Python for Mac

Security

• gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650).
• gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs.
• gh-143925: Reject control characters in data: URL media types.
• gh-143919: Reject control characters in http.cookies.Morsel fields and values.
• gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters.

Library

• gh-144380: Improve performance of io.BufferedReader line iteration by ~49%.
• gh-144169: Fix three crashes when non-string keyword arguments are supplied to objects in the ast module.
• gh-144100: Fixed a crash in ctypes when using a deprecated POINTER(str) type in argtypes. Instead of aborting, ctypes now raises a proper Python exception when the pointer target type is unresolved.
• gh-144050: Fix stat.filemode() in the pure-Python implementation to avoid misclassifying invalid mode values as block devices.
• gh-144023: Fixed validation of file descriptor 0 in posix functions when used with follow_symlinks parameter.
• gh-143999: Fix an issue where inspect.getgeneratorstate() and inspect.getcoroutinestate() could fail for generators wrapped by types.coroutine() in the suspended state.
• gh-143831: annotationlib.ForwardRef objects are now hashable when created from annotation scopes with closures. Previously, hashing such objects would throw an exception. Patch by Bartosz Sławecki.
• gh-143874: Fixed a bug in pdb where expression results were not sent back to remote client.
• gh-143880: Fix data race in functools.partial() in the free threading build.

Full list of changes available here