Log message:
python313 py313-html-docs: updated to 3.13.18

Python 3.13.18

Security

gh-160300: Fix http.cookiejar.DefaultCookiePolicy accepting and returning \ 
cookies with a negative Version attribute without checking their domain against \ 
the request host. Such cookies are now ignored.
CVE 2026-114583, gh-160097: tarfile.tar_filter() now rejects link members whose \ 
path resolves to the destination directory itself, as tarfile.data_filter() \ 
already did.
CVE 2026-115557, gh-160040: ssl now rejects TLS certificate chains that contain \ 
any of a set of compromised eMudhra intermediate CA keys. This is an \ 
extraordinary measure and a last line of defense: removing trust is primarily \ 
the job of the platform root store, and the built-in denylist only blocks \ 
connections while that update has not yet reached the OS, a container image, or \ 
a bundled trust store in various Python packages. Entries are added to the \ 
denylist only under a very high threshold. The denylist matches on the public \ 
key (the SHA-256 digest of the RFC 5280 SubjectPublicKeyInfo), so it also covers \ 
the cross-signed certificates that reuse one of the distrusted keys.
gh-159428: mimetypes no longer reads the files listed in mimetypes.knownfiles by \ 
default on Windows, and uses only the registry.
gh-157953: Update bundled libexpat to version 2.9.0.
gh-157579: Fix a race condition in the cleanup of tempfile.TemporaryDirectory. \ 
When working around file system permission errors, files are now removed \ 
relative to open directory file descriptors instead of resolving their path \ 
again, so that replacing a directory of the tree with a symbolic link can no \ 
longer make the cleanup delete files outside of the temporary directory. This \ 
addresses CVE 2026-12345.

Library

gh-87720: Fixed error in email new policies where header folding failed to \ 
detect the need to re-quote text obtained from encoded words in certain cases.

Tests

gh-159015: Fix test.test_math failing to import on musl-based systems. The skip \ 
condition of test_fma_zero_result compared the boolean returned by \ 
test.support.linked_to_musl() with a version tuple.

Log message:
python313 py313-html-docs: updated to 3.13.17

Python 3.13.17

Security
gh-159894: Bump the version of pip bundled in ensurepip to version 26.2.2.

Log message:
python313 py313-html-docs: updated to 3.13.16

3.13.16

macOS
gh-158010: Updated macOS installer to use OpenSSL 3.5.9, jumping from the 3.0 \ 
series to 3.5 after 3.0’s end of public support in September 2026.
Windows
gh-158010: Updated Windows builds to use OpenSSL 3.5.9, jumping from the 3.0 \ 
series to 3.5 after 3.0’s end of public support in September 2026.
gh-72353: Reading from the console on Windows now continues if the read was \ 
cancelled by Ctrl+C, but the SIGINT handler did not raise an exception. \ 
Previously the read ended as if at end of file.
gh-86427: Fix the encoding of the standard streams in the legacy Windows stdio \ 
mode (PYTHONLEGACYWINDOWSSTDIO). It is now the code page of the console, as in \ 
Python 3.7, not the ANSI code page.
gh-87587: os.device_encoding() on Windows now returns the code page of any \ 
console file descriptor, not only 0, 1 and 2, and returns None for other \ 
character devices like NUL. The UTF-8 code page is now reported as \ 
"utf-8" instead of "cp65001".
Tools/Demos
gh-113318: Fix Argument Clinic for @getter and @setter in a preprocessor \ 
conditional block. It failed with an internal error. Argument Clinic now also \ 
rejects the accessors of the same attribute with different C basenames, and the \ 
same accessor defined twice, which silently generated invalid or duplicated \ 
entries of PyGetSetDef.
Tests
gh-158051: The iOS testbed has been updated for compatibilty with Xcode 27.
gh-155997: Fix test.support.interpreters.list_all(). It failed if an interpreter \ 
was destroyed during the call, in particular by a garbage collection which \ 
finalized the object owning the last reference to it.
gh-75876: A test decorated with bigmemtest() now runs in a subprocess if it \ 
really allocates the memory it asks for (that is, if the -M option is used), so \ 
that the memory it uses and the address space it fragments are released when it \ 
ends. A dummy run stays in the process. The separate memory watchdog process is \ 
no longer used.
gh-155411: Fix test.support.subTests() for asynchronous test methods. They were \ 
wrapped in a synchronous function, which discarded the coroutine without \ 
awaiting it, so the test silently did not run at all.
gh-132581: The list of tests which altered the execution environment now \ 
includes the reasons why the environment was considered altered, for example an \ 
unraisable exception or a modified sys.path. The final result no longer repeats \ 
the same state twice (like ENV CHANGED then ENV CHANGED).
Security
gh-158446: Fix a crash or incorrect output that could occur when formatting a \ 
float or complex with a precision close to the platform’s INT_MAX. \ 
PyOS_double_to_string() now raises ValueError for any precision of that \ 
magnitude, regardless of presentation type or value, as the format string \ 
parsers already did for precisions above INT_MAX.

gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate \ 
the server_hostname argument if an ssl.SSLContext is passed with check_hostname \ 
set to True.

gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, \ 
server_hostname and session arguments similar to ssl.SSLContext.wrap_socket().

In particular, a context with check_hostname enabled and no server_hostname \ 
passed to wrap_bio() now raises ValueError instead of completing a handshake \ 
that verified the certificate chain without verifying the peer’s identity, \ 
with no indication that the check had been skipped.

gh-157265: In tarfile, when extracting a link falls back to extracting a member \ 
of the archive, skip the member when the filter function returns None when \ 
called with the extracted member’s name replaced with the link’s.

gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters \ 
where a crafted archive using a hard link to a symbolic link could change the \ 
permissions and modification time of a file outside the destination directory, \ 
and expose its contents inside the extracted tree. This addresses CVE \ 
2026-82049.

gh-157953: Update bundled libexpat to version 2.8.5.

gh-156002: Bound the amount of data zipfile decompresses per read for members \ 
compressed with bzip2, LZMA, or Zstandard, matching the existing limit for \ 
deflate. A small archive member could previously expand into an unbounded \ 
allocation even when read in small chunks.

gh-155999: Fix the tarfile tar and data extraction filters creating directories \ 
outside the destination for members whose name leaves the destination and \ 
returns to it, such as ../evil/../dest/sub/file. The containment check used the \ 
resolved path, but intermediate directories were created from the name as given.

gh-156293: Fix a crash in ssl when an sni_callback switches a connection to \ 
another SSLContext and the context that carries the callback is no longer \ 
referenced by the application. Servers that keep their sni_callback context \ 
alive (the usual case when it wraps the listening socket or is stored on the \ 
server object) were not affected. This addresses CVE 2026-19445.

gh-155292: Change the stringprep module and encodings.idna codec to not consider \ 
Unicode codepoint attributes beyond those defined in RFC 3454.

gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL \ 
scheme, preventing credentials stored for an HTTPS URL from being used for a \ 
matching HTTP URL, while URIs without a scheme continue to match any scheme.
Library
gh-158169: Fix zlib.Decompress.unconsumed_tail duplicating unused_data after end \ 
of stream when max_length was used.
gh-157672: Fix tkinter on macOS: creating a Tk instance no longer replaces the \ 
Python handlers of SIGINT, SIGHUP and SIGTERM with Tk’s handler which exits \ 
the process, so Ctrl-C raises KeyboardInterrupt again.
gh-157639: Fix a crash in cProfile when an external timer re-enters the \ 
profiler. Profiling events raised while the external timer runs are now ignored.
gh-157621: Fix a crash when a weak-reference callback is attached to a \ 
typing.ParamSpecArgs or typing.ParamSpecKwargs instance.
gh-69919: code.InteractiveInterpreter.runsource() and the REPL now report any \ 
exception raised by compiling the source, such as MemoryError or RecursionError \ 
for too deeply nested source, instead of propagating it or printing a traceback \ 
of the REPL internals.
gh-157451: Fix gettext plural form selection when the Plural-Forms expression \ 
combines the unary ! operator with a binary operator, for example !n + 1 or 2 * \ 
!n. The latter raised SyntaxError.
gh-157335: Fix out-of-bounds write in mmap.mmap.__setitem__ that could occur \ 
when converting the index or the assigned value (via __index__() for a single \ 
item, or via the buffer protocol for a slice) resized or closed the mmap object \ 
during the assignment.
gh-157406: Fix the Python implementation of xml.etree.ElementTree.XMLParser: the \ 
doctype() method of the target is now called for a document type declaration \ 
without an external identifier, like <!DOCTYPE html>, as in the C \ 
implementation.
gh-157325: Fix an out-of-bounds read in the hz incremental decoder when the \ 
input ends with ~.
gh-157301: Fix asyncio.Task hanging the event loop when an eager start fails to \ 
enter the task’s context.
gh-156002: zipfile again reads members through a third-party decompressor \ 
installed by monkey-patching the private _get_decompressor() to return an object \ 
that only implements old BZ2Decompressor API from Python 3.3. Note that \ 
decompressors without needs_input and two-argument decompress() are vulnerable \ 
to CVE 2026-15310.
gh-157159: The usage message printed by python -m tabnanny when no arguments are \ 
given now suggests python -m instead of the source file.
gh-156933: Fix incorrect integer return values from ctypes callbacks on some \ 
platforms, such as s390x.
gh-157048: Preserve the position and contents of io.BytesIO when \ 
BytesIO.__init__() fails because a buffer is exported.
gh-156961: Fix tkinter.font.nametofont() and the tkinter.font.Font constructor \ 
for a font name returned by Tk as a Tcl object, for example by \ 
ttk.Style.lookup().
gh-156970: Set the docstring of unittest.mock.Mock.return_value.
gh-156946: Fix a crash in curses.panel when the finalizer of a panel’s user \ 
pointer runs while the panel is being deallocated. The panel is now taken off \ 
the panel stack before its user pointer is dropped.
gh-156920: Fix asyncio on Windows: closing a DatagramTransport under \ 
ProactorEventLoop while datagrams were still queued, or while an in-flight write \ 
failed right as close() was draining the buffer, could strand the queued data \ 
and never call connection_lost(), hanging the close indefinitely.
gh-156797: Fix xml.sax.saxutils.XMLGenerator: the namespace URI is now escaped \ 
in the namespace declaration. Previously a URI containing &, < or a quote \ 
character produced a document which cannot be parsed.
gh-83895: xml.etree.ElementTree now accepts input larger than 2 GiB in the C \ 
implementation. The data is fed to Expat in chunks, as xml.parsers.expat already \ 
did, instead of raising OverflowError.
gh-99064: Fix xml.etree.ElementTree.parse() with a text file or other source of \ 
str data in the C implementation. The encoding declared in the document was \ 
applied to the already decoded text, which produced mojibake. It is now ignored, \ 
as when parsing with XMLParser.feed() or fromstring().
gh-156713: Fix nturl2path.pathname2url() and nturl2path.url2pathname(): the \ 
filesystem encoding and error handler are now used for percent-encoding and \ 
decoding, as in urllib.request. Previously paths containing surrogate characters \ 
raised UnicodeEncodeError.
gh-156698: Fix asyncio.ProactorEventLoop UDP transports so that a write error no \ 
longer strands a paused protocol: the write loop is now rescheduled when data \ 
remains buffered, and the protocol is resumed when the buffer has drained.
gh-127057: Fix asyncio.ProactorEventLoop UDP transports so that a \ 
ConnectionResetError raised by WSARecvFrom no longer stops the read loop.
gh-156658: xml.dom and xml.etree.ElementTree no longer treat characters which \ 
are not white space in XML (such as U+00A0) as white space. Previously they \ 
could be lost in indent(), canonicalize() with strip_text=True, and when parsing \ 
with the whitespace-in-element-content feature turned off.
gh-156476: The pure Python implementation of queue.SimpleQueue.get() now ignores \ 
timeout when block is false, matching the documented behavior and the C \ 
implementation. It previously raised ValueError.
gh-156444: Fix matching of a negated character set in a bytes pattern compiled \ 
with both re.IGNORECASE and re.LOCALE. The case closure is now applied to the \ 
members of the set, so that [^bc] no longer matches b'B'.
gh-156353: Fix configparser parsing when using whitespace in delimiters.
gh-156166: ssl: A failed assignment or deletion of the _msg_callback attribute \ 
of ssl.SSLContext no longer removes the current callback. Deleting it now raises \ 
AttributeError instead of TypeError.
gh-156173: Calling zlib.Decompress.flush() on invalid compressed data now raises \ 
zlib.error instead of being silently ignored.
gh-152817: sqlite3: Disallow removing the row_factory attribute of a cursor to \ 
prevent a crash on a query.
gh-156112: _ios_support no longer fails to import when \ 
ctypes.util.find_library() cannot resolve the ObjC runtime through the dyld \ 
shared cache, as is the case on iOS 13. The runtime is now loaded by name, which \ 
dyld resolves against the cache directly.
gh-156100: Fix crashes in sqlite3.Connection when deleting the autocommit \ 
attribute or setting it to an integer which does not fit in C long. Both now \ 
raise an exception.
gh-156099: Fix a crash when deleting the keylog_filename attribute of \ 
ssl.SSLContext. It now raises AttributeError.
gh-156067: Fix error handling in the zoneinfo accelerator module when a \ 
transition index is -1 or a TZ string’s __bool__ raises.
gh-155952: Fix the signatures of sqlite3.Connection.execute(), warnings.warn() \ 
and locale.setlocale() which rendered <unrepresentable> instead of the \ 
correct defaults for parameters.
gh-155835: hashlib: Fix data races when accessing digest_size and block_size on \ 
SHA-3 objects. Patch by Bénédikt Tran.
gh-155775: Fix a regression in imaplib introduced in the fix for gh-63121: \ 
refreshing the capabilities after a successful login() or authenticate() \ 
consumed the CAPABILITY response, so it could no longer be read with response().
gh-113318: Fix crashes when deleting an attribute whose setter is generated by \ 
Argument Clinic and is not prepared for deletion, among them the context, owner \ 
and session attributes of _ssl._SSLSocket. Deleting such attribute now raises \ 
AttributeError.
gh-155468: Fix netrc to distinguish empty quoted tokens from end-of-file, so \ 
malformed files no longer cause the remaining content to be silently ignored.
gh-155336: Fix error handling in socket.gethostbyaddr() and \ 
socket.gethostbyname_ex() when hostname resolution fails.
gh-102475: Fix os.path.realpath() on Windows: the unresolved part of the path is \ 
now appended, not joined, so a file name which looks like a drive (e.g. \ 
spam:eggs) no longer discards the resolved part. A path relative to another \ 
drive is now resolved against the root directory of that drive.
gh-89760: Fix os.path.realpath() on Windows: the \\?\ prefix is no longer \ 
stripped from a volume GUID path, which made the result invalid.
gh-84419: Fix os.stat() on Windows: trailing dots and spaces, which are ignored \ 
by the operating system, are no longer taken into account when the execute \ 
permissions are guessed from the file extension.
gh-155319: warnings.warn_explicit() now displays the source line taken from the \ 
loader of the module whose globals are passed as module_globals. It also no \ 
longer raises IndexError if lineno is out of the range of the module source.
gh-123011: warnings.warn_explicit() no longer emits a spurious \ 
DeprecationWarning or raises ImportError when it is called with the globals of \ 
the __main__ module.
gh-69370: python -m inspect --details no longer fails with UnicodeEncodeError if \ 
the path of the module contains characters unencodable in the encoding of \ 
sys.stdout. Such characters are now escaped with backslashes.
gh-69371: Fix pydoc for modules whose path contains undecodable bytes. \ 
pydoc.writedoc() and the pydoc HTTP server no longer fail with \ 
UnicodeEncodeError: the file URL is now percent-encoded using the filesystem \ 
encoding, and characters unencodable in the generated HTML page are escaped with \ 
backslashes.
gh-154855: Fix curses.window.instr() returning one character too few when the \ 
curses module is built against a curses library that counts the terminator in \ 
the requested length, such as the NetBSD one.
gh-135683: logging.FileHandler and logging.handlers.WatchedFileHandler now honor \ 
logging.raiseExceptions for errors that occur while opening the file, like for \ 
other errors during logging.
gh-82535: logging.handlers.SysLogHandler no longer fails if the address cannot \ 
be resolved when the handler is created. The address is resolved again when a \ 
record is emitted.
gh-153970: Calling str() on a subprocess.CalledProcessError no longer raises \ 
TypeError when its returncode is not an integer, such as None.
gh-153005: concurrent.interpreters.Queue.get() and \ 
concurrent.interpreters.Queue.put() now compute their timeout deadline from \ 
time.monotonic() instead of the wall clock, so adjusting the system clock during \ 
the call no longer makes them over- or under-wait.
gh-153772: isinstance() checks against collections.abc classes such as Mapping \ 
no longer raise AttributeError when the instance has no __class__. The abstract \ 
base class machinery now falls back to the object’s type in that case, \ 
matching the behaviour of the built-in isinstance().
gh-81241: Fix OSError when importing ctypes from a statically linked interpreter.
gh-153603: Fix a crash in the ISO-2022 decoders when decoding a byte after an \ 
unknown charset designation is set via the decoder’s setstate method. Patch by \ 
tonghuaroot.
gh-153539: Fix a crash in the C implementation of io.TextIOWrapper.tell() when \ 
the decoder’s getstate method triggers a reentrant seek, or when another \ 
thread seeks the same stream concurrently. Patch by tonghuaroot.
gh-152907: Restore cooked-mode terminal output flags around PyOS_InputHook \ 
callbacks in the new REPL (_pyrepl), so that output written by an input hook \ 
(for example a GUI toolkit event loop) is no longer emitted with OPOST disabled \ 
and keeps its carriage returns.
gh-153319: The turtledemo viewer now reads each demo script as UTF-8 instead of \ 
the locale encoding.
gh-152204: Fix the pure-Python implementations of datetime.date.fromisoformat(), \ 
datetime.time.fromisoformat() and datetime.datetime.fromisoformat() silently \ 
accepting some malformed ISO 8601 strings, such as non-ASCII digits or a sign in \ 
a fixed-width field (for example '2020+12' or \ 
'20201212T0102٣٤'). Each field is now required to be exactly N ASCII \ 
digits, matching the C implementation.
gh-145856: Fix plistlib.dumps() and plistlib.dump() so that skipkeys=True \ 
together with sort_keys=True correctly drops non-string keys when the dictionary \ 
contains a mix of string and non-string keys. Previously the sort ran before the \ 
filter and raised TypeError.
gh-146004: All -X options from the Python command line are now propagated to \ 
child processes spawned by multiprocessing, not just a hard-coded subset. This \ 
makes the behavior consistent between default “spawn” and “forkserver” \ 
start methods and the old “fork” start method. The options that were \ 
previously not propagated are: context_aware_warnings, cpu_count, \ 
disable-remote-debug, int_max_str_digits, lazy_imports, no_debug_ranges, \ 
pathconfig_warnings, perf, perf_jit, presite, pycache_prefix, \ 
thread_inherit_context, and warn_default_encoding.
gh-113329: Fix OSError being raised when trying to run doctests on a class \ 
objects in the REPL. Patch by Sten Wessel.
gh-102967: A bug in doctest._SpoofOut.truncate() was causing None to be passed \ 
to StringIO.seek() when no size was given. A simple fix skips the seek call when \ 
no size is given so the buffer can be truncated from the current position.
gh-82039: http.cookiejar.FileCookieJar.load() now checks the first, format \ 
signature line in a case-insensitive manner. Patch by Ashley Harvey.
gh-70758: Creating a new turtle screen after the previous one was closed no \ 
longer raises turtle.Terminator on the first turtle command.
bpo-44012: The exploded attribute of ipaddress.IPv6Address and \ 
ipaddress.IPv6Interface now supports addresses with a scope ID (link-local \ 
addresses). Previously the former raised AddressValueError and the latter \ 
omitted the scope ID.
gh-83869: Fix tarfile reading an archive with a GNU sparse 1.0 member whose size \ 
is set in the pax extended header. The offset of the next header was computed \ 
from the offset of the data, which is already past the sparse map, and from the \ 
size of the member, which can be the apparent size of the sparse file. All \ 
following members were unreachable.
gh-61366: http.cookiejar.MozillaCookieJar now reads session cookies written by \ 
curl and Wget, which use 0 in the expiration time field. Contributed by \ 
Jérémie Detrey.
IDLE
gh-158067: Fix the IDLE File Open dialog listing text files before Python files \ 
when opened from the Shell or an Output window.
gh-56596: Make IDLE keyboard shortcuts with ascii letters work when Caps Lock is \ 
on even when only one of the upper and lowercase versions are defined.
gh-75512: Output from a thread printed in the IDLE Shell while a statement is \ 
being entered no longer takes over the prompt of the statement.
gh-64007: IDLE no longer applies syntax coloring to the text entered for input() \ 
in the Shell.
gh-85560: Fix IDLE failing to find the opening parenthesis when a continuation \ 
line inside the parentheses starts with else of a conditional expression or with \ 
yield.
gh-75487: Fix saving a truncated number when an integer entry in the IDLE \ 
Settings dialog is blanked with the Backspace key.
gh-74112: Ctrl-C in the IDLE Shell now interrupts blocking calls such as \ 
time.sleep() and socket.recv.
gh-151471: Colorize the soft keyword type in IDLE.
gh-103089: IDLE no longer hangs when opening a file with very long lines. Only \ 
the first 2,000 characters of a line are colorized.
gh-89544: Fix IDLE hanging after Restart Shell while receiving a large output \ 
from the user process.
gh-70331: IDLE no longer fails to start with python -m idlelib, and its user \ 
process no longer fails to start, when the current directory contains user files \ 
with the same names as standard library modules that IDLE imports, such as \ 
random.py or tkinter.py.
gh-93016: Fix parsing of command line arguments in the IDLE “Run… \ 
Customized” dialog on Windows: backslashes are no longer treated as escape \ 
characters. Fix also display of the previous arguments in the dialog.
gh-59568: Fix “Save As” and “Open” dialogs in IDLE for a file whose name \ 
starts with ~ on Windows and X11 with Tcl/Tk older than 9.
gh-69004: The Debugger item of the IDLE Debug menu is now disabled while user \ 
code runs, like Stack Viewer.
gh-69365: The IDLE search dialogs now show a regular expression error below the \ 
entry instead of in a message box.
gh-93966: The highlighting of a syntax error in the IDLE Shell is now removed \ 
when the next statement is entered, not only when the next syntax error occurs.
gh-105689: Fix calltips, parenthesis matching and auto-indent in the IDLE Shell \ 
after output containing unbalanced quotes or parentheses.
gh-60402: In IDLE, Tab in a string that is not the start of a file name inserts \ 
a tab instead of opening the completion list.
gh-68453: Fix running IDLE with the -s option together with -c, -r or -: the \ 
command or script now runs after the startup file, without an error dialog and \ 
without restarting the shell.
gh-75234: Fix editing help sources and key bindings in the IDLE Settings dialog \ 
after selecting them with the keyboard.
gh-69919: IDLE now reports any exception raised by compiling the source, such as \ 
MemoryError for too deeply nested source, instead of hanging the Shell.
gh-91398: Remove the border around the IDLE Shell sidebar, which was drawn in \ 
the window background color and stood out with dark themes.
gh-71136: Fix a hang of the IDLE Shell when code run under the debugger raises \ 
KeyboardInterrupt.
gh-154511: Consolidate IDLE’s mouse wheel handling in idlelib.util. \ 
wheel_event moves there from idlelib.tree and joins x11_buttons, which tells \ 
whether Tk reports wheel rotations to a widget as \ 
<Button-4>/<Button-5> events, and bind_wheel, which binds whichever \ 
events Tk sends.
gh-156896: Stop deleting tkinter submodules when idlelib.run is imported.
gh-153480: Fix IDLE failing to start when opening a file which does not exist \ 
yet. Fix a traceback when a file open in the IDLE editor is deleted by another \ 
program; IDLE now asks whether to close the window, save the file elsewhere, or \ 
ignore it.
gh-55646: Fix IDLE crash at startup when the user configuration contains an \ 
invalid key binding, such as <Alt-Key-up> instead of <Alt-Key-Up>. \ 
The invalid binding is now ignored with a warning.
gh-66172: IDLE no longer fails to start when a user configuration file is \ 
corrupt. The unparsable file is renamed with a “.bad” suffix, default \ 
settings are used instead, and a warning lists the affected files.
gh-90304: Prevent IDLE from failing to start when a font reports a zero width \ 
for the '0' character. Such a broken font caused a ZeroDivisionError; \ 
the editor now falls back to the configured width.
gh-135511: Fix display of NameError and AttributeError with multi-line message.

Log message:
python313 py313-html-docs: updated to 3.13.15

Python 3.13.15

macOS
gh-153711: On macOS, do not attempt to use the dup3(2) and pipe2(2) system calls \ 
introduced in macOS 27 to prevent problems when running on older systems.
Windows
gh-140146: Prevent tkinter from hanging on Windows if stdin is redirected to a \ 
pipe in an interactive session. This is helpful for testing interactive usage of \ 
tkinter from a script, for example as part of the cpython test suite.
Tools/Demos
gh-155218: Fix Argument Clinic generating the flags of the optional groups in \ 
different order on 32-bit and 64-bit platforms.
gh-155207: Argument Clinic now supports the --dry-run and --diff options. They \ 
list the files which would be changed, or write a unified diff of the changes to \ 
the standard output, without modifying any file.
gh-64502: Fix Argument Clinic support of parameters with a default value used \ 
together with optional groups. Such parameters were always required in the \ 
generated parsing code.
gh-154580: Fix python-gdb.py raising UnicodeEncodeError when pretty-printing a \ 
non-ASCII str in a locale whose host charset cannot encode it, such as any \ 
non-ASCII string in the C locale.
Tests
gh-76595: Add C API tests for PyCapsule_Import().
gh-154167: The test runner (regrtest) now restores the default SIGINT handler if \ 
it was inherited as ignored, so the test suite no longer hangs when run as a \ 
shell background job.
gh-154144: Fix building the _testcapi module on NetBSD.
gh-152548: Add the test.support.isolation.runInSubprocess() decorator to run a \ 
test method or TestCase subclass in a fresh interpreter subprocess, isolated \ 
from the rest of the test run.
gh-151626: Fix several tests in test.test_inspect, test.test_import, \ 
test.test_importlib, test.test_py_compile and test.test_compileall that failed \ 
when the test suite was run with PYTHONPYCACHEPREFIX set. These tests now \ 
neutralize the pycache prefix where they assume the default __pycache__ bytecode \ 
layout.
gh-151096: Fix test_embed failing when CPython is configured with a split exec \ 
prefix (--exec-prefix differing from --prefix).
Security
gh-153030: Fixed quadratic complexity in incremental parsing of long \ 
unterminated constructs (such as tags or comments) in html.parser.HTMLParser, \ 
which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and \ 
find() avoid quadratic behavior when using XPath index predicates ([1], \ 
[last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter \ 
when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151544: Modules/Setup.local is no longer used as a landmark to discover \ 
whether Python is running in a source tree, as it could potentially affect \ 
actual installs. The pybuilddir.txt file is now the sole indicator of running in \ 
a source tree.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters \ 
where crafted archives could create a symlink pointing outside the destination \ 
directory. This was a bypass of CVE 2025-4330.
gh-150743: http.client now limits the number of chunked-response trailer lines \ 
it will read to 100, and the number of interim (1xx) responses it will skip to \ 
100. A malicious or broken server could previously stream trailer lines or 100 \ 
Continue responses forever, hanging the client even when a socket timeout was in \ 
use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing \ 
multi-line configparser values.
gh-143921: Reject NUL, CR and LF characters in IMAP commands. Other control \ 
characters are allowed and sent quoted.
Library
gh-155063: Bump the version of pip bundled in ensurepip to version 26.2.1
gh-155063: Bump the version of pip bundled in ensurepip to version 26.2
gh-154936: Fix the pure Python json decoder to report the correct position for \ 
invalid literal control characters in JSON strings.
gh-154892: Fix a bug in the C accelerator for zoneinfo where datetime.datetime \ 
subclasses returning -1 for hour, minute, or second could incorrectly raise a \ 
SystemError.
gh-154871: Fixed a crash in asyncio.Task.get_context() when called on an \ 
uninitialized task.
gh-154848: The pickle C accelerator now enforces frame boundaries when \ 
unpickling, as the pure Python implementation already did. An argument that \ 
straddles a frame boundary, or a frame that begins before the previous one has \ 
ended, now raises pickle.UnpicklingError instead of being silently read across \ 
the boundary. This prevents the loaded data from diverging from the pickletools \ 
disassembly of the same pickle.
gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which \ 
contains many quote characters. A doubled quote character is now also detected \ 
in a field which contains the delimiter or a line break.
gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains \ 
quoted fields, in particular for a single column of quoted fields.
gh-154738: Fix ExternalEntityParserCreate() not propagating the reparse-deferral \ 
setting to the subparser, which left GetReparseDeferralEnabled() returning an \ 
uninitialized value. Patch by tonghuaroot.
gh-93251: Fix UnicodeDecodeError in socket functions (such as getaddrinfo() and \ 
gethostbyaddr()) when the localized error message of the C library is not UTF-8: \ 
decode it from the locale encoding.
gh-154551: Fix ctypes.util.find_library() returning None in non-UTF-8 locales.
gh-79366: Fixed a race condition in logging: if a handler was removed while a \ 
record was being emitted, the following handlers of the same logger could be \ 
skipped.
gh-73458: Fix logging.config.listen(): it left the caller waiting for the ready \ 
event forever if the server could not be started, for example if the port was \ 
invalid or already in use. It now also binds to an IPv6 address if the host has \ 
no IPv4 address, for example if localhost is only aliased to ::1.
gh-154460: Fix time.strftime() and datetime.datetime.strftime() returning a \ 
wrong ISO 8601 week number (%V) on OpenBSD.
gh-154435: Fix os.posix_fadvise() and os.posix_fallocate() on DragonFly BSD: \ 
they raised OSError with a meaningless error code, because these functions \ 
return -1 and set errno there.
gh-154399: Fix venv activation in a non-interactive csh: activate.csh no longer \ 
fails when the prompt variable is not set.
gh-154389: Fix uuid.uuid1() on OpenBSD: it returned a version 4 UUID, because \ 
uuid_create() generates random UUIDs on this platform.
gh-154324: Fix os.sendfile() on illumos: it no longer reports a successful \ 
transfer when the underlying system call failed without writing any data.
gh-154307: Fix tempfile.TemporaryDirectory.cleanup() on DragonFly BSD, where \ 
removing a file with the UF_NOUNLINK flag failed with EISDIR instead of EPERM.
gh-154291: Fix socket.has_dualstack_ipv6() to return False on platforms such as \ 
DragonFly BSD where setting IPV6_V6ONLY to 0 silently has no effect.
gh-154283: On DragonFly BSD, threading.get_native_id() now returns a value that \ 
is unique across processes, matching the other platforms.
gh-154258: Fix a crash in mmap.mmap.resize() on NetBSD when growing a shared \ 
anonymous mapping. resize() now raises ValueError in this case, as it already \ 
did on Linux.
gh-154225: Fix os.openpty() on Solaris and illumos: it no longer leaves the \ 
pseudo-terminal as the controlling terminal of the calling process.
gh-154227: Fix os.posix_openpt() on OpenBSD, where it rejected the O_CLOEXEC flag.
gh-145030: Fix asyncio write pipe transports for named FIFOs on macOS and \ 
Solaris. Unread data sitting in the FIFO made the transport misinterpret a poll \ 
event as the reader disconnecting, wrongly closing the transport.
gh-154001: Fix random.binomialvariate() raising ZeroDivisionError when \ 
random.random() returns zero.
gh-153896: Deduplicate unhashable args in typing.Literal.
gh-153864: On a wide curses build, curses.window.insch() now inserts a non-ASCII \ 
byte as the character it encodes in the window’s encoding, consistently with \ 
addch(), instead of its code point.
gh-153862: On a wide curses build, curses.window.inch() now returns the \ 
locale-encoded byte of a non-ASCII character, matching instr(), instead of the \ 
low byte of its code point.
gh-146011: Fix a heap-use-after-free in the C implementation of decimal when \ 
calling repr() after deleting the Context.
gh-153761: Fix cancelling asyncio.loop.sock_accept() dropping a pending connection.
gh-153695: Hashing a sqlite3.Row that contains an unhashable value now raises \ 
TypeError instead of SystemError. Patch by tonghuaroot.
gh-153658: Fix sqlite3.Connection.iterdump() raising sqlite3.OperationalError \ 
when a table name contains a single quote. Patch by tonghuaroot.
gh-85943: Fix struct functions raising BytesWarning under the -bb command line \ 
option when a str format is used after an equal bytes format (or vice versa). \ 
The internal format cache no longer mixes str and bytes keys.
gh-153404: urllib.robotparser.RobotFileParser now silently ignores a Crawl-delay \ 
or Request-rate value written with non-decimal digits (such as U+00B2 \ 
SUPERSCRIPT TWO) instead of raising ValueError and aborting the parse of the \ 
whole robots.txt file.
gh-153417: Error messages from imaplib.IMAP4.select() and imaplib.IMAP4.uid() no \ 
longer raise BytesWarning under -bb when the mailbox or command argument is \ 
bytes.
gh-153406: email.utils.parsedate_to_datetime() now raises ValueError instead of \ 
OverflowError when the parsed year or timezone offset is out of range, matching \ 
its documented behavior.
gh-153083: Defer GC tracking of an array.array to the end of its construction. \ 
Patch by Donghee Na.
gh-143990: A tkinter.font.Font created from a named font, including by copy(), \ 
now copies its configured options rather than the options resolved by Tcl’s \ 
font actual, preserving a size specified in pixels (a negative size).
gh-153210: Fix crash on array import under a memory pressure.
gh-153200: Fix math.isqrt() returning an incorrect result for arguments not less \ 
than 2**64 that are instances of an int subclass with an overridden comparison \ 
operator.
gh-153068: Fix cProfile.Profile.enable() to no longer overwrite errors from \ 
sys.monitoring.
gh-153056: Fix string.Template raising a spurious ValueError when the pattern \ 
attribute is a compiled regular expression object, which the documentation \ 
allows.
gh-135661: Fix html.parser.HTMLParser: an abruptly closed empty comment \ 
(<!--> or <!--->) no longer extends up to a later --> in the same \ 
feed() call.
gh-54930: Error responses of http.server.BaseHTTPRequestHandler to malformed \ 
request lines now include a status line and headers instead of being sent in the \ 
bare HTTP/0.9 style. Only a valid HTTP/0.9 request (a two-word GET request line) \ 
now receives an HTTP/0.9 style response.
gh-152951: collections.deque prevent rare crash when calling extend under high \ 
memory pressure conditions.
gh-150880: Normalize non-extended Windows paths before appending the wildcard \ 
used by os.listdir() and os.scandir(), making paths with trailing spaces behave \ 
consistently with other filesystem APIs.
gh-152849: Out-of-range float and integer timestamps now raise OverflowError \ 
with the same message. Patch by tonghuaroot.
gh-152847: Reject a POSIX TZ transition rule with non-digit characters in the \ 
day-of-year field in the pure-Python zoneinfo parser. Patch by tonghuaroot.
gh-108280: Connecting imaplib to a server that does not send a valid IMAP4 \ 
greeting (for example a POP3 server answering on the IMAP port) now raises an \ 
error reporting the server’s response instead of imaplib.IMAP4.error: None.
gh-151126: Fix a crash caused by failing to set MemoryError on allocation \ 
failure when passing ctypes.Structure or ctypes.Union instances by value to \ 
ctypes foreign functions.
gh-63121: imaplib now refreshes the cached capability list after a successful \ 
login() or authenticate(), using the CAPABILITY response sent by the server or, \ 
if none was sent, by querying it, so that capabilities that become available \ 
only after authentication (such as ENABLE on Gmail) are recognized. Capabilities \ 
advertised in the server greeting are now also used, avoiding a redundant \ 
CAPABILITY command.
gh-88574: imaplib no longer fails when a server sends a spurious blank line \ 
after the counted data of a literal, including after a literal that terminates a \ 
response (such as a mailbox name returned by LIST). Such blank lines are now \ 
skipped without swallowing the following line.
gh-152502: Detect the curses mouse interface (getmouse(), the BUTTON* constants, \ 
and others) with a configure capability probe or library macros instead of \ 
gating it on ncurses-specific macros. It is now also available with other curses \ 
implementations that provide it, such as NetBSD curses and PDCurses (the latter \ 
underpins windows-curses).
gh-40038: imaplib now again quotes command arguments when necessary, for example \ 
mailbox names containing a space. Such quoting was inadvertently disabled when \ 
the module was ported to Python 3, and the arguments are now quoted according to \ 
the RFC 3501 grammar. For backward compatibility, an argument already enclosed \ 
in double quotes is left unchanged, so code that quotes arguments itself keeps \ 
working.
gh-50966: Fix unbounded recursion in turtle when a mouse event handler that \ 
moves the turtle is reentered while the screen is being redrawn, for example \ 
with screen.ondrag(turtle.goto). This could previously crash the interpreter.
gh-78335: Update the docstrings of tkinter and tkinter.ttk widget classes to \ 
list all supported widget options, including options added in Tk 9.0 and 9.1. \ 
tkinter.Menubutton and tkinter.Message previously had no option list at all.
gh-151126: Fix two crashes in tkinter and socket modules initialization under a \ 
memory pressure. Sets missing MemoryError.
gh-133031: curses.textpad.Textbox now enters and reads back the non-ASCII \ 
characters of an 8-bit locale encoding, instead of mangling them with a 7-bit \ 
mask.
gh-71880: curses.textpad.Textbox now lets the lower-right cell of the window be \ 
edited. Writing it with addch() would move the cursor past the end of the \ 
window, raising an error and scrolling a scrollable window, so it is now written \ 
with insch(), which keeps the cursor in place.
gh-83274: Deallocating a tkinter application from a thread other than the one it \ 
was created in no longer crashes the interpreter. The underlying Tcl interpreter \ 
is leaked instead, and a RuntimeWarning is reported.
gh-88758: tkinter.Misc.focus_get(), focus_displayof(), focus_lastfor() and \ 
winfo_containing() now return None instead of raising KeyError when the widget \ 
was not created by tkinter (for example a torn-off menu).
gh-38464: tkinter.Misc.nametowidget() now resolves the auto-generated names of \ 
cloned menus (a menu used as a menubar or a cascade) back to the original \ 
widget.
gh-152248: Make the C and pure-Python zoneinfo parsers validate POSIX TZ \ 
abbreviations consistently, rejecting unquoted abbreviations with non-letter \ 
characters and empty quoted abbreviations. Patch by tonghuaroot.
gh-80937: Fix a memory leak in tkinter when a Tcl command created with \ 
createcommand was not explicitly removed before the interpreter was deleted. The \ 
command no longer keeps the interpreter alive through a reference cycle.
gh-152246: Fix the pure-Python zoneinfo parser accepting an invalid POSIX TZ \ 
transition rule with a non-period separator. Patch by tonghuaroot.
gh-139816: Fix a hang in tkinter on interactive Python built without readline. \ 
An exception raised in a callback no longer causes the event loop to stop and \ 
wait for the user to press Enter; pending callbacks now keep running until input \ 
is actually available on stdin.
gh-139145: Fix a busy loop in tkinter on interactive Python. When a Tcl command \ 
running its own event loop (such as vwait or wait_variable()) was active and \ 
input arrived on stdin, the event loop kept spinning at 100% CPU. The stdin file \ 
handler is now removed as soon as input is available. Based on a patch by \ 
Michiel de Hoon.
gh-152212: Fix the pure-Python zoneinfo parser accepting a POSIX TZ string with \ 
a std abbreviation but no offset. This is invalid per POSIX and now raises \ 
ValueError, matching the C accelerator. Patch by tonghuaroot.
gh-152156: Fix a possible crash in _interpreters.create() under limited memory \ 
conditions.
gh-152157: The C implementations of fromisoformat() and fromisoformat() now \ 
reject a decimal separator that is not followed by any fractional digit before a \ 
timezone designator.
gh-151763: Fix crash in _interpqueues.create() whe MemoryError happens on queue \ 
creation.
gh-105895: Add match and case to the list of supported topics by help().
gh-152079: Fix datetime.datetime.fromisoformat() in the C implementation \ 
dropping the sub-second part of a UTC offset whose whole-second part is zero, \ 
matching the pure-Python implementation.
gh-152052: The json C accelerator now correctly reports an unterminated string \ 
for a \uXXXX escape at the end of the input.
gh-152060: Fix datetime.datetime.fromisoformat() raising AssertionError instead \ 
of ValueError for some malformed strings in the pure-Python implementation, \ 
matching the C implementation.
gh-126219: Fixed a crash in tkinter.Tk when className contains a non-BMP \ 
character and tkinter is built against Tcl/Tk 8.x. Such a name is now rejected \ 
with a ValueError.
gh-151955: Allow more types to be used in the bound argument to typing.ParamSpec.
gh-86165: Fix imaplib.Time2Internaldate() to use the local timezone offset for \ 
time.struct_time values with tm_gmtoff set to None, as returned by \ 
datetime.datetime.timetuple(). Contributed by Xiao Yuan.
gh-151814: Fix unbounded memory growth in io.TextIOWrapper when repeatedly \ 
writing an empty string.
gh-151695: Fix a use-after-free in the curses module. The encoding of the \ 
initial screen, used by curses.unctrl() and curses.ungetch() to encode non-ASCII \ 
characters, is now kept as a private copy instead of a borrowed pointer to a \ 
window object that may be deallocated.
gh-151596: Add missing size positional argument to the pure-Python \ 
implementation of io.TextIOBase.readline().
gh-148660: Fix a crash in collections.OrderedDict.copy() when a key’s __eq__ \ 
or a subclass method mutates the dict during the copy. Now raises RuntimeError \ 
instead, as iteration does.
gh-151497: Opening a tarfile archive no longer attempts to pre-allocate a huge \ 
buffer when a crafted or truncated member claims an oversized extended header (a \ 
GNU long name/link or a pax header). The extended header is now read in bounded \ 
chunks, so its size field can no longer trigger memory exhaustion.
gh-151403: Fixed a crash in subprocess.Popen (and _posixsubprocess.fork_exec) \ 
when an argv item’s __fspath__() concurrently mutates the args sequence being \ 
converted.
gh-151126: Fix crash on unset MemoryError on allocation failure in \ 
ctypes.get_errno().
gh-151416: Fix a crash in os.spawnv() and os.spawnve() when an argv item’s \ 
__fspath__() method mutates the argv list during argument conversion. \ 
os.spawnv() argument conversion errors other than TypeError, such as the \ 
ValueError for an embedded null, are no longer replaced with a generic \ 
TypeError.
gh-151337: Avoid possible memory leak in tkinter.c on Windows.
gh-151126: Fix a crash when MemoryError in os._path_splitroot() was not set properly.
gh-119710: Fix asyncio subprocess wait() hanging when the process has exited but \ 
one of its pipes is kept open by an inherited child process (so the pipe never \ 
reaches EOF). wait() now returns as soon as the process exits, regardless of the \ 
pipes’ state.
gh-151295: Fixed a crash (use-after-free) in bytes.join() and bytearray.join() \ 
that could occur if an item’s __buffer__() concurrently mutates the sequence \ 
being joined. The mutation is now reported as a RuntimeError instead.
gh-109940: Fix Windows venv activation in cmd.exe to respect \ 
VIRTUAL_ENV_DISABLE_PROMPT.
gh-117807: Fix mimetypes initialization from MIME map files containing invalid \ 
UTF-8 bytes.
gh-150771: Fix serialization of email messages using the shift_jis or euc-jp \ 
charsets: set_content() now encodes the payload using the output charset, so \ 
str(m) no longer raises UnicodeEncodeError.
gh-150484: Fix unittest.mock.mock_open() __exit__ raising TypeError when used \ 
with contextlib.ExitStack.
gh-149319: The asyncio REPL now ignores PYTHONSTARTUP and PYTHON_BASIC_REPL when \ 
-E or -I is used. Patch by Jonathan Dung.
gh-149221: Catch rare math domain error for random.binomialvariate().
gh-148441: xml.parsers.expat: prevent a crash in CharacterDataHandler() when the \ 
character data size exceeds the parser’s buffer size.
gh-47005: Fix urllib.request.AbstractHTTPHandler.do_open() to give regular \ 
headers set via add_header() priority over unredirected headers, consistent with \ 
get_header() and header_items().
gh-123720: asyncio: Fix asyncio.Server.serve_forever() shutdown regression. \ 
Since 3.12, cancelling serve_forever() could hang waiting for a handler blocked \ 
on a read from a client that never closed (effectively requiring two interrupts \ 
to stop); the shutdown sequence now ensures client streams are closed so \ 
serve_forever() exits promptly and handlers observe EOF.
gh-143988: Fixed crashes in socket.socket.sendmsg() and \ 
socket.socket.recvmsg_into() that could occur if buffer sequences are \ 
concurrently mutated.
gh-130796: Undeprecate the locale.getdefaultlocale() function. Patch by Victor \ 
Stinner.
gh-115634: Fix a deadlock in concurrent.futures.ProcessPoolExecutor when using \ 
max_tasks_per_child, present since the feature was introduced in Python 3.11. \ 
The executor stopped scheduling queued tasks after a worker process exited upon \ 
reaching its task limit. Based on a fix proposed by Tabrez Mohammed.
gh-79638: Disallow all access in urllib.robotparser if the robots.txt file is \ 
unreachable due to server or network errors.
gh-120665: Fixed an issue where unittest loaders would load and instantiate \ 
unittest.TestCase-derived subclasses that are also abstract base classes, which \ 
can’t be instantiated.
gh-105708: Accept an uppercase V prefix in IPvFuture addresses in \ 
urllib.parse.urlsplit().
gh-103925: Fix csv.Sniffer.sniff() for a sample with \r\n line endings in which \ 
a quoted field ends a line: a letter could be detected as the delimiter.
gh-101267: When a worker process terminates unexpectedly, \ 
concurrent.futures.ProcessPoolExecutor now sets a separate BrokenProcessPool \ 
exception on each pending future instead of sharing a single instance among them \ 
all. Sharing one exception produced malformed tracebacks: each Future.result() \ 
call re-raised the same object, appending another copy of the traceback to it.
IDLE
gh-82183: When the shell is busy running code, using “Run… Customized” \ 
with “Restart shell” unchecked now reports that the shell is executing \ 
instead of restarting it anyway.
gh-83653: Blanking an integer entry in IDLE’s Settings dialog, such as “Auto \ 
squeeze min lines”, no longer saves an empty string as an invalid \ 
configuration value.
gh-65339: Saving the IDLE Shell or an Output window now defaults to a .txt \ 
extension and lists text files before Python files, since their content is not \ 
Python source.
gh-80504: The “In files:” field of IDLE’s Find in Files dialog now always \ 
contains a full directory path, even for an unsaved editor or the Shell. This \ 
shows in the grep output which directory was searched.
gh-134300: Do not add the idlelib directory to the path of the IDLE user \ 
process. User code run in IDLE can no longer import idlelib submodules as \ 
top-level modules, such as import help.
gh-89360: Fix a rare crash in the IDLE editor when the completion window is \ 
closed: deleting a key binding for a sequence that is not bound to the virtual \ 
event is now ignored instead of raising a ValueError.
gh-71956: Fix Replace All in the IDLE editor’s Replace dialog when the search \ 
direction is “Up” and “Wrap around” is off: it now replaces all matches \ 
above the current position instead of only the first one.
gh-152728: Move functions run.fix_scaling, editor.fixwordbreaks (as \ 
fix_word_breaks) and pyshell.fix_x11_paste to idlelib.util.
gh-66331: Set the WM_CLASS window property of IDLE’s windows to Idle on X11, \ 
so that window managers group and label them correctly instead of using the \ 
default Toplevel.
gh-85320: IDLE now reads and writes its configuration files and the breakpoints \ 
file using UTF-8 instead of the locale encoding. This keeps non-ASCII data (such \ 
as non-ASCII paths) from being corrupted and makes the files portable between \ 
environments.
gh-94523: Detect file if modified at local disk and prompt to ask refresh. Patch \ 
by Shixian Li.
gh-139551: Support rendering BaseExceptionGroup in IDLE.
gh-89520: Make IDLE extension configuration look at user config files, allowing \ 
user-installed extensions to have settings and key bindings defined in \ 
~/.idlerc.
Documentation
gh-118150: Clarify in the difflib documentation what junk actually does, its \ 
drawbacks, and how to control it.
gh-86726: Greatly expand the tkinter documentation to cover the full public API \ 
of the package and its submodules. The descriptions are oriented towards Python \ 
rather than Tcl/Tk, with corrected return types and versionadded/versionchanged \ 
information.
Core and Builtins
gh-154937: Fix a data race on thread handle identifiers when _thread._shutdown() \ 
runs concurrently with the startup of non-daemon threads in the free-threaded \ 
build.

gh-154709: Fix an out-of-bounds access in reverse dictionary iterators when the \ 
underlying dictionary is cleared and modified after the iterator is created.

gh-154275: Fix a crash when getting deeply nested __parameters__ from a \ 
types.GenericAlias objects.

gh-152682: Fix NULL pointer dereference in compile() when a reserved name (e.g. \ 
__classdict__) is used as a type parameter name and memory allocation fails \ 
while formatting the error message.

gh-152635: Fix a crash caused when running out of memory creating a \ 
_interpchannels channel. Now a MemoryError is correctly raised.

gh-152375: Fix undefined behaviour when a sys.monitoring callback raised an \ 
exception while the program was following a branch or loop.

gh-152235: Defer GC tracking of set.intersection(), set.difference(), \ 
set.symmetric_difference(), set.union() and set.__sub__. Patch by Donghee Na.

gh-152235: Defer GC tracking of a set or frozenset to the end of its \ 
construction from iterable. Patch by Donghee Na.

gh-151905: Fix OOM error handling in PyFrame_GetBack() to propagate exceptions \ 
instead of masking them as None.

gh-151763: Fix a potential crash in compile(), exec(), eval() and ast.parse() \ 
when an allocation fails: the parser or compiler could return without setting an \ 
exception.

gh-151912: Fixed a crash in type() when selecting a metaclass whose tp_new slot \ 
is NULL. Such metaclasses are now rejected with TypeError instead of causing a \ 
NULL pointer dereference.

gh-151773: Fix a crash in contextvars.ContextVar.set() when memory allocation fails.

gh-151126: Fix a crash when sharing memoryview objects between interpreters \ 
fails due to running out of memory. It now raises a proper MemoryError.

gh-151126: Avoid possible crash in _winapi.c where a device has no memory left. \ 
Now it properly raises a MemoryError. Patch by Ivy Xu.

gh-151253: If import encodings (first import) fails at Python startup, dump the \ 
Python path configuration to help users debugging their configuration. Patch by \ 
Victor Stinner.

gh-151126: Fix a crash, when there’s no memory left on a device, which \ 
happened in _interpchannels module.

Now it raises proper MemoryError errors.

gh-151065: Fix memory leak when using the mimalloc memory allocator.

gh-150988: Fix a reference leak in OSError when attributes are set before \ 
super().__init__().

gh-149689: Fix missing error propagation in parser action helpers when memory \ 
allocation fails. Patch by Thomas Kowalski.
C API
gh-152132: Fix Py_RunMain() to return an exit code, rather than calling \ 
Py_Exit(), when running a script, a command, or the REPL. Patch by Victor \ 
Stinner.
Build
gh-154070: Build the curses module against a wide-character capable ncurses even \ 
when it is not named ncursesw – for example the pkgsrc ncurses on NetBSD and \ 
illumos, or the system ncurses on macOS. Such a library previously produced a \ 
narrow build.
gh-126877: Fix the configure check for Tcl/Tk which could wrongly succeed with \ 
optimizing compilers when the libraries are missing.
gh-153438: Update Windows build and installer tooling and documentation to use \ 
the current download URL for nuget.exe.
gh-152502: The curses module now detects set_escdelay(), set_tabsize() and the \ 
ESCDELAY and TABSIZE variables with configure capability probes instead of the \ 
ncurses-specific NCURSES_EXT_FUNCS macro, so they are exposed when building \ 
against other curses implementations such as NetBSD curses that provide them.
gh-138800: Fix library name in python3.pc on Android.
gh-115869: Make jit_stencils.h (which is produced during JIT builds) reproducible.

Log message:
python313 py313-html-docs: updated to 3.13.14

Python 3.13.14

macOS
gh-124111: Update macOS installer to use Tcl/Tk 8.6.18.
gh-150644: When system logging is enabled (with config.use_system_logger, \ 
messages are now tagged as public. This allows the macOS 26 system logger to \ 
view messages without special configuration.
gh-115119: Update macOS installer to use libmpdecimal 4.0.1.
Windows
gh-151159: Updated bundled version of OpenSSL to 3.0.21.
gh-151159: Update macOS installer to use OpenSSL 3.0.21.
Tests
gh-151130: Add more tests for PyWeakref_* C API.
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if \ 
it’s not supported. Patch by Victor Stinner.
Security
gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
gh-150599: Fix a possible stack buffer overflow in bz2 when a \ 
bz2.BZ2Decompressor is reused after a decompression error. The decompressor now \ 
becomes unusable after libbz2 reports an error.
gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when \ 
checking whether the destination is inside the source directory, preventing a \ 
symlink-based bypass of that guard.
gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the \ 
IPv4 address value returned from the source server in response to the PASV \ 
command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, \ 
the former behavior can be re-enabled by setting the \ 
trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to \ 
True. Thanks to Qi Deng at Aurascape AI for the report.
gh-149486: tarfile.data_filter() now validates link targets using the same \ 
normalised value that is written to disk, strips trailing separators from the \ 
member name when resolving a symlink’s directory, and rejects link members \ 
that would replace the destination directory itself. This closes several \ 
path-traversal bypasses of the data extraction filter.
gh-149079: Fix a potential denial of service in unicodedata.normalize(). The \ 
canonical ordering step of Unicode normalization used a quadratic-time insertion \ 
sort for reordering combining characters, which could be exploited with crafted \ 
input containing many combining characters in non-canonical order. Replaced with \ 
a linear-time counting sort for long runs.
gh-149018: Improved protection against XML hash-flooding attacks in \ 
xml.parsers.expat and xml.etree.ElementTree when Python is compiled with \ 
libExpat 2.8.0 or later.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-90309: Base64-encode values when embedding cookies to JavaScript using the \ 
http.cookies.BaseCookie.js_output() method to avoid injection and escaping.
gh-148808: Added buffer boundary check when using nbytes parameter with \ 
asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and \ 
the asyncio.ProactorEventLoop.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, \ 
bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation \ 
fails with MemoryError, which could let a subsequent decompress() call read or \ 
write through a stale pointer to the already-released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the \ 
dash-prefix safety check.
gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows \ 
which allowed to write files outside of the destination tree if the patch in the \ 
archive contains a Windows drive prefix. Now such invalid paths will be skipped. \ 
Files containing “..” in the name (like “foo..bar”) are no longer \ 
skipped.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option \ 
parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many \ 
whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the \ 
HTTPConnection.set_tunnel() method.
Library
gh-150913: Fix sqlite3.Blob slice assignment to raise TypeError and IndexError \ 
for type and size mismatches respectively, even when the target slice is empty.
gh-143008: Fix race conditions when re-initializing a io.TextIOWrapper object.
gh-150685: Update bundled pip to 26.1.2
gh-150406: Fix a possible crash occurring during socket module initialization \ 
when the system is out of memory on platforms without a reentrant gethostbyname.
gh-150372: readline: Fix a potential crash during tab completion caused by an \ 
out-of-memory error during module initialization.
gh-150175: Fix race condition in unittest.mock.ThreadingMock where concurrent \ 
calls could lose increments to call_count and other attributes due to a missing \ 
lock in _increment_mock_call.
gh-84353: Preserve non-UTF-8 encoded filenames when appending to a \ 
zipfile.ZipFile. Previously, non-ASCII names stored in a legacy encoding \ 
(without the UTF-8 flag bit set) could be corrupted when the central directory \ 
was rewritten: they were decoded as cp437 and then re-stored as UTF-8.
gh-149995: Update various docstrings in typing.
gh-88726: The email package now uses standard MIME charset names “gb2312” \ 
and “big5” instead of non-standard names “eucgb2312_cn” and \ 
“big5_tw”.
gh-149571: Fix the C implementation of xml.etree.ElementTree.Element.itertext(): \ 
it no longer emits text for comments and processing instructions.
gh-149921: Fix reference leaks in error paths of the _interpchannels and \ 
_interpqueues extension modules.
gh-149801: Add IANA registered names and aliases with leading zeros before \ 
number (like IBM00858, CP00858, IBM01140, CP01140) for corresponding codecs.
gh-149701: Fix bad return code from Lib/venv/bin/activate if hashing is disabled
gh-112821: In the REPL, autocompletion might run arbitrary code in the getter of \ 
a descriptor. If that getter raised an exception, autocompletion would fail to \ 
present any options for the entire object. Autocompletion now works as expected \ 
for these objects.
gh-149388: Make asyncio.windows_utils.PipeHandle closing idempotent.
gh-149489: Fix ElementTree serialization to HTML. The content of elements \ 
“xmp”, “iframe”, “noembed”, “noframes”, and “plaintext” is \ 
no longer escaped. The “plaintext” element no longer have the closing tag.
gh-149377: Update bundled pip to 26.1.1
gh-149231: In tomllib, the number of parts in TOML keys is now limited.
gh-149117: Fix runpy.run_module() and runpy.run_path() to set the name attribute \ 
on the ImportError they raise.
gh-149148: ensurepip: Upgrade bundled pip to 26.1. This version fixes the CVE \ 
2026-3219 vulnerability. Patch by Victor Stinner.
gh-148093: Fix an out-of-bounds read of one byte in binascii.a2b_uu(). Raise \ 
binascii.Error, instead of reading past the buffer end.
gh-148914: Fix memoization of in-band PickleBuffer in the Python implementation \ 
of pickle. Previously, identical PickleBuffers did not preserve identity, and \ 
empty writable PickleBuffer memoized an empty bytearray object in place of \ 
b'', so the following references to b'' were unpickled as an \ 
empty bytearray object.
gh-138907: Support RFC 9309 in urllib.robotparser.
gh-148954: Fix XML injection vulnerability in xmlrpc.client.dumps() where the \ 
methodname was not being escaped before interpolation into the XML body.
gh-148801: xml.etree.ElementTree: Fix a crash in Element.__deepcopy__ on deeply \ 
nested trees.
gh-148735: xml.etree.ElementTree: Fix a use-after-free in Element.findtext when \ 
the element tree is mutated concurrently during the search.
gh-146553: Fix infinite loop in typing.get_type_hints() when __wrapped__ forms a \ 
cycle. Patch by Shamil Abdulaev.
gh-148508: An intermittent timing error when running SSL tests on iOS has been \ 
resolved.
gh-148518: If an email containing an address header that ended in an open double \ 
quote was parsed with a non-compat32 policy, accessing the username attribute of \ 
the mailbox accessed through that header object would result in an IndexError. \ 
It now correctly returns an empty string as the result.
gh-148370: configparser: prevent quadratic behavior when a ParsingError is \ 
raised after a parser fails to parse multiple lines. Patch by Bénédikt Tran.
gh-148254: Use singular “sec” instead of “secs” in timeit verbose output \ 
for consistency with other time units.
gh-148192: email.generator.Generator._make_boundary could fail to detect a \ 
duplicate boundary string if linesep was not n. It now correctly detects \ 
boundary strings when linesep is rn as well.
gh-146313: Fix a deadlock in multiprocessing’s resource tracker where the \ 
parent process could hang indefinitely in os.waitpid() during interpreter \ 
shutdown if a child created via os.fork() still held the resource tracker’s \ 
pipe open.
gh-145831: Fix email.quoprimime.decode() leaving a stray \r when \ 
eol='\r\n' by stripping the full eol string instead of one character.
gh-145105: Fix crash in csv reader when iterating with a re-entrant iterator \ 
that calls next() on the same reader from within __next__.
gh-130750: Restore quoting of choices in argparse error messages for improved \ 
clarity and consistency with documentation.
gh-105936: Attempting to mutate non-field attributes of dataclasses with both \ 
frozen and slots being True now raises FrozenInstanceError instead of TypeError. \ 
Their non-dataclass subclasses can now freely mutate non-field attributes, and \ 
the original non-slotted class can be garbage collected. The fix also handles \ 
the case of an empty __class__ cell on a function found within the class \ 
(gh-148947).
gh-142516: ssl: fix reference leaks in ssl.SSLContext objects. Patch by \ 
Bénédikt Tran.
gh-142831: Fix a crash in the json module where a use-after-free could occur if \ 
the object being encoded is modified during serialization.
gh-140287: The asyncio REPL now handles exceptions when executing PYTHONSTARTUP \ 
scripts. Patch by Bartosz Sławecki.
gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and \ 
SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to \ 
tune protections against billion laughs attacks. Patch by Bénédikt Tran.
gh-132631: Fix “I/O operation on closed file” when parsing JSON Lines file \ 
with JSON CLI.
gh-128110: Fix bug in the parsing of email address headers that could result in \ 
extraneous spaces in the decoded text when using a modern email policy. Space \ 
between pairs of adjacent RFC 2047 encoded-words is now ignored, per section 6.2 \ 
(and consistent with existing parsing of unstructured headers like Subject).
gh-107398: Fix tarfile stream mode exception when process the file with the gzip \ 
extra field.
gh-123853: Update the table of Windows language code identifiers (LCIDs) used by \ 
locale.getdefaultlocale() on Windows to protocol version 16.0 (2024-04-23).
gh-70039: Fixed bug where smtplib.SMTP.starttls() could fail if \ 
smtplib.SMTP.connect() is called explicitly rather than implicitly.
gh-83281: email: improve handling trailing garbage in address lists to avoid \ 
throwing AttributeError in certain edge cases
gh-91099: imaplib.IMAP4.login() now raises exceptions with str instead of bytes. \ 
Patch by Florian Best.
IDLE
bpo-6699: Warn the user if a file will be overwritten when saving.
Documentation
gh-150319: Generic builtin and standard library types now document the meaning \ 
of their type parameters.
gh-148663: Document that calendar.IllegalMonthError is a subclass of both \ 
ValueError and IndexError since Python 3.12.
gh-146646: Document that glob.glob(), glob.iglob(), pathlib.Path.glob(), and \ 
pathlib.Path.rglob() silently suppress OSError exceptions raised from scanning \ 
the filesystem.
gh-109503: Fix documentation for shutil.move() on usage of os.rename() since \ 
nonatomic move might be used even if the files are on the same filesystem. Patch \ 
by Fang Li
Core and Builtins
gh-151112: Fix a crash in the compiler that could occur when running out of memory.

gh-151126: Fix a crash, when there’s no memory left on a device, which happened in:

code compilation - _winapi.CreateProcess()
Now these places raise proper MemoryError errors.

gh-150633: Fix the frozen importer accepting module names with embedded null \ 
bytes, which caused it to bypass the sys.modules cache and create duplicate \ 
module objects.

gh-149156: Fix an intermittent crash after os.fork() when perf trampoline \ 
profiling is enabled and the child returns through trampoline frames inherited \ 
from the parent process.

gh-149449: Fix a use-after-free crash when the unicodedata module was removed \ 
from sys.modules and garbage-collected between calls that decode \N{...} escapes \ 
or use the namereplace codec error handler.

gh-148450: Fix abc.register() so it invalidates type version tags for registered \ 
classes.

gh-150207: Fix a crash when a memory allocation fails during tokenizer \ 
initialization. A proper MemoryError is now raised instead.

gh-150107: asyncio: sendfile() and sock_sendfile() event loop methods now call \ 
file.seek(offset) if file has a seek() method, even if offset is 0 (default \ 
value).

gh-150146: Fix a crash on a complex type variable substitution.

from typing import TypeVar; \ 
memoryview[TypeVar("")][*typing.Mapping[..., ...]] used to fail due to \ 
missing NULL check on _unpack_args C function call.

gh-149590: Fix crash when faulthandler is imported more than once.

gh-149738: sqlite3: Disallow removing row_factory and text_factory attributes of \ 
a connection to prevent a crash on a query.

gh-139808: Add branch protections for AArch64 (BTI/PAC) in assembly code used by \ 
-X perf_jit (Linux perf profiler integration).

gh-148820: Fix a race in _PyRawMutex on the free-threaded build where a \ 
Py_PARK_INTR return from _PySemaphore_Wait could let the waiter destroy its \ 
semaphore before the unlocking thread’s _PySemaphore_Wakeup completed, causing \ 
a fatal ReleaseSemaphore error.

gh-148653: Forbid marshalling recursive code objects which cannot be correctly \ 
unmarshalled.

gh-148390: Fix an undefined behavior in memoryview when using the native boolean \ 
format (?) in cast(). Previously, on some common platforms, calling \ 
memoryview(b).cast("?").tolist() incorrectly returned [False] instead \ 
of [True] for any even byte b. Patch by Bénédikt Tran.

gh-148418: Fix a possible reference leak in a corrupted TYPE_CODE marshal stream.

gh-148222: Fix vectorcall support in types.GenericAlias when the underlying type \ 
does not support the vectorcall protocol. Fix possible leaks in \ 
types.GenericAlias and types.UnionType in case of memory error.

gh-145376: Fix reference leaks in various unusual error scenarios.
C API
gh-150907: Fix dynamic_annotations.h header file when built with C++ and \ 
Valgrind: add extern "C++" scope for the C++ template. Patch by Victor \ 
Stinner.
Build
gh-149351: Avoid possible broken macOS framework install names when DESTDIR is \ 
specified during builds.
gh-146475: Block Apple Clang from being used to build the JIT as it ships \ 
without required LLVM tools.
gh-148535: No longer use the gcc -fprofile-update=atomic flag on i686. The flag \ 
has been added to fix a random GCC internal error on PGO build (gh-145801) \ 
caused by corruption of profile data (.gcda files). The problem is that it makes \ 
the PGO build way slower (up to 47x slower) on i686. Since the GCC internal \ 
error was not seen on i686 so far, don’t use -fprofile-update=atomic on i686 \ 
anymore. Patch by Victor Stinner.

Log message:
python313 py313-html-docs: updated to 3.13.13

Python 3.13.13

macOS

gh-144551: Update macOS installer to use OpenSSL 3.0.19.
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.

Windows

gh-144551: Updated bundled version of OpenSSL to 3.0.19.
gh-140131: Fix REPL cursor position on Windows when module completion suggestion \ 
line hits console width.

Tests

gh-144418: The Android testbed’s emulator RAM has been increased from 2 GB to 4 GB.
gh-146202: Fix a race condition in regrtest: make sure that the temporary \ 
directory is created in the worker process. Previously, temp_cwd() could fail on \ 
Windows if the “build” directory was not created. Patch by Victor Stinner.
gh-144739: When Python was compiled with system expat older then 2.7.2 but tests \ 
run with newer expat, still skip test.test_pyexpat.MemoryProtectionTest.

Security

gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when \ 
converting deeply nested XML content models with ElementDeclHandler(). This \ 
addresses CVE 2026-4224.
gh-145599: Reject control characters in http.cookies.Morsel update() and \ 
js_output(). This addresses CVE 2026-3644.
gh-145506: Fixes CVE 2026-2297 by ensuring that SourcelessFileLoader uses \ 
io.open_code() when opening .pyc files.
gh-144370: Disallow usage of control characters in status in wsgiref.handlers to \ 
prevent HTTP header injections. Patch by Benedikt Johannes.
gh-143930: Reject leading dashes in URLs passed to webbrowser.open().

Library

gh-144503: Fix a regression introduced in 3.14.3 and 3.13.12 where the \ 
multiprocessing forkserver start method would fail with BrokenPipeError when the \ 
parent process had a very large sys.argv. The argv is now passed to the \ 
forkserver as separate command-line arguments rather than being embedded in the \ 
-c command string, avoiding the operating system’s per-argument length limit.
gh-146613: itertools: Fix a crash in itertools.groupby() when the grouper \ 
iterator is concurrently mutated.
gh-146080: ssl: fix a crash when an SNI callback tries to use an SSL object that \ 
has already been garbage-collected. Patch by Bénédikt Tran.
gh-146090: sqlite3: fix a crash when sqlite3.Connection.create_collation() fails \ 
with SQLITE_BUSY. Patch by Bénédikt Tran.
gh-146090: sqlite3: properly raise MemoryError instead of SystemError when a \ 
context callback fails to be allocated. Patch by Bénédikt Tran.
gh-145633: Fix struct.pack('f', float): use PyFloat_Pack4() to raise \ 
OverflowError. Patch by Sergey B Kirpichev and Victor Stinner.
gh-146310: The ensurepip module no longer looks for pip-*.whl wheel packages in \ 
the current directory.
gh-146083: Update bundled libexpat to version 2.7.5.
gh-146076: zoneinfo: fix crashes when deleting _weak_cache from a \ 
zoneinfo.ZoneInfo subclass.
gh-146054: Limit the size of encodings.search_function() cache. Found by OSS \ 
Fuzz in 493449985.
gh-145883: zoneinfo: Fix heap buffer overflow reads from malformed TZif data. \ 
Found by OSS Fuzz, issues 492245058 and 492230068.
gh-145750: Avoid undefined behaviour from signed integer overflow when parsing \ 
format strings in the struct module. Found by OSS Fuzz in 488466741.
gh-145492: Fix infinite recursion in collections.defaultdict __repr__ when a \ 
defaultdict contains itself. Based on analysis by KowalskiThomas in gh-145492.
gh-145623: Fix crash in struct when calling repr() or __sizeof__() on an \ 
uninitialized struct.Struct object created via Struct.__new__() without calling \ 
__init__().
gh-145616: Detect Android sysconfig ABI correctly on 32-bit ARM Android on \ 
64-bit ARM kernel
gh-145376: Fix null pointer dereference in unusual error scenario in hashlib.
gh-145551: Fix InvalidStateError when cancelling process created by \ 
asyncio.create_subprocess_exec() or asyncio.create_subprocess_shell(). Patch by \ 
Daan De Meyer.
gh-145417: venv: Prevent incorrect preservation of SELinux context when copying \ 
the Activate.ps1 script. The script inherited the SELinux security context of \ 
the system template directory, rather than the destination project directory.
gh-145301: hashlib: fix a crash when the initialization of the underlying C \ 
extension module fails.
gh-145264: Base64 decoder (see binascii.a2b_base64(), base64.b64decode(), etc) \ 
no longer ignores excess data after the first padded quad in non-strict \ 
(default) mode. Instead, in conformance with RFC 4648, section 3.3, it now \ 
ignores the pad character, “=”, if it is present before the end of the \ 
encoded data.
gh-145158: Avoid undefined behaviour from signed integer overflow when parsing \ 
format strings in the struct module.
gh-144984: Fix crash in xml.parsers.expat.xmlparser.ExternalEntityParserCreate() \ 
when an allocation fails. The error paths could dereference NULL handlers and \ 
double-decrement the parent parser’s reference count.
gh-88091: Fix unicodedata.decomposition() for Hangul characters.
gh-144835: Added missing explanations for some parameters in glob.glob() and \ 
glob.iglob().
gh-144833: Fixed a use-after-free in ssl when SSL_new() returns NULL in \ 
newPySSLSocket(). The error was reported via a dangling pointer after the object \ 
had already been freed.
gh-144259: Fix inconsistent display of long multiline pasted content in the REPL.
gh-144156: Fix the folding of headers by the email library when RFC 2047 encoded \ 
words are used. Now whitespace is correctly preserved and also correctly added \ 
between adjacent encoded words. The latter property was broken by the fix for \ 
gh-92081, which mostly fixed previous failures to preserve whitespace.
gh-66305: Fixed a hang on Windows in the tempfile module when trying to create a \ 
temporary file or subdirectory in a non-writable directory.
gh-140814: multiprocessing.freeze_support() no longer sets the default start \ 
method as a side effect, which previously caused a subsequent \ 
multiprocessing.set_start_method() call to raise RuntimeError.
gh-144475: Calling repr() on functools.partial() is now safer when the partial \ 
object’s internal attributes are replaced while the string representation is \ 
being generated.
gh-144538: Bump the version of pip bundled in ensurepip to version 26.0.1
gh-144363: Update bundled libexpat to 2.7.4
gh-143637: Fixed a crash in socket.sendmsg() that could occur if ancillary data \ 
is mutated re-entrantly during argument parsing.
gh-143880: Fix data race in functools.partial() in the free threading build.
gh-143543: Fix a crash in itertools.groupby that could occur when a user-defined \ 
__eq__() method re-enters the iterator during key comparison.
gh-140652: Fix a crash in _interpchannels.list_all() after closing a channel.
gh-143698: Allow scheduler and setpgroup arguments to be explicitly None when \ 
calling os.posix_spawn() or os.posix_spawnp(). Patch by Bénédikt Tran.
gh-143698: Raise TypeError instead of SystemError when the scheduler in \ 
os.posix_spawn() or os.posix_spawnp() is not a tuple. Patch by Bénédikt Tran.
gh-143304: Fix ctypes.CDLL to honor the handle parameter on POSIX systems.
gh-142781: zoneinfo: fix a crash when instantiating ZoneInfo objects for which \ 
the internal class-level cache is inconsistent.
gh-142763: Fix a race condition between zoneinfo.ZoneInfo creation and \ 
zoneinfo.ZoneInfo.clear_cache() that could raise KeyError.
gh-142787: Fix assertion failure in sqlite3 blob subscript when slicing with \ 
indices that result in an empty slice.
gh-142352: Fix asyncio.StreamWriter.start_tls() to transfer buffered data from \ 
StreamReader to the SSL layer, preventing data loss when upgrading a connection \ 
to TLS mid-stream (e.g., when implementing PROXY protocol support).
gh-141707: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE when \ 
parsing GNU long name or link headers.
gh-139933: Improve AttributeError suggestions for classes with a custom \ 
__dir__() method returning a list of unsortable values. Patch by Bénédikt \ 
Tran.
gh-138891: Fix SyntaxError when inspect.get_annotations(f, eval_str=True) is \ 
called on a function annotated with a PEP 646 star_expression
gh-137335: Get rid of any possibility of a name conflict for named pipes in \ 
multiprocessing and asyncio on Windows, no matter how small.
gh-80667: Support lookup for Tangut Ideographs in unicodedata.
bpo-40243: Fix unicodedata.ucd_3_2_0.numeric() for non-decimal values.

Documentation

gh-126676: Expand argparse documentation for type=bool with a demonstration of \ 
the surprising behavior and pointers to common alternatives.
gh-145450: Document missing public wave.Wave_write getter methods.

Core and Builtins

gh-148157: Fix an unlikely crash when parsing an invalid type comments for \ 
function parameters. Found by OSS Fuzz in 492782951.

gh-146615: Fix a crash in __get__() for METH_METHOD descriptors when an invalid \ 
(non-type) object is passed as the second argument. Patch by Steven Sun.

gh-146128: Fix a bug which could cause constant values to be partially corrupted \ 
in AArch64 JIT code. This issue is theoretical, and hasn’t actually been \ 
observed in unmodified Python interpreters.

gh-146250: Fixed a memory leak in SyntaxError when re-initializing it.

gh-146245: Fixed reference leaks in socket when audit hooks raise exceptions in \ 
socket.getaddrinfo() and socket.sendto().

gh-146227: Fix wrong type in _Py_atomic_load_uint16 in the C11 atomics backend \ 
(pyatomic_std.h), which used a 32-bit atomic load instead of 16-bit. Found by \ 
Mohammed Zuhaib.

gh-146056: Fix repr() for lists containing NULLs.

gh-145990: python --help-env sections are now sorted by environment variable name.

gh-145376: Fix GC tracking in structseq.__replace__().

gh-142183: Avoid a pathological case where repeated calls at a specific stack \ 
depth could be significantly slower.

gh-145783: Fix an unlikely crash in the parser when certain errors were \ 
erroneously not propagated. Found by OSS Fuzz in 491369109.

gh-145701: Fix SystemError when __classdict__ or __conditional_annotations__ is \ 
in a class-scope inlined comprehension. Found by OSS Fuzz in 491105000.

gh-145335: Fix a crash in os.pathconf() when called with -1 as the path argument.

gh-145234: Fixed a SystemError in the parser when an encoding cookie (for \ 
example, UTF-7) decodes to carriage returns (\r). Newlines are now normalized \ 
after decoding in the string tokenizer.

Patch by Pablo Galindo.

gh-130555: Fix use-after-free in dict.clear() when the dictionary values are \ 
embedded in an object and a destructor causes re-entrant mutation of the \ 
dictionary.

gh-145008: Fix a bug when calling certain methods at the recursion limit which \ 
manifested as a corruption of Python’s operand stack. Patch by Ken Jin.

gh-144872: Fix heap buffer overflow in the parser found by OSS-Fuzz.

gh-144766: Fix a crash in fork child process when perf support is enabled.

gh-144759: Fix undefined behavior in the lexer when start and multi_line_start \ 
pointers are NULL in _PyLexer_remember_fstring_buffers() and \ 
_PyLexer_restore_fstring_buffers(). The NULL pointer arithmetic (NULL - \ 
valid_pointer) is now guarded with explicit NULL checks.

gh-144601: Fix crash when importing a module whose PyInit function raises an \ 
exception from a subinterpreter.

gh-143636: Fix a crash when calling SimpleNamespace.__replace__() on \ 
non-namespace instances. Patch by Bénédikt Tran.

gh-143650: Fix race condition in importlib where a thread could receive a stale \ 
module reference when another thread’s import fails.

gh-140594: Fix an out of bounds read when a single NUL character is read from \ 
the standard input. Patch by Shamil Abdulaev.

gh-91636: While performing garbage collection, clear weakrefs to unreachable \ 
objects that are created during running of finalizers. If those weakrefs were \ 
are not cleared, they could reveal unreachable objects.

gh-130327: Fix erroneous clearing of an object’s __dict__ if overwritten at \ 
runtime.

gh-80667: Literals using the \N{name} escape syntax can now construct CJK \ 
ideographs and Hangul syllables using case-insensitive names.

Build

gh-146541: The Android testbed can now be built for 32-bit ARM and x86 targets.
gh-146450: The Android build script was modified to improve parity with other \ 
platform build scripts.
gh-145801: When Python build is optimized with GCC using PGO, use \ 
-fprofile-update=atomic option to use atomic operations when updating profile \ 
information. This option reduces the risk of gcov Data Files (.gcda) corruption \ 
which can cause random GCC crashes. Patch by Victor Stinner.
gh-129259: Fix AIX build failures caused by incorrect struct alignment in \ 
_Py_CODEUNIT and _Py_BackoffCounter by adding AIX-specific #pragma pack \ 
directives.

Log message:
python*: restrict expat workaround to NetBSD<11.99.5

that version installs expat_config.h

Pullups for 10, 11 have been filed, the pattern can be improved
when they are merged.

Log message:
python31*: force use expat from pkgsrc to fix builds across platforms