Pre-create the Android emulator image so that the the configuration can be
modified to use 4GB of RAM.
(cherry picked from commit a95ee3a21d97afdbe6bd2ce4cd8343a36cd13b02)
Malcolm Smith [Sun, 5 Apr 2026 23:47:01 +0000 (00:47 +0100)]
[3.13] gh-146541: Allow building the Android testbed for 32-bit targets (GH-146542) (#148107)
Allows building the Android testbed for 32-bit targets, adding the target triplets
`arm-linux-androideabi` and `i686-linux-android`.
(cherry picked from commit 848bbe9ff21ae0a3ee412cc25843835ace4f75df)
Co-authored-by: Robert Kirkman <31490854+robertkirkman@users.noreply.github.com>
[3.13] gh-146450: Normalise feature set of Android build script with other platform build scripts (GH-146451) (#148066)
Allows for cleaning a subset of targets, customization of the download cache and
cross-build directories, and modifies the build command to allow 'all', 'build'
and 'hosts' targets.
(cherry picked from commit b8470deb5d52f524ae18c6f232fecfc99b133397)
Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
Victor Stinner [Tue, 31 Mar 2026 15:06:38 +0000 (17:06 +0200)]
[3.13] gh-143050: Correct PyLong_FromString() to use _PyLong_Negate() (#145901) (#147437)
The long_from_string_base() might return a small integer, when the
_pylong.py is used to do conversion. Hence, we must be careful here to
not smash it "small int" bit by using the _PyLong_FlipSign().
Malcolm Smith [Sat, 28 Mar 2026 07:25:35 +0000 (07:25 +0000)]
[3.13] gh-145616: Detect Android sysconfig ABI correctly on 32-bit ARM Android on 64-bit ARM kernel (GH-145617) (#146539)
When Python is running on 32-bit ARM Android on a 64-bit ARM kernel, `os.uname().machine` is `armv8l`. Such devices run the same userspace code as `armv7l` devices, so apply the same `armeabi_v7a` Android ABI to them, which works.
(cherry picked from commit 3a2b81e919103c0be3bc60a47aaa74d34fea6e9e)
Co-authored-by: Robert Kirkman <31490854+robertkirkman@users.noreply.github.com>
[3.13] gh-146310: Fix ensurepip to treat empty WHEEL_PKG_DIR as unset (GH-146357) (#146535)
gh-146310: Fix ensurepip to treat empty WHEEL_PKG_DIR as unset (GH-146357)
Path('') resolves to CWD, so an empty WHEEL_PKG_DIR string caused
ensurepip to search the current working directory for wheel files.
Add a truthiness check to treat empty strings the same as None.
(cherry picked from commit 73cc1fd4f45b4daf2b2f9a6be69148775c7c2bff)
Co-authored-by: Imgyu Kim <kimimgo@gmail.com> Co-authored-by: Victor Stinner <vstinner@python.org>
[3.13] gh-146059: Cleanup pickle fast_save_enter() test (GH-146481) (#146510)
gh-146059: Cleanup pickle fast_save_enter() test (GH-146481)
Remove {"key": data}, it's not required to reproduce the bug.
Simplify also deep_nested_struct(): remove the seed parameter.
Fix a typo in a comment.
(cherry picked from commit 0c7a75aeef4dae87f02536ed4c42a57c13ef20e2)
Co-authored-by: Victor Stinner <vstinner@python.org>
[3.13] gh-144837: Improve documentation for more collection methods (GH-144841) (GH-146484)
Use uniform standard signature syntax in the tutorial and in
the array and collections modules documentation.
(cherry picked from commit 17070f41d4ccf5e82e5841e467b3aef5294f2c9a)
T. Wouters [Tue, 24 Mar 2026 01:27:57 +0000 (02:27 +0100)]
[3.13] gh-142183: Cache one datachunk per tstate to prevent alloc/dealloc thrashing (GH-145789) (#146123)
* gh-142183: Cache one datachunk per tstate to prevent alloc/dealloc thrashing (GH-145789) (#145828)
Cache one datachunk per tstate to prevent alloc/dealloc thrashing when repeatedly hitting the same call depth at exactly the wrong boundary.
Move new _ts member to the end to not mess up remote debuggers' ideas of the
struct's layout. (The struct is only created by the runtime, and the new
field only used by the runtime, so it should be safe.)
[3.13] gh-146202: Create tmp_dir in regrtest worker (GH-146347) (#146350)
gh-146202: Create tmp_dir in regrtest worker (GH-146347)
Create tmp_dir in libregrtest.worker since the directory can be
different than the --tempdir directory.
(cherry picked from commit bcff99cb3f3b887a08c4f0ace1279ced38dd9e62)
Co-authored-by: Victor Stinner <vstinner@python.org>
[3.13] gh-145264: Do not ignore excess Base64 data after the first padded quad (GH-145267) (GH-146326) (GH-146348)
Base64 decoder (see binascii.a2b_base64(), base64.b64decode(), etc)
no longer ignores excess data after the first padded quad in non-strict
(default) mode. Instead, in conformance with RFC 4648, it ignores the
pad character, "=", if it is present before the end of the encoded data.
(cherry picked from commit 4561f6418a691b3e89aef0901f53fe0dfb7f7c0e)
(cherry picked from commit e31c55121620189a0d1a07b689762d8ca9c1b7fa)
Sergey Miryanov [Mon, 23 Mar 2026 23:50:41 +0000 (04:50 +0500)]
[3.13] GH-91636: Clear weakrefs created by finalizers. (GH-136401) (GH-144214)
Weakrefs to unreachable garbage that are created during running of
finalizers need to be cleared. This avoids exposing objects that
have `tp_clear` called on them to Python-level code.
(cherry picked from commit b6b99bf7f1edab77c485faf4e23da868f3a7b68c)
Co-authored-by: Neil Schemenauer <nas-github@arctrix.com>
[3.13] gh-136672: Docs: Move parts of Enum HOWTO to API Docs (GH-139176) (GH-144803)
To avoid duplicate content in the Enum HOWTO and
API documentation which is not automatically synced,
the section about supported __dunder__ and _sunder
names is moved from HOWTO to API docs.
[3.13] gh-138234: clarify returncode behavior for subprocesses created with `shell=True` (GH-138536) (#146255)
gh-138234: clarify returncode behavior for subprocesses created with `shell=True` (GH-138536)
(cherry picked from commit 8a531f89df8f8bf4c4fe395f9edcdc19852bdf1c)
* Fix _PyFrame_GetLocals() and _PyFrame_GetLocals() error handling.
* _PyEval_ExceptionGroupMatch() now fails on _PyFrame_GetLocals()
error.
(cherry picked from commit 8eeb800faf5562e6ce3805416f656ab09243c9a6)
[3.13] gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600) (#146024)
gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600)
Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
(cherry picked from commit 57e88c1cf95e1481b94ae57abe1010469d47a6b4)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
[3.13] gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) (#145996)
* gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987)
Fix C stack overflow (CVE-2026-4224) when an Expat parser
with a registered `ElementDeclHandler` parses inline DTD
containing deeply nested content model.
[3.13] gh-140814: Fix freeze_support() setting start method as side effect (GH-144608) (#146009)
gh-140814: Fix freeze_support() setting start method as side effect (GH-144608)
freeze_support() called get_start_method() without allow_none=True,
which locked in the default start method context. This caused a
subsequent set_start_method() call to raise "context has already been
set". Use allow_none=True and accept None as a matching value, since
spawn.freeze_support() independently detects spawned child processes.
Test that freeze_support() does not lock in the default start method,
which would prevent a subsequent set_start_method() call.
(cherry picked from commit ee5318025b0f9f4d30d9358627df68181e0d223f)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Gregory P. Smith [Sun, 15 Mar 2026 22:35:53 +0000 (15:35 -0700)]
[3.13] gh-145990: sort --help-env first section by name (others and xoptions already sorted) (GH-146003)
* sort `--help-env` sections by environment variable name
Only needed in the first section, in 3.13 the second section was already sorted.
* regression test for --help-env & --help-xoptions sort order
Victor Stinner [Thu, 12 Mar 2026 23:17:00 +0000 (00:17 +0100)]
[3.13] gh-145801: Use gcc -fprofile-update=atomic for PGO builds (#145802) (#145893)
gh-145801: Use gcc -fprofile-update=atomic for PGO builds (#145802)
When Python build is optimized with GCC using PGO, use
-fprofile-update=atomic option to use atomic operations when updating
profile information. This option reduces the risk of gcov Data Files
(.gcda) corruption which can cause random GCC crashes.
[3.13] gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline() (GH-140910) (#145853)
gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline() (GH-140910)
(cherry picked from commit 86a0756234df7ce42fa4731c91067cb7f2e244d5)
Previously, component-wise relative error bound was tested. However,
such bound can't exist already for complex multiplication as one can be
used to perform subtraction of floating-point numbers, e.g. x and y for
z0=1+1j and z1=x+yj.
```pycon
>>> x, y = 1e-9+1j, 1+1j
>>> a = x*y*y.conjugate()/2;a
(1.0000000272292198e-09+1j)
>>> b = x*(y*y.conjugate()/2);b
(1e-09+1j)
>>> b == x
True
>>> (a.real-b.real)/math.ulp(b.real) 131672427.0
```
(cherry picked from commit c4333a12708a917d1cfb6418c04be45793ecc392)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
projects / thirdparty / Python / cpython.git / log
