|
| 1 | +.. date: 2024-02-18-03-14-40 |
| 2 | +.. gh-issue: 115398 |
| 3 | +.. nonce: tzvxH8 |
| 4 | +.. release date: 2024-03-19 |
| 5 | +.. section: Security |
| 6 | +
|
| 7 | +Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding |
| 8 | +five new methods: |
| 9 | + |
| 10 | +* :meth:`xml.etree.ElementTree.XMLParser.flush` |
| 11 | +* :meth:`xml.etree.ElementTree.XMLPullParser.flush` |
| 12 | +* :meth:`xml.parsers.expat.xmlparser.GetReparseDeferralEnabled` |
| 13 | +* :meth:`xml.parsers.expat.xmlparser.SetReparseDeferralEnabled` |
| 14 | +* :meth:`xml.sax.expatreader.ExpatParser.flush` |
| 15 | + |
| 16 | +.. |
| 17 | +
|
| 18 | +.. date: 2024-02-13-15-14-39 |
| 19 | +.. gh-issue: 115399 |
| 20 | +.. nonce: xT-scP |
| 21 | +.. section: Security |
| 22 | +
|
| 23 | +Update bundled libexpat to 2.6.0 |
| 24 | + |
| 25 | +.. |
| 26 | +
|
| 27 | +.. date: 2024-01-26-22-14-09 |
| 28 | +.. gh-issue: 114572 |
| 29 | +.. nonce: t1QMQD |
| 30 | +.. section: Security |
| 31 | +
|
| 32 | +:meth:`ssl.SSLContext.cert_store_stats` and |
| 33 | +:meth:`ssl.SSLContext.get_ca_certs` now correctly lock access to the |
| 34 | +certificate store, when the :class:`ssl.SSLContext` is shared across |
| 35 | +multiple threads. |
| 36 | + |
| 37 | +.. |
| 38 | +
|
| 39 | +.. date: 2024-01-02-19-52-23 |
| 40 | +.. gh-issue: 113659 |
| 41 | +.. nonce: DkmnQc |
| 42 | +.. section: Security |
| 43 | +
|
| 44 | +Skip ``.pth`` files with names starting with a dot or hidden file attribute. |
| 45 | + |
| 46 | +.. |
| 47 | +
|
| 48 | +.. date: 2023-10-27-19-38-33 |
| 49 | +.. gh-issue: 102388 |
| 50 | +.. nonce: vd5YUZ |
| 51 | +.. section: Core and Builtins |
| 52 | +
|
| 53 | +Fix a bug where ``iso2022_jp_3`` and ``iso2022_jp_2004`` codecs read out of |
| 54 | +bounds |
| 55 | + |
| 56 | +.. |
| 57 | +
|
| 58 | +.. date: 2024-02-09-19-41-48 |
| 59 | +.. gh-issue: 115197 |
| 60 | +.. nonce: 20wkWH |
| 61 | +.. section: Library |
| 62 | +
|
| 63 | +``urllib.request`` no longer resolves the hostname before checking it |
| 64 | +against the system's proxy bypass list on macOS and Windows. |
| 65 | + |
| 66 | +.. |
| 67 | +
|
| 68 | +.. date: 2024-02-08-14-21-28 |
| 69 | +.. gh-issue: 115133 |
| 70 | +.. nonce: ycl4ko |
| 71 | +.. section: Library |
| 72 | +
|
| 73 | +Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat |
| 74 | +2.6.0. |
| 75 | + |
| 76 | +.. |
| 77 | +
|
| 78 | +.. date: 2023-12-01-16-09-59 |
| 79 | +.. gh-issue: 81194 |
| 80 | +.. nonce: FFad1c |
| 81 | +.. section: Library |
| 82 | +
|
| 83 | +Fix a crash in :func:`socket.if_indextoname` with specific value (UINT_MAX). |
| 84 | +Fix an integer overflow in :func:`socket.if_indextoname` on 64-bit |
| 85 | +non-Windows platforms. |
| 86 | + |
| 87 | +.. |
| 88 | +
|
| 89 | +.. date: 2023-09-28-13-15-51 |
| 90 | +.. gh-issue: 109858 |
| 91 | +.. nonce: 43e2dg |
| 92 | +.. section: Library |
| 93 | +
|
| 94 | +Protect :mod:`zipfile` from "quoted-overlap" zipbomb. It now raises |
| 95 | +BadZipFile when try to read an entry that overlaps with other entry or |
| 96 | +central directory. |
| 97 | + |
| 98 | +.. |
| 99 | +
|
| 100 | +.. date: 2022-12-01-16-57-44 |
| 101 | +.. gh-issue: 91133 |
| 102 | +.. nonce: LKMVCV |
| 103 | +.. section: Library |
| 104 | +
|
| 105 | +Fix a bug in :class:`tempfile.TemporaryDirectory` cleanup, which now no |
| 106 | +longer dereferences symlinks when working around file system permission |
| 107 | +errors. |
| 108 | + |
| 109 | +.. |
| 110 | +
|
| 111 | +.. date: 2024-02-14-20-17-04 |
| 112 | +.. gh-issue: 115399 |
| 113 | +.. nonce: fb9a0R |
| 114 | +.. section: Documentation |
| 115 | +
|
| 116 | +Document CVE-2023-52425 of Expat <2.6.0 under "XML vulnerabilities". |
| 117 | + |
| 118 | +.. |
| 119 | +
|
| 120 | +.. date: 2024-02-01-14-35-05 |
| 121 | +.. gh-issue: 111239 |
| 122 | +.. nonce: SO7SUF |
| 123 | +.. section: Windows |
| 124 | +
|
| 125 | +Update Windows builds to use zlib v1.3.1. |
| 126 | + |
| 127 | +.. |
| 128 | +
|
| 129 | +.. date: 2023-09-29-10-35-29 |
| 130 | +.. gh-issue: 109991 |
| 131 | +.. nonce: GmuzGZ |
| 132 | +.. section: Windows |
| 133 | +
|
| 134 | +Windows builds now use OpenSSL 1.1.1w. Note that OpenSSL 1.1 has reached its |
| 135 | +end of life and no future fixes will be made, and this version of Python is |
| 136 | +no longer receiving maintenance fixes and will not be updated to OpenSSL |
| 137 | +3.0. |
| 138 | + |
| 139 | +.. |
| 140 | +
|
| 141 | +.. date: 2023-09-27-23-31-54 |
| 142 | +.. gh-issue: 109991 |
| 143 | +.. nonce: sUUYY8 |
| 144 | +.. section: Tools/Demos |
| 145 | +
|
| 146 | +Update GitHub CI workflows to use OpenSSL 3.0.11 and multissltests to use |
| 147 | +1.1.1w, 3.0.11, and 3.1.3. |
0 commit comments