[3.14] gh-103878: Document that the cancelled file dialog value is only falsy (GH-152429) (GH-152627)
Its exact type (empty string, tuple, list or None) varies between
platforms and Tk versions, so advise testing the result for truth.
(cherry picked from commit 9dd3340a623093b5d0ff054d5d42c370bb09221c)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-69134: Wait until mapped in keyboard virtual-event tests (GH-152599) (GH-152606)
test_virtual_events and test_selection_event generate key events after
focus_force(). On Windows these are only delivered once the toplevel is
mapped, so they could be dropped and the test fail. Wait until the
widget is mapped, as the other GUI tests already do.
(cherry picked from commit be4eebb8386d07f360dd835a0ecb4a1eb6385736)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-152228: Fix an assertion failure in `str.replace` under a limited memory case (GH-152229) (#152616)
gh-152228: Fix an assertion failure in `str.replace` under a limited memory case (GH-152229)
(cherry picked from commit c5043dce1c6743682d93c71e937b95e7d27e0b35)
set_escdelay(), set_tabsize() and the ESCDELAY and TABSIZE variables were
gated only by the ncurses-specific NCURSES_EXT_FUNCS macro, which excluded
them when building against other curses implementations such as NetBSD curses
even when they provided them. Detect each with a configure capability probe
and gate on HAVE_CURSES_*.
(cherry picked from commit 0635e55b47e306aa6cc0610105775849b0699e2c)
(cherry picked from commit 2a4ffa6f2128308ba5ba81a7c8912fb781a271e0)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The name parameter of Misc.wait_variable(), setvar() and getvar() and the
value parameter of setvar() should not be optional. Their default values
('PY_VAR' and '1') are not meaningful and should not be advertised.
(cherry picked from commit e134a1aa36027fb3c8bd9493028072365b19479b)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-133031: Support non-ASCII characters in curses.textpad.Textbox (GH-152451) (GH-152468)
Textbox mangled non-ASCII characters of an 8-bit locale encoding: it masked
reads with curses.ascii.ascii(), which clears the 8th bit, and tested input
with curses.ascii.isprint(), which rejects bytes above 127.
Decode cells and input bytes with the window's encoding instead. Cells are
read with instr() and the lower-right cell is written as text, since inch() and
insch() with an int byte mishandle a non-ASCII character on a wide build. This
uses only the byte-oriented curses API, so it works without wide-character
support.
(cherry picked from commit c253f0c14b046cf79881d0602620a3b2a15c2316)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-85320: Use UTF-8 for IDLE configuration and breakpoint files (GH-152475) (GH-152556)
They were read and written using the locale encoding, which could corrupt
non-ASCII paths and made them non-portable.
(cherry picked from commit f6e904e1a666cb1e5664750b1c3d8f89cba3a769)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-87577: Document that wm_manage does not accept ttk widgets (GH-152532) (GH-152544)
wm_manage() works only with the classic tkinter Frame, LabelFrame and
Toplevel widgets, not their tkinter.ttk counterparts.
(cherry picked from commit 2670cb062c9ec31cd6df7be645f929a8398601c7)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation (GH-151573) (#152541)
gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation (GH-151573)
* gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation
OrderedDict.copy() walks the internal linked list while building the new
dict. The loop body can run arbitrary Python (a key's __eq__/__hash__, or
a subclass __getitem__/__setitem__) which can clear the source dict and
free the nodes being iterated.
Detect this the same way OrderedDict.__eq__ already does (gh-119004):
snapshot od_state before the loop, hold a strong reference to the key and
read the hash before any reentrant call, and raise RuntimeError if the
state changed before advancing to the next node.
Gregory P. Smith [Mon, 29 Jun 2026 02:03:03 +0000 (19:03 -0700)]
[3.14] gh-151416: fix a borrowed ref potential use after free via fspath in os.spawnv/spawnve (GH-151417) (#152536)
gh-151416: fix a borrowed ref potential use after free via fspath in os.spawnv/spawnve (GH-151417)
* gh-151416: Fix use-after-free in os.spawnv/spawnve when __fspath__ mutates argv
The argv conversion loops passed references borrowed from the argv list
into fsconvert_strdup(). An item's __fspath__() can mutate the list and
release its reference to the item, leaving the converter operating on a
freed object. A shrunk list could also make PyList_GetItem() return
NULL, which PyUnicode_FS{Converter,Decoder}() treat as a request to
release an uninitialized output variable.
Hold a strong reference to each item across the conversion, matching
parse_arglist() and parse_envlist().
* gh-151416: Don't mask non-TypeError argv conversion errors in os.spawnv
os.spawnv() replaced any error raised during argv item conversion,
such as MemoryError, codec errors, or the embedded-null ValueError,
with a generic TypeError. Only add the contextual message when the
conversion actually raised TypeError, matching how os.spawnve() and
the exec functions propagate these errors.
The test is gated to the native C spawnv: the Python fallback used
elsewhere reports conversion failures from the forked child as exit
status 127 instead of raising.
Gregory P. Smith [Sun, 28 Jun 2026 19:32:02 +0000 (12:32 -0700)]
[3.14] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150749)
http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).
Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.
Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.
---
This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4)
[3.14] gh-69134: Harden tkinter GUI tests that depend on a mapped widget (GH-152499) (GH-152517)
Add wait_until_mapped() and AbstractTkTest.require_mapped() to
test_tkinter.support and use them to guard the assertions that need a
widget to be actually mapped (winfo_width(), identify(), coords(), ...).
This avoids intermittent failures under window managers that do not map
the widget promptly, without skipping the unrelated checks.
(cherry picked from commit 0fff6bd86cf0224152c509e295d3cbbd209098f3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-78335: Complete the widget option lists in tkinter docstrings (GH-152485) (GH-152501)
Several widget __init__ docstrings omitted valid options, and Menubutton and
Message had no option list at all. List every option supported by the widget,
tagging those added in Tk 9.0 and 9.1.
Add test_options_in_docstring, asserting that every option in OPTIONS is named
in the widget's __init__ docstring. Options reported by keys() but not in the
docstring are only printed in verbose mode, as some depend on the Tk version.
(cherry picked from commit ba0c0e6be18ea56d00b4534cc9e32d1acaba96d6)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-110904: Recommend windows-curses in the curses HOWTO (GH-152491) (GH-152507)
The HOWTO pointed at UniCurses, which is unmaintained and exposes its own
API. windows-curses provides the standard curses interface on Windows, so
existing code runs unchanged.
(cherry picked from commit 7b0dff7d16ce59df44847ab04567eb97bfbc3576)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The non-ASCII tests only exercised what the runner's locale could encode (in
practice UTF-8). Add 8-bit-encoding cases to the character and string I/O
tests, each guarded by the existing encodability check: ASCII, a character
common to the Latin encodings ('é'), and ones distinctive to a single encoding
(byte 0xA4 is '¤' in ISO-8859-1, '€' in ISO-8859-15, 'є' in KOI8-U). Run the
whole suite under different locales to cover them; unrepresentable cases skip.
* gh-152415: Verify character output round-trips in test_output_character
Read each written character back with in_wch() or instr() rather than
inch(), which on a wide build returns the low byte of the code point
instead of the locale-encoded byte and so mangles a non-ASCII character
of an 8-bit locale. This lets the int-argument cases cover '€'/'є', and
adds matching coverage for the str argument.
insch() with an int byte > 127 is checked only for Latin-1: on a wide
build ncurses winsch stores a printable byte directly as a code point
instead of decoding it through the locale.
(cherry picked from commit 003d3620cc0f44caca7bf26c3e6964f5f379645f)
(cherry picked from commit a75aa418deeec926a10eef12cf4e8215fd67c947)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-70273: Document default class bindings in tkinter (GH-152389) (GH-152394)
Note in the Bindings and events section that every widget inherits Tk
class bindings for its standard behavior, where they are documented, and
how to suppress an unwanted one by returning "break" from a callback.
(cherry picked from commit 4fd69ef97a67fc935e0d4f30662f2a1985ba6be9)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-71880: Allow editing the last cell in curses.textpad.Textbox (GH-152363) (GH-152365)
Textbox.edit() ignored typing in the lower-right cell of the window. It is
now written with insch(), which fills the cell without moving the cursor out
of the window (addch() there raises an error and scrolls a scrollable window).
(cherry picked from commit 11b394381f30815a8ad0123afb0a55e7a0369f79)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add more tests for tkinter.dnd (GH-152362) (GH-152368)
Cover the drag cursor, the Motion and ButtonRelease bindings, switching
between targets, the target search up the master chain, dnd_accept()
returning None, and restarting after a drag has finished.
(cherry picked from commit 389e00f13fb5b20b424980b08678753441db7529)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-38464: Make tkinter nametowidget() work with cloned menus (GH-152336) (GH-152350)
Map the auto-generated name of a cloned menu (a menu used as a menubar
or a cascade) back to the original widget instead of raising KeyError.
(cherry picked from commit 5c3555bdc56a8e110a7d366f8ac0a93cd082e90f)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
focus_get(), focus_displayof(), focus_lastfor() and winfo_containing()
now return None instead of raising KeyError when the focused widget was
not created by tkinter (for example a torn-off menu).
(cherry picked from commit 5fed5ce85d9c862673cc68294f757f345bbcc9b1)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] IDLE: fix dedent() usage in htest (GH-152256) (#152343)
IDLE: fix dedent() usage in htest (GH-152256)
Fix typos: in GH-112642, initial string concatenation quotes were left when switching to textwrap.dedent().
(cherry picked from commit 74272d4f0b8478c1d879671ba35ec4ddaae50178)
[3.14] gh-80937: Fix memory leak in tkinter createcommand (GH-152294) (GH-152328)
A command created with createcommand() held a strong reference to the
interpreter, forming an uncollectable cycle (interpreter -> command ->
interpreter) that kept the interpreter and the callback alive until the
command was removed with deletecommand() or destroy(). The command now
borrows the reference; it cannot outlive the interpreter, which deletes its
commands when finalized.
(cherry picked from commit bbf7786a904e558a15d01475356167e29b2e3708)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
When a Tcl command running its own event loop (such as vwait or
wait_variable) was active and the user typed input on stdin, the event
loop kept spinning at 100% CPU. The stdin file handler is now removed as
soon as input becomes available.
Also fix gh-139816: an exception raised in a callback no longer stops the
event loop to wait for Enter on a Python built without readline; pending
callbacks keep running until input is actually available on stdin.
(cherry picked from commit 3ffda34f5cd3809a8755c9596948e4e477661d5f)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: mdehoon <mjldehoon@yahoo.com> Co-authored-by: Christopher Chavez <chrischavez@gmx.us> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add tests for ttk Menubutton and OptionMenu widget options (GH-151960) (GH-151964)
Decorate ttk.MenubuttonTest with add_configure_tests() and make
ttk.OptionMenuTest inherit it to cover the standard widget options.
(cherry picked from commit ce147129c183b934800b539c9a85b7d6bf44ae5d)
Serhiy Storchaka [Wed, 24 Jun 2026 19:32:28 +0000 (22:32 +0300)]
[3.14] gh-86726: Improve the structure of the tkinter reference (GH-152109 (GH-152111) (GH-152116)
Add short group intros before each cluster of Misc methods.
Group the Tk and Toplevel classes in a new "Toplevel widgets" section, move
the Tcl() function to the module-level functions, and move the "File
handlers" section into the reference.
(cherry picked from commit c7faa6936e17630ec26d4e0438ae9b95561b7151)
(cherry picked from commit 2d5187116b526b3570c0010ba58f4066b6be468d)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The size is taken from the archive and is not validated, so a ~512-byte
crafted file can claim several gigabytes (or, via base-256 encoding, far
more) and make read() pre-allocate that much memory -- on open/iterate,
before any extraction filter runs.
Read the extended-header data in bounded chunks instead, so an oversized
or truncated header can no longer force a huge allocation. The bytes
returned for valid archives are unchanged.
(cherry picked from commit da99711d37dba3413af05207ea8b12cb06041c0f)
[3.14] gh-84008: Document that the LC_NUMERIC locale affects tkinter numeric widgets (GH-152008) (GH-152050)
Spinbox, Scale and ttk.Spinbox format floating-point values according to
the LC_NUMERIC locale, but such values are always parsed with a period, so
a comma-decimal locale breaks DoubleVar.get().
(cherry picked from commit ee78d4323c174d0281fef5e04e965cda4c46eeb7)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-126219: Fix crash in tkinter.Tk with non-BMP className on Tcl/Tk 8.x (GH-151980) (GH-152046)
Tcl 8.x crashes when title-casing a non-BMP character during Tk
initialization, so such a className is now rejected with a ValueError.
(cherry picked from commit 124c7cd91be8cff76d1eec0adef65991c23c4419)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Document where widget methods shadow inherited Misc, geometry-manager and
Wm methods, correct the inaccurate "size/bbox is an alias of
grid_size/grid_bbox" claims, and add "# overrides X" comments at the
definitions.
Also document the geometry-manager ambiguity: the short names forget, info,
slaves and propagate are defined by Pack, Place and Grid but
resolve to the pack variant.
Cross-reference the window-manager methods grid, forget and state with the
same-named grid geometry manager, Pack.forget and ttk.Widget.state.
[3.14] gh-151665: Fix inspect.signature() on type alias and type parameter evaluators (GH-151787) (#151880)
[3.15] gh-151665: Fix inspect.signature() on type alias and type parameter evaluators (GH-151787)
(cherry picked from commit 453714a2dc0d16e6e6b8cff70801dfc1284bf74d)
Zang Peiyu [Sun, 21 Jun 2026 16:39:36 +0000 (00:39 +0800)]
[3.14] gh-150484: Fix mock_open __exit__ with contextlib.ExitStack (GH-151829)
mock_open's _exit_side_effect had a fixed 3-arg signature, but
contextlib.ExitStack calls __exit__ with 4 args (self + 3 exc info).
Use *args to accept any number of arguments.
Verify the virtual events that widgets emit in response to user
interaction, driven by generated events: <<ListboxSelect>> (Listbox),
<<Increment>> and <<Decrement>> (ttk Spinbox), and <<TreeviewSelect>>,
<<TreeviewOpen>> and <<TreeviewClose>> (ttk Treeview).
(cherry picked from commit e51b616efff845ea2a7d312aa43d5f5100064d88)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add tests for tkinter.filedialog (GH-151781) (GH-151796)
Exercise the native dialogs (Open, SaveAs and Directory) through the
_test_callback seam without opening them, and test the pure-Python
FileDialog selection, filter and ok/cancel logic without entering its
modal loop.
(cherry picked from commit 58fd9ec3cfe0d588db97eb98c0dc7fdb0256be76)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add interactive tests for tkinter.simpledialog (GH-151794) (GH-151803)
Drive the modal query dialogs with generated events to exercise the
<Return> and <Escape> key bindings and the value validation: accepting
an integer, float or string, cancelling, rejecting a non-numeric value
and rejecting a value outside the allowed range.
(cherry picked from commit 706238e764169dd36f918a0541adf9687cc3f296)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add tests for the remaining tkinter Misc, Wm and Text methods (GH-151782) (GH-151800)
Cover Misc.wait_variable and wait_window, tk_focusFollowsMouse,
selection_handle, the error paths of grab_set_global, send, the
X11-specific Wm methods iconposition, iconmask, iconwindow,
colormapwindows and manage/forget, and the Text.window_config alias and
deprecated yview_pickplace.
(cherry picked from commit aa71eb287f6d812e5270109acb9119c2ad0baef9)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add tests for tkinter.dnd (GH-151780) (GH-151791)
Drive the drag-and-drop protocol (dnd_start and the DndHandler enter/
motion/commit, leave/cancel and end callbacks).
(cherry picked from commit 2a126a534b0253cf65fb6d06da0cce72eb2eaa23)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.14] gh-151678: Add tests for tkinter.scrolledtext (GH-151753) (GH-151760)
Add a test for the ScrolledText widget, which had no tests: that it is
a Text widget held in a Frame with a Scrollbar, that Text methods work,
that the geometry manager methods are redirected to the frame while
configure is not, and that the scrollbar tracks the text view.
(cherry picked from commit a9db5cb52fefffc8fcdddc8e1c5f23222970825a)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.14] gh-151678: Add tests for tkinter font, image, variable, Misc and Wm methods (GH-151751) (GH-151755)
* font: copy(), the config alias, the displayof argument of measure and
metrics, and the errors raised for invalid options and a wrong number
of arguments;
* image: the cget method and the config alias, and the errors raised by
transparency_get and transparency_set;
* variable: that initialize is an alias of set and the deprecated trace
is an alias of trace_variable;
* Misc: tk_focusNext, tk_focusPrev, tk_strictMotif, tk_bisque and
option_readfile;
* Wm: wm_iconphoto.
(cherry picked from commit 66cc04855100c3865bd01adfe92a3a02dbc3a914)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.14] gh-151678: Add tests for tkinter Misc, Wm and geometry manager methods (GH-151732) (GH-151738)
Cover previously-untested methods of the Misc, Wm, Pack, Place and Grid
classes:
* a new WinfoTest class for the winfo_* query methods (class, name,
parent, children, toplevel, visual and screen information, atoms,
pointer and screen coordinates, fpixels, containing, interps,
viewable), including the pre-existing winfo_rgb and winfo_pathname;
* in MiscTest: getint, getdouble, getvar, register, deletecommand,
option_add/get/clear, nametowidget, the focus_*, grab_* and
selection_own* methods, event_add/delete/info, and bell;
* in WmTest: title, geometry, minsize/maxsize, resizable, aspect, grid,
positionfrom/sizefrom, focusmodel, iconname, client/command,
overrideredirect, state (with withdraw and deiconify), frame, group,
protocol and transient;
* the short-named aliases of the grid_*, pack_* and place_* geometry
manager methods.
(cherry picked from commit 23793ac211371415eaf9491fef031f121969dfb3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
projects / thirdparty / Python / cpython.git / log
