gh-146059: Call fast_save_leave() in pickle save_frozenset() (GH-146173)
Add more pickle tests: test also nested structures.
(cherry picked from commit 5c0dcb3e0d)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-145633: Fix struct.pack('f') on s390x (#146422)
Use PyFloat_Pack4() to raise OverflowError.
Add more tests on packing/unpacking floats.
(cherry picked from commit 8de70b31c5)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
gh-146202: Create tmp_dir in regrtest worker (GH-146347)
Create tmp_dir in libregrtest.worker since the directory can be
different than the --tempdir directory.
(cherry picked from commit bcff99cb3f)
Co-authored-by: Victor Stinner <vstinner@python.org>
Base64 decoder (see binascii.a2b_base64(), base64.b64decode(), etc)
no longer ignores excess data after the first padded quad in non-strict
(default) mode. Instead, in conformance with RFC 4648, it ignores the
pad character, "=", if it is present before the end of the encoded data.
(cherry picked from commit 4561f6418a)
(cherry picked from commit e31c551216)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Weakrefs to unreachable garbage that are created during running of
finalizers need to be cleared. This avoids exposing objects that
have `tp_clear` called on them to Python-level code.
(cherry picked from commit b6b99bf7f1)
Co-authored-by: Neil Schemenauer <nas-github@arctrix.com>
Docs: replace all `datetime` imports with `import datetime as dt` (GH-145640)
(cherry picked from commit 83360b5869)
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
The test doesn't actually test any pyrepl code (it runs Python with -S)
and has a race condition that causes intermittent timeouts on CI.
(cherry picked from commit e18abc6a1f)
gh-145599, CVE 2026-3644: Reject control characters in `http.cookies.Morsel.update()` (GH-145600)
Reject control characters in `http.cookies.Morsel.update()` and `http.cookies.BaseCookie.js_output`.
(cherry picked from commit 57e88c1cf9)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
* gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987)
Fix C stack overflow (CVE-2026-4224) when an Expat parser
with a registered `ElementDeclHandler` parses inline DTD
containing deeply nested content model.
---------
(cherry picked from commit eb0e8be3a7)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
* Remvoe `skip_if_unlimited_stack_size` decorator
* Remove more decorators not on this branch
---------
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
gh-140814: Fix freeze_support() setting start method as side effect (GH-144608)
freeze_support() called get_start_method() without allow_none=True,
which locked in the default start method context. This caused a
subsequent set_start_method() call to raise "context has already been
set". Use allow_none=True and accept None as a matching value, since
spawn.freeze_support() independently detects spawned child processes.
Test that freeze_support() does not lock in the default start method,
which would prevent a subsequent set_start_method() call.
(cherry picked from commit ee5318025b)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
* sort `--help-env` sections by environment variable name
Only needed in the first section, in 3.13 the second section was already sorted.
* regression test for --help-env & --help-xoptions sort order
Manual backport of GH-145997
gh-140594: Fix an out of bounds read when feeding NUL byte to PyOS_StdioReadline() (GH-140910)
(cherry picked from commit 86a0756234)
Co-authored-by: Shamil <ashm.tech@proton.me>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit 2d35f9bc1c)
Includes test fix-up from GH-145788
(cherry picked from commit aa4240ebea)
Co-authored-by: Thomas Kowalski <thom.kowa@gmail.com>
Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com>
gh-145607: Ensure BIG_DATA has two compressed blocks in test_bz2 (GH-145730)
(cherry picked from commit 19676e5fc2)
Co-authored-by: Emma Smith <emma@emmatyping.dev>
The cache may be cleared between the evaluation of the if statement and the
call to popitem.
(cherry picked from commit 665c1db94f)
Co-authored-by: Sam Gross <colesbury@gmail.com>
gh-144173: fix flaky test_complex.test_truediv() (GH-144355)
Previously, component-wise relative error bound was tested. However,
such bound can't exist already for complex multiplication as one can be
used to perform subtraction of floating-point numbers, e.g. x and y for
z0=1+1j and z1=x+yj.
```pycon
>>> x, y = 1e-9+1j, 1+1j
>>> a = x*y*y.conjugate()/2;a
(1.0000000272292198e-09+1j)
>>> b = x*(y*y.conjugate()/2);b
(1e-09+1j)
>>> b == x
True
>>> (a.real-b.real)/math.ulp(b.real)
131672427.0
```
(cherry picked from commit c4333a1270)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
Only set the format attribute after successful (re-)initialization.
(cherry picked from commit 3f33bf83e8)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
gh-142651: use `NonCallableMock._lock` for thread safety of `call_count` (GH-142922)
(cherry picked from commit 728e4a075e)
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
* gh-145701: Fix `__classdict__` & `__conditional_annotations__` in class-scope inlined comprehensions (GH-145702)
(cherry picked from commit 63eaaf9599)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
* Add `:oss-fuzz:` macro support
Backports part of 255e79fa95.
---------
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
gh-145548: Use VMADDR_CID_LOCAL in VSOCK socket tests (GH-145589)
Prefer VMADDR_CID_LOCAL instead of VMADDR_CID_ANY for bind() in the
server. Skip the test if bind() fails with EADDRNOTAVAIL.
Log vsock CID in test.pythoninfo.
(cherry picked from commit 6c8c72f7fe)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-144370: Disallow usage of control characters in status in wsgiref.handlers for security (GH-144371)
Disallow usage of control characters in status in wsgiref.handlers
to prevent HTTP header injections.
(cherry picked from commit d931725bc8)
Co-authored-by: Benedikt Johannes <benedikt.johannes.hofer@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Adds _PYLAUNCHER_INIDIR as a private variable since the launcher is deprecated and not getting new features.
(cherry picked from commit 6cdbd7bc5d)
Co-authored-by: Itamar Oren <itamarost@gmail.com>
The handle parameter was being ignored in the POSIX implementation
of CDLL._load_library(), causing it to always call _dlopen() even
when a valid handle was provided. This was a regression introduced
in recent refactoring.
(cherry picked from commit 27ded24348)
Co-authored-by: Arjit Singh Grover <143692910+Koolvansh07@users.noreply.github.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
[3.14] GH-144739: Skip test_pyexpat.MemoryProtectionTest based on expat compile-time version, not runtime (GH-144740) (GH-145494)
GH-144739: Skip test_pyexpat.MemoryProtectionTest based on expat compile-time version, not runtime (GH-144740)
(cherry picked from commit 45e9343d7e)
(cherry picked from commit bcc2dd8d30)
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Miro Hrončok <miro@hroncok.cz>
