Log message:
python310 py310-html-docs: updated to 3.10.21

3.10.21

macOS
gh-137586: Invoke osascript with absolute path in webbrowser and turtledemo.
Tests
gh-149776: Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if \ 
it’s not supported. Patch by Victor Stinner.
Security
gh-153030: Fixed quadratic complexity in incremental parsing of long \ 
unterminated constructs (such as tags or comments) in html.parser.HTMLParser, \ 
which could be exploited for a denial of service.
gh-152674: The xml.etree.ElementTree.Element methods findall(), iterfind() and \ 
find() avoid quadratic behavior when using XPath index predicates ([1], \ 
[last()], [last()-N]) on XML documents with many same-tag siblings.
gh-152216: Update bundled libexpat to version 2.8.2.
gh-151987: The tarfile.TarFile.extract() method now applies the given filter \ 
when it extracts a link target from the archive as a fallback.
gh-151981: In tarfile, seeking a stream now stops when end of the stream is reached.
gh-151558: Fixed an vulnerability in the tarfile data and tar extraction filters \ 
where crafted archives could create a symlink pointing outside the destination \ 
directory. This was a bypass of CVE-2025-4330.
gh-150599: Fix a possible stack buffer overflow in bz2 when a \ 
bz2.BZ2Decompressor is reused after a decompression error. The decompressor now \ 
becomes unusable after libbz2 reports an error.
gh-150743: http.client now limits the number of chunked-response trailer lines \ 
it will read to 100, and the number of interim (1xx) responses it will skip to \ 
100. A malicious or broken server could previously stream trailer lines or 100 \ 
Continue responses forever, hanging the client even when a socket timeout was in \ 
use. Reported by @YLChen-007 via GHSA-w4q2-g22w-6fr4.
gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE-2026-45186.
gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the \ 
IPv4 address value returned from the source server in response to the PASV \ 
command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, \ 
the former behavior can be re-enabled by setting the \ 
trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to \ 
True. Thanks to Qi Deng at Aurascape AI for the report.
gh-149486: tarfile.data_filter() now validates link targets using the same \ 
normalised value that is written to disk, strips trailing separators from the \ 
member name when resolving a symlink’s directory, and rejects link members \ 
that would replace the destination directory itself. This closes several \ 
path-traversal bypasses of the data extraction filter.
gh-149079: Fix a potential denial of service in unicodedata.normalize(). The \ 
canonical ordering step of Unicode normalization used a quadratic-time insertion \ 
sort for reordering combining characters, which could be exploited with crafted \ 
input containing many combining characters in non-canonical order. Replaced with \ 
a linear-time counting sort for long runs.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, \ 
bz2.BZ2Decompressor when memory allocation fails with MemoryError, which could \ 
let a subsequent decompress() call read or write through a stale pointer to the \ 
already-released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the \ 
dash-prefix safety check.
gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows \ 
which allowed to write files outside of the destination tree if the patch in the \ 
archive contains a Windows drive prefix. Now such invalid paths will be skipped. \ 
Files containing “..” in the name (like “foo..bar”) are no longer \ 
skipped.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option \ 
parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many \ 
whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the \ 
HTTPConnection.set_tunnel() method.
gh-145986: xml.parsers.expat: Fixed a crash caused by unbounded C recursion when \ 
converting deeply nested XML content models with ElementDeclHandler(). This \ 
addresses CVE-2026-4224.
gh-145599: Reject control characters in http.cookies.Morsel update() and \ 
js_output(). This addresses CVE-2026-3644.
gh-145506: Fixes CVE-2026-2297 by ensuring that SourcelessFileLoader uses \ 
io.open_code() when opening .pyc files.
gh-144370: Disallow usage of control characters in status in wsgiref.handlers to \ 
prevent HTTP header injections. Patch by Benedikt Johannes.
gh-143930: Reject leading dashes in URLs passed to webbrowser.open().
gh-143927: Normalize all line endings (CR, CRLF, and LF) to LF+TAB when writing \ 
multi-line configparser values.
Library
gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which \ 
contains many quote characters. A doubled quote character is now also detected \ 
in a field which contains the delimiter or a line break.
gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains \ 
quoted fields, in particular for a single column of quoted fields.
gh-146083: Update bundled libexpat to version 2.7.5.
gh-141707: Don’t change tarfile.TarInfo type from AREGTYPE to DIRTYPE when \ 
parsing GNU long name or link headers.
gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and \ 
SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to \ 
tune protections against billion laughs attacks. Patch by Bénédikt Tran.
gh-100372: ssl.SSLContext.load_verify_locations() no longer incorrectly accepts \ 
some cases of trailing data when parsing DER.
Build
gh-153438: Update Windows build and installer tooling and documentation to use \ 
the current download URL for nuget.exe.

Log message:
python*: restrict expat workaround to NetBSD<11.99.5

that version installs expat_config.h

Pullups for 10, 11 have been filed, the pattern can be improved
when they are merged.

Log message:
python310 py310-html-docs: updated to 3.10.20

Python 3.10.20

Security

gh-144125: BytesGenerator will now refuse to serialize (write) headers that are \ 
unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas \ 
Bloemsaat and Petr Viktorin in gh-121650).
gh-143935: Fixed a bug in the folding of comments when flattening an email \ 
message using a modern email policy. Comments consisting of a very long sequence \ 
of non-foldable characters could trigger a forced line wrap that omitted the \ 
required leading space on the continuation line, causing the remainder of the \ 
comment to be interpreted as a new header field. This enabled header injection \ 
with carefully crafted inputs.
gh-143925: Reject control characters in data: URL media types.
gh-143919: Reject control characters in http.cookies.Morsel fields and values.
gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, \ 
values, and parameters.
gh-142145: Remove quadratic behavior in xml.minidom node ID cache clearing. In \ 
order to do this without breaking existing users, we also add the ownerDocument \ 
attribute to xml.dom.minidom elements and attributes created by directly \ 
instantiating the Element or Attr class. Note that this way of creating nodes is \ 
not supported; creator functions like xml.dom.Document.documentElement() should \ 
be used instead.
gh-137836: Add support of the “plaintext” element, RAWTEXT elements \ 
“xmp”, “iframe”, “noembed” and “noframes”, and optionally \ 
RAWTEXT element “noscript” in html.parser.HTMLParser.
gh-136063: email.message: ensure linear complexity for legacy HTTP parameters \ 
parsing. Patch by Bénédikt Tran.
gh-136065: Fix quadratic complexity in os.path.expandvars().
gh-119451: Fix a potential memory denial of service in the http.client module. \ 
When connecting to a malicious server, it could cause an arbitrary amount of \ 
memory to be allocated. This could have led to symptoms including a MemoryError, \ 
swapping, out of memory (OOM) killed processes or containers, or even system \ 
crashes.
gh-119452: Fix a potential memory denial of service in the http.server module. \ 
When a malicious user is connected to the CGI server on Windows, it could cause \ 
an arbitrary amount of memory to be allocated. This could have led to symptoms \ 
including a MemoryError, swapping, out of memory (OOM) killed processes or \ 
containers, or even system crashes.
gh-119342: Fix a potential memory denial of service in the plistlib module. When \ 
reading a Plist file received from untrusted source, it could cause an arbitrary \ 
amount of memory to be allocated. This could have led to symptoms including a \ 
MemoryError, swapping, out of memory (OOM) killed processes or containers, or \ 
even system crashes.

Library

gh-144833: Fixed a use-after-free in ssl when SSL_new() returns NULL in \ 
newPySSLSocket(). The error was reported via a dangling pointer after the object \ 
had already been freed.
gh-144363: Update bundled libexpat to 2.7.4
gh-90949: Add SetAllocTrackerActivationThreshold() and \ 
SetAllocTrackerMaximumAmplification() to xmlparser objects to prevent use of \ 
disproportional amounts of dynamic memory from within an Expat parser. Patch by \ 
Bénédikt Tran.

Core and Builtins

gh-120384: Fix an array out of bounds crash in list_ass_subscript, which could \ 
be invoked via some specificly tailored input: including concurrent modification \ 
of a list object, where one thread assigns a slice and another clears it.
gh-120298: Fix use-after free in list_richcompare_impl which can be invoked via \ 
some specificly tailored evil input.

Log message:
*: recursive bump for icu 78.1

Log message:
python310 py310-html-docs: updated to 3.10.19

Python 3.10.19

Security

gh-139700: Check consistency of the zip64 end of central directory record. \ 
Support records with “zip64 extensible data” if there are no bytes prepended \ 
to the ZIP file.
gh-139400: xml.parsers.expat: Make sure that parent Expat parsers are only \ 
garbage-collected once they are no longer referenced by subparsers created by \ 
ExternalEntityParserCreate(). Patch by Sebastian Pipping.
gh-135661: Fix parsing start and end tags in html.parser.HTMLParser according to \ 
the HTML5 standard.
Whitespaces no longer accepted between </ and the tag name. E.g. </ \ 
script> does not end the script section.
Vertical tabulation (\v) and non-ASCII whitespaces no longer recognized as \ 
whitespaces. The only whitespaces are \t\n\r\f and space.
Null character (U+0000) no longer ends the tag name.
Attributes and slashes after the tag name in end tags are now ignored, instead \ 
of terminating after the first > in quoted attribute value. E.g. \ 
</script/foo=">"/>.
Multiple slashes and whitespaces between the last attribute and closing > are \ 
now ignored in both start and end tags. E.g. <a foo=bar/ //>.
Multiple = between attribute name and value are no longer collapsed. E.g. <a \ 
foo==bar> produces attribute “foo” with value “=bar”.
gh-135661: Fix CDATA section parsing in html.parser.HTMLParser according to the \ 
HTML5 standard: ] ]> and ]] > no longer end the CDATA section. Add private \ 
method _set_support_cdata() which can be used to specify how to parse \ 
<[CDATA[ — as a CDATA section in foreign content (SVG or MathML) or as a \ 
bogus comment in the HTML namespace.
gh-102555: Fix comment parsing in html.parser.HTMLParser according to the HTML5 \ 
standard. --!> now ends the comment. -- > no longer ends the comment. \ 
Support abnormally ended empty comments <--> and <--->.
gh-135462: Fix quadratic complexity in processing specially crafted input in \ 
html.parser.HTMLParser. End-of-file errors are now handled according to the \ 
HTML5 specs – comments and declarations are automatically closed, tags are \ 
ignored.
gh-118350: Fix support of escapable raw text mode (elements “textarea” and \ 
“title”) in html.parser.HTMLParser.
gh-86155: html.parser.HTMLParser.close() no longer loses data when the \ 
<script> tag is not closed. Patch by Waylan Limberg.

Library

gh-139312: Upgrade bundled libexpat to 2.7.3
gh-138998: Update bundled libexpat to 2.7.2
gh-130577: tarfile now validates archives to ensure member offsets are \ 
non-negative. (Contributed by Alexander Enrique Urieles Nieto in gh-130577.)
gh-135374: Update the bundled copy of setuptools to 79.0.1.

Log message:
python310 py310-html-docs: updated to 3.10.18

Python 3.10.18 final

Security

gh-135034: Fixes multiple issues that allowed tarfile extraction filters \ 
(filter="data" and filter="tar") to be bypassed using \ 
crafted symlinks and hard links.

Addresses CVE 2024-12718, CVE 2025-4138, CVE 2025-4330, and CVE 2025-4517.

gh-133767: Fix use-after-free in the “unicode-escape” decoder with a \ 
non-“strict” error handler.

gh-128840: Short-circuit the processing of long IPv6 addresses early in \ 
ipaddress to prevent excessive memory consumption and a minor denial-of-service.

Library

gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
gh-134062: ipaddress: fix collisions in __hash__() for IPv4Network and \ 
IPv6Network objects.
gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC \ 
3596, §2.5. Patch by Bénédikt Tran.
bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC \ 
4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk.

Log message:
*: recursive bump for icu 77 and libxml2 2.14

Log message:
python310 py310-html-docs: updated to 3.10.17

Python 3.10.17 final

Security

gh-131809: Update bundled libexpat to 2.7.1
gh-131261: Upgrade to libexpat 2.7.0
gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host \ 
parsing would not reject domain names containing square brackets ([ and ]). \ 
Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC \ 
3986 Section 3.2.2.
gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an \ 
email message using a modern email policy. Previously when an encoded-word was \ 
too long for a line, it would be decoded, split across lines, and re-encoded. \ 
But commas and other special characters in the original text could be left \ 
unencoded and unquoted. This could theoretically be used to spoof header lines \ 
using a carefully constructed encoded-word if the resulting rendered email was \ 
transmitted or re-parsed.
gh-80222: Fix bug in the folding of quoted strings when flattening an email \ 
message using a modern email policy. Previously when a quoted string was folded \ 
so that it spanned more than one line, the surrounding quotes and internal \ 
escapes would be omitted. This could theoretically be used to spoof header lines \ 
using a carefully constructed quoted string if the resulting rendered email was \ 
transmitted or re-parsed.
gh-119511: Fix a potential denial of service in the imaplib module. When \ 
connecting to a malicious server, it could cause an arbitrary amount of memory \ 
to be allocated. On many systems this is harmless as unused virtual memory is \ 
only a mapping, but if this hit a virtual address size limit it could lead to a \ 
MemoryError or other process crash. On unusual systems or builds where all \ 
allocated memory is touched and backed by actual ram or storage it could’ve \ 
consumed resources doing so until similarly crashing.

Library

gh-127257: In ssl, system call failures that OpenSSL reports using ERR_LIB_SYS \ 
are now raised as OSError.

Documentation

gh-121277: Writers of CPython’s documentation can now use next as the version \ 
for the versionchanged, versionadded, deprecated directives.