kangtastic [Sun, 22 Mar 2026 21:10:28 +0000 (14:10 -0700)]
gh-146192: Add base32 support to binascii (GH-146193)
Add base32 encoder and decoder functions implemented in
C to the binascii module and use them to greatly improve the
performance and reduce the memory usage of the existing
base32 codec functions in the base64 module.
* Put the "Loading shared libraries" section first
* Adjust formatting at the end of the section
* In "Finding shared libraries", add more text about what's going on
* Move the stub function doc for find_library into "Finding shared libraries"
* Also move the sister function, find_msvcrt. That's on the chopping block,
but not removed now.
Serhiy Storchaka [Fri, 20 Mar 2026 11:07:00 +0000 (13:07 +0200)]
gh-145980: Add support for alternative alphabets in the binascii module (GH-145981)
* Add the alphabet parameter in functions b2a_base64(), a2b_base64(),
b2a_base85(), and a2b_base85().
* And a number of "*_ALPHABET" constants.
* Remove b2a_z85() and a2b_z85().
gh-145633: Refine notes on non-IEEE platforms (#145845)
* We don't specify what happens on non-IEEE platforms.
* Use rather PY_LITTLE_ENDIAN to get native endianness.
* Mention that unpack functions don't fail in CPython.
* Mention that PyFloat_Pack8 doesn't fail in CPython.
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Co-authored-by: Victor Stinner <vstinner@python.org>
gh-145254: Fix formatting of thread safety annotations (#146111)
- Add leading space so that the spacing between the previous annotation
and the thread safety annotation looks correct.
- Remove trailing period from the link to the thread safety level.
Victor Stinner [Wed, 18 Mar 2026 16:23:05 +0000 (17:23 +0100)]
gh-146092: Fix error handling in _BINARY_OP_ADD_UNICODE opcode (#146117)
Fix also error handling in _BINARY_OP_ADD_FLOAT,
_BINARY_OP_SUBTRACT_FLOAT and _BINARY_OP_MULTIPLY_FLOAT opcodes.
PyStackRef_FromPyObjectSteal() must not be called with a NULL
pointer.
Sam Gross [Tue, 17 Mar 2026 18:24:44 +0000 (14:24 -0400)]
gh-145779: Improve classmethod/staticmethod scaling in free-threaded build (#145826)
Add special cases for classmethod and staticmethod descriptors in
_PyObject_GetMethodStackRef() to avoid calling tp_descr_get, which
avoids reference count contention on the bound method and underlying
callable. This improves scaling when calling classmethods and
staticmethods from multiple threads.
Also refactor method_vectorcall in classobject.c into a new _PyObject_VectorcallPrepend() helper so that it can be used by
PyObject_VectorcallMethod as well.
gh-144975: Fix wave.Wave_write.setframerate() validation order (GH-144976)
Validate the frame rate after rounding to an integer, not before.
This prevents values like 0.5 from passing validation (0.5 > 0)
but then rounding to 0, which would cause a confusing delayed error
"sampling rate not specified" when writing frames.
With this fix, setframerate(0.5) immediately raises "bad frame rate",
providing clear feedback at the point of the error.
The DIALECT_GETATTR macro in dialect_new() unconditionally called
PyErr_Clear() when PyObject_GetAttrString() failed, which suppressed
all exceptions including MemoryError, KeyboardInterrupt, and
RuntimeError. Now only AttributeError is cleared; other exceptions
propagate via the existing error handling path.
Serhiy Storchaka [Tue, 17 Mar 2026 10:16:35 +0000 (12:16 +0200)]
gh-144545: Improve handling of default values in Argument Clinic (GH-146016)
* Add the c_init_default attribute which is used to initialize the C variable
if the default is not explicitly provided.
* Add the c_default_init() method which is used to derive c_default from
default if c_default is not explicitly provided.
* Explicit c_default and py_default are now almost always have precedence
over the generated value.
* Add support for bytes literals as default values.
* Improve support for str literals as default values (support non-ASCII
and non-printable characters and special characters like backslash or quotes).
* Fix support for str and bytes literals containing trigraphs, "/*" and "*/".
* Improve support for default values in converters "char" and "int(accept={str})".
* Converter "int(accept={str})" now requires 1-character string instead of
integer as default value.
* Add support for non-None default values in converter "Py_buffer": NULL,
str and bytes literals.
* Improve error handling for invalid default values.
* Rename Null to NullType for consistency.
Gregory P. Smith [Mon, 16 Mar 2026 05:50:19 +0000 (22:50 -0700)]
gh-140814: Fix freeze_support() setting start method as side effect (GH-144608)
freeze_support() called get_start_method() without allow_none=True,
which locked in the default start method context. This caused a
subsequent set_start_method() call to raise "context has already been
set". Use allow_none=True and accept None as a matching value, since
spawn.freeze_support() independently detects spawned child processes.
Test that freeze_support() does not lock in the default start method,
which would prevent a subsequent set_start_method() call.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Stan Ulbrych [Sun, 15 Mar 2026 21:46:06 +0000 (21:46 +0000)]
gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (#145987)
Fix C stack overflow (CVE-2026-4224) when an Expat parser
with a registered `ElementDeclHandler` parses inline DTD
containing deeply nested content model.
the lazy imports PEP initial implementation (3.15 alpha) inadvertently incremented the length of the sys.flags tuple. In a way that did not do anything useful or related to the lazy imports setting (it exposed sys.flags.gil in the tuple). This fixes that to hard code the length to the 3.13 & 3.14 released length of 18 and have our tests and code comments make it clear that we've since stopped making new sys.flags attributes available via sequence index.