_global`
* :attr:`ipaddress.IPv6Address.is_private`
* :attr:`ipaddress.IPv6Address.is_global`
Also in the corresponding :class:`ipaddress.IPv4Network` and
:class:`ipaddress.IPv6Network` attributes
Fixes bsc#1226448 (CVE-2024-4032).
- gh-102988: :func:`email.utils.getaddresses` and
:func:`email.utils.parseaddr` now return ``('', '')`` 2-tuples in more
situations where invalid email addresses are encountered instead of
potentially inaccurate values. Add optional *strict* parameter to these
two functions: use ``strict=False`` to get the old behavior, accept
malformed inputs. ``getattr(email.utils, 'supports_strict_parsing',
False)`` can be use to check if the *strict* paramater is available. Patch
by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix
(bsc#1210638).
- gh-67693: Fix :func:`urllib.parse.urlunparse` and
:func:`urllib.parse.urlunsplit` for URIs with path starting with multiple
slashes and no authority. Based on patch by Ashwin Ramaswami.
- Core and Builtins
- gh-112275: A deadlock involving ``pystate.c``'s ``HEAD_LOCK`` in
``posixmodule.c`` at fork is now fixed. Patch by ChuBoning based on
previous Python 3.12 fix by Victor Stinner.
- Remove upstreamed patches:
- CVE-2023-27043-email-parsing-errors.patch
- CVE-2024-6232-cookies-quad-complex.patch
- CVE-2024-4032-private-IP-addrs.patch
- CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch
- CVE-2024-8088-inf-loop-zipfile_Path.patch
- CVE-2024-6923-email-hdr-inject.patch
* Thu Sep 05 2024 Matej Cepl <mcepl@cepl.eu>
- Add CVE-2024-6232-cookies-quad-complex.patch to avoid quadratic
complexity in parsing tarfile headers (bsc#1230227, CVE-2024-6232).
* Thu Sep 05 2024 Matej Cepl <mcepl@cepl.eu>
- Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with
patched libexpat below 2.6.0 that doesn't update the version number,
just in SLE.
- Remove old-libexpat.patch, of course.
* Mon Sep 02 2024 Matej Cepl <mcepl@cepl.eu>
- Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
failing test_sendfile_close_peer_in_the_middle_of_receiving
tests on Linux >= 6.10 (GH-120227).
* Wed Aug 28 2024 Matej Cepl <mcepl@cepl.eu>
- Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
malformed payload to cause infinite loops in zipfile.Path
(bsc#1229704, CVE-2024-8088).
* Wed Aug 07 2024 Matej Cepl <mcepl@suse.com>
- Add CVE-2024-6923-email-hdr-inject.patch to prevent email
header injection due to unquoted newlines (bsc#1228780,
CVE-2024-6923).
- Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
adding reproducibility patches from gh#python/cpython!121872
and gh#python/cpython!121883.
- Add CVE-2024-5642-OpenSSL-API-buf-overread-NPN.patch removing
support for anything but OpenSSL 1.1.1 or newer (bsc#1227233,
CVE-2024-5642).
- %{profileopt} variable is set according to the variable
%{do_profiling} (bsc#1227999)
* Mon Jul 22 2024 Matej Cepl <mcepl@cepl.eu>
- Remove %suse_update_desktop_file macro as it is not useful any
more.
* Mon Jul 15 2024 Matej Cepl <mcepl@cepl.eu>
- Stop using %%defattr, it seems to be breaking proper executable
attributes on /usr/bin/ scripts (bsc#1227378).
* Wed Jun 26 2024 Matej Cepl <mcepl@cepl.eu>
- Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
(CVE-2024-4032) rearranging definition of private v global IP
addresses.
* Fri Jun 21 2024 Matej Cepl <mcepl@cepl.eu>
- Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch
fixing bsc#1226447 (CVE-2024-0397) by removing memory race
condition in ssl.SSLContext certificate store methods.
* Sun Mar 24 2024 Matej Cepl <mcepl@cepl.eu>
- Add old-libexpat.patch making the test suite work with
libexpat < 2.6.0 (gh#python/cpython#117187).
* Thu Mar 21 2024 Matej Cepl <mcepl@cepl.eu>
- Update to 3.9.19:
- Security
- gh-115398: Allow controlling Expat >=2.6.0 reparse deferral
(CVE-2023-52425, bsc#1219559) by adding five new methods:
xml.etree.ElementTree.XMLParser.flush()
xml.etree.ElementTree.XMLPullParser.flush()
xml.parsers.expat.xmlparser.GetReparseDeferralEnabled()
xml.parsers.expat.xmlparser.SetReparseDeferralEnabled()
xml.sax.expatreader.ExpatParser.flush()
- gh-115399: Update bundled libexpat to 2.6.0
- gh-113659: Skip .pth files with names starting with a dot
or hidden file attribute.
- Core and Builtins
- gh-102388: Fix a bug where iso2022_jp_3 and iso2022_jp_2004
codecs read out of bounds
- Library
- gh-115197: urllib.request no longer resolves the hostname
before checking it against the system’s proxy bypass list
on macOS and Windows.
- gh-115133: Fix tests for XMLPullParser with Expat 2.6.0.
- gh-81194: Fix a crash in socket.if_indextoname() with
specific value (UINT_MAX). Fix an integer overflow in
socket.if_indextoname() on 64-bit non-Windows platforms.
- gh-109858: Protect zipfile from “quoted-overlap”
zipbomb. It now raises BadZipFile when try to read an
entry that overlaps with other entry or central directory
(CVE-2024-0450, bsc#1221854).
- gh-107077: Seems that in some conditions, OpenSSL will
return SSL_ERROR_SYSCALL instead of SSL_ERROR_SSL
when a certification verification has failed, but
the error parameters will still contain ERR_LIB_SSL
and SSL_R_CERTIFICATE_VERIFY_FAILED. We are now
detecting this situation and raising the appropiate
ssl.SSLCertVerificationError. Patch by Pablo Galindo
- gh-91133: Fix a bug in tempfile.TemporaryDirectory cleanup,
which now no longer dereferences symlinks when working
around file system permission errors (CVE-2023-6597,
bsc#1219666).
- Documentation
- gh-115399: Document CVE-2023-52425 of Expat <2.6.0 under
“XML vulnerabilities”.
- Tools/Demos
- gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.11
and multissltests to use 1.1.1w and 3.0.11.
- Remove upstreamed patches:
- CVE-2023-6597-TempDir-cleaning-symlink.patch
- libexpat260.patch
- Refreshed patches:
- F00251-change-user-install-location.patch
- python-3.3.0b1-localpath.patch
* Wed Mar 06 2024 Pedro Monreal <pmonreal@suse.com>
- Use the system-wide crypto-policies [bsc#1211301]
* Use the system default cipher list instead of hardcoded values
* Add the --with-ssl-default-suites=openssl configure option
* Wed Feb 28 2024 Matej Cepl <mcepl@suse.com>
- Update SPEC file to build on SLE-15-SP5 (jsc#PED-7886).
* Fri Feb 23 2024 Matej Cepl <mcepl@suse.com>
- (bsc#1219666, CVE-2023-6597) Add
CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from
gh#python/cpython!99930) fixing symlink bug in cleanup of
tempfile.TemporaryDirectory.
- Repurpose skip-failing-tests.patch to increase timeout for
test.test_asyncio.test_tasks.TimeoutTests.test_timeout_time,
which fails on slow machines in IBS (s390x).
* Tue Feb 20 2024 Matej Cepl <mcepl@cepl.eu>
- Remove double definition of /usr/bin/idle%%{version} in
%%files.
* Thu Feb 15 2024 Daniel Garcia <daniel.garcia@suse.com>
- Add upstream patch libexpat260.patch, Fix tests for XMLPullParser
with Expat 2.6.0, gh#python/cpython#115289
* Mon Dec 18 2023 Matej Cepl <mcepl@cepl.eu>
- Refresh CVE-2023-27043-email-parsing-errors.patch to
gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043).
- Thus we can remove Revert-gh105127-left-tests.patch, which is
now useless.
* Wed Sep 06 2023 Daniel Garcia <daniel.garcia@suse.com>
- Update to 3.9.18 (bsc#1214692):
- (bsc#1215454, gh-108310) Fixed an issue where instances
of ssl.SSLSocket were vulnerable to a bypass of the TLS
handshake and included protections (like certificate
verification) and treating sent unencrypted data as if it
were post-handshake TLS encrypted data. Security issue
reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory
P. Smith.
- gh-107845: tarfile.data_filter() now takes the location of
symlinks into account when determining their target, so it will no
longer reject some valid tarballs with
LinkOutsideDestinationError.
- gh-107565: Update multissltests and GitHub CI workflows to use
OpenSSL 1.1.1v, 3.0.10, and 3.1.2.
- Refresh all patches:
- 98437-sphinx.locale._-as-gettext-in-pyspecific.patch
- 99366-patch.dict-can-decorate-async.patch
- Revert-gh105127-left-tests.patch
- bpo-31046_ensurepip_honours_prefix.patch
- decimal.patch
- distutils-reproducible-compile.patch
- gh-78214-marshal_stabilize_FLAG_REF.patch
- python-3.3.0b1-localpath.patch
- python-3.3.0b1-test-posix_fadvise.patch
- python3-imp-returntype.patch
- subprocess-raise-timeout.patch
- support-expat-CVE-2022-25236-patched.patch
- downport-Sphinx-features.patch
* Thu Aug 03 2023 Matej Cepl <mcepl@suse.com>
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API). (The patch is faulty,
gh#python/cpython#106669, but upstream decided not to just
revert it).
* Sat Jul 29 2023 Matej Cepl <mcepl@suse.com>
- Add bpo-37596-make-set-marshalling.patch making marshalling of
`set` and `frozenset` deterministic (bsc#1211765).
* Wed Jul 19 2023 Matej Cepl <mcepl@suse.com>
- Add gh-78214-marshal_stabilize_FLAG_REF.patch to marshal.c for
stabilizing FLAG_REF usage (required for reproduceability;
bsc#1213463).
* Fri Jul 14 2023 Matej Cepl <mcepl@suse.com>
- Revert faulty fix for CVE-2023-27043 (gh#python/cpython#106669)
* Fri Jun 30 2023 Matej Cepl <mcepl@suse.com>
- Add downport-Sphinx-features.patch to make documentation
buildable even on SLE-15.
* Wed Jun 28 2023 Matej Cepl <mcepl@suse.com>
- Update to 3.9.17 (bsc#1212015):
- gh-103142: The version of OpenSSL used in Windows and
Mac installers has been upgraded to 1.1.1u to address
CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464,
as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303
fixed previously in 1.1.1t (gh-101727).
- gh-102153: urllib.parse.urlsplit() now strips leading C0
control and space characters following the specification for
URLs defined by WHATWG in response to CVE-2023-24329
(bsc#1208471).
- gh-99889: Fixed a security in flaw in uu.decode() that could
allow for directory traversal based on the input if no
out_file was specified.
- gh-104049: Do not expose the local on-disk
location in directory indexes produced by
http.client.SimpleHTTPRequestHandler.
- gh-103935: trace.__main__ now uses io.open_code() for files
to be executed instead of raw open().
- gh-102953: The extraction methods in tarfile, and
shutil.unpack_archive(), have a new filter argument that
allows limiting tar features than may be surprising or
dangerous, such as creating files outside the destination
directory. See Extraction filters for details (fixing
CVE-2007-4559, bsc#1203750).
- gh-102126: Fixed a deadlock at shutdown when clearing thread
states if any finalizer tries to acquire the runtime head
lock.
- gh-100892: Fixed a crash due to a race while iterating over
thread states in clearing threading.local.
- Remove upstreamed patches:
- CVE-2023-24329-blank-URL-bypass.patch
- CVE-2007-4559-filter-tarfile_extractall.patch
* Sat May 06 2023 Matej Cepl <mcepl@suse.com>
- Add 99366-patch.dict-can-decorate-async.patch fixing
gh#python/cpython#98086 (backport from Python 3.10 patch in
gh#python/cpython!99366), fixing bsc#1211158.
* Wed May 03 2023 Matej Cepl <mcepl@suse.com>
- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
CVE-2007-4559 (bsc#1203750) by adding the filter for
tarfile.extractall (PEP 706).
* Tue Apr 18 2023 Steve Kowalik <steven.kowalik@suse.com>
- Use python3 modules to build the documentation.
* Wed Mar 01 2023 Matej Cepl <mcepl@suse.com>
- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
bsc#1208471) blocklists bypass via the urllib.parse component
when supplying a URL that starts with blank characters
* Tue Feb 21 2023 Matej Cepl <mcepl@suse.com>
- Add provides for readline and sqlite3 to the main Python
package.
* Fri Jan 27 2023 Thorsten Kukuk <kukuk@suse.com>
- Disable NIS for new products, it's deprecated and gets removed
* Fri Jan 13 2023 Martin Liška <mliska@suse.cz>
- Suppress warnings for Sphinx 6.0+.
* Thu Dec 08 2022 Matej Cepl <mcepl@suse.com>
- Update to 3.9.16:
- python -m http.server no longer allows terminal control
characters sent within a garbage request to be printed to the
stderr server log.
This is done by changing the http.server
BaseHTTPRequestHandler .log_message method to replace control
characters with a \xHH hex escape before printing.
- Avoid publishing list of active per-interpreter audit hooks
via the gc module
- The IDNA codec decoder used on DNS hostnames by socket or
asyncio related name resolution functions no longer involves
a quadratic algorithm. This prevents a potential CPU denial
of service if an out-of-spec excessive length hostname
involving bidirectional characters were decoded. Some
protocols such as urllib http 3xx redirects potentially allow
for an attacker to supply such a name (CVE-2015-20107).
- Update bundled libexpat to 2.5.0
- Port XKCP’s fix for the buffer overflows in SHA-3
(CVE-2022-37454).
- On Linux the multiprocessing module returns to using
filesystem backed unix domain sockets for communication with
the forkserver process instead of the Linux abstract socket
namespace. Only code that chooses to use the “forkserver”
start method is affected.
Abstract sockets have no permissions and could allow any
user on the system in the same network namespace (often
the whole system) to inject code into the multiprocessing
forkserver process. This was a potential privilege
escalation. Filesystem based socket permissions restrict this
to the forkserver process user as was the default in Python
3.8 and earlier.
This prevents Linux CVE-2022-42919.
- The deprecated mailcap module now refuses to inject unsafe
text (filenames, MIME types, parameters) into shell
commands. Instead of using such text, it will warn and act
as if a match was not found (or for test commands, as if the
test failed).
- Removed upstreamed patches:
- CVE-2015-20107-mailcap-unsafe-filenames.patch
- CVE-2022-42919-loc-priv-mulitproc-forksrv.patch
- CVE-2022-45061-DoS-by-IDNA-decode.patch
* Wed Nov 09 2022 Matej Cepl <mcepl@suse.com>
- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
extremely long domain names.
* Thu Nov 03 2022 Matej Cepl <mcepl@suse.com>
- Add CVE-2022-42919-loc-priv-mulitproc-forksrv.patch to avoid
CVE-2022-42919 (bsc#1204886) avoiding Linux specific local
privilege escalation via the multiprocessing forkserver start
method.
* Fri Oct 21 2022 Matej Cepl <mcepl@suse.com>
- Add 98437-sphinx.locale._-as-gettext-in-pyspecific.patch to
allow building of documentation with the latest Sphinx 5.3.0
(gh#python/cpython#98366).
* Wed Oct 19 2022 Matej Cepl <mcepl@suse.com>
- Update to 3.9.15:
- Fix multiplying a list by an integer (list *= int): detect
the integer overflow when the new allocated length is close
to the maximum size.
- Fix a shell code injection vulnerability in the
get-remote-certificate.py example script. The script no
longer uses a shell to run openssl commands. (originally
filed as CVE-2022-37460, later withdrawn)
- Fix command line parsing: reject -X int_max_str_digits option
with no value (invalid) when the PYTHONINTMAXSTRDIGITS
environment variable is set to a valid limit.
- When ValueError is raised if an integer is larger than the
limit, mention the sys.set_int_max_str_digits() function in
the error message.
- Update bundled libexpat to 2.4.9
* Sun Sep 11 2022 Matej Cepl <mcepl@suse.com>
- Update to 3.9.14:
- (CVE-2020-10735, bsc#1203125). Converting between int
and str in bases other than 2 (binary), 4, 8 (octal), 16
(hexadecimal), or 32 such as base 10 (decimal) now raises a
ValueError if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the
algorithmic complexity.
This new limit can be configured or disabled by environment
variable, command line flag, or sys APIs. See the integer
string conversion length limitation documentation. The
default limit is 4300 digits in string form.
- Also other bug fixes:
- http.server: Fix an open redirection vulnerability in the
HTTP server when an URI path starts with //. Vulnerability
discovered, and initial fix proposed, by Hamza Avvan.
- Fix contextvars HAMT implementation to handle iteration
over deep trees. The bug was discovered and fixed by Eli
Libman. See MagicStack/immutables#84 for more details.
- Fix binding of unix socket to empty address on Linux to use
an available address from the abstract namespace, instead
of “0”.
- Suppress writing an XML declaration in open files
in ElementTree.write() with encoding='unicode' and
xml_declaration=None.
- Fix the formatting for await x and not x in the operator
precedence table when using the help() system.
- Fix ensurepip environment isolation for subprocess running
pip.
- Fix problem with test_ssl test_get_ciphers on systems that
require perfect forward secrecy (PFS) ciphers.
- test_ssl is now checking for supported TLS version and
protocols in more tests.
- Removed upstreamed patches:
- CVE-2021-28861-double-slash-path.patch
- Realign patches:
- bpo-31046_ensurepip_honours_prefix.patch
- sphinx-update-removed-function.patch
* Thu Sep 01 2022 Steve Kowalik <steven.kowalik@suse.com>
- Add patch CVE-2021-28861-double-slash-path.patch:
* http.server: Fix an open redirection vulnerability in the HTTP server
when an URI path starts with //. (bsc#1202624, CVE-2021-28861)
* Thu Jul 21 2022 Matej Cepl <mcepl@suse.com>
- Switch from %primary_interpreter to prjconf-defined
%primary_python (gh#openSUSE/python-rpm-macros#127).
* Thu Jun 09 2022 Matej Cepl <mcepl@suse.com>
- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
command injection in the mailcap module.
- Fix building of documentation and the universal configuration of the
%primary_interpreter.
- (bsc#1196784, CVE-2022-25236) Rename patch:
support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch
and update the patch to detect expat >= 2.4.4 instead of >= 2.4.5
as it was fully patched against CVE-2022-25236.
* Fri May 20 2022 Matej Cepl <mcepl@suse.com>
- Update to 3.9.13:
- Core and Builtins
- gh-92311: Fixed a bug where setting frame.f_lineno to jump
over a list comprehension could misbehave or crash.
- gh-92112: Fix crash triggered by an evil custom mro() on
a metaclass.
- gh-92036: Fix a crash in subinterpreters related to the
garbage collector. When a subinterpreter is deleted,
untrack all objects tracked by its GC. To prevent a crash
in deallocator functions expecting objects to be tracked by
the GC, leak a strong reference to these objects on
purpose, so they are never deleted and their deallocator
functions are not called. Patch by Victor Stinner.
- gh-91421: Fix a potential integer overflow in
_Py_DecodeUTF8Ex.
- bpo-46775: Some Windows system error codes(>= 10000) are
now mapped into the correct errno and may now raise
a subclass of OSError. Patch by Dong-hee Na.
- bpo-46962: Classes and functions that unconditionally
declared their docstrings ignoring the
- -without-doc-strings compilation flag no longer do so.
- The classes affected are pickle.PickleBuffer,
testcapi.RecursingInfinitelyError, and types.GenericAlias.
- The functions affected are 24 methods in ctypes.
- Patch by Oleg Iarygin.
- bpo-36819: Fix crashes in built-in encoders with error
handlers that return position less or equal than the
starting position of non-encodable characters.
- Library
- gh-91581: utcfromtimestamp() no longer attempts to resolve
fold in the pure Python implementation, since the fold is
never 1 in UTC. In addition to being slightly faster in the
common case, this also prevents some errors when the
timestamp is close to datetime.min. Patch by Paul Ganssle.
- gh-92530: Fix an issue that occurred after interrupting
threading.Condition.notify().
- gh-92049: Forbid pickling constants re._constants.SUCCESS
etc. Previously, pickling did not fail, but the result
could not be unpickled.
- bpo-47029: Always close the read end of the pipe used by
multiprocessing.Queue after the last write of buffered data
to the write end of the pipe to avoid BrokenPipeError at
garbage collection and at multiprocessing.Queue.close()
calls. Patch by Géry Ogam.
- gh-91910: Add missing f prefix to f-strings in error
messages from the multiprocessing and asyncio modules.
- gh-91810: ElementTree method write() and function
tostring() now use the text file’s encoding (“UTF-8” if not
available) instead of locale encoding in XML declaration
when encoding="unicode" is specified.
- gh-91832: Add required attribute to argparse.Action repr
output.
- gh-91734: Fix OSS audio support on Solaris.
- gh-91700: Compilation of regular expression containing
a conditional expression (?(group)...) now raises an
appropriate re.error if the group number refers to not
defined group. Previously an internal RuntimeError was
raised.
- gh-91676: Fix unittest.IsolatedAsyncioTestCase to shutdown
the per test event loop executor before returning from its
run method so that a not yet stopped or garbage collected
executor state does not persist beyond the test.
- gh-90568: Parsing \N escapes of Unicode Named Character
Sequences in a regular expression raises now re.error
instead of TypeError.
- gh-91595: Fix the comparison of character and integer
inside Tools.gdb.libpython.write_repr(). Patch by Yu Liu.
- gh-90622: Worker processes for
concurrent.futures.ProcessPoolExecutor are no longer
spawned on demand (a feature added in 3.9) when the
multiprocessing context start method is "fork" as that can
lead to deadlocks in the child processes due to a fork
happening while threads are running.
- gh-91575: Update case-insensitive matching in the re module
to the latest Unicode version.
- gh-91581: Remove an unhandled error case in the
C implementation of calls to datetime.fromtimestamp with no
time zone (i.e. getting a local time from an epoch
timestamp). This should have no user-facing effect other
than giving a possibly more accurate error message when
called with timestamps that fall on 10000-01-01 in the
local time. Patch by Paul Ganssle.
- bpo-34480: Fix a bug where _markupbase raised an
UnboundLocalError when an invalid keyword was found in
marked section. Patch by Marek Suscak.
- bpo-27929: Fix asyncio.loop.sock_connect() to only resolve
names for socket.AF_INET or socket.AF_INET6 families.
Resolution may not make sense for other families, like
socket.AF_BLUETOOTH and socket.AF_UNIX.
- bpo-43323: Fix errors in the email module if the charset
itself contains undecodable/unencodable characters.
- bpo-46787: Fix concurrent.futures.ProcessPoolExecutor
exception memory leak
- bpo-46415: Fix ipaddress.ip_{address,interface,network}
raising TypeError instead of ValueError if given invalid
tuple as address parameter.
- bpo-44911: IsolatedAsyncioTestCase will no longer throw an
exception while cancelling leaked tasks. Patch by Bar
Harel.
- bpo-44493: Add missing terminated NUL in sockaddr_un’s
length
- This was potentially observable when using non-abstract
AF_UNIX datagram sockets to processes written in another
programming language.
- bpo-42627: Fix incorrect parsing of Windows registry proxy
settings
- bpo-36073: Raise ProgrammingError instead of segfaulting on
recursive usage of cursors in sqlite3 converters. Patch by
Sergey Fedoseev.
- Documentation
- gh-91888: Add a new gh role to the documentation to link to
GitHub issues.
- gh-91783: Document security issues concerning the use of
the function shutil.unpack_archive()
- gh-91547: Remove “Undocumented modules” page.
- bpo-44347: Clarify the meaning of dirs_exist_ok, a kwarg of
shutil.copytree().
- bpo-38668: Update the introduction to documentation for
os.path to remove warnings that became irrelevant after the
implementations of PEP 383 and PEP 529.
- bpo-47138: Pin Jinja to a version compatible with Sphinx
version 2.4.4.
- bpo-46962: All docstrings in code snippets are now wrapped
into PyDoc_STR() to follow the guideline of PEP 7’s
Documentation Strings paragraph. Patch by Oleg Iarygin.
- bpo-26792: Improve the docstrings of runpy.run_module() and
runpy.run_path(). Original patch by Andrew Brezovsky.
- bpo-45790: Adjust inaccurate phrasing in Defining Extension
Types: Tutorial about the ob_base field and the macros used
to access its contents.
- bpo-42340: Document that in some circumstances
KeyboardInterrupt may cause the code to enter an
inconsistent state. Provided a sample workaround to avoid
it if needed.
- bpo-41233: Link the errnos referenced in
Doc/library/exceptions.rst to their respective section in
Doc/library/errno.rst, and vice versa. Previously this was
only done for EINTR and InterruptedError. Patch by Yan
“yyyyyyyan” Orestes.
- bpo-38056: Overhaul the Error Handlers documentation in
codecs.
- bpo-13553: Document tkinter.Tk args.
- Tests
- gh-91607: Fix test_concurrent_futures to test the correct
multiprocessing start method context in several cases where
the test logic mixed this up.
- bpo-47205: Skip test for sched_getaffinity() and
sched_setaffinity() error case on FreeBSD.
- bpo-29890: Add tests for ipaddress.IPv4Interface and
ipaddress.IPv6Interface construction with tuple arguments.
Original patch and tests by louisom.
- Build
- bpo-47103: Windows PGInstrument builds now copy a required
DLL into the output directory, making it easier to run the
profile stage of a PGO build.
- Windows
- bpo-47194: Update zlib to v1.2.12 to resolve
CVE-2018-25032.
- bpo-46785: Fix race condition between os.stat() and
unlinking a file on Windows, by using errors codes returned
by FindFirstFileW() when appropriate in win32_xstat_impl.
- bpo-40859: Update Windows build to use xz-5.2.5
- Tools/Demos
- gh-91583: Fix regression in the code generated by Argument
Clinic for functions with the defining_class parameter.
- Add patch support-expat-245.patch:
* Support Expat >= 2.4.4 (jsc#SLE-21253, CVE-2022-25236)
* Sat Mar 26 2022 Matej Cepl <mcepl@suse.com>
- Update to 3.9.12:
- bpo-46968: Check for the existence of the “sys/auxv.h” header
in faulthandler to avoid compilation problems in systems
where this header doesn’t exist. Patch by Pablo Galindo
- bpo-47101: hashlib.algorithms_available now lists only
algorithms that are provided by activated crypto providers on
OpenSSL 3.0. Legacy algorithms are not listed unless the
legacy provider has been loaded into the default OSSL
context.
- bpo-23691: Protect the re.finditer() iterator from
re-entering.
- bpo-42369: Fix thread safety of zipfile._SharedFile.tell() to
avoid a “zipfile.BadZipFile: Bad CRC-32 for file” exception
when reading a ZipFile from multiple threads.
- bpo-38256: Fix binascii.crc32() when it is compiled to use
zlib’c crc32 to work properly on inputs 4+GiB in length
instead of returning the wrong result. The workaround prior
to this was to always feed the function data in increments
smaller than 4GiB or to just call the zlib module function.
- bpo-39394: A warning about inline flags not at the start of
the regular expression now contains the position of the flag.
- bpo-47061: Deprecate the various modules listed by PEP 594:
- aifc, asynchat, asyncore, audioop, cgi, cgitb, chunk, crypt,
imghdr, msilib, nntplib, nis, ossaudiodev, pipes, smtpd,
sndhdr, spwd, sunau, telnetlib, uu, xdrlib
- bpo-2604: Fix bug where doctests using globals would fail
when run multiple times.
- bpo-45997: Fix asyncio.Semaphore re-aquiring FIFO order.
- bpo-47022: The asynchat, asyncore and smtpd modules have been
deprecated since at least Python 3.6. Their documentation has
now been updated to note they will removed in Python 3.12
(PEP 594).
- bpo-46421: Fix a unittest issue where if the command was
invoked as python -m unittest and the filename(s) began with
a dot (.), a ValueError is returned.
- bpo-40296: Fix supporting generic aliases in pydoc.
- bpo-14156: argparse.FileType now supports an argument of ‘-’
in binary mode, returning the .buffer attribute of
sys.stdin/sys.stdout as appropriate. Modes including ‘x’ and
‘a’ are treated equivalently to ‘w’ when argument is ‘-’.
Patch contributed by Josh Rosenberg
- Update to 3.9.11:
- bpo-46852: Rename the private undocumented
float.__set_format__() method to float.__setformat__() to fix
a typo introduced in Python 3.7. The method is only used by
test_float. Patch by Victor Stinner.
- bpo-46794: Bump up the libexpat version into 2.4.6
- bpo-46762: Fix an assert failure in debug builds when a ‘<’,
‘>’, or ‘=’ is the last character in an f-string that’s
missing a closing right brace.
- bpo-46732: Correct the docstring for the __bool__() method.
Patch by Jelle Zijlstra.
- bpo-40479: Add a missing call to va_end() in
Modules/_hashopenssl.c.
- bpo-46615: When iterating over sets internally in
setobject.c, acquire strong references to the resulting items
from the set. This prevents crashes in corner-cases of
various set operations where the set gets mutated.
- bpo-43721: Fix docstrings of getter, setter, and deleter to
clarify that they create a new copy of the property.
- bpo-46503: Fix an assert when parsing some invalid N escape
sequences in f-strings.
- bpo-46417: Fix a race condition on setting a type __bases__
attribute: the internal function add_subclass() now gets the
PyTypeObject.tp_subclasses member after calling
PyWeakref_NewRef() which can trigger a garbage collection
which can indirectly modify PyTypeObject.tp_subclasses. Patch
by Victor Stinner.
- bpo-46383: Fix invalid signature of _zoneinfo’s module_free
function to resolve a crash on wasm32-emscripten platform.
- bpo-43253: Fix a crash when closing transports where the
underlying socket handle is already invalid on the Proactor
event loop.
- bpo-47004: Apply bugfixes from importlib_metadata 4.11.3,
including bugfix for EntryPoint.extras, which was returning
match objects and not the extras strings.
- bpo-46985: Upgrade pip wheel bundled with ensurepip (pip
22.0.4, bnc#1186819, CVE-2021-3572)
- bpo-46968: faulthandler: On Linux 5.14 and newer, dynamically
determine size of signal handler stack size CPython allocates
using getauxval(AT_MINSIGSTKSZ). This changes allows for
Python extension’s request to Linux kernel to use AMX_TILE
instruction set on Sapphire Rapids Xeon processor to succeed,
unblocking use of the ISA in frameworks.
- bpo-46955: Expose asyncio.base_events.Server as
asyncio.Server. Patch by Stefan Zabka.
- bpo-46932: Update bundled libexpat to 2.4.7
- bpo-25707: Fixed a file leak in
xml.etree.ElementTree.iterparse() when the iterator is not
exhausted. Patch by Jacob Walls.
- bpo-44886: Inherit asyncio proactor datagram transport from
asyncio.DatagramTransport.
- bpo-46827: Support UDP sockets in asyncio.loop.sock_connect()
for selector-based event loops. Patch by Thomas Grainger.
- bpo-46811: Make test suite support Expat >=2.4.5
- bpo-46252: Raise TypeError if ssl.SSLSocket is passed to
transport-based APIs.
- bpo-46784: Fix libexpat symbols collisions with user
dynamically loaded or statically linked libexpat in embedded
Python.
- bpo-39327: shutil.rmtree() can now work with VirtualBox
shared folders when running from the guest operating-system.
- bpo-46756: Fix a bug in
urllib.request.HTTPPasswordMgr.find_user_password() and
urllib.request.HTTPPasswordMgrWithPriorAuth.is_authenticated()
which allowed to bypass authorization. For example, access to
URI example.org/foobar was allowed if the user was authorized
for URI example.org/foo.
- bpo-45863: When the tarfile module creates a pax format
archive, it will put an integer representation of timestamps
in the ustar header (if possible) for the benefit of older
unarchivers, in addition to the existing full-precision
timestamps in the pax extended header.
- bpo-46672: Fix NameError in asyncio.gather() when initial
type check fails.
- bpo-45948: Fixed a discrepancy in the C implementation of the
xml.etree.ElementTree module. Now, instantiating an
xml.etree.ElementTree.XMLParser with a target=None keyword
provides a default xml.etree.ElementTree.TreeBuilder target
as the Python implementation does.
- bpo-46591: Make the IDLE doc URL on the About IDLE dialog
clickable.
- bpo-46400: expat: Update libexpat from 2.4.1 to 2.4.4
- bpo-46487: Add the get_write_buffer_limits method to
asyncio.transports.WriteTransport and to the SSL transport.
- bpo-46539: In typing.get_type_hints(), support evaluating
stringified ClassVar and Final annotations inside Annotated.
Patch by Gregory Beauregard.
- bpo-46491: Allow typing.Annotated to wrap typing.Final and
typing.ClassVar. Patch by Gregory Beauregard.
- bpo-46436: Fix command-line option -d/--directory in module
http.server which is ignored when combined with command-line
option --cgi. Patch by Géry Ogam.
- bpo-41403: Make mock.patch() raise a TypeError with
a relevant error message on invalid arg. Previously it
allowed a cryptic AttributeError to escape.
- bpo-46474: In importlib.metadata.EntryPoint.pattern, avoid
potential REDoS by limiting ambiguity in consecutive
whitespace.
- bpo-46469: asyncio generic classes now return
types.GenericAlias in __class_getitem__ instead of the same
class.
- bpo-46434: pdb now gracefully handles help when __doc__ is
missing, for example when run with pregenerated optimized
.pyc files.
- bpo-46333: The __eq__() and __hash__() methods of
typing.ForwardRef now honor the module parameter of
typing.ForwardRef. Forward references from different modules
are now differentiated.
- bpo-43118: Fix a bug in inspect.signature() that was causing
it to fail on some subclasses of classes with
a __text_signature__ referencing module globals. Patch by
Weipeng Hong.
- bpo-21987: Fix an issue with tarfile.TarFile.getmember()
getting a directory name with a trailing slash.
- bpo-20392: Fix inconsistency with uppercase file extensions
in MimeTypes.guess_type(). Patch by Kumar Aditya.
- bpo-46080: Fix exception in argparse help text generation if
a argparse.BooleanOptionalAction argument’s default is
argparse.SUPPRESS and it has help specified. Patch by Felix
Fontein.
- bpo-44439: Fix .write() method of a member file in ZipFile,
when the input data is an object that supports the buffer
protocol, the file length may be wrong.
- bpo-45703: When a namespace package is imported before
another module from the same namespace is created/installed
in a different sys.path location while the program is
running, calling the importlib.invalidate_caches() function
will now also guarantee the new module is noticed.
- bpo-24959: Fix bug where unittest sometimes drops frames from
tracebacks of exceptions raised in tests.
- bpo-46463: Fixes escape4chm.py script used when building the
CHM documentation file
- bpo-46913: Fix test_faulthandler.test_sigfpe() if Python is
built with undefined behavior sanitizer (UBSAN): disable
UBSAN on the faulthandler_sigfpe() function. Patch by Victor
Stinner.
- bpo-46708: Prevent default asyncio event loop policy
modification warning after test_asyncio execution.
- bpo-46616: Ensures test_importlib.test_windows cleans up
registry keys after completion.
- bpo-44359: test_ftplib now silently ignores socket errors to
prevent logging unhandled threading exceptions. Patch by
Victor Stinner.
- bpo-46542: Fix a Python crash in test_lib2to3 when using
Python built in debug mode: limit the recursion limit. Patch
by Victor Stinner.
- bpo-46576: test_peg_generator now disables compiler
optimization when testing compilation of its own C extensions
to significantly speed up the testing on non-debug builds of
CPython.
- bpo-46542: Fix test_json tests checking for RecursionError:
modify these tests to use support.infinite_recursion(). Patch
by Victor Stinner.
- bpo-13886: Skip test_builtin PTY tests on non-ASCII
characters if the readline module is loaded. The readline
module changes input() behavior, but test_builtin is not
intented to test the readline module. Patch by Victor
Stinner.
- bpo-38472: Fix GCC detection in setup.py when
cross-compiling. The C compiler is now run with LC_ALL=C.
Previously, the detection failed with a German locale.
- bpo-46513: configure no longer uses AC_C_CHAR_UNSIGNED macro
and pyconfig.h no longer defines reserved symbol
__CHAR_UNSIGNED__.
- bpo-45925: Update Windows installer to use SQLite 3.37.2.
- bpo-45296: Clarify close, quit, and exit in IDLE. In the File
menu, ‘Close’ and ‘Exit’ are now ‘Close Window’ (the current
one) and ‘Exit’ is now ‘Exit IDLE’ (by closing all windows).
In Shell, ‘quit()’ and ‘exit()’ mean ‘close Shell’. If there
are no other windows, this also exits IDLE.
- bpo-45447: Apply IDLE syntax highlighting to pyi files. Patch
by Alex Waygood and Terry Jan Reedy.
- Removed upstreamed patches:
- support-expat-245.patch
* Tue Feb 22 2022 Steve Kowalik <steven.kowalik@suse.com>
- Add patch support-expat-245.patch:
* Support Expat >= 2.4.5
* Wed Jan 19 2022 Matej Cepl <mcepl@suse.com>
- Update to 3.9.10:
Bugfix-only release
* Mon Nov 29 2021 Matej Cepl <mcepl@suse.com>
- Remove shebangs from from python-base libraries in _libdir
(bsc#1193179, bsc#1192249).
- Readjust patches:
- bpo-31046_ensurepip_honours_prefix.patch
- decimal.patch
- python-3.3.0b1-fix_date_time_compiler.patch
* Wed Nov 17 2021 Steve Kowalik <steven.kowalik@suse.com>
- Update to 3.9.9:
* Core and Builtins
+ bpo-30570: Fixed a crash in issubclass() from infinite recursion when searching pathological __bases__ tuples.
+ bpo-45494: Fix parser crash when reporting errors involving invalid continuation characters. Patch by Pablo Galindo.
+ bpo-45385: Fix reference leak from descr_check. Patch by Dong-hee Na.
+ bpo-45167: Fix deepcopying of types.GenericAlias objects.
+ bpo-44219: Release the GIL while performing isatty system calls on arbitrary file descriptors. In particular, this affects os.isatty(), os.device_encoding() and io.TextIOWrapper. By extension, io.open() in text mode is also affected. This change solves a deadlock in os.isatty(). Patch by Vincent Michel in bpo-44219.
+ bpo-44959: Added fallback to extension modules with ‘.sl’ suffix on HP-UX
+ bpo-44050: Extensions that indicate they use global state (by setting m_size to -1) can again be used in multiple interpreters. This reverts to behavior of Python 3.8.
+ bpo-45121: Fix issue where Protocol.__init__ raises RecursionError when it’s called directly or via super(). Patch provided by Yurii Karabas.
+ bpo-45083: When the interpreter renders an exception, its name now has a complete qualname. Previously only the class name was concatenated to the module name, which sometimes resulted in an incorrect full name being displayed.
+ bpo-45738: Fix computation of error location for invalid continuation characters in the parser. Patch by Pablo Galindo.
+ Library
+ bpo-45678: Fix bug in Python 3.9 that meant functools.singledispatchmethod failed to properly wrap the attributes of the target method. Patch by Alex Waygood.
+ bpo-45679: Fix caching of multi-value typing.Literal. Literal[True, 2] is no longer equal to Literal[1, 2].
+ bpo-45438: Fix typing.Signature string representation for generic builtin types.
+ bpo-45581: sqlite3.connect() now correctly raises MemoryError if the underlying SQLite API signals memory error. Patch by Erlend E. Aasland.
+ bpo-39679: Fix bug in functools.singledispatchmethod that caused it to fail when attempting to register a classmethod() or staticmethod() using type annotations. Patch contributed by Alex Waygood.
+ bpo-45515: Add references to zoneinfo in the datetime documentation, mostly replacing outdated references to dateutil.tz. Change by Paul Ganssle.
+ bpo-45467: Fix incremental decoder and stream reader in the “raw-unicode-escape” codec. Previously they failed if the escape sequence was split.
+ bpo-45461: Fix incremental decoder and stream reader in the “unicode-escape” codec. Previously they failed if the escape sequence was split.
+ bpo-45239: Fixed email.utils.parsedate_tz() crashing with UnboundLocalError on certain invalid input instead of returning None. Patch by Ben Hoyt.
+ bpo-44904: Fix bug in the doctest module that caused it to fail if a docstring included an example with a classmethod property. Patch by Alex Waygood.
+ bpo-45406: Make inspect.getmodule() catch FileNotFoundError raised by :’func:inspect.getabsfile, and return None to indicate that the module could not be determined.
+ bpo-45262: Prevent use-after-free in asyncio. Make sure the cached running loop holder gets cleared on dealloc to prevent use-after-free in get_running_loop
+ bpo-45386: Make xmlrpc.client more robust to C runtimes where the underlying C strftime function results in a ValueError when testing for year formatting options.
+ bpo-45371: Fix clang rpath issue in distutils. The UnixCCompiler now uses correct clang option to add a runtime library directory (rpath) to a shared library.
+ bpo-20028: Improve error message of csv.Dialect when initializing. Patch by Vajrasky Kok and Dong-hee Na.
+ bpo-45343: Update bundled pip to 21.2.4 and setuptools to 58.1.0
+ bpo-41710: On Unix, if the sem_clockwait() function is available in the C library (glibc 2.30 and newer), the threading.Lock.acquire() method now uses the monotonic clock (time.CLOCK_MONOTONIC) for the timeout, rather than using the system clock (time.CLOCK_REALTIME), to not be affected by system clock changes. Patch by Victor Stinner.
+ bpo-45328: Fixed http.client.HTTPConnection to work properly in OSs that don’t support the TCP_NODELAY socket option.
+ bpo-1596321: Fix the threading._shutdown() function when the threading module was imported first from a thread different than the main thread: no longer log an error at Python exit.
+ bpo-45274: Fix a race condition in the Thread.join() method of the threading module. If the function is interrupted by a signal and the signal handler raises an exception, make sure that the thread remains in a consistent state to prevent a deadlock. Patch by Victor Stinner.
+ bpo-45238: Fix unittest.IsolatedAsyncioTestCase.debug(): it runs now asynchronous methods and callbacks.
+ bpo-36674: unittest.TestCase.debug() raises now a unittest.SkipTest if the class or the test method are decorated with the skipping decorator.
+ bpo-45235: Fix an issue where argparse would not preserve values in a provided namespace when using a subparser with defaults.
+ bpo-45234: Fixed a regression in copyfile(), copy(), copy2() raising FileNotFoundError when source is a directory, which should raise IsADirectoryError
+ bpo-45228: Fix stack buffer overflow in parsing J1939 network address.
+ bpo-45192: Fix the tempfile._infer_return_type function so that the dir argument of the tempfile functions accepts an object implementing the os.PathLike protocol.
+ bpo-45160: When tracing a tkinter variable used by a ttk OptionMenu, callbacks are no longer made twice.
+ bpo-35474: Calling mimetypes.guess_all_extensions() with strict=False no longer affects the result of the following call with strict=True. Also, mutating the returned list no longer affects the global state.
+ bpo-45166: typing.get_type_hints() now works with Final wrapped in ForwardRef.
+ bpo-45097: Remove deprecation warnings about the loop argument in asyncio incorrectly emitted in cases when the user does not pass the loop argument.
+ bpo-45081: Fix issue when dataclasses that inherit from typing.Protocol subclasses have wrong __init__. Patch provided by Yurii Karabas.
+ bpo-24444: Fixed an error raised in argparse help display when help for an option is set to 1+ blank spaces or when choices arg is an empty container.
+ bpo-45021: Fix a potential deadlock at shutdown of forked children when using concurrent.futures module
+ bpo-45030: Fix integer overflow in pickling and copying the range iterator.
+ bpo-39039: tarfile.open raises ReadError when a zlib error occurs during file extraction.
+ bpo-44594: Fix an edge case of ExitStack and AsyncExitStack exception chaining. They will now match with block behavior when __context__ is explicitly set to None when the exception is in flight.
* Documentation
+ bpo-45726: Improve documentation for functools.singledispatch() and functools.singledispatchmethod.
+ bpo-45680: Amend the docs on GenericAlias objects to clarify that non-container classes can also implement __class_getitem__. Patch contributed by Alex Waygood.
+ bpo-45655: Add a new “relevant PEPs” section to the top of the documentation for the typing module. Patch by Alex Waygood.
+ bpo-45604: Add level argument to multiprocessing.log_to_stderr function docs.
+ bpo-45464: Mention in the documentation of Built-in Exceptions that inheriting from multiple exception types in a single subclass is not recommended due to possible memory layout incompatibility.
+ bpo-45449: Add note about PEP 585 in collections.abc.
+ bpo-45516: Add protocol description to the importlib.abc.Traversable documentation.
+ bpo-20692: Add Programming FAQ entry explaining that int literal attribute access requires either a space after or parentheses around the literal.
+ bpo-45216: Remove extra documentation listing methods in difflib. It was rendering twice in pydoc and was outdated in some places.
+ bpo-45772: socket.socket documentation is corrected to a class from a function.
+ bpo-45392: Update the docstring of the type built-in to remove a redundant line and to mention keyword arguments for the constructor.
* Tests
+ bpo-45578: Add tests for dis.distb()
+ bpo-45577: Add subtests for all pickle protocols in test_zoneinfo.
+ bpo-43592: test.libregrtest now raises the soft resource limit for the maximum number of file descriptors when the default is too low for our test suite as was often the case on macOS.
+ bpo-40173: Fix test.support.import_helper.import_fresh_module().
+ bpo-45280: Add a test case for empty typing.NamedTuple.
+ bpo-45269: Cover case when invalid markers type is supplied to c_make_encoder.
+ bpo-45209: Fix UserWarning: resource_tracker warning in _test_multiprocessing._TestSharedMemory.test_shared_memory_cleaned_after_process_termination
+ bpo-45195: Fix test_readline.test_nonascii(): sometimes, the newline character is not written at the end, so don’t expect it in the output. Patch by Victor Stinner.
+ bpo-45156: Fixes infinite loop on unittest.mock.seal() of mocks created by create_autospec().
+ bpo-45042: Fixes that test classes decorated with @hashlib_helper.requires_hashdigest were skipped all the time.
+ bpo-45235: Reverted an argparse bugfix that caused regression in the handling of default arguments for subparsers. This prevented leaf level arguments from taking precedence over root level arguments.
+ bpo-45765: In importlib.metadata, fix distribution discovery for an empty path.
+ bpo-45644: In-place JSON file formatting using python3 -m json.tool infile infile now works correctly, previously it left the file empty. Patch by Chris Wesseling.
* Build
+ bpo-43158: setup.py now uses values from configure script to build the _uuid extension module. Configure now detects util-linux’s libuuid, too.
+ bpo-45571: Modules/Setup now use PY_CFLAGS_NODIST instead of PY_CFLAGS to compile shared modules.
+ bpo-45532: Update sys.version to use main as fallback information. Patch by Jeong YunWon.
+ bpo-45405: Prevent internal configure error when running configure with recent versions of non-Apple clang. Patch by David Bohman.
+ bpo-45220: Avoid building with the Windows 11 SDK previews automatically. This may be overridden by setting the DefaultWindowsSDKVersion environment variable before building.
* C API
+ bpo-44687: BufferedReader.peek() no longer raises ValueError when the entire file has already been buffered.
+ bpo-44751: Remove crypt.h include from the public Python.h header.
- Drop patch incorrect-deprecation-warn-asyncio.patch, fix included.
* Sat Nov 06 2021 Matej Cepl <mcepl@suse.com>
- rpm-build-python dependency is available on the current
Factory, not with SLE.
* Sat Oct 30 2021 Matej Cepl <mcepl@suse.com>
- Add incorrect-deprecation-warn-asyncio.patch to fix bpo#45097
(from gh#python/cpython#28153) to remove incorrect deprecation
warnings in asyncio.
* Wed Oct 13 2021 Dominique Leuenberger <dimstar@opensuse.org>
- BuildRequire rpm-build-python: The provider to inject python(abi)
has been moved there. rpm-build pulls rpm-build-python
automatically in when building anything against python3-base, but
this implies that the initial build of python3-base does not
trigger the automatic installation.
* Tue Aug 31 2021 Matej Cepl <mcepl@suse.com>
- Update to 3.9.7:
- Security
- Replaced usage of tempfile.mktemp() with TemporaryDirectory
to avoid a potential race condition.
- Add auditing events to the marshal module, and stop raising
code.__init__ events for every unmarshalled code object.
Directly instantiated code objects will continue to raise
an event, and audit event handlers should inspect or
collect the raw marshal data. This reduces a significant
performance overhead when loading from .pyc files.
- Made the internal putcmd function in smtplib sanitize input
for presence of \r and \n characters to avoid (unlikely)
command injection.
- Core and Builtins
- Fixed pickling of range iterators that iterated for over
2**32 times.
- Fix a race in WeakKeyDictionary, WeakValueDictionary and
WeakSet when two threads attempt to commit the last pending
removal. This fixes asyncio.create_task and fixes a data
loss in asyncio.run where shutdown_asyncgens is not run
- Fixed a corner case bug where the result of
float.fromhex('0x.8p-1074') was rounded the wrong way.
- Refine the syntax error for trailing commas in import
statements. Patch by Pablo Galindo.
- Restore behaviour of complex exponentiation with
integer-valued exponent of type float or complex.
- Correct the ast locations of f-strings with format specs
and repeated expressions. Patch by Pablo Galindo
- Use new trashcan macros (Py_TRASHCAN_BEGIN/END) in
frameobject.c instead of the old ones
(Py_TRASHCAN_SAFE_BEGIN/END).
- Fix segmentation fault with deep recursion when cleaning
method objects. Patch by Augusto Goulart and Pablo Galindo.
- Fix bug where PyErr_SetObject hangs when the current
exception has a cycle in its context chain.
- Fix reference leaks in the error paths of update_bases()
and __build_class__. Patch by Pablo Galindo.
- Fix undefined behaviour in complex object exponentiation.
- Remove uses of PyObject_GC_Del() in error path when
initializing types.GenericAlias.
- Remove the pass-through for hash() of weakref.proxy objects
to prevent unintended consequences when the original
referred object dies while the proxy is part of a hashable
object. Patch by Pablo Galindo.
- Fix ltrace functionality when exceptions are raised. Patch
by Pablo Galindo
- Fix a crash at Python exit when a deallocator function
removes the last strong reference to a heap type. Patch by
Victor Stinner.
- Fix crash when using passing a non-exception to
a generator’s throw() method. Patch by Noah Oxer
- Library
- run() now always return a TestResult instance. Previously
it returned None if the test class or method was decorated
with a skipping decorator.
- Fix bugs in cleaning up classes and modules in unittest:
- Functions registered with addModuleCleanup() were not
called unless the user defines tearDownModule() in
their test module.
- Functions registered with addClassCleanup() were not
called if tearDownClass is set to None.
- Buffering in TestResult did not work with functions
registered with addClassCleanup() and
addModuleCleanup().
- Errors in functions registered with addClassCleanup()
and addModuleCleanup() were not handled correctly in
buffered and debug modes.
- Errors in setUpModule() and functions registered with
addModuleCleanup() were reported in wrong order.
- And several lesser bugs.
- Made email date parsing more robust against malformed
input, namely a whitespace-only Date: header. Patch by
Wouter Bolsterlee.
- Fix a crash in the signal handler of the faulthandler
module: no longer modify the reference count of frame
objects. Patch by Victor Stinner.
- Method stopTestRun() is now always called in pair with
method startTestRun() for TestResult objects implicitly
created in run(). Previously it was not called for test
methods and classes decorated with a skipping decorator.
- argparse.BooleanOptionalAction’s default value is no longer
printed twice when used with
argparse.ArgumentDefaultsHelpFormatter.
- Upgrade bundled pip to 21.2.3 and setuptools to 57.4.0
- Fix the os.set_inheritable() function on FreeBSD 14 for
file descriptor opened with the O_PATH flag: ignore the
EBADF error on ioctl(), fallback on the fcntl()
implementation. Patch by Victor Stinner.
- The @functools.total_ordering() decorator now works with
metaclasses.
- sqlite3 user-defined functions and aggregators returning
strings with embedded NUL characters are no longer
truncated. Patch by Erlend E. Aasland.
- Always show loop= arg deprecations in asyncio.gather() and
asyncio.sleep()
- Non-protocol subclasses of typing.Protocol ignore now the
__init__ method inherited from protocol base classes.
- The tokenize.tokenize() doesn’t incorrectly generate
a NEWLINE token if the source doesn’t end with a new line
character but the last line is a comment, as the function
is already generating a NL token. Patch by Pablo Galindo
- Fix http.client.HTTPSConnection fails to download >2GiB
data.
- rcompleter does not call getattr() on property objects to
avoid the side-effect of evaluating the corresponding
method.
- weakref.proxy objects referencing non-iterators now raise
TypeError rather than dereferencing the null tp_iternext
slot and crashing.
- The implementation of collections.abc.Set._hash() now
matches that of frozenset.__hash__().
- Fixed issue in compileall.compile_file() when sys.stdout is
redirected. Patch by Stefan Hölzl.
- Give priority to using the current class constructor in
inspect.signature(). Patch by Weipeng Hong.
- Fix memory leak in _tkinter._flatten() if it is called with
a sequence or set, but not list or tuple.
- Update shutil.copyfile() to raise FileNotFoundError instead
of confusing IsADirectoryError when a path ending with
a os.path.sep does not exist; shutil.copy() and
shutil.copy2() are also affected.
- handle StopIteration subclass raised from
@contextlib.contextmanager generator
- Make the implementation consistency of indexOf() between
C and Python versions. Patch by Dong-hee Na.
- Fixes TypedDict to work with typing.get_type_hints() and
postponed evaluation of annotations across modules.
- Fix bug with pdb’s handling of import error due to
a package which does not have a __main__ module
- Fixed an exception thrown while parsing a malformed
multipart email by email.message.EmailMessage.
- pathlib.PureWindowsPath.is_reserved() now identifies
a greater range of reserved filenames, including those with
trailing spaces or colons.
- Handle exceptions from parsing the arg of pdb’s run/restart
command.
- The sqlite3 context manager now performs a rollback (thus
releasing the database lock) if commit failed. Patch by
Luca Citi and Erlend E. Aasland.
- Improved string handling for sqlite3 user-defined functions
and aggregates:
- It is now possible to pass strings with embedded null
characters to UDFs
- Conversion failures now correctly raise MemoryError
- Patch by Erlend E. Aasland.
- Handle RecursionError in TracebackException’s constructor,
so that long exceptions chains are truncated instead of
causing traceback formatting to fail.
- Fix email.message.EmailMessage.set_content() when called
with binary data and 7bit content transfer encoding.
- The compresslevel and preset keyword arguments of
tarfile.open() are now both documented and tested.
- Fixed a Y2k38 bug in the compileall module where it would
fail to compile files with a modification time after the
year 2038.
- Fix test___all__ on platforms lacking a shared memory
implementation.
- Pass multiprocessing BaseProxy argument manager_owned
through AutoProxy.
- email.utils.getaddresses() now accepts email.header.Header
objects along with string values. Patch by Zackery Spytz.
- lib2to3 now recognizes async generators everywhere.
- Fix TypeError when required subparsers without dest do not
receive arguments. Patch by Anthony Sottile.
- Documentation
- Removed the othergui.rst file, any references to it, and
the list of GUI frameworks in the FAQ. In their place I’ve
added links to the Python Wiki page on GUI frameworks.
- Update the definition of __future__ in the glossary by
replacing the confusing word “pseudo-module” with a more
accurate description.
- Add typical examples to os.path.splitext docs
- Clarify that shutil.make_archive() is not thread-safe due
to reliance on changing the current working directory.
- Update of three expired hyperlinks in
Doc/distributing/index.rst: “Project structure”, “Building
and packaging the project”, and “Uploading the project to
the Python Packaging Index”.
- Updated the docstring and docs of filecmp.cmp() to be more
accurate and less confusing especially in respect to
shallow arg.
- Match the docstring and python implementation of countOf()
to the behavior of its c implementation.
- List all kwargs for textwrap.wrap(), textwrap.fill(), and
textwrap.shorten(). Now, there are nav links to attributes
of TextWrap, which makes navigation much easier while
minimizing duplication in the documentation.
- Clarify that atexit uses equality comparisons internally.
- Documentation of csv.Dialect is more descriptive.
- Fix documentation for the return type of
sysconfig.get_path().
- Add a “Security Considerations” index which links to
standard library modules that have explicitly documented
security considerations.
- Remove the unqualified claim that tkinter is threadsafe. It
has not been true for several years and likely never was.
An explanation of what is true may be added later, after
more discussion, and possibly after patching _tkinter.c,
- Tests
- Add calls of gc.collect() in tests to support PyPy.
- Made tests relying on the _asyncio C extension module
optional to allow running on alternative Python
implementations. Patch by Serhiy Storchaka.
- Fix auto history tests of test_readline: sometimes, the
newline character is not written at the end, so don’t
expect it in the output.
- Add ability to wholesale silence DeprecationWarnings while
running the regression test suite.
- Notify users running test_decimal regression tests on macOS
of potential harmless “malloc can’t allocate region”
messages spewed by test_decimal.
- Fixed floating point precision issue in turtle tests.
- Regression tests, when run with -w, are now re-running only
the affected test methods instead of re-running the entire
test file.
- Add test for nested queues when using multiprocessing
shared objects AutoProxy[Queue] inside ListProxy and
DictProxy
* Fri Aug 27 2021 Matej Cepl <mcepl@suse.com>
- Add decimal.patch to add building with --with-system-libmpdec
option (bsc#1189356).
* Thu Aug 26 2021 Andreas Schwab <schwab@suse.de>
- test_faulthandler is still problematic under qemu linux-user emulation,
disable it there
- Reenable profileopt with qemu emulation, test_faulthandler is no longer
run during profiling
* Mon Aug 09 2021 Fusion Future <qydwhotmail@gmail.com>
- Update to 3.9.6:
* Security
- bpo-44022 (bsc#1189241, CVE-2021-3737): http.client now
avoids infinitely reading potential HTTP headers after
a 100 Continue status response from the server.
* Core and Builtins
- bpo-44168: Fix error message in the parser involving keyword
arguments with invalid expressions. Patch by Pablo Galindo
- bpo-44114: Fix incorrect dictkeys_reversed and
dictitems_reversed function signatures in C code, which broke
webassembly builds.
- bpo-44070: No longer eagerly makes import filenames absolute,
except for extension modules, which was introduced in 3.9.5.
- bpo-28146: Fix a confusing error message in str.format().
- bpo-11105: When compiling ast.AST objects with recursive
references through compile(), the interpreter doesn’t crash
anymore instead it raises a RecursionError.
* Library
- bpo-43972: When http.server.SimpleHTTPRequestHandler sends a
301 (Moved Permanently) for a directory path not ending with
/, add a Content-Length: 0 header. This improves the behavior
for certain clients.
- bpo-43776: When subprocess.Popen args are provided as a
string or as pathlib.Path, the Popen instance repr now shows
the right thing.
- bpo-43318: Fix a bug where pdb does not always echo cleared
breakpoints.
- bpo-43295: datetime.datetime.strptime() now raises ValueError
instead of IndexError when matching 'z' with the %z format
specifier.
- bpo-37022: pdb now displays exceptions from repr() with its p
and pp commands.
* IDLE
- bpo-33962: Move the indent space setting from the Font tab to
the new Windows tab. Patch by Mark Roseman and Terry Jan
Reedy.
- bpo-40468: Split the settings dialog General tab into Windows
and Shell/ED tabs. Move help sources, which extend the Help
menu, to the Extensions tab. Make space for new options and
shorten the dialog. The latter makes the dialog better fit
small screens.
- bpo-41611: Avoid uncaught exceptions in
AutoCompleteWindow.winconfig_event().
- bpo-41611: Fix IDLE sometimes freezing upon tab-completion on
macOS.
* Tools/Demos
- bpo-44074: Make patchcheck automatically detect the correct
base branch name (previously it was hardcoded to ‘master’)
- Upstreamed patches were removed:
- bpo44426-complex-keyword-sphinx.patch
- Refreshed patches:
- subprocess-raise-timeout.patch
* Mon Aug 02 2021 Matej Cepl <mcepl@suse.com>
- Use versioned python-Sphinx to avoid dependency on other
version of Python (bsc#1183858).
* Sat Jun 19 2021 Matej Cepl <mcepl@suse.com>
- Add bpo44426-complex-keyword-sphinx.patch allowing generating
documentation with Sphinx 4 (bpo#44426).
* Sat Jun 05 2021 Matej Cepl <mcepl@suse.com>
- Revert previous skip over test_capi
- Add skip-test_pyobject_freed_is_freed.patch to skip failing
test on SLE-15.
* Fri Jun 04 2021 Dirk Müller <dmueller@suse.com>
- allow build with Sphinx >= 3.x
* Wed Jun 02 2021 Dan Čermák <dcermak@suse.com>
- Exclude test_capi on Leap (test fails there)
* Fri May 21 2021 Matej Cepl <mcepl@suse.com>
- Stop providing "python" symbol (bsc#1185588), which means
python2 currently.
* Wed May 05 2021 Matej Cepl <mcepl@suse.com>
- Update to 3.9.5:
* Security
- bpo-43434: Creating a sqlite3.Connection object now also
produces a sqlite3.connect auditing event. Previously this
event was only produced by sqlite3.connect() calls. Patch
by Erlend E. Aasland.
- bpo-43882: The presence of newline or tab characters in
parts of a URL could allow some forms of attacks.
- Following the controlling specification for URLs defined by
WHATWG urllib.parse() now removes ASCII newlines and tabs
from URLs, preventing such attacks.
- bpo-43472: Ensures interpreter-level audit hooks receive
the cpython.PyInterpreterState_New event when called
through the _xxsubinterpreters module.
- bpo-36384 (bsc#1185706, CVE-2021-29921): ipaddress module
no longer accepts any leading zeros in IPv4 address
strings. Leading zeros are ambiguous and interpreted as
octal notation by some libraries. For example the legacy
function socket.inet_aton() treats leading zeros as octal
notatation. glibc implementation of modern inet_pton() does
not accept any leading zeros. For a while the ipaddress
module used to accept ambiguous leading zeros.
- bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular
Expression Denial of Service (ReDoS) vulnerability in
urllib.request.AbstractBasicAuthHandler. The
ReDoS-vulnerable regex has quadratic worst-case complexity
and it allows cause a denial of service when identifying
crafted invalid RFCs. This ReDoS issue is on the client
side and needs remote attackers to control the HTTP server.
- bpo-42800: Audit hooks are now fired for frame.f_code,
traceback.tb_frame, and generator code/frame attribute
access.
* Core and Builtins
- bpo-43105: Importlib now resolves relative paths when
creating module spec objects from file locations.
- bpo-42924: Fix bytearray repetition incorrectly copying
data from the start of the buffer, even if the data is
offset within the buffer (e.g. after reassigning a slice at
the start of the bytearray to a shorter byte string).
* Library
- bpo-43993: Update bundled pip to 21.1.1.
- bpo-43937: Fixed the turtle module working with non-default
root window.
- bpo-43930: Update bundled pip to 21.1 and setuptools to
56.0.0
- bpo-43920: OpenSSL 3.0.0: load_verify_locations() now
returns a consistent error message when cadata contains no
valid certificate.
- bpo-43607: urllib can now convert Windows paths with \\?\
prefixes into URL paths.
- bpo-43284: platform.win32_ver derives the windows version
from sys.getwindowsversion().platform_version which in turn
derives the version from kernel32.dll (which can be of
a different version than Windows itself). Therefore change
the platform.win32_ver to determine the version using the
platform module’s _syscmd_ver private function to return an
accurate version.
- bpo-42248: [Enum] ensure exceptions raised in _missing__
are released
- bpo-43799: OpenSSL 3.0.0: define OPENSSL_API_COMPAT 1.1.1
to suppress deprecation warnings. Python requires OpenSSL
1.1.1 APIs.
- bpo-43794: Add ssl.OP_IGNORE_UNEXPECTED_EOF constants
(OpenSSL 3.0.0)
- bpo-43789: OpenSSL 3.0.0: Don’t call the password callback
function a second time when first call has signaled an
error condition.
- bpo-43788: The header files for ssl error codes are now
OpenSSL version-specific. Exceptions will now show correct
reason and library codes. The make_ssl_data.py script has
been rewritten to use OpenSSL’s text file with error codes.
- bpo-43655: tkinter dialog windows are now recognized as
dialogs by window managers on macOS and X Window.
- bpo-43534: turtle.textinput() and turtle.numinput() create
now a transient window working on behalf of the canvas
window.
- bpo-43522: Fix problem with hostname_checks_common_name.
OpenSSL does not copy hostflags from struct SSL_CTX to
struct SSL.
- bpo-42967: Allow bytes separator argument in
urllib.parse.parse_qs and urllib.parse.parse_qsl when
parsing str query strings. Previously, this raised
a TypeError.
- bpo-43176: Fixed processing of a dataclass that inherits
from a frozen dataclass with no fields. It is now correctly
detected as an error.
- bpo-41735: Fix thread locks in zlib module may go wrong in
rare case. Patch by Ma Lin.
- bpo-36470: Fix dataclasses with InitVars and replace().
Patch by Claudiu Popa.
- bpo-32745: Fix a regression in the handling of ctypes’
ctypes.c_wchar_p type: embedded null characters would cause
a ValueError to be raised. Patch by Zackery Spytz.
* Documentation
- bpo-43959: The documentation on the PyContextVar C-API was
clarified.
- bpo-43938: Update dataclasses documentation to express that
FrozenInstanceError is derived from AttributeError.
- bpo-43755: Update documentation to reflect that
unparenthesized lambda expressions can no longer be the
expression part in an if clause in comprehensions and
generator expressions since Python 3.9.
- bpo-43739: Fixing the example code in
Doc/extending/extending.rst to declare and initialize the
pmodule variable to be of the right type.
* Tests
- bpo-43961: Fix
test_logging.test_namer_rotator_inheritance() on Windows:
use os.replace() rather than os.rename(). Patch by Victor
Stinner.
- bpo-43842: Fix a race condition in the SMTP test of
test_logging. Don’t close a file descriptor (socket) from
a different thread while asyncore.loop() is polling the
file descriptor. Patch by Victor Stinner.
- bpo-43811: Tests multiple OpenSSL versions on GitHub
Actions. Use ccache to speed up testing.
- bpo-43791: OpenSSL 3.0.0: Disable testing of legacy
protocols TLS 1.0 and 1.1. Tests are failing with
TLSV1_ALERT_INTERNAL_ERROR.
- Refreshed patches:
- bpo-31046_ensurepip_honours_prefix.patch
- python-3.3.0b1-fix_date_time_compiler.patch
- Add vendorized files from bluez-devel to enable building support for
Bluetooth.
* Sun May 02 2021 Ben Greiner <code@bnavigator.de>
- Make sure to close the import_failed.map file after the exception
has been raised in order to avoid ResourceWarnings when the
failing import is part of a try...except block.
* Wed Apr 28 2021 Matej Cepl <mcepl@suse.com>
- Update to 3.9.4:
- bpo#43710: Reverted the fix for https://bugs.python.org/issue42500
as it changed the PyThreadState struct size and broke the 3.9.x ABI
in the 3.9.3 release (visible on 32-bit platforms using binaries
compiled using an earlier version of Python 3.9.x headers).
- bpo#26053: Fixed bug where the pdb interactive run command echoed
the args from the shell command line, even if those have been
overridden at the pdb prompt.
- bpo#42988 (bsc#1183374) CVE-2021-3426: Remove the getfile
feature of the pydoc module which could be abused to read
arbitrary files on the disk (directory traversal
vulnerability). Moreover, even source code of Python modules
can contain sensitive data like passwords. Vulnerability
reported by David Schwörer.
- bpo#43285: ftplib no longer trusts the IP address value
returned from the server in response to the PASV command by
default. This prevents a malicious FTP server from using the
response to probe IPv4 address and port combinations on the
client network. Code that requires the former vulnerable
behavior may set a trust_server_pasv_ipv4_address attribute
on their ftplib.FTP instances to True to re-enable it.
- bpo#43439: Add audit hooks for gc.get_objects(),
gc.get_referrers() and gc.get_referents(). Patch by Pablo
Galindo.
- bpo#43660: Fix crash that happens when replacing sys.stderr
with a callable that can remove the object while an exception
is being printed. Patch by Pablo Galindo.
- bpo#43555: Report the column offset for SyntaxError for
invalid line continuation characters. Patch by Pablo Galindo.
- bpo#43517: Fix misdetection of circular imports when using
from pkg.mod import attr, which caused false positives in
non-trivial multi-threaded code.
- bpo#35883: Python no longer fails at startup with a fatal
error if a command line argument contains an invalid Unicode
character. The Py_DecodeLocale() function now escapes byte
sequences which would be decoded as Unicode characters
outside the [U+0000; U+10ffff] range.
- bpo#43406: Fix a possible race condition where
PyErr_CheckSignals tries to execute a non-Python signal
handler.
- bpo#42500: Improve handling of exceptions near recursion
limit. Converts a number of Fatal Errors in RecursionErrors.
- bpo#43433: xmlrpc.client.ServerProxy no longer ignores query
and fragment in the URL of the server.
- bpo#35930: Raising an exception raised in a “future” instance
will create reference cycles.
- bpo#43577: Fix deadlock when using ssl.SSLContext debug
callback with ssl.SSLContext.sni_callback().
- bpo#43521: ast.unparse can now render NaNs and empty sets.
- bpo#43423: subprocess.communicate() no longer raises an
IndexError when there is an empty stdout or stderr IO buffer
during a timeout on Windows.
- bpo#27820: Fixed long-standing bug of smtplib.SMTP where
doing AUTH LOGIN with initial_response_ok=False will fail.
The cause is that SMTP.auth_login _always_ returns a password
if provided with a challenge string, thus non-compliant with
the standard for AUTH LOGIN. Also fixes bug with the test for
smtpd.
- bpo#43332: Improves the networking efficiency of http.client
when using a proxy via set_tunnel(). Fewer small send calls
are made during connection setup.
- bpo#43399: Fix ElementTree.extend not working on iterators
when using the Python implementation
- bpo#43316: The python -m gzip command line application now
properly fails when detecting an unsupported extension. It
exits with a non-zero exit code and prints an error message
to stderr.
- bpo#43260: Fix TextIOWrapper can not flush internal buffer
forever after very large text is written.
- bpo#42782: Fail fast in shutil.move() to avoid creating
destination directories on failure.
- bpo#37193: Fixed memory leak in socketserver.ThreadingMixIn
introduced in Python 3.7.
- bpo#43199: Answer “Why is there no goto?” in the Design and
History FAQ.
- bpo#43407: Clarified that a result from time.monotonic(),
time.perf_counter(), time.process_time(), or
time.thread_time() can be compared with the result from any
following call to the same function - not just the next
immediate call.
- bpo#27646: Clarify that ‘yield from <expr>’ works with any
iterable, not just iterators.
- bpo#36346: Update some deprecated unicode APIs which are
documented as “will be removed in 4.0” to “3.12”. See PEP 623
for detail.
- bpo#37945: Fix test_getsetlocale_issue1813() of test_locale:
skip the test if setlocale() fails. Patch by Victor Stinner.
- bpo#41561: Add workaround for Ubuntu’s custom OpenSSL
security level policy.
- bpo#43288: Fix test_importlib to correctly skip Unicode file
tests if the fileystem does not support them.
- bpo#43617: Improve configure.ac: Check for presence of
autoconf-archive package and remove our copies of M4 macros.
- bpo#42225: Document that IDLE can fail on Unix either from
misconfigured IP masquerage rules or failure displaying
complex colored (non-ascii) characters.
- bpo#43283: Document why printing to IDLE’s Shell is often
slower than printing to a system terminal and that it can be
made faster by pre-formatting a single string before
printing.
* Fri Feb 19 2021 Matej Cepl <mcepl@suse.com>
- Update to 3.9.2:
- bpo#42938 (bsc#1181126): Avoid static buffers when computing
the repr of ctypes.c_double and ctypes.c_longdouble
values. This issue was assigned CVE-2021-3177.
- bpo#42967 (bsc#1182379): Fix web cache poisoning
vulnerability by defaulting the query args separator to &,
and allowing the user to choose a custom separator. This
issue was assigned CVE-2021-23336.
- Upstreamed patches were removed:
- CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch
- bsc1167501-invalid-alignment.patch
- skip_random_failing_tests.patch
- CVE-2019-5010-null-defer-x509-cert-DOS.patch
* Tue Feb 09 2021 Steve Kowalik <steven.kowalik@suse.com>
- Add Obsoletes for python3-base when primary interpreter is set to
properly replace it during upgrades. (bsc#1181324)
* Mon Feb 08 2021 Matej Cepl <mcepl@suse.com>
- Update to 3.9.1:
Security bugs:
- Prevented potential DoS attack via CPU and RAM exhaustion
when processing malformed Apple Property List files in binary
format.
- The plistlib module no longer accepts entity declarations in
XML plist files to avoid XML vulnerabilities. This should not
affect users as entity declarations are not used in regular
plist files.
- Add volatile to the accumulator variable in
hmac.compare_digest, making constant-time-defeating
optimizations less likely.
Core and Builtins
- Allow assignment expressions in set literals and set
comprehensions as per PEP 572. Patch by Pablo Galindo.
- Fix a regression introduced by the new parser, where an
unparenthesized walrus operator was not allowed within
generator expressions.
- types.GenericAlias objects can now be the targets of
weakrefs.
- Fixed a bug in the PEG parser that was causing crashes in
debug mode. Now errors are checked in left-recursive rules to
avoid cases where such errors do not get handled in time and
appear as long-distance crashes in other places.
- Fixed a possible crash in the PEG parser when checking for
the ‘!=’ token in the barry_as_flufl rule. Patch by Pablo
Galindo.
- Fix handling of errors during creation of PyFunctionObject,
which resulted in operations on uninitialized memory. Patch
by Yonatan Goldschmidt.
- Fix a bug in the parser, where a curly brace following
a primary didn’t fail immediately. This led to invalid
expressions like a {b} to throw a SyntaxError with a wrong
offset, or invalid expressions ending with a curly brace like
a { to not fail immediately in the REPL.
- Fix possible buffer overflow in the new parser when checking
for continuation lines. Patch by Pablo Galindo.
- Run the parser two times. On the first run, disable all the
rules that only generate better error messages to gain
performance. If there’s a parse failure, run the parser
a second time with those enabled.
- Document the default implementation of object.__eq__.
- Fix peephole optimizer misoptimize conditional jump
+ JUMP_IF_NOT_EXC_MATCH pair.
- The garbage collector now tracks all user-defined classes.
Patch by Brandt Bucher.
- Fixed potential issues with removing not completely
initialized module from sys.modules when import fails.
- Star-unpacking is now allowed for with item’s targets in the
PEG parser.
- Fixed stack overflow in issubclass() and isinstance() when
getting the __bases__ attribute leads to infinite recursion.
- When loading a native module and a load failure occurs,
prevent a possible UnicodeDecodeError when not running in
a UTF-8 locale by decoding the load error message using the
current locale’s encoding.
- Correctly count control blocks in ‘except’ in compiler.
Ensures that a syntax error, rather a fatal error, occurs for
deeply nested, named exception handlers.
Library
- types.GenericAlias will now raise a TypeError when attempting
to initialize with a keyword argument. Previously, this would
cause the interpreter to crash if the interpreter was
compiled with debug symbols. This does not affect
interpreters compiled for release. Patch by Ken Jin.
- CGIHTTPRequestHandler.run_cgi() HTTP_ACCEPT improperly
parsed. Replace the special purpose getallmatchingheaders
with generic get_all method and add relevant tests.
- inspect.findsource() now raises OSError instead of IndexError
when co_lineno of a code object is greater than the file
length. This can happen, for example, when a file is edited
after it was imported. PR by Irit Katriel.
- Fix handling of trailing comments by inspect.getsource().
- ChainMap.__iter__ no longer calls __getitem__ on underlying
maps
- TracebackException no longer holds a reference to the
exception’s traceback object. Consequently, instances of
TracebackException for equivalent but non-equal exceptions
now compare as equal.
- We fixed an issue in pickle.whichmodule in which importing
multiprocessing could change the how pickle identifies which
module an object belongs to, potentially breaking the
unpickling of those objects.
- Clarify the error message for asyncio.IncompleteReadError
when expected is None.
- Extracting a symlink from a tarball should succeed and
overwrite the symlink if it already exists. The fix is to
remove the existing file or symlink before extraction. Based
on patch by Chris AtLee, Jeffrey Kintscher, and Senthil
Kumaran.
- Fixed tkinter.ttk.Style.map(). The function accepts now the
representation of the default state as empty sequence (as
returned by Style.map()). The structure of the result is now
the same on all platform and does not depend on the value of
wantobjects.
- Fix various issues with typing.Literal parameter handling
(flatten, deduplicate, use type to cache key). Patch provided
by Yurii Karabas.
- Fix the threading.Thread class at fork: do nothing if the
thread is already stopped (ex: fork called at Python exit).
Previously, an error was logged in the child process.
- The onerror callback from shutil.rmtree now receives correct
function when os.open fails.
- Fix os.sendfile() on illumos.
- Fixed writing binary Plist files larger than 4 GiB.
- The repr() of typing types containing Generic Alias Types
previously did not show the parameterized types in the
GenericAlias. They have now been changed to do so.
- webbrowser: Ignore NotADirectoryError when calling
xdg-settings.
- binhex.binhex() consisently writes macOS 9 line endings.
- Fix a stack overflow error for asyncio Task or Future repr().
- The overflow occurs under some circumstances when a Task or
Future recursively returns itself.
- Fix memory leak in subprocess.Popen() in case an uid (gid)
specified in user (group, extra_groups) overflows uid_t
(gid_t).
- Improve asyncio.wait function to create the futures set just
one time.
- InvalidFileException and RecursionError are now the only
errors caused by loading malformed binary Plist file
(previously ValueError and TypeError could be raised in some
specific cases).
- Pickling heap types implemented in C with protocols 0 and
1 raises now an error instead of producing incorrect data.
- plistlib: fix parsing XML plists with hexadecimal integer
values
- Fix an incorrectly formatted error from
_codecs.charmap_decode() when called with a mapped value
outside the range of valid Unicode code points. PR by Max
Bernstein.
- Fix pickling pure Python datetime.time subclasses. Patch by
Dean Inwood.
- Fixed a bug that was causing ctypes.util.find_library() to
return None when triying to locate a library in an
environment when gcc>=9 is available and ldconfig is not.
Patch by Pablo Galindo
- C14N 2.0 serialisation in xml.etree.ElementTree failed for
unprefixed attributes when a default namespace was defined.
- Fix a bug in the symtable module that was causing
module-scope global variables to not be reported as both
local and global. Patch by Pablo Galindo.
- str() for the type attribute of the tkinter.Event object
always returns now the numeric code returned by Tk instead of
the name of the event type.
- fix tkinter.EventType Enum so all members are strings, and
none are tuples
- Fix SQLite3 segfault when backing up closed database. Patch
contributed by Peter David McCormick.
- Fix the tarfile module to write only basename of TAR file to
GZIP compression header.
- Allow ctypes.wintypes to be imported on non-Windows systems.
- shutil.which() now ignores empty entries in PATHEXT instead
of treating them as a match.
- Fix time-of-check/time-of-action issue in
subprocess.Popen.send_signal.
- Fix --outfile for cProfile / profile not writing the output
file in the original directory when the program being
profiled changes the working directory. PR by Anthony
Sottile.
- ZipFile truncates files to avoid corruption when a shorter
comment is provided in append (“a”) mode. Patch by Jan Mazur.
- Fixed KeyError exception when flattening an email to a string
attempts to replace a non-existent Content-Transfer-Encoding
header.
Documentation
- Fix the URL for the IMAP protocol documents.
- Document __format__ functionality for IP addresses.
- Clarify that subscription expressions are also valid for
certain classes and types in the standard library, and for
user-defined classes and types if the classmethod
__class_getitem__() is provided.
- Documented generic alias type and types.GenericAlias. Also
added an entry in glossary for generic types.
- In Programming FAQ “Sequences (Tuples/Lists)” section, add
“How do you remove multiple items from a list”.
- Fix RemovedInSphinx40Warning when building the documentation.
Patch by Dong-hee Na.
- Update the refcounts info of PyType_FromModuleAndSpec.
- Fix tarfile’s extractfile documentation
- Document some restrictions on the default string
representations of numeric classes.
Tests
- Reenable test_gdb on gdb 9.2 and newer:
https://bugzilla.redhat.com/show_bug.cgi?id=1866884 bug is
fixed in gdb 10.1.
- Fix test_asyncio.test_call_later() race condition: don’t
measure asyncio performance in the call_later() unit test.
The test failed randomly on the CI.
- Include _testinternalcapi module in Windows installer for
test suite
- Fix test_logging.test_race_between_set_target_and_flush():
the test now waits until all threads complete to avoid
leaking running threads.
- Avoid a test failure in test_lib2to3 if the module has
already imported at the time the test executes. Patch by
Pablo Galindo.
- Tests for CJK codecs no longer call eval() on content
received via HTTP.
- Fix test_site.test_license_exists_at_url(): call
urllib.request.urlcleanup() to reset the global
urllib.request._opener. Patch by Victor Stinner.
- test_ssl: skip test_min_max_version_mismatch when TLS 1.0 is
not available
- Add tests for SIGINT handling in the runpy module.
- Fixed a failure in test_tk.test_widgets.ScaleTest happening
when executing the test with Tk 8.6.10.
Build
- Fix a race condition in “make regen-all” when make -jN option
is used to run jobs in parallel. The clinic.py script now
only use atomic write to write files. Moveover, generated
files are now left unchanged if the content does not change,
to not change the file modification time.
- Update Py_UNREACHABLE to use __builtin_unreachable() if only
the compiler is able to use it. Patch by Dong-hee Na.
- Addressed three compiler warnings found by undefined behavior
sanitizer (ubsan).
IDLE
- Fix reporting offset of the RE error in searchengine.
- Get docstrings for IDLE calltips more often by using
inspect.getdoc.
- Mostly finish using ttk widgets, mainly for editor, settings,
and searches. Some patches by Mark Roseman.
- Use ‘IDLE Shell’ as shell title
- Rewrite the Calltips doc section.
- In calltips, stop reminding that ‘/’ marks the end of
positional-only arguments.
- Typing opening and closing parentheses inside the parentheses
of a function call will no longer cause unnecessary
“flashing” off and on of an existing open call-tip, e.g. when
typed in a string literal.
C API
- Fix potential crash in deallocating method objects when
dynamically allocated PyMethodDef’s lifetime is managed
through the self argument of a PyCFunction.
- Py_FileSystemDefaultEncodeErrors and Py_UTF8Mode are
available again in limited API.
- Readjustet and reapplied patches:
- CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch
- bpo-31046_ensurepip_honours_prefix.patch
- python-3.3.0b1-fix_date_time_compiler.patch
- skip_random_failing_tests.patch
- sphinx-update-removed-function.patch
* Fri Jan 29 2021 Matej Cepl <mcepl@suse.com>
- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution.
* Tue Jan 05 2021 Matej Cepl <mcepl@suse.com>
- (bsc#1180125) We really don't Require python-rpm-macros package.
Unnecessary dependency.

Files

/usr/lib64/python3.9/lib-dynload/_tkinter.cpython-39-s390x-linux-gnu.so
/usr/lib64/python3.9/tkinter
/usr/lib64/python3.9/tkinter/__init__.py
/usr/lib64/python3.9/tkinter/__main__.py
/usr/lib64/python3.9/tkinter/__pycache__
/usr/lib64/python3.9/tkinter/__pycache__/__init__.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/__init__.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/__init__.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/__main__.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/__main__.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/__main__.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/colorchooser.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/colorchooser.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/colorchooser.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/commondialog.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/commondialog.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/commondialog.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/constants.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/constants.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/constants.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/dialog.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/dialog.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/dialog.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/dnd.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/dnd.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/dnd.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/filedialog.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/filedialog.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/filedialog.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/font.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/font.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/font.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/messagebox.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/messagebox.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/messagebox.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/scrolledtext.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/scrolledtext.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/scrolledtext.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/simpledialog.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/simpledialog.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/simpledialog.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/tix.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/tix.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/tix.cpython-39.pyc
/usr/lib64/python3.9/tkinter/__pycache__/ttk.cpython-39.opt-1.pyc
/usr/lib64/python3.9/tkinter/__pycache__/ttk.cpython-39.opt-2.pyc
/usr/lib64/python3.9/tkinter/__pycache__/ttk.cpython-39.pyc
/usr/lib64/python3.9/tkinter/colorchooser.py
/usr/lib64/python3.9/tkinter/commondialog.py
/usr/lib64/python3.9/tkinter/constants.py
/usr/lib64/python3.9/tkinter/dialog.py
/usr/lib64/python3.9/tkinter/dnd.py
/usr/lib64/python3.9/tkinter/filedialog.py
/usr/lib64/python3.9/tkinter/font.py
/usr/lib64/python3.9/tkinter/messagebox.py
/usr/lib64/python3.9/tkinter/scrolledtext.py
/usr/lib64/python3.9/tkinter/simpledialog.py
/usr/lib64/python3.9/tkinter/tix.py
/usr/lib64/python3.9/tkinter/ttk.py

Generated by rpm2html 1.8.1

Fabrice Bellet, Thu Nov 7 00:51:36 2024

python39-tk-3.9.20-5.1 RPM for s390x

From OpenSuSE Ports Tumbleweed for s390x

Provides

Requires

License

Changelog

Files