From acb4dc12b6df8615af7b43120ef601e04072f7d2 Mon Sep 17 00:00:00 2001 From: Pablo Galindo Salgado Date: Thu, 1 Oct 2026 01:47:25 +0100 Subject: [PATCH] Python 3.10.22 --- Doc/library/asyncio-eventloop.rst | 2 +- Doc/library/ssl.rst | 4 +- Doc/library/tarfile.rst | 2 +- Doc/library/urllib.request.rst | 2 +- Include/patchlevel.h | 4 +- Lib/pydoc_data/topics.py | 2 +- Misc/NEWS.d/3.10.22.rst | 171 ++++++++++++++++++ ...-08-26-02-30-00.gh-issue-156353.abcdef.rst | 1 - ...-09-08-13-06-29.gh-issue-156002.vmOC8T.rst | 5 - ...-04-26-19-30-45.gh-issue-149018.a9SqWb.rst | 3 - ...-07-31-16-20-17.gh-issue-155694.SsxlKG.rst | 4 - ...-08-06-11-43-20.gh-issue-155292.j4pHBO.rst | 2 - ...-08-10-12-00-00.gh-issue-156293.sNIcbk.rst | 7 - ...-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst | 5 - ...-08-18-13-54-05.gh-issue-156002.CcWXPP.rst | 4 - ...-08-31-16-47-33.gh-issue-157953.KxCF5N.rst | 1 - ...-09-06-11-02-46.gh-issue-157190.tarhln.rst | 5 - ...-09-10-13-38-11.gh-issue-157265.-vYuMp.rst | 3 - ...-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst | 9 - ...-09-23-11-34-30.gh-issue-156793.zC_AjF.rst | 6 - ...-09-29-16-32-46.gh-issue-158446.dToaPr.rst | 5 - README.rst | 4 +- 22 files changed, 181 insertions(+), 70 deletions(-) create mode 100644 Misc/NEWS.d/3.10.22.rst delete mode 100644 Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst delete mode 100644 Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst delete mode 100644 Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst diff --git a/Doc/library/asyncio-eventloop.rst b/Doc/library/asyncio-eventloop.rst index d9b183733bd..a00154b1cc0 100644 --- a/Doc/library/asyncio-eventloop.rst +++ b/Doc/library/asyncio-eventloop.rst @@ -505,7 +505,7 @@ Opening network connections For more information: https://tools.ietf.org/html/rfc6555 - .. versionchanged:: next + .. versionchanged:: 3.10.22 Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True`` and ``server_hostname`` is not supplied. In Python 3.13 and later a ``ValueError`` is raised instead. diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 9d066359571..ed602e8915f 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -1779,7 +1779,7 @@ to speed up repeated connections from the same clients. .. versionadded:: 3.7 - .. versionchanged:: next + .. versionchanged:: 3.10.22 After the callback assigns a new :attr:`SSLSocket.context`, later ClientHello messages on the connection are dispatched to the new context's *sni_callback*. @@ -1914,7 +1914,7 @@ to speed up repeated connections from the same clients. The method returns on instance of :attr:`SSLContext.sslobject_class` instead of hard-coded :class:`SSLObject`. - .. versionchanged:: next + .. versionchanged:: 3.10.22 The *server_side*, *server_hostname* and *session* parameters are now validated as :meth:`SSLContext.wrap_socket` validates them. Previously a context with :attr:`~SSLContext.check_hostname` enabled and no diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst index 4b1d377b15e..a8fdef14d7b 100644 --- a/Doc/library/tarfile.rst +++ b/Doc/library/tarfile.rst @@ -962,7 +962,7 @@ reused in custom filters: Return the modified ``TarInfo`` member. - .. versionchanged:: next + .. versionchanged:: 3.10.22 Filenames containing ``..`` components are now normalized. diff --git a/Doc/library/urllib.request.rst b/Doc/library/urllib.request.rst index 6cc606536a9..ef52a4c6c46 100644 --- a/Doc/library/urllib.request.rst +++ b/Doc/library/urllib.request.rst @@ -927,7 +927,7 @@ These methods are available on :class:`HTTPPasswordMgr` and match authentication URIs with the same scheme or no scheme. A URI without a scheme matches authentication URIs with any scheme. - .. versionchanged:: next + .. versionchanged:: 3.10.22 Authentication credentials for URIs with a scheme are now scoped by that scheme. diff --git a/Include/patchlevel.h b/Include/patchlevel.h index 5fb36393037..d44eb4fa98c 100644 --- a/Include/patchlevel.h +++ b/Include/patchlevel.h @@ -18,12 +18,12 @@ /*--start constants--*/ #define PY_MAJOR_VERSION 3 #define PY_MINOR_VERSION 10 -#define PY_MICRO_VERSION 21 +#define PY_MICRO_VERSION 22 #define PY_RELEASE_LEVEL PY_RELEASE_LEVEL_FINAL #define PY_RELEASE_SERIAL 0 /* Version as a string */ -#define PY_VERSION "3.10.21+" +#define PY_VERSION "3.10.22" /*--end constants--*/ /* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2. diff --git a/Lib/pydoc_data/topics.py b/Lib/pydoc_data/topics.py index 823cd9dff67..4509b967d43 100644 --- a/Lib/pydoc_data/topics.py +++ b/Lib/pydoc_data/topics.py @@ -1,5 +1,5 @@ # -*- coding: utf-8 -*- -# Autogenerated by Sphinx on Thu Aug 13 00:02:25 2026 +# Autogenerated by Sphinx on Thu Oct 1 01:47:59 2026 topics = {'assert': 'The "assert" statement\n' '**********************\n' '\n' diff --git a/Misc/NEWS.d/3.10.22.rst b/Misc/NEWS.d/3.10.22.rst new file mode 100644 index 00000000000..8f8888cd83b --- /dev/null +++ b/Misc/NEWS.d/3.10.22.rst @@ -0,0 +1,171 @@ +.. date: 2026-09-29-16-32-46 +.. gh-issue: 158446 +.. nonce: dToaPr +.. release date: 2026-10-01 +.. section: Security + +Fix a crash or incorrect output that could occur when formatting a +:class:`float` or :class:`complex` with a precision close to the platform's +``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` +for any precision of that magnitude, regardless of presentation type or +value, as the format string parsers already did for precisions above +``INT_MAX``. + +.. + +.. date: 2026-09-23-11-34-30 +.. gh-issue: 156793 +.. nonce: zC_AjF +.. section: Security + +:mod:`asyncio`: :meth:`loop.start_tls() ` and +:meth:`loop.create_connection() ` now +validate the *server_hostname* argument if an :class:`ssl.SSLContext` is +passed with *check_hostname* set to ``True``, emitting +:exc:`DeprecationWarning` if *server_hostname* is missing. (This will raise +:exc:`ValueError` in Python 3.13 and later.) + +.. + +.. date: 2026-09-16-14-05-19 +.. gh-issue: 156793 +.. nonce: Qa1T5Z +.. section: Security + +:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, +*server_hostname* and *session* arguments similar to +:meth:`ssl.SSLContext.wrap_socket`, but for backward compatiblity reasons +emits :exc:`DeprecationWarning` instead of :exc:`ValueError`. + +In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled +and no *server_hostname* passed to :meth:`!wrap_bio` now emits +:exc:`DeprecationWarning` to indicate the hostname wasn't checked. (In +Python 3.13 and later, this raises :exc:`ValueError`.) + +.. + +.. date: 2026-09-10-13-38-11 +.. gh-issue: 157265 +.. nonce: -vYuMp +.. section: Security + +In :mod:`tarfile`, when extracting a link falls back to extracting a member +of the archive, skip the member when the filter function returns None when +called with the extracted member's name replaced with the link's. + +.. + +.. date: 2026-09-06-11-02-46 +.. gh-issue: 157190 +.. nonce: tarhln +.. section: Security + +Fixed a vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction +filters where a crafted archive using a hard link to a symbolic link could +change the permissions and modification time of a file outside the +destination directory, and expose its contents inside the extracted tree. +This addresses CVE 2026-82049. + +.. + +.. date: 2026-08-31-16-47-33 +.. gh-issue: 157953 +.. nonce: KxCF5N +.. section: Security + +Update bundled `libexpat `_ to version 2.8.5. + +.. + +.. date: 2026-08-18-13-54-05 +.. gh-issue: 156002 +.. nonce: CcWXPP +.. section: Security + +Bound the amount of data :mod:`zipfile` decompresses per read for members +compressed with bzip2, LZMA, or Zstandard, matching the existing limit for +deflate. A small archive member could previously expand into an unbounded +allocation even when read in small chunks. + +.. + +.. date: 2026-08-13-13-08-11 +.. gh-issue: 155999 +.. nonce: Xt4rWq +.. section: Security + +Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating +directories outside the destination for members whose name leaves the +destination and returns to it, such as ``../evil/../dest/sub/file``. The +containment check used the resolved path, but intermediate directories were +created from the name as given. + +.. + +.. date: 2026-08-10-12-00-00 +.. gh-issue: 156293 +.. nonce: sNIcbk +.. section: Security + +Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` +switches a connection to another :class:`~ssl.SSLContext` and the context +that carries the callback is no longer referenced by the application. +Servers that keep their ``sni_callback`` context alive (the usual case when +it wraps the listening socket or is stored on the server object) were not +affected. This addresses `CVE-2026-19445 +`_. + +.. + +.. date: 2026-08-06-11-43-20 +.. gh-issue: 155292 +.. nonce: j4pHBO +.. section: Security + +Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not +consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. + +.. + +.. date: 2026-07-31-16-20-17 +.. gh-issue: 155694 +.. nonce: SsxlKG +.. section: Security + +Fix `CVE-2026-15806 `_ by +scoping :class:`~urllib.request.HTTPPasswordMgr` credentials to the URL +scheme, preventing credentials stored for an HTTPS URL from being used for a +matching HTTP URL, while URIs without a scheme continue to match any scheme. + +.. + +.. date: 2026-04-26-19-30-45 +.. gh-issue: 149018 +.. nonce: a9SqWb +.. section: Security + +Improved protection against XML hash-flooding attacks in +:mod:`xml.parsers.expat` and :mod:`xml.etree.ElementTree` when Python is +compiled with libExpat 2.8.0 or later. + +.. + +.. date: 2026-09-08-13-06-29 +.. gh-issue: 156002 +.. nonce: vmOC8T +.. section: Library + +:mod:`zipfile` again reads members through a third-party decompressor +installed by monkey-patching the private ``_get_decompressor()`` to return +an object that only implements old BZ2Decompressor API from Python 3.3. Note +that decompressors without ``needs_input`` and two-argument ``decompress()`` +are vulnerable to CVE 2026-15310. + +.. + +.. date: 2026-08-26-02-30-00 +.. gh-issue: 156353 +.. nonce: abcdef +.. section: Library + +Fix :mod:`configparser` parsing when using whitespace in *delimiters*. diff --git a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst b/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst deleted file mode 100644 index 0dd925cf596..00000000000 --- a/Misc/NEWS.d/next/Library/2026-08-26-02-30-00.gh-issue-156353.abcdef.rst +++ /dev/null @@ -1 +0,0 @@ -Fix :mod:`configparser` parsing when using whitespace in *delimiters*. diff --git a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst b/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst deleted file mode 100644 index 689967bff72..00000000000 --- a/Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst +++ /dev/null @@ -1,5 +0,0 @@ -:mod:`zipfile` again reads members through a third-party decompressor -installed by monkey-patching the private ``_get_decompressor()`` to return an -object that only implements old BZ2Decompressor API from Python 3.3. -Note that decompressors without ``needs_input`` and two-argument -``decompress()`` are vulnerable to CVE 2026-15310. diff --git a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst deleted file mode 100644 index d1b5b368684..00000000000 --- a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst +++ /dev/null @@ -1,3 +0,0 @@ -Improved protection against XML hash-flooding attacks in -:mod:`xml.parsers.expat` and :mod:`xml.etree.ElementTree` when Python is -compiled with libExpat 2.8.0 or later. diff --git a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst b/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst deleted file mode 100644 index e85d482715a..00000000000 --- a/Misc/NEWS.d/next/Security/2026-07-31-16-20-17.gh-issue-155694.SsxlKG.rst +++ /dev/null @@ -1,4 +0,0 @@ -Fix `CVE-2026-15806 `_ by scoping :class:`~urllib.request.HTTPPasswordMgr` -credentials to the URL scheme, preventing credentials stored for an HTTPS -URL from being used for a matching HTTP URL, while URIs without a scheme -continue to match any scheme. diff --git a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst b/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst deleted file mode 100644 index 7a81a8ba1ee..00000000000 --- a/Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst +++ /dev/null @@ -1,2 +0,0 @@ -Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not -consider Unicode codepoint attributes beyond those defined in :rfc:`3454`. diff --git a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst b/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst deleted file mode 100644 index 75b4ad2e3bc..00000000000 --- a/Misc/NEWS.d/next/Security/2026-08-10-12-00-00.gh-issue-156293.sNIcbk.rst +++ /dev/null @@ -1,7 +0,0 @@ -Fix a crash in :mod:`ssl` when an :attr:`~ssl.SSLContext.sni_callback` -switches a connection to another :class:`~ssl.SSLContext` and the context -that carries the callback is no longer referenced by the application. -Servers that keep their ``sni_callback`` context alive (the usual case when -it wraps the listening socket or is stored on the server object) were not -affected. -This addresses `CVE-2026-19445 `_. diff --git a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst b/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst deleted file mode 100644 index 59b725e55bb..00000000000 --- a/Misc/NEWS.d/next/Security/2026-08-13-13-08-11.gh-issue-155999.Xt4rWq.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix the :mod:`tarfile` ``tar`` and ``data`` extraction filters creating -directories outside the destination for members whose name leaves the -destination and returns to it, such as ``../evil/../dest/sub/file``. The -containment check used the resolved path, but intermediate directories were -created from the name as given. diff --git a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst b/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst deleted file mode 100644 index 4e49ad5ce8f..00000000000 --- a/Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst +++ /dev/null @@ -1,4 +0,0 @@ -Bound the amount of data :mod:`zipfile` decompresses per read for members -compressed with bzip2, LZMA, or Zstandard, matching the existing limit for -deflate. A small archive member could previously expand into an unbounded -allocation even when read in small chunks. diff --git a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst b/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst deleted file mode 100644 index 5b3ea77cb36..00000000000 --- a/Misc/NEWS.d/next/Security/2026-08-31-16-47-33.gh-issue-157953.KxCF5N.rst +++ /dev/null @@ -1 +0,0 @@ -Update bundled `libexpat `_ to version 2.8.5. diff --git a/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst b/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst deleted file mode 100644 index c3aac4084c1..00000000000 --- a/Misc/NEWS.d/next/Security/2026-09-06-11-02-46.gh-issue-157190.tarhln.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fixed a vulnerability in the :mod:`tarfile` ``data`` and ``tar`` extraction -filters where a crafted archive using a hard link to a symbolic link could -change the permissions and modification time of a file outside the -destination directory, and expose its contents inside the extracted tree. -This addresses CVE 2026-82049. diff --git a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst b/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst deleted file mode 100644 index ba27e47f734..00000000000 --- a/Misc/NEWS.d/next/Security/2026-09-10-13-38-11.gh-issue-157265.-vYuMp.rst +++ /dev/null @@ -1,3 +0,0 @@ -In :mod:`tarfile`, when extracting a link falls back to extracting a member -of the archive, skip the member when the filter function returns None when -called with the extracted member's name replaced with the link's. diff --git a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst b/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst deleted file mode 100644 index ce43a563f3a..00000000000 --- a/Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst +++ /dev/null @@ -1,9 +0,0 @@ -:meth:`ssl.SSLContext.wrap_bio` now validates its *server_side*, -*server_hostname* and *session* arguments similar to -:meth:`ssl.SSLContext.wrap_socket`, but for backward compatiblity reasons -emits :exc:`DeprecationWarning` instead of :exc:`ValueError`. - -In particular, a context with :attr:`~ssl.SSLContext.check_hostname` enabled -and no *server_hostname* passed to :meth:`!wrap_bio` now emits -:exc:`DeprecationWarning` to indicate the hostname wasn't checked. -(In Python 3.13 and later, this raises :exc:`ValueError`.) diff --git a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst b/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst deleted file mode 100644 index 9afd6e9c454..00000000000 --- a/Misc/NEWS.d/next/Security/2026-09-23-11-34-30.gh-issue-156793.zC_AjF.rst +++ /dev/null @@ -1,6 +0,0 @@ -:mod:`asyncio`: :meth:`loop.start_tls() ` and -:meth:`loop.create_connection() ` now -validate the *server_hostname* argument if an :class:`ssl.SSLContext` is -passed with *check_hostname* set to ``True``, emitting -:exc:`DeprecationWarning` if *server_hostname* is missing. (This will raise -:exc:`ValueError` in Python 3.13 and later.) diff --git a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst b/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst deleted file mode 100644 index f17a3f68b93..00000000000 --- a/Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst +++ /dev/null @@ -1,5 +0,0 @@ -Fix a crash or incorrect output that could occur when formatting a -:class:`float` or :class:`complex` with a precision close to the platform's -``INT_MAX``. :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` for -any precision of that magnitude, regardless of presentation type or value, as -the format string parsers already did for precisions above ``INT_MAX``. diff --git a/README.rst b/README.rst index a6ca0030032..ffb8f1623e6 100644 --- a/README.rst +++ b/README.rst @@ -1,5 +1,5 @@ -This is Python version 3.10.21+ -=============================== +This is Python version 3.10.22 +============================== .. image:: https://travis-ci.com/python/cpython.svg?branch=master :alt: CPython build status on Travis CI