Victor Stinner [Thu, 2 Jul 2026 13:00:51 +0000 (15:00 +0200)]
gh-152680: Detect virtualization on Windows in pythoninfo (#152824)
Use WMI to detect virtualization on Windows.
Replace wmic command with _wmi module to get the operating system caption and
version.
The wmic tool is deprecated since January 2024:
https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242
For example, it's no longer installed in Windows images on GitHub
Action.
Fix also run_command(): no longer try to spawn a subprocess if the
platform doesn't support subprocess. It avoids logging run_command()
errors.
gh-88574: Skip a spurious blank line after a literal in imaplib (GH-152751)
Some IMAP servers send an extra blank line after the data of a literal.
imaplib mistook it for the response trailer and failed on the next
command. Such a blank line is now skipped.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gh-66335: Add tests for imaplib command methods (GH-152872)
Add coverage tests for the IMAP4 command methods and their UID variants
(SELECT, CREATE, COPY, STORE, FETCH, SEARCH, SORT, THREAD, DELETE,
RENAME, SUBSCRIBE, UNSUBSCRIBE, LIST, STATUS, the ACL and quota
commands, ANNOTATION, PROXYAUTH and ENABLE), plus test helpers
(splitargs, parse_sequence_set, make_simple_handler) and per-command
argument capture in the test server.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gh-108280: Give a meaningful error for an invalid imaplib greeting (GH-152768)
Connecting to a server that does not send a valid IMAP4 greeting, such as
a POP3 server answering on the IMAP port, failed with the unhelpful
"imaplib.IMAP4.error: None". A meaningful message is now raised instead.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gh-63121: Refresh imaplib capabilities on state changes (GH-152752)
imaplib fetched the server capabilities only once, at connection time.
They are now also refreshed after a successful LOGIN or AUTHENTICATE,
from the CAPABILITY response the server sent or, if it sent none, by
querying it. This lets methods such as enable() see capabilities added
after login, for example ENABLE on Gmail (gh-103451).
Capabilities advertised in the server greeting are now used too, saving
a redundant CAPABILITY command.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gh-82183: Do not restart the busy IDLE shell when running without restart (#152745)
"Run... Customized" with "Restart shell" unchecked restarted the shell
anyway when it was busy executing code, killing any pending input. It now
reports that the shell is executing just once, not twice, and does not run.
gh-134300: Remove idlelib from the path of the IDLE user process (#152739)
The idlelib directory ends up on sys.path when idle.py is run as a script,
and it was passed to the user process, where it let user code import
idlelib submodules as top-level modules, such as "import help".
gh-71956: Fix IDLE Replace All searching up without wrap around (#152737)
When the search direction is "Up" and "Wrap around" is off, Replace All
replaced only the first match above the current position (and all matches
below it). It now replaces all matches from the start of the text down to
the current position, consistently with the "Up" direction.
gh-66331: Set correct WM_CLASS on X11 for IDLE windows (#152733)
Set the WM_CLASS of IDLE's long-lived windows (window-list windows and
the stack viewers) to "Idle" instead of the default "Toplevel", so that
window managers group and label them correctly.
Bump the `actions/{github-script,checkout}` and `j178/prek-action` actions (#152760)
Bumps the actions group with 3 updates: [actions/github-script](https://github.com/actions/github-script), [actions/checkout](https://github.com/actions/checkout) and [j178/prek-action](https://github.com/j178/prek-action).
Serhiy Storchaka [Tue, 30 Jun 2026 19:24:07 +0000 (22:24 +0300)]
gh-152502: Detect the curses mouse interface and is_* methods portably (GH-152705)
The mouse interface (getmouse(), has_mouse(), the BUTTON* constants,
window.mouse_trafo(), ...) and the window is_*() state-query methods were gated
on ncurses-specific macros, so they were dropped on other curses implementations
that provide them, such as NetBSD curses and PDCurses.
Gate them instead on configure capability probes (for functions NetBSD curses
provides, since it defines no identifying macro) or on NCURSES_EXT_FUNCS or the
PDCURSES macro (for functions only ncurses and PDCurses provide). Probe for
getmouse() with its X/Open getmouse(MEVENT *) signature, since PDCurses declares
an incompatible getmouse(void) unless built for the ncurses mouse API, which
PDC_NCMOUSE now always selects.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Petr Vaganov [Tue, 30 Jun 2026 14:45:25 +0000 (21:45 +0700)]
gh-152682: Fix NULL dereference on OOM in `symtable_visit_type_param_bound_or_default` (#152684)
In `symtable_visit_type_param_bound_or_default()`, when a reserved name
(e.g. `__classdict__`) is used as a type parameter, `PyUnicode_FromFormat()`
is called to build the SyntaxError message. If the allocation fails and
returns NULL, the subsequent `PyErr_SetObject()` and `Py_DECREF()` calls
would dereference NULL, causing a segfault.
Fix by returning 0 immediately when `PyUnicode_FromFormat()` returns NULL.
This propagates the MemoryError set by `PyUnicode_FromFormat()`.
The bug was introduced in gh-128632 (commit 891c61c).
Steve Stagg [Tue, 30 Jun 2026 10:57:28 +0000 (11:57 +0100)]
gh-152635: Raise MemoryError when the lock allocation fails in `_interpchannels.create()` (#152642)
Previously, an allocation failure when creating
the lock for a channel in `_interpchannels` would trigger an assert.
Caused by `handle_channel_error` being passed an error code of -1
which is only allowed if an exception has been set.
(in this case, no exception was set)
`channelsmod_create` now forwards the error code from `channel_create`
which `handle_channel_error` already handled.
Serhiy Storchaka [Tue, 30 Jun 2026 09:19:43 +0000 (12:19 +0300)]
gh-50966: Fix unbounded recursion in turtle drag handlers (GH-152626)
TurtleScreenBase._update() redraws with cv.update(), which also reprocesses
input events, so a handler that moves the turtle (such as
screen.ondrag(turtle.goto)) reenters _update() for every queued event until
the interpreter crashes. A reentrant _update() now only flushes drawing with
update_idletasks().
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Tue, 30 Jun 2026 09:09:09 +0000 (12:09 +0300)]
gh-152325: Gate curses.has_mouse() on the ncurses patch level (GH-152652)
has_mouse() was added to ncurses after the 5.7 release, but the binding
guarded it only with NCURSES_MOUSE_VERSION, which 5.7 already defines, so
the module failed to compile against ncurses 5.7 (such as the system
curses on macOS). Gate it additionally on NCURSES_EXT_FUNCS, which holds
the library's patch date.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
xzkdeng [Tue, 30 Jun 2026 09:08:39 +0000 (17:08 +0800)]
gh-133510: Add links to more info for the match statement in FAQ anwser (#133511)
Co-authored-by: sobolevn <mail@sobolevn.me> Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com> Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Stan Ulbrych <stan@python.org>
Gregory P. Smith [Tue, 30 Jun 2026 00:05:02 +0000 (17:05 -0700)]
gh-146219: Document reusing a thread state across repeated foreign-thread calls (GH-146221)
* Document reusing a thread state across repeated foreign-thread calls
Add a subsection under "Non-Python created threads" explaining the
performance cost of creating/destroying a PyThreadState on every
Ensure/Release cycle and showing how to keep one alive for the
thread's lifetime instead.
* add a comma
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
---------
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
Serhiy Storchaka [Mon, 29 Jun 2026 20:49:19 +0000 (23:49 +0300)]
gh-103878: Return a consistent empty value from cancelled file dialogs (GH-152435)
On cancellation Tcl may report the empty result as '', () or b'' depending
on the platform and Tk version. Normalize it so that askopenfilename(),
asksaveasfilename() and askdirectory() always return '' and
askopenfilenames() always returns ().
Open._fixresult() now distinguishes single from multiple results by the
'multiple' option rather than the result type.
Co-authored-by: Christopher Chavez <chrischavez@gmx.us> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Mon, 29 Jun 2026 15:30:23 +0000 (18:30 +0300)]
gh-69134: Wait until mapped in keyboard virtual-event tests (GH-152599)
test_virtual_events and test_selection_event generate key events after
focus_force(). On Windows these are only delivered once the toplevel is
mapped, so they could be dropped and the test fail. Wait until the
widget is mapped, as the other GUI tests already do.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Mon, 29 Jun 2026 14:11:03 +0000 (17:11 +0300)]
gh-152587: Make name and value required in tkinter variable methods (GH-152595)
The name parameter of Misc.wait_variable(), setvar() and getvar() and the
value parameter of setvar() no longer have default values, which were not
meaningful ('PY_VAR' and '1').
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The name parameter of Misc.wait_variable(), setvar() and getvar() and the
value parameter of setvar() should not be optional. Their default values
('PY_VAR' and '1') are not meaningful and should not be advertised.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Mon, 29 Jun 2026 13:15:02 +0000 (16:15 +0300)]
gh-152584: Reorganize the curses documentation into topic subsections (GH-152583)
Reorganize the curses documentation into topic subsections
Group the module-level functions, window methods and constants by topic
instead of presenting them as flat alphabetical lists, following the
categories used by the ncurses manual pages.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Mon, 29 Jun 2026 12:06:47 +0000 (15:06 +0300)]
gh-152503: Fix garbage text from curses wide-character cell reads (GH-152505)
window.in_wch(), window.in_wchstr() and window.getbkgrnd() read a cell
into an uninitialized cchar_t, relying on the curses library to leave the
text NUL-terminated -- which ncurses does but X/Open does not require, so
some libraries (such as NetBSD curses) returned uninitialized bytes as
wide characters. Zero-initialize the cell buffers before the read and
default the getcchar() output to an empty string.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Mon, 29 Jun 2026 12:02:12 +0000 (15:02 +0300)]
gh-152502: Detect optional curses functions with configure probes (GH-152504)
Some curses functions were called unconditionally or gated only by the
ncurses-specific NCURSES_EXT_FUNCS macro, which broke building the module
against other curses implementations (narrow ncurses, NetBSD curses) even
when they provided the function. Detect each with a configure capability
probe and gate on HAVE_CURSES_*.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Gregory P. Smith [Mon, 29 Jun 2026 08:11:14 +0000 (01:11 -0700)]
gh-110357: hashlib no longer logs at import when a guaranteed hash is unavailable (GH-152538)
When a normally-guaranteed hash algorithm cannot be constructed at import time
(e.g. an OpenSSL FIPS configuration excludes it from the default provider, or
the build used --without-builtin-hashlib-hashes), importing hashlib emitted an
"ERROR:root:hash algorithm ... will not be supported at runtime" message to
stderr. For the many programs that never use the missing algorithm this is
pure noise. Worse, logging.error() lazily calls logging.basicConfig(), which
mutates the root logger's handlers -- a global side effect that the test suite
flags as an altered execution environment.
Stop logging in that path. Code that actually uses a missing algorithm still
gets a clear ValueError from the stub constructor installed in its place.
The stray output has shown up incidentally in FIPS / "No Builtin Hashes"
buildbot reports for years (e.g. gh-110357, gh-76902) without being the
reported subject.
Gregory P. Smith [Mon, 29 Jun 2026 02:04:10 +0000 (19:04 -0700)]
gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation (GH-151573)
* gh-148660: Fix use-after-free in OrderedDict.copy() on reentrant mutation
OrderedDict.copy() walks the internal linked list while building the new
dict. The loop body can run arbitrary Python (a key's __eq__/__hash__, or
a subclass __getitem__/__setitem__) which can clear the source dict and
free the nodes being iterated.
Detect this the same way OrderedDict.__eq__ already does (gh-119004):
snapshot od_state before the loop, hold a strong reference to the key and
read the hash before any reentrant call, and raise RuntimeError if the
state changed before advancing to the next node.
Gregory P. Smith [Mon, 29 Jun 2026 00:27:15 +0000 (17:27 -0700)]
gh-151416: fix a borrowed ref potential use after free via fspath in os.spawnv/spawnve (GH-151417)
* gh-151416: Fix use-after-free in os.spawnv/spawnve when __fspath__ mutates argv
The argv conversion loops passed references borrowed from the argv list
into fsconvert_strdup(). An item's __fspath__() can mutate the list and
release its reference to the item, leaving the converter operating on a
freed object. A shrunk list could also make PyList_GetItem() return
NULL, which PyUnicode_FS{Converter,Decoder}() treat as a request to
release an uninitialized output variable.
Hold a strong reference to each item across the conversion, matching
parse_arglist() and parse_envlist().
* gh-151416: Don't mask non-TypeError argv conversion errors in os.spawnv
os.spawnv() replaced any error raised during argv item conversion,
such as MemoryError, codec errors, or the embedded-null ValueError,
with a generic TypeError. Only add the contextual message when the
conversion actually raised TypeError, matching how os.spawnve() and
the exec functions propagate these errors.
The test is gated to the native C spawnv: the Python fallback used
elsewhere reports conversion failures from the forked child as exit
status 127 instead of raising.
Gregory P. Smith [Sun, 28 Jun 2026 19:06:41 +0000 (12:06 -0700)]
gh-150743: Limit trailer lines and interim responses read by http.client (GH-150741)
http.client read chunked-response trailer lines and skipped interim (1xx)
responses in unbounded loops, so a server streaming either forever would
hang the client even with a socket timeout set (data keeps arriving, so
the timeout never fires).
Trailer lines are now limited to max_response_headers (100 by default)
and interim responses to 100; HTTPException is raised past either limit.
Follow-up to gh-88188 for CVE-2021-3737, which bounded header lines
within an interim response but not these two sibling loops.
---
This issue was reported to us via [GHSA-w4q2-g22w-6fr4](https://github.com/python/cpython/security/advisories/GHSA-w4q2-g22w-6fr4) and was determined not to be high enough severity to handle privately.
Serhiy Storchaka [Sun, 28 Jun 2026 17:11:47 +0000 (20:11 +0300)]
gh-69134: Harden tkinter GUI tests that depend on a mapped widget (GH-152499)
Add wait_until_mapped() and AbstractTkTest.require_mapped() to
test_tkinter.support and use them to guard the assertions that need a
widget to be actually mapped (winfo_width(), identify(), coords(), ...).
This avoids intermittent failures under window managers that do not map
the widget promptly, without skipping the unrelated checks.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Sun, 28 Jun 2026 16:30:04 +0000 (19:30 +0300)]
gh-110904: Recommend windows-curses in the curses HOWTO (GH-152491)
The HOWTO pointed at UniCurses, which is unmaintained and exposes its own
API. windows-curses provides the standard curses interface on Windows, so
existing code runs unchanged.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Sun, 28 Jun 2026 16:14:27 +0000 (19:14 +0300)]
gh-78335: Complete the widget option lists in tkinter docstrings (GH-152485)
Several widget __init__ docstrings omitted valid options, and Menubutton and
Message had no option list at all. List every option supported by the widget,
tagging those added in Tk 9.0 and 9.1.
Add test_options_in_docstring, asserting that every option in OPTIONS is named
in the widget's __init__ docstring. Options reported by keys() but not in the
docstring are only printed in verbose mode, as some depend on the Tk version.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Sun, 28 Jun 2026 14:09:03 +0000 (17:09 +0300)]
gh-152325: Add curses.has_mouse() and curses.window.mouse_trafo() (GH-152484)
has_mouse() reports whether the mouse driver was successfully initialized.
window.mouse_trafo(y, x, to_screen) converts a coordinate pair between
window-relative and screen-relative coordinates, returning the (y, x) pair or
None if it lies outside the window. Together these complete the curses mouse
interface.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Sun, 28 Jun 2026 14:03:22 +0000 (17:03 +0300)]
gh-87881: Document the result of curses inch() and getbkgd() (GH-152488)
Explain the character/attribute bit layout and how to extract the parts
(A_CHARTEXT and A_ATTRIBUTES bit-masks, pair_number() for the color pair),
or use in_wch() to get a complexchar.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Serhiy Storchaka [Sun, 28 Jun 2026 12:49:28 +0000 (15:49 +0300)]
gh-133031: Support the full Unicode range in curses.textpad.Textbox (GH-152482)
Read input with get_wch() and the window back with in_wch(), so combining
characters and characters outside the locale encoding now work where curses has
wide-character support.
edit() passes non-ASCII characters to validate() as strings, keeping ASCII and
key codes as integers so existing validators keep working.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
projects / thirdparty / Python / cpython.git / log
