Co-authored-by: Harjoth Khara <harjoth.khara@gmail.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Co-authored-by: Stan Ulbrych <stan@python.org>
[3.15] gh-135661: Fix abrupt closing of empty comment in HTMLParser (GH-153007) (GH-153024)
An abruptly closed empty comment ("<!-->" or "<!--->") no longer extends
up to a later "-->" in the same feed() call.
test_htmlparser now also feeds each string source as a single chunk, in
addition to one character at a time, to exercise different input buffering.
(cherry picked from commit ed370d3337c1ac4f7295b444a4807c0b72287608)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-150579: use lazy imports for concurrent.futures (GH-150585) (#152975)
gh-150579: use lazy imports for concurrent.futures (GH-150585)
This module has a manual lazy import hack using `__getattr__`. Now that lazy imports exist and cannot be disabled, this could use lazy imports instead.
Key differences: this will now show up in sys.lazy_modules when accessed. Error messages should be a bit better without the wrapper `__getattr__` involved. That's the only differences I can think of.
(cherry picked from commit 423ae0ff36c6485f722e0fe3274124dc3df09862)
Signed-off-by: Henry Schreiner <henryfs@princeton.edu> Co-authored-by: Henry Schreiner <henryfs@princeton.edu> Co-authored-by: Gregory P. Smith <greg@krypto.org>
[3.15] gh-83386: Enable test_hang_gh83386 for ProcessPoolExecutor (GH-152976) (#152982)
gh-83386: Enable test_hang_gh83386 for ProcessPoolExecutor (GH-152976)
The hang this test guards against (interpreter exit after
shutdown(wait=False) with running futures) was fixed for
ProcessPoolExecutor by the executor management rewrite years ago, but
the test still skipped it citing the issue. The skip also hid a latent
NameError in the subprocess template, which only selects a start method
in the process pool variants; rewrite it to use the same
mp_context=get_context() shape as the sibling templates. Remove a stale
comment claiming ProcessPoolExecutor often hangs with wait=False.
(cherry picked from commit 548c7314138b85cab3b945a1ce05440dd836a2ea)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
[3.15] gh-150880: Normalize paths on Windows before appending wildcard (GH-152906) (GH-152963)
gh-150880: Normalize paths on Windows before appending wildcard (GH-152906)
This ensures that we don't turn a "valid" path with trailing spaces into an invalid path with embedded spaces.
(cherry picked from commit 1b4135a2c69f5320dbdcb37dcc295a5fd36580b5)
[3.15] gh-152785: Upgrade GCC from 10 to 13 in GHA Address Sanitizer (GH-152782) (#152949)
gh-152785: Upgrade GCC from 10 to 13 in GHA Address Sanitizer (GH-152782)
Remove the step which installs GCC 10. This step was needed when
Ubuntu only had GCC 9. We are now using Ubuntu 24.04 which has GCC
13.
(cherry picked from commit 31a0e0968e92c65019e4e0547475904e9b047d4a)
Co-authored-by: Victor Stinner <vstinner@python.org>
[3.15] gh-150641: Fix evaluating forward references in STRING format can 'leak' internal names in `typing` (GH-150648) (#152935)
gh-150641: Fix evaluating forward references in STRING format can 'leak' internal names in `typing` (GH-150648)
(cherry picked from commit f75028f7ceebee4cbeb46bf040834e2005d57436)
[3.15] gh-115634: Fix ProcessPoolExecutor deadlock with max_tasks_per_child (GH-140900) (#152926)
gh-115634: Fix ProcessPoolExecutor deadlock with max_tasks_per_child (GH-140900)
The idle worker semaphore counts task completions, not idle workers, so
it can hold a stale token released by a worker that later exited upon
reaching its max_tasks_per_child limit. The worker replacement path
consumed such tokens and skipped spawning a replacement, deadlocking
the remaining queued tasks once no workers were left.
Replace dead workers based on len(self._processes) without consulting
the semaphore. The submit() path is unchanged, preserving on-demand
spawning and idle worker reuse.
Replace the documentation note added in GH-140897 with a versionchanged
entry now that the bug is fixed.
[3.15] gh-98894: Check readelf failures in test_dtrace (GH-152345) (#152891)
gh-98894: Check readelf failures in test_dtrace (GH-152345)
Report readelf command failures directly instead of later failing with
missing-probe assertions.
(cherry picked from commit d60a6779e8dd5fbf1f2f84b34bb5a20f3e8cd7fd)
[3.15] gh-152680: Detect virtualization on Windows in pythoninfo (GH-152824) (#152890)
gh-152680: Detect virtualization on Windows in pythoninfo (GH-152824)
Use WMI to detect virtualization on Windows.
Replace wmic command with _wmi module to get the operating system caption and
version.
The wmic tool is deprecated since January 2024:
https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242
For example, it's no longer installed in Windows images on GitHub
Action.
Fix also run_command(): no longer try to spawn a subprocess if the
platform doesn't support subprocess. It avoids logging run_command()
errors.
(cherry picked from commit 4e4869b62fa91e26117b1d9136f60b58c9f505a5)
Co-authored-by: Victor Stinner <vstinner@python.org>
[3.15] gh-88574: Skip a spurious blank line after a literal in imaplib (GH-152751) (GH-152884)
Some IMAP servers send an extra blank line after the data of a literal.
imaplib mistook it for the response trailer and failed on the next
command. Such a blank line is now skipped.
(cherry picked from commit 53ff1a28ccfa69925c3c452cfc003970640fa65b)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.15] gh-66335: Add tests for imaplib command methods (GH-152872) (GH-152873)
Add coverage tests for the IMAP4 command methods and their UID variants
(SELECT, CREATE, COPY, STORE, FETCH, SEARCH, SORT, THREAD, DELETE,
RENAME, SUBSCRIBE, UNSUBSCRIBE, LIST, STATUS, the ACL and quota
commands, ANNOTATION, PROXYAUTH and ENABLE), plus test helpers
(splitargs, parse_sequence_set, make_simple_handler) and per-command
argument capture in the test server.
(cherry picked from commit a50b089b7c46e3068d9177b5f18ac767a31a18cd)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.15] gh-144473: Add "steal" term to glossary; clarify "stealing" on error (GH-144502) (GH-152771)
With one exception, all "stealing" functions also steal on error,
but it makes sense to note this in each case.
(cherry picked from commit 34503f39532279efb12653754bb3a7e535fb66cc)
Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
[3.15] gh-108280: Give a meaningful error for an invalid imaplib greeting (GH-152768) (GH-152856)
Connecting to a server that does not send a valid IMAP4 greeting, such as
a POP3 server answering on the IMAP port, failed with the unhelpful
"imaplib.IMAP4.error: None". A meaningful message is now raised instead.
(cherry picked from commit 262b6a0df5a325e788928ab0cd514fa4786571b4)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.15] gh-63121: Refresh imaplib capabilities on state changes (GH-152752) (GH-152854)
imaplib fetched the server capabilities only once, at connection time.
They are now also refreshed after a successful LOGIN or AUTHENTICATE,
from the CAPABILITY response the server sent or, if it sent none, by
querying it. This lets methods such as enable() see capabilities added
after login, for example ENABLE on Gmail (gh-103451).
Capabilities advertised in the server greeting are now used too, saving
a redundant CAPABILITY command.
(cherry picked from commit c89b72abed7393d9d428f1e336e3aa02e7ef6ce8)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.15] gh-72507: Document that imaplib does not verify TLS certificates by default (GH-152778) (GH-152862)
IMAP4_SSL() and IMAP4.starttls() do not verify the server certificate or
hostname unless a suitable ssl_context is passed.
(cherry picked from commit f3bf8abb8c0f4cb20bed3dc7d98eca4a2d668709)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.15] gh-79964: Clarify the imaplib fetch example in the docs (GH-152780) (GH-152859)
A FETCH response may contain additional or unsolicited data, so the
message is not always data[0][1].
(cherry picked from commit 50ae0be74988564fb09746a49eb4b8f8e740f3c3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
[3.15] gh-82183: Do not restart the busy IDLE shell when running without restart (GH-152745) (#152832)
gh-82183: Do not restart the busy IDLE shell when running without restart (GH-152745)
"Run... Customized" with "Restart shell" unchecked restarted the shell
anyway when it was busy executing code, killing any pending input. It now
reports that the shell is executing just once, not twice, and does not run.
(cherry picked from commit be449b1c6ad739a40a7da35a81317bb49f1f54ff)
[3.15] gh-75595: Do not save a blank int entry in IDLE Settings (GH-152743) (#152827)
gh-75595: Do not save a blank int entry in IDLE Settings (GH-152743)
gh-83653: Do not save a blank int entry in IDLE Settings
Blanking an integer entry wrote an empty string to the config file, which
caused an "invalid int value" warning when it was read back.
(cherry picked from commit 3428762f33c6c064998f5b0c385cdfd0f0c2e198)
[3.15] gh-65339: Save IDLE Shell and Output windows as text by default (GH-152742) (#152821)
gh-65339: Save IDLE Shell and Output windows as text by default (GH-152742)
Their content is not Python source, so the Save As dialog now lists text
files first and defaults to a ".txt" extension.
(cherry picked from commit efcfb1a4e0f4d0d0e33aefccd8373e116e98e3de)
[3.15] gh-80504: Always show the full search path in IDLE Find in Files (GH-152740) (#152810)
gh-80504: Always show the full search path in IDLE Find in Files (GH-152740)
The "In files:" field of the Find in Files dialog now always contains a
full directory path, so the grep output shows which directory was searched.
(cherry picked from commit f21f338f1f88352d50362271a7f38c01745a65da)
[3.15] gh-134300: Remove idlelib from the path of the IDLE user process (GH-152739) (#152807)
gh-134300: Remove idlelib from the path of the IDLE user process (GH-152739)
The idlelib directory ends up on sys.path when idle.py is run as a script,
and it was passed to the user process, where it let user code import
idlelib submodules as top-level modules, such as "import help".
(cherry picked from commit 3f5491a09223f7371b4b4c92225e8dfdf1c989b7)
[3.15] gh-89360: Fix ValueError in IDLE MultiCall event_delete (GH-152738) (#152802)
gh-89360: Fix ValueError in IDLE MultiCall event_delete (GH-152738)
Deleting a key binding for a sequence not bound to the virtual event no
longer raises a ValueError; the discrepancy is now ignored.
(cherry picked from commit ea7619faeacf310ba1b2ef41ad07966ce2aae11f)
[3.15] gh-71956: Fix IDLE Replace All searching up without wrap around (GH-152737) (#152799)
gh-71956: Fix IDLE Replace All searching up without wrap around (GH-152737)
When the search direction is "Up" and "Wrap around" is off, Replace All
replaced only the first match above the current position (and all matches
below it). It now replaces all matches from the start of the text down to
the current position, consistently with the "Up" direction.
(cherry picked from commit ef27e5b310feebb6068f9e798eee7069e1966fc9)
[3.15] gh-66331: Set correct WM_CLASS on X11 for IDLE windows (GH-152733) (#152794)
gh-66331: Set correct WM_CLASS on X11 for IDLE windows (GH-152733)
Set the WM_CLASS of IDLE's long-lived windows (window-list windows and
the stack viewers) to "Idle" instead of the default "Toplevel", so that
window managers group and label them correctly.
(cherry picked from commit 4e16b8d4eef162082c3d409f171802ceccb36521)
IDLE - move 3 toplevel fix_xyz functions to idlelb.util
Move idlelib functions run.fix_scaling, editor.fixwordbreaks
(as fix_word_breaks). All are used in at least 3 modules.
(cherry picked from commit 53ca52ddb0c2725a1c34e4eb2245339cd3dcaa84)
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
[3.15] gh-151626: Fix tests that fail when PYTHONPYCACHEPREFIX is set (GH-151952) (#152736)
gh-151626: Fix tests that fail when PYTHONPYCACHEPREFIX is set (GH-151952)
Fix tests in test_compileall, test_import, test_importlib, test_py_compile, and test_inspect to neutralize PYTHONPYCACHEPREFIX
(cherry picked from commit 564c58c718bc3de9cf3d9bc20cdc06317411c1cd)
Serhiy Storchaka [Tue, 30 Jun 2026 20:59:28 +0000 (23:59 +0300)]
[3.15] gh-152502: Detect the curses mouse interface portably (GH-152705) (GH-152707)
The mouse interface (getmouse(), the BUTTON* constants, ...) was gated on the
ncurses-specific NCURSES_MOUSE_VERSION macro, so it was dropped on other curses
implementations that provide it, such as NetBSD curses and PDCurses.
Gate it instead on a configure capability probe or the PDCURSES macro. Probe
for getmouse() with its X/Open getmouse(MEVENT *) signature, since PDCurses
declares an incompatible getmouse(void) unless built for the ncurses mouse API,
which PDC_NCMOUSE now always selects.
[3.15] gh-152680: Detect container/VM in test.pythoninfo (GH-152668) (#152699)
gh-152680: Detect container/VM in test.pythoninfo (GH-152668)
On Apple, log the hardware model as "system.hardware".
* Log the "CI", "IMAGE_OS_VERSION" and "container"
environment variables.
* Add run_command() and first_line() functions.
(cherry picked from commit f1c536372199cfb9c2e7b360b7bf04208c9eee82)
Co-authored-by: Victor Stinner <vstinner@python.org>
[3.15] gh-151126: Fix a possible crash during the startup with no memory under `Py_STACKREF_DEBUG` (GH-152478) (#152677)
gh-151126: Fix a possible crash during the startup with no memory under `Py_STACKREF_DEBUG` (GH-152478)
(cherry picked from commit ecdef1773006529b0fea6639d0effeecbb41679c)
[3.15] gh-152635: Raise MemoryError when the lock allocation fails in `_interpchannels.create()` (GH-152642) (#152671)
gh-152635: Raise MemoryError when the lock allocation fails in `_interpchannels.create()` (GH-152642)
Previously, an allocation failure when creating
the lock for a channel in `_interpchannels` would trigger an assert.
Caused by `handle_channel_error` being passed an error code of -1
which is only allowed if an exception has been set.
(in this case, no exception was set)
`channelsmod_create` now forwards the error code from `channel_create`
which `handle_channel_error` already handled.
(cherry picked from commit b383aa6e1a8ea53fdeed88c71fbc34d8b2d1fde9)
Co-authored-by: Steve Stagg <stestagg@gmail.com> Co-authored-by: sobolevn <mail@sobolevn.me>
TurtleScreenBase._update() redraws with cv.update(), which also reprocesses
input events, so a handler that moves the turtle (such as
screen.ondrag(turtle.goto)) reenters _update() for every queued event until
the interpreter crashes. A reentrant _update() now only flushes drawing with
update_idletasks().
(cherry picked from commit 6f103fab178c07cbb5f701b8ad97e275b6eb6c4c)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-146219: Document reusing a thread state across repeated foreign-thread calls (GH-146221) (#152644)
gh-146219: Document reusing a thread state across repeated foreign-thread calls (GH-146221)
* Document reusing a thread state across repeated foreign-thread calls
Add a subsection under "Non-Python created threads" explaining the
performance cost of creating/destroying a PyThreadState on every
Ensure/Release cycle and showing how to keep one alive for the
thread's lifetime instead.
[3.15] gh-103878: Document that the cancelled file dialog value is only falsy (GH-152429) (GH-152629)
Its exact type (empty string, tuple, list or None) varies between
platforms and Tk versions, so advise testing the result for truth.
(cherry picked from commit 9dd3340a623093b5d0ff054d5d42c370bb09221c)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-152228: Fix an assertion failure in `str.replace` under a limited memory case (GH-152229) (#152615)
gh-152228: Fix an assertion failure in `str.replace` under a limited memory case (GH-152229)
(cherry picked from commit c5043dce1c6743682d93c71e937b95e7d27e0b35)
[3.15] gh-69134: Wait until mapped in keyboard virtual-event tests (GH-152599) (GH-152605)
test_virtual_events and test_selection_event generate key events after
focus_force(). On Windows these are only delivered once the toplevel is
mapped, so they could be dropped and the test fail. Wait until the
widget is mapped, as the other GUI tests already do.
(cherry picked from commit be4eebb8386d07f360dd835a0ecb4a1eb6385736)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-69134: Harden tkinter GUI tests that depend on a mapped widget (GH-152499) (GH-152516)
Add wait_until_mapped() and AbstractTkTest.require_mapped() to
test_tkinter.support and use them to guard the assertions that need a
widget to be actually mapped (winfo_width(), identify(), coords(), ...).
This avoids intermittent failures under window managers that do not map
the widget promptly, without skipping the unrelated checks.
(cherry picked from commit 0fff6bd86cf0224152c509e295d3cbbd209098f3)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
set_escdelay(), set_tabsize() and the ESCDELAY and TABSIZE variables were
gated only by the ncurses-specific NCURSES_EXT_FUNCS macro, which excluded
them when building against other curses implementations such as NetBSD curses
even when they provided them. Detect each with a configure capability probe
and gate on HAVE_CURSES_*.
(cherry picked from commit 0635e55b47e306aa6cc0610105775849b0699e2c)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The name parameter of Misc.wait_variable(), setvar() and getvar() and the
value parameter of setvar() should not be optional. Their default values
('PY_VAR' and '1') are not meaningful and should not be advertised.
(cherry picked from commit e134a1aa36027fb3c8bd9493028072365b19479b)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-133031: Support non-ASCII characters in curses.textpad.Textbox (GH-152451) (GH-152467)
Textbox mangled non-ASCII characters of an 8-bit locale encoding: it masked
reads with curses.ascii.ascii(), which clears the 8th bit, and tested input
with curses.ascii.isprint(), which rejects bytes above 127.
Decode cells and input bytes with the window's encoding instead. Cells are
read with instr() and the lower-right cell is written as text, since inch() and
insch() with an int byte mishandle a non-ASCII character on a wide build. This
uses only the byte-oriented curses API, so it works without wide-character
support.
(cherry picked from commit c253f0c14b046cf79881d0602620a3b2a15c2316)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-85320: Use UTF-8 for IDLE configuration and breakpoint files (GH-152475) (GH-152555)
They were read and written using the locale encoding, which could corrupt
non-ASCII paths and made them non-portable.
(cherry picked from commit f6e904e1a666cb1e5664750b1c3d8f89cba3a769)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-110357: hashlib no longer logs at import when a guaranteed hash is unavailable (GH-152538) (#152554)
gh-110357: hashlib no longer logs at import when a guaranteed hash is unavailable (GH-152538)
When a normally-guaranteed hash algorithm cannot be constructed at import time
(e.g. an OpenSSL FIPS configuration excludes it from the default provider, or
the build used --without-builtin-hashlib-hashes), importing hashlib emitted an
"ERROR:root:hash algorithm ... will not be supported at runtime" message to
stderr. For the many programs that never use the missing algorithm this is
pure noise. Worse, logging.error() lazily calls logging.basicConfig(), which
mutates the root logger's handlers -- a global side effect that the test suite
flags as an altered execution environment.
Stop logging in that path. Code that actually uses a missing algorithm still
gets a clear ValueError from the stub constructor installed in its place.
The stray output has shown up incidentally in FIPS / "No Builtin Hashes"
buildbot reports for years (e.g. gh-110357, gh-76902) without being the
reported subject.
(cherry picked from commit 8ae1a236fd334a590e90028f615cd4a822ae6f97)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
[3.15] gh-87577: Document that wm_manage does not accept ttk widgets (GH-152532) (GH-152543)
wm_manage() works only with the classic tkinter Frame, LabelFrame and
Toplevel widgets, not their tkinter.ttk counterparts.
(cherry picked from commit 2670cb062c9ec31cd6df7be645f929a8398601c7)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation (GH-151573) (#152540)
gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation (GH-151573)
* gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation
OrderedDict.copy() walks the internal linked list while building the new
dict. The loop body can run arbitrary Python (a key's __eq__/__hash__, or
a subclass __getitem__/__setitem__) which can clear the source dict and
free the nodes being iterated.
Detect this the same way OrderedDict.__eq__ already does (gh-119004):
snapshot od_state before the loop, hold a strong reference to the key and
read the hash before any reentrant call, and raise RuntimeError if the
state changed before advancing to the next node.
[3.15] gh-151416: fix a borrowed ref potential use after free via fspath in os.spawnv/spawnve (GH-151417) (#152535)
gh-151416: fix a borrowed ref potential use after free via fspath in os.spawnv/spawnve (GH-151417)
* gh-151416: Fix use-after-free in os.spawnv/spawnve when __fspath__ mutates argv
The argv conversion loops passed references borrowed from the argv list
into fsconvert_strdup(). An item's __fspath__() can mutate the list and
release its reference to the item, leaving the converter operating on a
freed object. A shrunk list could also make PyList_GetItem() return
NULL, which PyUnicode_FS{Converter,Decoder}() treat as a request to
release an uninitialized output variable.
Hold a strong reference to each item across the conversion, matching
parse_arglist() and parse_envlist().
* gh-151416: Don't mask non-TypeError argv conversion errors in os.spawnv
os.spawnv() replaced any error raised during argv item conversion,
such as MemoryError, codec errors, or the embedded-null ValueError,
with a generic TypeError. Only add the contextual message when the
conversion actually raised TypeError, matching how os.spawnve() and
the exec functions propagate these errors.
The test is gated to the native C spawnv: the Python fallback used
elsewhere reports conversion failures from the forked child as exit
status 127 instead of raising.
(cherry picked from commit f57d3d6db39ea0bd39743f1a614b46cbefbfdab6)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
[3.15] gh-150743: Limit trailer lines and interim responses read by http.client (GH-150741) (#152523)
gh-150743: Limit trailer lines and interim responses read by http.client (GH-150741)
http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).
Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.
Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.
(cherry picked from commit 41cc78a7a47fe584e2c2899737fec877d61ae331)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
---
This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4) and was determined not to be high enough severity to handle privately.
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Serhiy Storchaka [Sun, 28 Jun 2026 17:06:55 +0000 (20:06 +0300)]
[3.15] gh-87881: Document the result of curses inch() and getbkgd() (GH-152488) (GH-152511)
Explain the character/attribute bit layout and how to extract the parts
(A_CHARTEXT and A_ATTRIBUTES bit-masks, pair_number() for the color pair).
(cherry picked from commit d831a690766e92b3be5e40134f64407bd041bcbf)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-78335: Complete the widget option lists in tkinter docstrings (GH-152485) (GH-152500)
Several widget __init__ docstrings omitted valid options, and Menubutton and
Message had no option list at all. List every option supported by the widget,
tagging those added in Tk 9.0 and 9.1.
Add test_options_in_docstring, asserting that every option in OPTIONS is named
in the widget's __init__ docstring. Options reported by keys() but not in the
docstring are only printed in verbose mode, as some depend on the Tk version.
(cherry picked from commit ba0c0e6be18ea56d00b4534cc9e32d1acaba96d6)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-110904: Recommend windows-curses in the curses HOWTO (GH-152491) (GH-152506)
The HOWTO pointed at UniCurses, which is unmaintained and exposes its own
API. windows-curses provides the standard curses interface on Windows, so
existing code runs unchanged.
(cherry picked from commit 7b0dff7d16ce59df44847ab04567eb97bfbc3576)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The non-ASCII tests only exercised what the runner's locale could encode (in
practice UTF-8). Add 8-bit-encoding cases to the character and string I/O
tests, each guarded by the existing encodability check: ASCII, a character
common to the Latin encodings ('é'), and ones distinctive to a single encoding
(byte 0xA4 is '¤' in ISO-8859-1, '€' in ISO-8859-15, 'є' in KOI8-U). Run the
whole suite under different locales to cover them; unrepresentable cases skip.
* gh-152415: Verify character output round-trips in test_output_character
Read each written character back with in_wch() or instr() rather than
inch(), which on a wide build returns the low byte of the code point
instead of the locale-encoded byte and so mangles a non-ASCII character
of an 8-bit locale. This lets the int-argument cases cover '€'/'є', and
adds matching coverage for the str argument.
insch() with an int byte > 127 is checked only for Latin-1: on a wide
build ncurses winsch stores a printable byte directly as a code point
instead of decoding it through the locale.
(cherry picked from commit 003d3620cc0f44caca7bf26c3e6964f5f379645f)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
[3.15] gh-151613: Fix remote debugging frame cache ABA (#152448)
gh-151613: Fix remote debugging frame cache ABA (#151614)
The remote debugging frame cache previously used only the last_profiled_frame address as its cache anchor. If a frame returned and a later frame reused the same _PyInterpreterFrame address, the profiler could accept a stale cache entry and splice parent frames from a different call chain into the current stack.
This adds a last_profiled_frame_seq counter next to last_profiled_frame, increments it when the anchor advances, stores it in frame cache entries, and validates cache hits against both the frame address and the sequence. Cache miss walks now copy stack chunks before storing new cache entries so stored continuations come from a stable snapshot. The new regression test exercises alternating call chains and checks that cached stacks never contain frames from both branches.
[3.15] gh-152434: Block --async-aware with --binary (GH-152444) (#152446)
gh-152434: Block --async-aware with --binary (GH-152444)
The binary writer does not currently handle AwaitedInfo samples and
crashes when running in --async-aware mode.
(cherry picked from commit 876c06cab9e824747d708a031c6b81b1f8a4f8dc)
Co-authored-by: László Kiss Kollár <kiss.kollar.laszlo@gmail.com>
[3.15] gh-151029: Fix sys.remote_exec() unable to find writable memory when libpython replaced on disk (GH-151032) (#152443)
gh-151029: Fix sys.remote_exec() unable to find writable memory when libpython replaced on disk (GH-151032)
(cherry picked from commit a69d0fc41ef339378022f1c0190a9692cb276a7f)
Co-authored-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Pablo Galindo <pablogsal@gmail.com>
projects / thirdparty / Python / cpython.git / log
