The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys. This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages. Entries are added to the denylist only under a very high
threshold.
The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.
---------
Signed-off-by: Christian Heimes <christian@python.org>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an @include meta to pegen: the rules of an included grammar file are
appended to the including file's rules. The C generator emits the rules
of each included file into a separate C file next to the main output.
Use it to move the invalid_* rules from Grammar/python.gram into
Grammar/invalid.gram, which generates Parser/parser_invalid.c.
* Update vendored mimalloc to v2.5.2
Upgrade mimalloc from v2.1.2 to v2.5.2 as-is from upstream.
v2.1.2: https://github.com/microsoft/mimalloc/releases/tag/v2.1.2
v2.5.2: https://github.com/microsoft/mimalloc/releases/tag/v2.5.2
* Re-apply CPython-specific changes to mimalloc v2.5.2
Most of the previous downstream changes were upstreamed in mimalloc
v2.1.3 - v2.1.7 (heap tags, _mi_heap_init/_mi_tld_init, MI_PRIM_THREAD_ID,
sub-processes, heap walk optimizations, platform fixes) and are dropped.
Remaining CPython-specific changes, all marked with a "CPython" comment:
- QSBR delayed page freeing for free-threaded builds (gh-115103,
gh-145615): mi_page_t/mi_heap_t fields and _PyMem_mi_* hooks in
page.c, heap.c and segment.c.
- debug_offset: preserve the first bytes of a PyObject (ob_tid, refcount
fields) when filling freed or uninitialized memory in debug builds
(gh-115491).
- Atomic mi_block_t.next loads/stores to avoid TSAN reports (gh-129748).
- Relax the owning thread assertion in _mi_free_delayed_block for
free-threaded builds, since the GC traverses heaps of other threads.
- Call _mi_heap_delayed_free_partial() in mi_heap_visit_blocks()
(gh-112532).
- Only count reclaimed pages up to MI_MEDIUM_OBJ_SIZE_MAX as a
"right page" in mi_segment_reclaim (gh-115103).
- Rename the weak _ZSt15get_new_handlerv symbol and disable the
mi_is_in_heap_region debug warning.
- Zero-initialize _mi_page_empty instead of a positional initializer.
* Update the free-threaded build to mimalloc v2.5.2 changes
mimalloc v2.1.4 replaced the list of abandoned segments with per-arena
bitmaps and introduced sub-processes (mi_subproc_t) to keep abandoned
segments of separate interpreters apart. Use them instead of the
CPython-specific mi_abandoned_pool_t:
- Each interpreter owns a mi_subproc_t created in init_interpreter().
- tstate_mimalloc_bind() sets tld->segments.subproc and uses the
upstream _mi_heap_init() signature.
- The GC and sys.getallocatedblocks() visit abandoned segments with
_PyMem_mi_visit_abandoned_blocks(), the upstream cursor API without
the mi_option_visit_abandoned requirement, while STW.
* Update NEWS.d
* fix MSAN
* fix TSAN
* fix test_cext
* Disable THP
* Address code review
* Address code review
* Address code review
* nit
* Address code review
* Address code review
This makes it so that in wasi builds if `-DPY_CALL_TRAMPOLINE` is passed, a call trampoline adaptor is used to prevent traps when there is a call signature mismatch between a C slot handler and the signature that the interpreter uses to call it.
This requires Clang >= 22. PEP 11 specifies that builds of Python 3.15 use WASI SDK version 33 which includes clang 23.1.0, so this could be used with Python 3.15 WASI builds but not earlier ones.
It requires a WebAssembly runtime that supports wasm-gc. Wasmtime has supported wasm-gc since version 27.0 released November 25, 2024. Some other runtimes still don't support it, but for those runtimes people can use builds with the trampoline disabled.
This also removed the Emscripten trampoline support for JS runtimes with no wasm-gc support. This removes a lot of implementation complexity and allows WASI and Emscripten to share code. The main concern is that it drops support for some very old iPhones, but every iPhone model released since 2018 is compatible with versions of Safari that support wasm-gc.
Tests were added that define handlers with various wrong numbers of arguments. The tests also run on non-webassembly platforms since they should work there as well.
Test PySlice_Check(), PySlice_New(), PySlice_GetIndices(), PySlice_Unpack(),
PySlice_AdjustIndices() and PySlice_GetIndicesEx() -- both the macro and the
deprecated function.
Document the length and step precondition of PySlice_AdjustIndices()
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
* gh-153569: move tokenizer input state and relocation into the reader
* gh-153569: borrow diagnostic lines through the source API
* gh-153569: group indentation and logical-line state
* gh-153569: remove unused tokenizer cursor and source lookup APIs
* gh-153569: report tokenizer diagnostics without rewinding the scanner
* gh-153569: use tokenizer views and remove obsolete API remnants
In debug mode at Python exit, check if immutable singleton objects
have been modified by mistake to detect bugs in C extensions.
Add tests corrupting bytes, str, bool and int singleton objects.
Add pycore_global_objects_fini.h internal header file.
pycore_global_objects_fini_generated.h is now fully generated by the
script.
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Make pegen and _tokenize consume tokenizer operations instead of accessing the tokenizer layout. Return token kind, span, location, and raw-string context together, so parser actions use the context of the cached token.
Represent persistent scanner positions as offsets and remove pointer save/restore bookkeeping when input storage grows.
The iteration stops when the callable raises the specified exception (an
exception class or a tuple of exception classes). It is keyword-only and
can be used without the stop value. The second parameter of iter() is now
named stop_value and can be passed as a keyword argument.
aiter() now accepts the same parameters, which it never had before: the
callable is called and its result is awaited for every __anext__().
If the callable raises StopIteration (StopAsyncIteration in aiter()) which
does not match stop_exception, it is replaced with RuntimeError, as PEP 479
and PEP 525 do for generators.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ole32.dll pulls in user32.dll, which makes the system treat the process as
a GUI process and stop sending logoff and shutdown console control events
to it. It is only needed for ProgIDFromCLSID() when formatting a COM error.
Add tests on functions:
* PyType_ClearCache()
* PyType_GetFlags()
* PyType_IsSubtype()
* PyType_Ready()
Move PyType limited C API tests from _testcapi to _testlimitedcapi.
Add a new Modules/_testlimitedcapi/type.c file.
Add _testcapi helpers to create a capsule with an arbitrary name and to call PyCapsule_Import(), and Python tests covering the current behavior: only the first component of the dotted name is imported, the rest are attribute lookups.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PyRun functions now raises ValueError if the start argument is
invalid.
* Add Modules/_testlimitedcapi/run.c.
* Rename _Py_CompileStringObjectWithModule() to
_Py_CompileStringObject().
Where the C library provides iconv(), the codecs module now exposes every
encoding iconv() knows but Python has no built-in codec for -- the POSIX
counterpart of the Windows code-page support. Use it by name (e.g.
"cp1133"), or with an "iconv:" prefix to force it over a built-in codec.
The codec is a last-resort search function and never shadows a built-in.
Both directions pivot through native-endian UTF-32, keeping one input unit
per code point so error handlers get the exact string position.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Tcl 9 makefile.vc now uses TCLSH_NATIVE during the build process,
not just the installation. We had been setting it to the installed
location of the x86 tclsh.exe, which does not yet exist when the x86
build process needs it. That build doesn't actually need TCLSH_NATIVE,
though (there's a check specifically allowing TCLSH to be used if
MACHINE is IX86 and TCLSH_NATIVE is undefined), so don't set it.
