Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Co-authored-by: Savannah Ostrowski <savannah@python.org> Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Stan Ulbrych <stan@ulbrych.org>
Sam Gross [Tue, 10 Mar 2026 13:31:52 +0000 (09:31 -0400)]
[3.14] gh-145685: Stop the world when updating MRO of existing types (gh-145707) (#145715)
We already have a stop-the-world pause elsewhere in this code path
(type_set_bases) and this makes will make it easier to avoid contention
on the TYPE_LOCK when looking up names in the MRO hierarchy.
[3.14] gh-145615: Fix mimalloc page leak in the free-threaded build (gh-145626) (#145691)
Fix three issues that caused mimalloc pages to be leaked until the
owning thread exited:
1. In _PyMem_mi_page_maybe_free(), move pages out of the full queue
when relying on QSBR to defer freeing the page. Pages in the full
queue are never searched by mi_page_queue_find_free_ex(), so a page
left there is unusable for allocations.
2. Move _PyMem_mi_page_clear_qsbr() from _mi_page_free_collect() to
_mi_page_thread_free_collect() where it only fires when all blocks
on the page are free (used == 0). The previous placement was too
broad: it cleared QSBR state whenever local_free was non-NULL, but
_mi_page_free_collect() is called from non-allocation paths (e.g.,
page visiting in mi_heap_visit_blocks) where the page is not being
reused.
3. In _PyMem_mi_page_maybe_free(), use the page's heap tld to find the
correct thread state for QSBR list insertion instead of
PyThreadState_GET(). During stop-the-world pauses, the function may
process pages belonging to other threads, so the current thread
state is not necessarily the owner of the page.
[3.14] gh-145219: Add Emscripten cross-build and clean configurability (GH-145581) (#145654)
Modifies the Emscripten build script to allow for custom cross-build directory
names, and to only clean Emscripten-specific paths (optionally including the
build python).
(cherry picked from commit 015613384fea7a00bb2077760e325e5baab6814b)
Co-authored-by: Hood Chatham <roberthoodchatham@gmail.com> Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
[3.14] gh-145177: Support multiple Emscripten versions for Emscripten buildbot (GH-145180) (#145582)
Adds an `--emsdk-cache` argument to the Emscripten build script and an
emscripten_version.txt file. If the `--emsdk-cache` argument is passed, the build script
will look in `emscripten_version.txt` to get the expected emsdk version is installed in
a folder called e.g., 4.0.12 in the directory indicated by the `--emsdk-cache` argument,
and run the build with that Emscripten tooling activated.
(cherry picked from commit c3fb0d9d96902774c08b199dda0479a8d31398a5)
[3.14] gh-145376: Fix crashes in `md5module.c` and `hmacmodule.c` (GH-145422) (#145610)
gh-145376: Fix crashes in `md5module.c` and `hmacmodule.c` (GH-145422)
Fix a possible NULL pointer dereference in `md5module.c` and a double-free in `hmacmodule.c`.
Those crashes only occur in error paths taken when the interpreter fails to allocate memory.
(cherry picked from commit c1d77683213c400fca144692654845e6f5418981)
[3.14] gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371) (#145586)
gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371)
Disallow usage of control characters in status in wsgiref.handlers
to prevent HTTP header injections.
(cherry picked from commit d931725bc850cd096f6703bc285e885f1e015f05)
Co-authored-by: Benedikt Johannes <benedikt.johannes.hofer@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org>
[3.14] gh-122941: Fix test_launcher sporadic failures via py.ini isolation (GH-145090)
Adds _PYLAUNCHER_INIDIR as a private variable since the launcher is deprecated and not getting new features.
(cherry picked from commit 6cdbd7bc5d4ee63459d03a944477ea8671a05198)
[3.14] gh-145557: Check ctypes is available in test_external_inspection (GH-145558) (#145565)
gh-145557: Check ctypes is available in test_external_inspection (GH-145558)
Currently TestGetStackTrace.test_self_trace_after_ctypes_import() will fail if
the _ctypes extension is not built. Make it match test_ctypes by skipping
the test in that case.
(cherry picked from commit 7232883adfc28f94a62d2e79c897db59711702d7)
Co-authored-by: Alex Malyshev <lex.malyshev@gmail.com>
[3.14] gh-143304: Fix ctypes.CDLL to honor handle parameter on POSIX systems (GH-143318) (GH-145172)
The handle parameter was being ignored in the POSIX implementation
of CDLL._load_library(), causing it to always call _dlopen() even
when a valid handle was provided. This was a regression introduced
in recent refactoring.
(cherry picked from commit 27ded243485670fa836c9bb421e37a6ef16eca8e)
Co-authored-by: Arjit Singh Grover <143692910+Koolvansh07@users.noreply.github.com> Co-authored-by: Petr Viktorin <encukou@gmail.com>
[3.14] gh-145455: Show output of blurb & sphinx-build version commands (GH-145457) (#145461)
gh-145455: Show output of blurb & sphinx-build version commands (GH-145457)
In gh-145455, an outdated dependency caused an import error that was not
printed out (`2>&1`); the message instead said that the tools are missing.
Don't redirect stderr, to show warnings and failures.
Also, switch `blurb` to output a version on a single line (`--version` rather
than `help`), and, and don't redirect stdout either.
This results in two version info lines being printed out. These get drowned
in typical Sphinx output, and can be helpful when debugging.
(cherry picked from commit f1de65b3669226d563802a32b78a2294e971151a)
[3.14] gh-142352: Fix `asyncio` `start_tls()` to transfer buffered data from StreamReader (GH-142354) (#145363)
gh-142352: Fix `asyncio` `start_tls()` to transfer buffered data from StreamReader (GH-142354)
(cherry picked from commit 0598f4a8999b96409e0a2bf9c480afc76a876860)
This undoes a change made as a part of PR 137470, for compatibility with EMSDK
4.0.19. It adds `emscripten_trampoline` field in `pycore_runtime_structs.h`
and initializes it from JS initialization code with the wasm-gc based trampoline
if possible. Otherwise we fall back to the JS trampoline.
(cherry picked from commit 43fdb7037e76c18d9545ac11b2f1e3e398152ada)
[3.14] gh-142518: Move thread safety sections into a new page (GH-144716) (#145223)
- Create a new page for thread safety notes for built-in types
- Move thread safety notes for `list` into the new page
- Move thread safety notes for `dict` into the new page
---------
(cherry picked from commit 017ccd3bf420b79333f79f44a470c9c30a09aadc)
Co-authored-by: Lysandros Nikolaou <lisandrosnik@gmail.com> Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
[3.14] gh-137335: Fix unlikely name conflicts for named pipes in multiprocessing and asyncio on Windows (GH-137389) (GH-145170)
Since os.stat() raises an OSError for existing named pipe "\\.\pipe\...",
os.path.exists() always returns False for it, and tempfile.mktemp() can
return a name that matches an existing named pipe.
So, tempfile.mktemp() cannot be used to generate unique names for named
pipes. Instead, CreateNamedPipe() should be called in a loop with
different names until it completes successfully.
(cherry picked from commit d6a71f4690c702892644b1fbae90ae9ef733a8ab)
[3.14] gh-66305: Fix a hang on Windows in the tempfile module (GH-144672) (GH-145168)
It occurred when trying to create a temporary file or subdirectory in
a non-writable directory.
(cherry picked from commit ca66d3c40cd9ac1fb94dd7cd79ccb8fecf019527)
Rafael Santos [Tue, 24 Feb 2026 02:52:57 +0000 (20:52 -0600)]
[3.14] gh-145028: Fix blake2 tests in test_hashlib when it is missing due to configure --without-builtin-hashlib-hashes (GH-145029) (#145164)
[3.14] gh-145028: Fix blake2 tests in test_hashlib when it is missing due to build config (GH-145029)
specifically configure --without-builtin-hashlib-hashes means the otherwise guaranteed available blake2 family will not exist. this allows the test suite to still pass.
(cherry picked from commit 273d5062ca17ac47354486f3fc6e672a04cf22e0)
Bénédikt Tran [Sat, 21 Feb 2026 15:04:31 +0000 (16:04 +0100)]
[3.14] gh-143698: correctly check `scheduler` and `setpgroup` values for `os.posix_spawn[p]` (GH-143699) (#145073)
Fix an issue where passing invalid arguments to `os.posix_spawn[p]` functions
raised a SystemError instead of a TypeError, and allow to explicitly use `None`
for `scheduler` and `setpgroup` as specified in the docs.
gh-144694: Fix re.Match.group() doc claiming [1..99] range limit (GH-144696)
The documentation incorrectly stated that numeric group arguments
must be in the range [1..99]. This limit was removed in Python 3.5
(bpo-22437). Replace with "a positive integer" since the next
sentence already documents the IndexError for out-of-range values.
(cherry picked from commit 85021bc2477f3ab394172b6dda3110e59f4777dd)
gh-144156: Fix email header folding concatenating encoded words (GH-144692)
The fix for gh-92081 (gh-92281) was unfortunately flawed, and broke whitespace handling for encoded word patterns that had previously been working correctly but had no corresponding tests, unfortunately in a way that made the resulting headers not RFC compliant, in such a way that Yahoo started rejecting the resulting emails. This fix was released in 3.14 alpha 1, 3.13 beta 2 and 3.12.5. This PR fixes the original problem in a way that does not break anything, and in fact fixes a small pre-existing bug (a spurious whitespace after the ':' of the header label if the header value is immediately wrapped on to the next line). (RDM)
(cherry picked from commit 0f7cd5544a4dd1d7cf892c93c661510d619caaa7)
Co-authored-by: Robsdedude <dev@rouvenbauer.de> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: R. David Murray <rdmurray@bitdance.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>