Gregory P. Smith [Mon, 16 Mar 2026 05:50:19 +0000 (22:50 -0700)]
gh-140814: Fix freeze_support() setting start method as side effect (GH-144608)
freeze_support() called get_start_method() without allow_none=True,
which locked in the default start method context. This caused a
subsequent set_start_method() call to raise "context has already been
set". Use allow_none=True and accept None as a matching value, since
spawn.freeze_support() independently detects spawned child processes.
Test that freeze_support() does not lock in the default start method,
which would prevent a subsequent set_start_method() call.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Stan Ulbrych [Sun, 15 Mar 2026 21:46:06 +0000 (21:46 +0000)]
gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (#145987)
Fix C stack overflow (CVE-2026-4224) when an Expat parser
with a registered `ElementDeclHandler` parses inline DTD
containing deeply nested content model.
the lazy imports PEP initial implementation (3.15 alpha) inadvertently incremented the length of the sys.flags tuple. In a way that did not do anything useful or related to the lazy imports setting (it exposed sys.flags.gil in the tuple). This fixes that to hard code the length to the 3.13 & 3.14 released length of 18 and have our tests and code comments make it clear that we've since stopped making new sys.flags attributes available via sequence index.
Serhiy Storchaka [Fri, 13 Mar 2026 11:05:41 +0000 (13:05 +0200)]
gh-145850: Change some implementation details in struct.Struct (GH-145851)
* calling it with non-ASCII string format will now raise a ValueError
instead of UnicodeEncodeError
* calling it with non-ASCII bytes format will now raise a ValueError
instead of struct.error
* getting the format attribute of uninitialized object will now raise
an AttributeError instead of RuntimeError.
Victor Stinner [Thu, 12 Mar 2026 22:48:51 +0000 (23:48 +0100)]
gh-145801: Use gcc -fprofile-update=atomic for PGO builds (#145802)
When Python build is optimized with GCC using PGO, use
-fprofile-update=atomic option to use atomic operations when updating
profile information. This option reduces the risk of gcov Data Files
(.gcda) corruption which can cause random GCC crashes.
Charlie Lin [Thu, 12 Mar 2026 16:56:07 +0000 (12:56 -0400)]
gh-145717: Add a few Microsoft-specific MIME types, and synchronize between `mimetypes` module and tests (#145718)
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Petr Viktorin <encukou@gmail.com>
Thomas Kowalski [Thu, 12 Mar 2026 13:27:07 +0000 (14:27 +0100)]
gh-145681: do not deallocate list buffer in `_PyList_AsTupleAndClear` (GH-145680)
Setting the size to 0 turns the list contents into overallocated memory that the deallocator will free.
Ownership is transferred to the new tuple so no refcount adjustment is needed.
Serhiy Storchaka [Thu, 12 Mar 2026 07:44:11 +0000 (09:44 +0200)]
gh-143715: Deprecate incomplete initialization of struct.Struct() (GH-145580)
* Struct.__new__() will require a mandatory argument (format)
* Calls of __init__() method with a different format argument on initialized
Struct are deprecated
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
Shrey Naithani [Wed, 11 Mar 2026 12:08:48 +0000 (17:38 +0530)]
gh-145587: fix busy loop in multiprocessing.connection.wait on Windows (GH-145597)
Ensure wait() blocks for the specified timeout when object_list is empty, preventing 100% CPU usage. This aligns the Windows behavior with the Unix implementation.
Co-authored-by: AN Long <aisk@users.noreply.github.com>
gh-145633: Remove support for ancient ARM platforms with mixed-endian doubles (#145634)
* Drop DOUBLE_IS_ARM_MIXED_ENDIAN_IEEE754 macro.
* Use DOUBLE_IS_BIG/LITTLE_ENDIAN_IEEE754 to detect endianness of
float/doubles.
* Drop "unknown_format" code path in PyFloat_Pack/Unpack*().
Co-authored-by: Victor Stinner <vstinner@python.org>
Previously, component-wise relative error bound was tested. However,
such bound can't exist already for complex multiplication as one can be
used to perform subtraction of floating-point numbers, e.g. x and y for
z0=1+1j and z1=x+yj.
```pycon
>>> x, y = 1e-9+1j, 1+1j
>>> a = x*y*y.conjugate()/2;a
(1.0000000272292198e-09+1j)
>>> b = x*(y*y.conjugate()/2);b
(1e-09+1j)
>>> b == x
True
>>> (a.real-b.real)/math.ulp(b.real) 131672427.0
```
Farhan Saif [Tue, 10 Mar 2026 16:23:39 +0000 (11:23 -0500)]
gh-125053: Document that ob_mutex must only be used via critical section API (#144599)
Add a warning in the free-threading extensions howto explaining that
PyObject.ob_mutex is reserved for the critical section API and must not
be locked directly with PyMutex_Lock, as this can cause deadlocks.
Extension authors who need their own lock should add a separate PyMutex
field to their object struct.
Also add an ob_mutex member entry under PyObject in the C API reference
(Doc/c-api/structures.rst) with a cross-reference to the howto.
Co-authored-by: Victor Stinner <vstinner@python.org>
Sam Gross [Mon, 9 Mar 2026 22:41:07 +0000 (18:41 -0400)]
gh-145685: Stop the world when updating MRO of existing types (gh-145707)
We already have a stop-the-world pause elsewhere in this code path
(type_set_bases) and this makes will make it easier to avoid contention
on the TYPE_LOCK when looking up names in the MRO hierarchy.
Also use deferred reference counting for non-immortal MROs.